1
vote
0answers
60 views

Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks

Bitcoin uses SHA-256, Base58Check, ECDSA (Sep256k1) and RIPEMD-160 as the basis of its encryption (see this article for a short guide on how addresses are created). I would like to create an ...
1
vote
0answers
63 views

Parallel-resistant proof-of-work scheme without hidden knowledge

Follow-up to: Parallel-resistant proof-of-work scheme? Is there a proof-of-work scheme that: can only be solved serially; given the solution, can be verified in minimal time; deterministically ...
1
vote
0answers
73 views

Is MITM possible after key exchange phase done successfully in RSA?

Is MITM attack theoretically possible after public/private key pair exchange is done successfully. Say Alice and Bob have genuine public keys of each other. Is MITM possible further during ...
1
vote
0answers
21 views

Random numbers for Master Key and Key_block

Exploration through RFCs concludes that random numbers used in the creation of Master Key and Key Block(Key material for Encryption Key and Mac Secret) are from ServerHello.random and ...
1
vote
0answers
99 views

Any use for now-defunct Mt Gox Yubikey?

As everyone is now aware, Mt Gox has declared bankruptcy. As what appears to be the very last thing they did, Mt Gox accepted my $35 and fulfilled my special Mt Gox Yubikey. Having just arrived in the ...
1
vote
0answers
67 views

Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
1
vote
0answers
75 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
1
vote
0answers
100 views

Using RSA key pair for file encryption

I'm looking for a way to perform encrypted nightly backups of a server I administer, without storing the decryption key on the server. A form of PK encryption seems ideal for this, as I can store the ...
1
vote
0answers
52 views

Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
1
vote
0answers
82 views

Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
1
vote
0answers
105 views

What RC4 key value will completely invert $S$ after initial permutation?

What RC4 key value will completely invert $S$ after the initial permutation, so that $S[0] = 255, S[1] = 254, …, S[254] = 1, S[255] = 0$?
1
vote
0answers
38 views

Storing password or derived key in keychain?

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 ...
1
vote
0answers
58 views

Which gives better deterministic encryption SIV or Plain ECB mode?

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ? AES-ECB($key$ , $msg$) SIV($key$, NIL , ...
1
vote
0answers
126 views

Hash function that is efficient on GPU and poorly suited to ASIC

I have such requirements to the hash function in my project: operating on 32-bit data, not mathematically breakable (built on existing hashes known to be secure), free of branching, as much as ...
1
vote
0answers
53 views

How to specify last $t$ bits are only sent when a signature is sent?

I have read that in cases where there is a limit on the amount of data sent over the network, one idea is to sent only $t$ bits of data rather than sending all the bits. For example, in the Schnorr ...
1
vote
0answers
52 views

Is it feasible to break an encrypted and later encoded message?

A message is sent from a person to another. The plain message is first encrypted, even with a weak algorithm - say, DES. Then, the encrypted message is encoded with a simple substitution, which is ...
1
vote
0answers
75 views

Secret sharing - no dealer, modifiable, verifiable

I need to find a secret sharing scheme with these properties: The scheme is set up by all participants, ie no single entity called the dealer The parameters of secret sharing need to be ...
1
vote
0answers
73 views

Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
1
vote
0answers
118 views

A fast non-cryptographic hash function that is “strong enough”?

I'm designing a simple one-time-password mechanism for authentication against a possibly-insecure server - i.e. I don't want to use symmetric shared secrets. The first idea that came into mind was ...
1
vote
0answers
24 views

Cryptography: Oblivious Transfer with at most one transfer?

I am trying find a transfer method for this problem. Suppose Alice and Bob both has access to a function F with two parameters. Func(x,y) randomly returns "p" to alice and "q" to Bob such that x*y=p ...
1
vote
0answers
51 views

When do I need to renew keys for Salsa20 or HMAC?

I currently have a system which uses two keys sourced from a single key subjected to HKDF. One key is used in the Salsa20 stream ...
1
vote
0answers
104 views

Pohlig-Hellman exponentiation block cipher

Let $G$ be a group of order $n$ and let $e,d$ be integers such that $ed\equiv 1 \pmod{n}$. Then the exponentiation maps $x \mapsto x^e$ and $y \mapsto y^d$ are inverse maps on $G$. These maps give us ...
1
vote
0answers
74 views

Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?

I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? ...
1
vote
0answers
94 views

Where can I find examples of ECC implemented in VHDL?

I am looking into implementing ECDSA signature and ECDH key agreement in a Xilinx FPGA. All the examples I have found of VHDL implementations skip over how to construct the low level ECC primitives ...
1
vote
0answers
58 views

Can you provide an example in relation to Hidden Field Equations Multivariate?

I'm reading about Hidden Field Equations Multivariate scheme. My lecture states that the central map is a univariate polynomial $$P(X)=\sum_{i=0}^{r-1}\sum_{j=0}^{r-1}p_{ij}x^{q^i+q^j} \in K[X]$$ ...
1
vote
0answers
95 views

Is there any analysis of freebsd's “geli” encrypted geometry provider?

