All Questions
0
votes
0answers
125 views
How can I become familiar with the logic syntax used in Cryptography papers? [closed]
I'm having to write a 5000 word essay on Cryptography, and many (if not all) of the papers I've read on the topics have logic syntax I simply don't understand.
How can I become familiar with the ...
3
votes
2answers
68 views
GPG and PAR2 error correction data from the plain archive, will it compromise security?
I have the following scenario:
Archives compressed with 7z, hundreds of MiB in size
GPG to encrypt the archives (binary, without ASCII armor)
PAR2 to create error correction data
Question
1. ...
3
votes
0answers
81 views
How can scrypt be improved to counter GPU mining
I know scrypt was designed to lessen the GPU/ASIC advantage.
We now have litecoin as a real-world example of this. However, it hasn't worked out perfectly. Most coins are mined by GPUs, although the ...
1
vote
2answers
66 views
How secure is passing a MAC to Python's random.seed before using random.choice to generate a MAC?
I'd like to use Python's random.choice seeded with a HMAC-SHA1 tag to generate a MAC encoded in a variable set of chars.
...
1
vote
1answer
49 views
Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?
The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
2
votes
2answers
131 views
Why is $h(H, m) = E(m, H) \oplus m$ insecure?
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are ...
5
votes
1answer
116 views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
2
votes
1answer
69 views
What's the probable usage of Interlock Protocol
I've recently read some articles about the Interlock Protocol, Article by Ron Rivest and Adi Shamir.
I'm wondering if it is possible to protect Key-exchange under Public-Key cryptography from the ...
4
votes
1answer
202 views
Why exactly is Blowfish faster than AES?
I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
0
votes
1answer
96 views
Ciphertext-only attack on Simplified DES
Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
2
votes
1answer
75 views
Is it safe to assume Salsa20 to be a PRP?
Often in security proofs a certain block cipher is assumed to be a pseudorandom permutation or PRP. I wonder if this goes for stream ciphers as well, and specifically for Salsa20.
If limit ourselves ...
2
votes
2answers
101 views
Keys required for cryptography
I am reading an article on cryptography at following location:
http://www.entrust.com/resources/pdf/cryptointro.pdf
Historically, encryption systems used what is known as symmetric cryptography. ...
1
vote
2answers
190 views
Does key authentication in SSH protect from MitM?
How do cryptography in SSH(2) work (secure channel establishment, authentication)?
Does key authentication in SSH(2) protect from MitM by providing authentication and integrity and why?
1
vote
0answers
49 views
Perfect secrecy and change of plaintext probability distributions
How to prove that if a cryptosystem has perfect secrecy for a given plaintext probability distribution then it will have perfect secrecy for all other possible plaintext probability distributions?
Do ...
1
vote
0answers
30 views
Encrypted Functions with Fully Homomorphic Encryption [duplicate]
While Fully Homomorphic Encryption schemes facilitate carrying out computations over encrypted data, can the function that has to be evaluated be encrypted too ?
For example, if i have some programs ...
5
votes
1answer
123 views
Correct way to map random number to defined range?
Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX.
What is the best way to map this random number to a ...
2
votes
0answers
114 views
Correct way to truncate data to a range
2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm.
I want to take a stream of k trusted random ...
0
votes
1answer
86 views
decryption many time pad
I have eleven ciphertexts that were encrypted with the same key (which I don't know). I want to decrypt the last ciphertext. I read similar question like Many time pad attack but I can't solve my ...
2
votes
0answers
65 views
How can I prove that this encryption scheme from a random oracle is secure?
I am reading this example:
A random oracle is an ideal object.
What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
1
vote
1answer
51 views
Comprehension question on a signature protocol based on the RSA assumption
We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
2
votes
1answer
99 views
How to use salt if I am sending hashed password?
If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?
0
votes
2answers
66 views
ElGamal: Generation of “g” value?
I haven't been able to find a clear explanation on this (and I'm probably just confused in general). I have the following parameters of ElGamal signatures:
$p$ = safe prime
$q = (p-1)/2$
$g$ = an ...
5
votes
1answer
135 views
Is there an existing AEAD scheme with minimal IV requirements?
Is there an existing AEAD scheme such that, for inputs with the same AD and IV
ciphertexts are allowed to leak whether or not their plaintexts are equal,
if the scheme can process the plaintext in a ...
1
vote
1answer
36 views
Pseudo Random Generator (PRG) from Rabin function
I'm trying to make a PRG using the Rabin function. The code (in Java) I wrote to implement the function is:
...
1
vote
1answer
98 views
Proper uses for CTR and CBC AES block cipher modes
Assuming the following:
Key is randomly generated is being used (32 bytes+)
IV is also randomly generated
Crypto random key generator is used
Data being encrypted contains common bytes like ...
2
votes
1answer
73 views
Why unit vectors should be encrypted bit per bit in that case?
