12
votes
3answers
1k views

Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?

I understand the need for padding in MD5. But why do we append the message length to the padding? I heard it strengthens the hash but how? Please provide an example if possible and how it applies to ...
12
votes
4answers
984 views

About Cryptography in a Character Language

Suppose I had a message in Chinese (or another non-phonetic language) and I wanted to encipher it. Some of the simplest encryptions in English are substitution ciphers, but such ciphers don't seem ...
12
votes
3answers
2k views

Why is OCB-AES mode not becoming a standard for authenticated encryption?

The OCB mode of authenticated encryption (used for example with AES) is the fastest way to provide authenticity and confidentiality without having to strive into questions like: Encrypt then MAC, MAC ...
12
votes
3answers
2k views

Why does SHA-1 have 80 rounds?

Why does SHA-1 algorithm have exactly 80 rounds? Is it to reduce collisions? If yes, then why do SHA-2 and SHA-3 have a lower number of rounds?
12
votes
2answers
922 views

Why would anyone use an elliptic curve with a cofactor > 1?

In cryptography, an elliptic curve is a group based on a finite field $GF(p^k)$; this group has $n$ elements on it, and we work on a prime-sized subgroup of size $q$. We denote the value $h = n/q$ as ...
12
votes
3answers
1k views

Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?

Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
12
votes
3answers
667 views

Where do I securely store the key for a system where the source is visible?

I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there. I've ...
12
votes
1answer
711 views

Does unbalancing a feistel cipher always improve security? Does it improve security at all?

So according to Wikipedia unbalanced feistel ciphers provide greater provable security. Specifically, they state: The Thorp shuffle is an extreme case of an unbalanced Feistel cipher in which one ...
12
votes
1answer
4k views

What to watch for with openssl generating weak keys? (low entropy)

(Disclaimer: I am regular software engineer with only basic crypto knowledge, so helpful if can be explained for a layman.) I am concerned about generating weak keys on a shared linux box with ...
12
votes
2answers
3k views

Why is MixColumns omitted from the last round of AES?

All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
12
votes
2answers
1k views

Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing? I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
12
votes
2answers
4k views

What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?

For the purposes of signing and verifying signatures, what is the value of the hash function? Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process ...
12
votes
3answers
2k views

What is the ideal cipher model?

What is the ideal cipher model? What assumptions does it make about a block cipher? How does it relate to assuming that my block cipher is a pseudo-random permutation (PRP)? When is the ideal ...
12
votes
1answer
611 views

Why did NIST remove The Lempel-Ziv Compression test from the Statistical Test Suite?

NIST removed "The Lempel-Ziv Compression" test from the Statistical Test Suite in revision 2008 and above and has not incorporated it since – see revision 2010. Why was it removed? Does it no longer ...
12
votes
1answer
3k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
12
votes
1answer
4k views

Compare Blockmode CBC (with diffuser) against XTS

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC ...
12
votes
2answers
1k views

Design properties of the Rijndael finite field

So we've already had a question on replacing the Rijndael S-Box. My question is - can we use a different finite field other than the one given by $x^8 + x^4 + x^3 + x + 1$ in $GF(2^8)$. In other ...
12
votes
1answer
474 views

Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?

A recent paper by Göloğlu, Granger, McGuire, and Zumbrägel: Solving a 6120-bit DLP on a Desktop Computer seems to "demonstrate a practical DLP break in the finite field of $2^{6120}$ elements, using ...
12
votes
3answers
591 views

What exactly is the impact of the hidden subgroup problem on cryptography?

I understand my group theory (allegedly), so I can make partial sense of The Hidden Subgroup problem: Given a group $G$, a subgroup $H \leq G$, and a set $X$, we say a function $f : G \Rightarrow ...
12
votes
1answer
2k views

How to communicate by email with forward secrecy and deniability?

My correspondents and I would like to communicate privately by email. We used to employ PGP but that might have been shooting ourselves in the foot. PGP doesn't have forward secrecy. If any of our ...
12
votes
2answers
11k views

Signatures: RSA compared to ECDSA

I'm signing very small messages using RSA, and the signature and public key are added to every message, which requires a lot of space compared to the actual content. I'm considering switching to ...
12
votes
1answer
1k views

How does HOTP keep in sync?

My understanding of HOTP is that each password is unique and based on a counter. $$PASSWORD = HOTP_1(K,C)$$ Where $C$ is an incremental counter. What I wish to know, is how you keep the client ...
12
votes
1answer
400 views

Security of pairing-based cryptography over binary fields regarding new attacks

In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$. Pairing-based cryptography using binary ...
11
votes
3answers
20k views

RSA encryption with private key and decryption with a public key

When using the RSA cryptosystem, does it still work if you instead encrypt with the private key and decrypt with the public key? What about in the case of using RSA for sender authentication?
11
votes
5answers
2k views

How can rainbow tables be used for a dictionary attack?

I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ...
11
votes
3answers
2k views

Which algorithms are used to factorize large integers?

Even if RSA decided to cancel the Factoring Challenge, it seems that some teams keep working on it. According to Wikipedia, RSA-768 has been factored in late 2009. What are the current large integer ...
11
votes
2answers
2k views

Can two different pairs of RSA key have the same modulus?

