2
votes
1answer
41 views

run length testing [closed]

Looking for guidance/references with/about calculations: I am designing a widget that creates N-bit binary sequences. My customers target spec for the sequence's minimum entropy is X bits/bit. I plan ...
1
vote
1answer
73 views

Is SRP post-quantum secure?

Just a simple one: is SRP-6a post-quantum secure? If not, are there any post-quantum secure "SRP-6a-like" alternatives?
2
votes
1answer
114 views

Simple proof of work example?

Can anyone show me a simple proof of work algorithm that I can use to stop spammers? I've looked at hashcat, but i think there's a bit too much specialized hardware for bitcoin mining. That is, the ...
3
votes
1answer
778 views

Theoretical attack on RSA

The high security of RSA is granted, because it is very hard to factorize $$ N = p * q $$ Nevertheless, there is actually no need of factorizing $N$, in order to generate the $Private$ $Key$, but the ...
2
votes
1answer
66 views

Composing and Inverting Symmetric Encryption Keys

Using a symmetric encryption algorithm $E$ on a message $M$, users usually send $E(M)$ to the recipient and then the recipient will compute $E^{-1}(E(M))=M$ to retrieve the message. For what symmetric ...
4
votes
0answers
56 views

Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
5
votes
2answers
175 views

Is perfect-forward secrecy achieved with RSA?

I am new to cryptography and am going through the book Understanding Cryptography by Paar and Pelzl. From what I understand Symmetric key distribution systems like Kerberos do not provide PFS ...
9
votes
2answers
301 views

AES-GCM Disadvantage

What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ...
0
votes
0answers
18 views

How do I extract the private key components $N$ and $D$ from a private RSA key? [migrated]

I have a private RSA key like – for example – this one: ...
-1
votes
1answer
86 views

Questions on FHE over the Integers - the question modified!

I modified my question since it is not as specific as I wanted. I'm studying FHE over the Integer which is https://eprint.iacr.org/2009/616.pdf I got questions about the proof of Lemma A.1. In page ...
2
votes
1answer
41 views

Symmetric-key login protocol

I'm trying to analyze a login protocol based on symmetric key cryptography. I'm just starting out, so this may very likely be a very bad idea, but nonetheless I'd like to hear your thoughts on it. ...
4
votes
1answer
117 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
2
votes
1answer
50 views

PGP String to Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
3
votes
1answer
107 views

Is this an acceptable All-or-Nothing Transform?

I was thinking about AONTs, and designed the one below, I call it CHANT for Chained-Hash All-or-Nothing Transform; it's my very first shot at something of the sort, and was hoping I could get your ...
2
votes
1answer
47 views

Encrypted files in an encrypted partition or folder

Recently I started wondering about multiple encryption and found pages upon pages of posts and debates about the security of cascades. Now, don’t worry – I'm not looking for someone to discuss a ...
2
votes
0answers
80 views

Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i): Identification based on PK decryption and witness. Consider the following protocol: $A \leftarrow B: h(r), B, P_A(r,B)$ ...
2
votes
1answer
87 views

Test Vectors for ciphers

While implementing ciphers (/hash functions, ...), I often face this problem: Where to find test vectors for it; so that I can guarantee my program is correct. It is generally a tedious job to find ...
-2
votes
0answers
44 views

Would it be possible to crack the key used for params given DES [duplicate]

I am working on a product that will link back to another product. The problem is the GET params on the target product are encrypted using DES (I believe) so the params look like... ...
1
vote
2answers
120 views

Public key Issue - same key pair as existing one? [duplicate]

My question is a bit naive, but what if someone generates the same RSA key pair as someone else? This person would have the same private key and so would be able to decrypt messages not intended to ...
2
votes
2answers
86 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
1
vote
0answers
14 views

TLS WG Charter and Security Goals [migrated]

I was looking at the TLS Working Group Charter. I noticed that confidentiality and integrity of messages for those who desire it are not goals for the group. Naively, I believe confidentiality and ...
4
votes
1answer
78 views

OTT service using FPE

Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an ...
4
votes
1answer
118 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
6
votes
1answer
69 views

The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme ...
4
votes
3answers
123 views

Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication. We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting ...
2
votes
1answer
204 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
0
votes
1answer
121 views

Known plaintext attack on ElGamal encryption

Assume that Alice uses Bob’s ElGamal public key ( = 2, Yb = 8) to send two messages $M = 17$ and $M' = 37$ using the same random integer $k = 9$. Eve intercepts the ciphertext and somehow she finds ...
4
votes
1answer
121 views

Compression function to guarantee randomness of one time pads?