At this work at section $2.2$ concerning a possible application for the BGN cryposystem the author points out that if you want to encrypt a unit vector $\overrightarrow{u_l}$ of size $l$ then the ...
2
votes
0answers
45 views
Relaxed trust criterion for mental poker server?
I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
1
vote
1answer
71 views
What does “adaptively secure” mean?
In a paper it says "In the generic group model, the PRF is adaptively secure for inputs of $\mathbb{Z}_q^n$". Maybe a stupid question, but what does "adaptively secure" mean exactly?
0
votes
0answers
19 views
ECKS-PS algorithm: searching in encrypted data; bilinear maps [duplicate]
I have found an encryption algorithm named ECKS-PS (published in a paper named 'efficient conjunctive keyword search on encrypted data storage system', written by Jin Wook Byun, Dong Hoon Lee, and ...
0
votes
1answer
47 views
EC equivalent for RSA-OAEP
I have some questions regarding aforementioned subject:
Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
Is ECIES-KEM sufficient ?
1
vote
1answer
116 views
AES Message Authentication Vulnerability
My securities instructor recently posed this question to the class and I am bending my brain in half trying to figure it out.
Suppose $y_1 = AES(K, x_1)$ and $y_2 = AES(K,x_2)$, and suppose you ...
0
votes
1answer
89 views
ECKS-PS algorithm: searching in encrypted data; bilinear maps
I have found an encryption algorithm named ECKS-PS (published in the paper Efficient conjunctive keyword search on encrypted data storage system) that allows an user to search in encrypted data. All ...
4
votes
1answer
245 views
Any point in waiting for the SHA-3 standard?
The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter?
That is, can we just assume it's going to be as specified by the submitters ...
4
votes
0answers
57 views
MD4 First preimage - state of the art
What's the state of the attack to get the first preimage on MD4?
Is it still this http://www.di.ens.fr/~leurent/files/MD4_FSE08.pdf in 2^102 ?
1
vote
2answers
155 views
AES+CTR+HMAC Encryption and Authentication on an Arduino
In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel.
We have chosen AES in CTR ...
0
votes
2answers
75 views
Using salted hash as password for easy memorization without reuse?
I had an idea earlier:
Secure passwords are a) long, and b) unpredictable. A hash is both of these. Would it be safe to reuse a key between sites, and include the site's name as a salt? For example:
...
1
vote
1answer
71 views
Ciphers in CBC mode reveal place of change in plaintext
Theoretically, when using a symmetric block cipher in CBC mode, the current block is dependent on the previous block. Suppose one plaintext is encrypted using CBC, and then one bit of it is changed, ...
4
votes
2answers
174 views
Signature schemes for underpowered devices (8bit microcontroller)
I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel.
Recently ...
1
vote
0answers
64 views
Known-plaintext attack on Blowfish in ECB mode
The protection scheme I faced recently seems so weak nowadays that a simple exhaustive key search would be enough to recover the user key in an acceptable amount of time (it's OK, since almost no ...
1
vote
1answer
87 views
Given a certain entrophy per character, how long should a passphrase be to guarantee key strength?
Given an entrophy of 1.5 bits per character, how long does a passphrase have the be to guarantee a key strength of a 128 bit random key?
Assuming an alphabet of 26, one character takes log2(26)=4.7 ...
-2
votes
2answers
114 views
May the problem with DES using OFB mode be generalized for all feistel ciphers
There is a problem with using DES as the block cipher in OFB mode, eg: the feedback that goes back into the next round will be encrypted with the same key $k$ resulting back into the plaintext IV used ...
2
votes
1answer
90 views
Does the IV need to be known by AES (CBC mode)?
I was thinking about this today and thought I should ask. I think I understand IV's enough to say that they are basically the same thing as Salts when talking about hashes. They are there to improve ...
0
votes
0answers
53 views
How do I generate decryption keys for the IDEA algorithm from the 128 bit key?
I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code:
...
0
votes
0answers
71 views
How secure is this perl script to use an AES encryption on files? [closed]
I am not entierly sure if it is appropriate to ask such a question here, but then again, I don't know a better place. If it is the wrong place, let me know, and I will remove it.
Could someone share ...
0
votes
1answer
38 views
PBKDF2 when dkLen and hLen have the same size
I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key ...
2
votes
1answer
72 views
Question about the definition of a secure PRF
I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF.
I understand the test goes as follows: A challenger picks a function $f$ such that
$f \leftarrow ...
0
votes
2answers
89 views
Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?
If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My ...
1
vote
1answer
65 views
Is there a preferred way/standard on how to transmit an initialization vector for AES encryption
Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
2
votes
2answers
63 views
Case insensitive verification of HMAC / Base64 signature
I am signing a short message using the base64 of an HMAC, like this (python):
...
0
votes
0answers
54 views
How fast can a wrong decryption key be detected using ECC?
When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that?
...
