All Questions
12
votes
3answers
870 views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
9
votes
1answer
1k views
Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?
I'm wondering why we use encrypt-decrypt-encrypt sequence in 3DES with three keys instead of three times encryption with three different keys?
8
votes
4answers
1k views
How can rainbow tables be used for a dictionary attack?
I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length.
The maximum length I can enforce is 14 characters. ...
7
votes
1answer
3k views
How does the index of coincidence work in the Kasiki test?
I'm starting to learn about cryptanalysis and I am having a bit of difficulty understanding the Kasiski test's index of coincidence. I have a book (Cryptography Theory And Practice by Douglas Stinson) ...
7
votes
1answer
450 views
Replacing the Rijndael S-Box?
The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?
6
votes
2answers
1k views
Impacts of not using RSA exponent of 65537
This RFC says the RSA Exponent should be 65537. Why is that number recommended and what are the theoretical and practical impacts & risks of making that number higher or lower?
What are the ...
5
votes
1answer
123 views
Correct way to map random number to defined range?
Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX.
What is the best way to map this random number to a ...
5
votes
2answers
169 views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST ...
5
votes
2answers
290 views
Proof that lottery does not know outcome of draw
Could a variable participant lottery system cryptographically prove that they have zero knowledge of the outcome of a draw?
Participants do not choose numbers in this lottery and winning numbers are ...
5
votes
3answers
345 views
How to authenticate over open channel?
I am making an arduino project to open my garage door. I want to make it so users with the passphrase can open the door. Due to computational restrictions it is unlikely encryption is possible. ...
5
votes
4answers
994 views
What alphanumeric string length can be used to guarantee no hash collisions from CRC-64?
If I'm hashing alphanumeric strings (chars in the set 0-9, a-...
4
votes
3answers
392 views
CBC - a canonical mode, even though there are streaming modes
Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
4
votes
4answers
1k views
How can one securely generate an asymmetric key pair from a short passphrase?
Background info:
I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
3
votes
4answers
1k views
PBKDF2 and salt
I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions.
Actually we use the derivation function together with the salt to provide ...
3
votes
3answers
491 views
RS Erasure Coding and Shamir's Secret Sharing
So I was trying to understand the basic difference between erasure coding and secret sharing, and I found this paper (that you can find here or here).
For what I understand, it states that Shamir's ...
2
votes
4answers
176 views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
1
vote
1answer
110 views
Attack on DSA with signatures made with k, k+1, k+2
For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages ...
1
vote
2answers
175 views
One-way function and factoring
I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
10
votes
2answers
267 views
Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
I take the definition of safe prime as: a prime $p$ is safe when $(p-1)/2$ is prime.
Safe primes of appropriate size are the standard choice for the modulus of cryptosystems related to the discrete ...
10
votes
3answers
2k views
Why is public-key encryption so much less efficient than secret-key encryption?
I'm currently reading Cryptography Engineering. After giving a high level explanation of the difference between secret-key encryption and public-key encryption, the book says:
So why do we bother ...
10
votes
8answers
850 views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
9
votes
2answers
543 views
Blum Blum Shub vs. AES-CTR or other CSPRNGs
Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
9
votes
3answers
3k views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
9
votes
2answers
420 views
I have a few questions about the random oracle model
1.) Proving the security of a scheme with the ROM takes two steps; first you prove that the sceme is secure in this idealized world where a random oracle exists and then you implement this scheme in ...
8
votes
1answer
557 views
Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?
I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32 Giga Bytes of ciphertext) by the method devised by Paul C. van Oorschot ...
8
votes
5answers
1k views
What is the post-quantum cryptography alternative to Diffie-Hellman?
Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption ...
8
votes
4answers
611 views
Properties of PRNG / Hashes
There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications.
So, I was wondering how ...
7
votes
1answer
281 views
Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?
Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
7
votes
2answers
242 views
What is the purpose of using different hash functions for the leaves and internals of a hash tree?
I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the ...
7
votes
2answers
482 views
Selecting a large random prime
Say I want a random 1024-bit prime $p$. The obviously-correct way to do this is select a random 1024-bit number and test its primality with the usual well-known tests.
But suppose instead that I do ...
6
votes
3answers
358 views
Security equivalence proofs for breaking RSA
It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring.
In otherwords, ...
6
votes
2answers
498 views
Can one implement AES on 4-bit microcontroller?
It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID.
I have yet to come across ...
6
votes
1answer
273 views
Compressing EC private keys
For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure.
I ...
6
votes
3answers
159 views
Number of intersections of two sets
Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
6
votes
3answers
384 views
What tests can I do to ensure my PRNG is working correctly?
In the past I have used the Chi-squared test to check the statistical randomness of my generator. Is this a good test to use? Are there other tests?
5
votes
3answers
569 views
What is the recommended replacement for MD5?
Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?
5
votes
1answer
340 views
How does a “Tiger Tree Hash” handle data whose size isn't a power of two?
Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two.
...
5
votes
2answers
1k views
Use of salt to hash a password
In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
5
votes
1answer
261 views
If the PSK is known, is it possible to decrypt traffic from other clients in a WPA2 wlan network?
If in a public WLAN WPA2-PSK is used, but the PSK is more or less publicly available, does this mean that an attacker with that PSK can easily decrypt wlan traffic from/to other clients of that WLAN?
...
5
votes
4answers
172 views
Changing algorithms during encryption
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.
For ...
4
votes
5answers
333 views
Any efficient text-based steganographic schemes?
While there are sophisticated and efficient steganographic schemes with images as cover available, I am yet ignorant of the existence of any fairly efficient and secure schemes with texts as cover. ...
4
votes
1answer
238 views
Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid
When given p = 5, q = 11, N = 55 and e = 17, I'm trying to compute the private key d.
I can calculate phi(N) = 40, but my lecturer then says to use the extended Euclidean algorithm to compute d. ...
4
votes
2answers
554 views
128 bit hash with least chance of collision
I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
4
votes
3answers
249 views
Is there some way to generate a non-predictable random number in a decentralised network?
Is there a way to generate a random number with given restrictions:
It will be used in a decentralised network with a big number of peers (no central authority to generate it)
Its generation should ...
4
votes
1answer
546 views
Example of CHI Square test on Caesar Cipher?
I am trying to get my head round the chi square test, when used with the Caesar cipher.
I started off using this formula,
$$ X = \sum_{i = 1}^k \frac{f_i · f'_i}{n · n'} $$
Where ...
4
votes
2answers
348 views
Random Coin Flip using ElGamal and a Trusted Party
An old exam question I am trying to figure out:
Consider the following protocol for two parties to flip a fair coin.
Trusted party T publishes her public key pk
A chooses a random bit ...
3
votes
2answers
99 views
How is the x coordinate of a “point at infinity” encoded in a Secp256k1 signature?
I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity (0) if present in a signature. For example, r could be the x ...
3
votes
6answers
311 views
Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
3
votes
1answer
69 views
iterated discrete log problem
Consider the following problem: given $g_1 \ldots g_i,h_1 \ldots h_i \in G$, $\forall i$ find $x_i$ such that $g_i^{x_i}=h_i$
For $i=1$ this is the discrete log problem and is assumed to to have ...
3
votes
1answer
207 views
LFSR dynamic mutation
In normal LFSR, the state is a function of the initial seed, taps positions and time, nothing else. I've seen a modification of LFSR that works like this:
...