First of all, I would like to note that I am not building my own crypto. I am simply curious and would like to learn. What I am wondering is this: if we are worried about randomness of something ...
2
votes
0answers
75 views

Understanding Lattice based cryptosystem [closed]

I have heard that there is one paradigm of Public key cryptosystem, called Lattice based crytography. Further, its security claims are such that it will not be affected even if the quantum computers ...
1
vote
1answer
60 views

Whitening and randomness extraction

The Von Neumann randomness extractor is explicitly mentioned in the randomness extractor page of Wikipedia, but strangely enough that page does not contain any reference to whitening the results of an ...
3
votes
2answers
98 views

CSPRNG that cannot be used as random extractor

Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any ...
-1
votes
0answers
91 views

A problem about zero knowledge proofs

$En()$ is a certain encryption function, $G$ is a cyclic group with order $q$ (a prime), $g,h$ are two generators of $G$. $\lambda_1,\lambda_2 \in Z_q^*$, $\mu$ has the relation $\mathcal{R} ...
5
votes
1answer
199 views

Elliptic Curve Cryptography

I have been trying this for a while. But I couldn't get it. How can I determine the point of intersection of the tangent line at (0, 0) on the curve $y^2 + y = x^3 + x^2$ ?
3
votes
1answer
157 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
2
votes
1answer
67 views

Should I calculate two CMACs over two different strings that share common bytes?

I am trying to secure my RF communication in which one RF package consists of two separate segments. I need to make sure that one segment of one packet is not replaced with a valid segment of some ...
3
votes
2answers
134 views

Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
2
votes
1answer
105 views

Probability that two different files can have same MD5 hash for both an unencrypted and encrypted version (AES256, same key between files)

This math is way over my head, and don't even know if it can be done, but here are the assumptions: Take unencrypted File [Fu] of variable length, but assume 100KB as an example. Let File [Fe] be ...
4
votes
1answer
80 views

Key Derivation from random salted seed, HMAC and HMAC based KDF

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing ...
0
votes
2answers
76 views

Elliptic curve group over a prime finite field $F_p$

If $p$ is a big prime, and the elliptic curve $E$ is defined over $F_p$ by the equation $y^2=x^3+ax+b$ where $a,b\in F_p$. The point on $E/F_p$ together with the infinite point $\mathcal{O}$ form a ...
2
votes
3answers
81 views

Does 3-DES take approximately the same time to encrypt 1B and 1KB?

I am using 3-DES to encrypt some data in Java. I decided to run some tests and plot some graphics to decide how to optimally pack data for its encryption (see how encryption/decryption time behave ...
2
votes
0answers
50 views

Where is the OID and ASN.1 specified for AES_CMAC?

I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under ...
0
votes
1answer
106 views

Vigenère cipher: Security when key length and plaintext length are the same

I have read the Vigenère cipher is secure as long as the key length is the same as the length of the data to be ciphered. Is this true in cases where the same key is used multiple times. In that case ...
1
vote
1answer
75 views

Adding an IV to an AES implementation

I have an embedded project that requires AES, I seem to have found an AES implementation that fits the bill here: http://www.literatecode.com/aes256, but it does not include an IV. Are there any ...
0
votes
1answer
101 views

Is MAC-then-encrypt with stream ciphers secure?

While thinking about this recent question about a hash-then encrypt design, I reread the MAC-encrypt vs. encrypt-MAC question and noticed this answer quoting a paper showing that MAC-then-encrypt is ...
5
votes
2answers
517 views

How does a rolling code work?

I have general questions regarding rolling codes. Basically there is a sender and a receiver. Both have a sequence generator. The receiver checks if the received sequence matches the newly generated. ...
1
vote
0answers
63 views

Universal hashing techniques based on matrix multiplication

The article here says below, about a universal hashing technique based on matrix multiplications. "However, there is a little known method based on using a random matrix. It has lots of advantages - ...
6
votes
3answers
208 views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
-2
votes
1answer
44 views

Textbook RSA with exponent e=3 [duplicate]

I remember $e=3$ is a bad choice for textbook RSA. But I can't really recall why. What happens if I choose $e=3$? Can I retrieve the message by simply calculating $\sqrt[3]{c}$? Why can't I do that ...
1
vote
2answers
66 views

Different padding rules for Merkle-Damgard and Keccak/sponge function

We learned that length padding was used in Merkle-Damgard where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
2
votes
1answer
94 views

Secure way to store fixed size string of digits

I need to store a string of digits (0-9) of a fixed size in my database securely. I've already performed a rainbow table attack on a plain hash, and it broke it in a matter of seconds. One option I ...

15 30 50 per page