Can $n=pq$ be part of two different pairs of RSA keys? If such keys exist, say $(e_1,n)$ and $(e_2,n)$, how are they related? What will be the security concerns for the two users?
11
votes
3answers
684 views

Does NTRU decrypt correctly now?

The NTRU public-key cryptosystem has a lot of interesting properties (being resistant to quantum computer attacks, being standardized by several important bodies), but it also has a pretty unique ...
11
votes
2answers
6k views

Definition of Textbook RSA

What is the definition of Textbook RSA? What are some of the properties of textbook RSA? How does it differ from other RSAs?
11
votes
3answers
2k views

Is 80 bits of key size considered safe against brute force attacks?

I came across KATAN Family of Ciphers for small domain input blocks . They cipher arbitrary block lengths 32,48,64 but their key size 80 bits only. Is 80 bits of key size considered safe with ...
11
votes
4answers
813 views

Are there cryptographic hash functions that can be computed using only paper and pen without leaking any information about the plaintext?

I am looking for a cryptographic hash function that can be computed by a human using only paper and pen without ever leaking any information about the plaintext on the paper. The cryptographic hash ...
11
votes
2answers
585 views

Do I have to have a different salt for each password?

Should I use a different salt for each password? In my system, there are no user names, only passwords. When a user logins in, he types in one or more passwords and the server compares the results ...
11
votes
3answers
2k views

At the current time, is SHA256 the de facto standard for strong cryptographic hashes?

At the current time, is SHA256 the de facto standard for strong cryptographic hashes? From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ...
11
votes
3answers
1k views

What is the use of REAL random number generators in cryptography?

I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators. However, I don't understand for what a real random number ...
11
votes
3answers
5k views

What is pre-image resistance, and how can the lack thereof be exploited?

What is "preimage resistance", and how can the lack thereof be exploited? How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?
11
votes
3answers
2k views

“Weaknesses” in SHA-256d?

According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so: SHA-256d(x) = SHA-256(SHA-256(x)) Apparently, the motivation for ...
11
votes
2answers
1k views

How does the MOV attack work?

What exactly is the MOV attack, how does it actually work, and what is it used for? It's explained briefly here and I'd like to know what it is more / what is it fully used for.
11
votes
4answers
7k views

What is the effect of the different AES key lengths?

How does a changing key length affects the ciphertext, not only in case of AES, but in general? I know that the key spaces become much larger and the number of rounds in case of AES changes, but is ...
11
votes
4answers
326 views

Do parts of a hash carry the properties of the entire hash?

When I need to generate unique id's based on some information hashing is typical choice. However, sometimes that id needs to be of a particular size. I've seen a lot of schemes (HMAC-MD5-96 in SSH, ...
11
votes
2answers
1k views

Practical consequences of using functional encryption for software obfuscation

I came across this article, which describes a method, developed by UCLA CS professor Amit Sahai et al, for using functional encryption in order to achieve software obfuscation. The paper that the ...
11
votes
2answers
4k views

What is difference between PRG, PRF, and PRP

Until what I have gotten is: A PRG is generator is a part of PRF that produces pseudo-random values for the function. PRF is semantically secure and has no worries of being invertible. Fine, then ...
11
votes
3answers
745 views

What is a Non-Interactive Zero Knowledge Proof?

I understand the concept of a Zero Knowledge Proof thanks to the easy to understand analogy of Alibaba's cave. However, this seems to require interaction between the verifier and the other party. I ...
11
votes
1answer
5k views

Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)

Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size ...
11
votes
2answers
970 views

Random oracle model proofs and programmability

Proving the security of a scheme with the random oracle model (ROM) involves two steps: first you prove that the scheme is secure in an idealized world where a random oracle exists, and then you ...
11
votes
2answers
2k views

Is HMAC-DRBG or Hash-DRBG stronger?

Out of the two deterministic random bit generators defined in section 10.1 of NIST SP 800-90A (i.e. based on hash functions), which one is cryptographically stronger? Hash-DRBG (Section 10.1.1) ...
11
votes
1answer
3k views

What is a white-box implementation of a cryptographic algorithm?

What is a white-box implementation? Does a white-box implementation have specific properties?
11
votes
1answer
701 views

Is Wikipedia's table about SHA-2 collisions correct?

I was looking a Wikipedia article on SHA-2, and the "Comparison of SHA functions" table seems to indicate that SHA-2 is less secure than SHA-1. Is this true, or is the table wrong / misleading? ...
11
votes
5answers
680 views

How do I construct a 256-bit hash function from 128-bit AES?

I would like to generate a 256-bit hash on a microcontroller that has a 128-bit (only) AES engine. How can I construct a 256-bit hash function from a 128-bit cipher?
11
votes
2answers
466 views

Why use a 1-2 Oblivious Transfer instead of a 1 out of n Oblivious Transfer?

When initiating an oblivious transfer, why would someone use a 1-2 oblivious transfer rather than going for an 1 out of n oblivious transfer? Perhaps a slight time overhead for the extra message ...
11
votes
2answers
2k views

Is using a predictable IV with CFB mode safe or not?

While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine): "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...

15 30 50 per page