I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
1
vote
0answers
157 views

What is the chance of a collision when using SHA-3?

I currently am writing a web app and am using two random hashes that are before and after the string and are both 50 char long (alphabet, numbers, and special chars). ...
1
vote
0answers
89 views

$\phi$ function in Dual_EC_DRBG

I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition ...
1
vote
0answers
139 views

How good is the RandomPool generator in Crypto++ library?

How good is the RandomPool generator in Crypto++ library? I never heard of it before… I wonder if there is a Fortuna C implementation that I could use in an Objective-C project. Also: How secure is ...
1
vote
0answers
65 views

How can user privacy be preserved in certificateless cryptography?

In certificateless cryptography, how can a user preserve his privacy from Key Generation Center? If the KGC becomes malicious, how can the user's privacy be preserved? I read "Privacy-Preserving ...
1
vote
0answers
35 views

TCR hash functions from MD5

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical (pag. 10 and 11) and here say The most direct way to construct a TCR hash function is to key a function like MD5 or SHA-1. ...
1
vote
0answers
107 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
1
vote
0answers
112 views

Best group if one wants the discrete log problem to be hard?

Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are ...
1
vote
0answers
65 views

Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know ...
1
vote
0answers
93 views

What scheme will allow merging and splitting the result of a function?

I am wondering if it's possible to have a scheme as follows. Here is the scenario: we have a set of objects (e.g. strings) {O1, O2, ..., On} we have a set of users {U1, U2, ..., Um} each user asks ...
1
vote
0answers
81 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...
1
vote
0answers
36 views

MD Construction Doesn't Propagate TCR

I'm reading a proof of the proposition of CollisionResistant Hashing Towards Making UOWHFs Practical Suppose there exists a compression function $F: \Sigma^k\times\Sigma^{c+m'} \rightarrow ...
1
vote
0answers
54 views

Perfect Forward Secrecy in MTI/A0

Would the property of perfect forward secrecy still be achieved in MTI/A0 for a session key that was established between C and D when one LL-key aD is revealed so that both LL-keys aC and aD are ...
1
vote
0answers
125 views

About Elliptic Curve ElGamal, 3 simple problems I have trouble with

In Elliptic Curve ElGamal, why are a=b=1 always legal for primes whose lengths are no shorter than 11(2) bits long? Is there any reason why the Point at Infinity can always be encoded as (0,0)? ...
1
vote
0answers
112 views

How to develop a public key cryptosystem based on a hard problem?

Recently, I found a function that is performed on a sequence to return another sequence. All known algorithms for finding the input, given the output are of exponential complexity. I want to propose ...
1
vote
0answers
45 views

Can you help me understand this strange implication direction in security reduction for OAEP 3-round?

I'm reading the paper OAEP 3-round, where they introduce a 3-round version of the OAEP (which originally used only two rounds). However, in their security statement for this construction (Theorem 4 ...
1
vote
0answers
103 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
1
vote
0answers
138 views

Diffie-Hellman exchange

So for a Diffie-Hellman problem, I am given the prime $p$ for the Diffie-Hellman exchange. I am also given $g$, secret number for machine as $A$, secret number for station as $B$, a Diffie-Hellman ...
1
vote
0answers
59 views

Partial encryption of a file?

I want to partially encrypt a large block of data using AES. Meaning: given plaintext[0:1100], I would like to encrypt ...
1
vote
0answers
124 views

PGP encryption options

I recently began using PGP desktop and found several options for my encryption capabilities. Which of these (AES, Cast, Triple DES, TwoFish, IDEA) is the most recent, firstly, secondly may the NSA not ...
1
vote
0answers
192 views

Does BouncyCastle (for ECC) resist timing attacks?

I need to extend the TLS protocol to be able to use other key exchange scheme based on elliptic curves. I am planning to use BouncyCastle's implementation in Java and in .NET. I am worring about ...
1
vote
0answers
456 views

Decrypting a message without the private key using CRT

I am given 5 different encryption modulus, $N$, each ranging from 78 to 88 numbers long. Then for the encryption exponent, each has the same which is 5. Then I am given 5 different encrypted messages, ...
1
vote
0answers
216 views

Understanding elliptic curve encryption

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve (mod p). Suppose I have the following elliptic curve: y^2 ...
1
vote
0answers
49 views

How does Dissent protect against Sybil Attacks?

Dissent claims to be able to be resistant to Sybil attacks. Dissent seeks to offer accountable anonymity, giving users strong guarantees of anonymity while also protecting online groups or forums ...
1
vote
0answers
55 views

Can you help me understand this “Message Modification by Meet-in-the-Middle” related to Tiger Hash?

I found this paper that explains how to attack a reduced round tiger hash, but I'm having a hard time understanding some of the mathematical notation. Could someone explain the section "Message ...

15 30 50 per page