0
votes
1answer
218 views

Why sorting is needed for Meet-in-the-middle attack

The weakness of double DES, E (k1, E(k2, M)) is that Meet-in-the-middle attack is possible. When performing Meet-in-the-middle ...
0
votes
0answers
93 views

Importance of ShiftRows in AES

If ShiftRows is excluded from AES, then an attacker can attack the modified AES by simply treating $128$-bit input as $4$ $32$-bits blocks. The attacker can attack these $4$ blocks separately. ...
5
votes
3answers
451 views

What is the most computationally efficient way of generating pseudo-random permutations?

I have an application in which I need to create up to J randomly shuffled-copies of an array of length N. Then I will have millions or even billions of iterations such that, in each iteration, I will ...
0
votes
2answers
214 views

Are all block ciphers FPE (format preserving encryption)?

A FPE preserves the format. There is a correspondence between the format of the ciphertext and the plaintext. Given that a message in some binary enconded format can easily be divded in some ...
7
votes
1answer
205 views

Implementation and Testing of SRP-6a

I have been wracking my brain trying to develop a functioning implementation of SRP-6a in Python to use with a 3rd-party API that claims to use SRP-6a with $N=$ 2048-bit prime and generator of $2$. ...
2
votes
1answer
100 views

How many of primitive point on the elliptic curve?

In elliptic curves for cryptography, I know $nG=O$, where $G$ is a base point represented by $G=(x_g,y_g)\ on\ E(F_P)$, where $n$ is Order of point $G$. For example, $P(0,6)$ is a primitive point on ...
1
vote
0answers
92 views

Complexity to find an preimage of a hash function

Suppose a hash function based on Merkle-Damguard construction. Its compression function is given as $H_i=E_{m_i}(H_{i-1})$, where $E_{m_i}()$ denotes the encryption of an ideal block cipher with ...
8
votes
5answers
1k views

Perfectly secret cipher can leak about the key?

As defined by Shannon, a cipher is perfectly secure if ciphertext leaks no information about the plain text. Under this definition, can ciphertext leak something about the key? Are there any ciphers ...
1
vote
1answer
170 views

Key derivation for AES-Encryption key and HMAC

Okay so I have two options for how I would derive two keys for AES encryption and HMAC they are as follows: Run BCrypt on a users passphrase and then use the bouncy castle implementation of HKDF in ...
1
vote
1answer
128 views

How can CBC-MAC be secure when message length is fixed?

I was doing some self-initiated knowledge gathering about digests, signatures and hmacs and I ran across the fact that you can use CBC as a MAC, but if the message size is not fixed; then it is not ...
3
votes
2answers
310 views

Small Prime Difference in RSA

In RSA, the $p$ and $q$ should be randomly generated, and they are the same size. The difference between $p$ and $q$ should not be small. Suppose that $u=|p-q|<20$ and $p \times q ...
2
votes
2answers
114 views

What is primary security in ECC?

I read the following paragraph in a book about Elliptic Curve Cryptography, but didn't understand it: The primary security in ECC is the parameter $n$; where $n$ is Order of point $G$, that is $n$ ...
0
votes
1answer
93 views

Best practices (if any) to add metadata to encrypted files

I am encrypting files using AES/CBC/PKCSPadding, with 256 bits long keys. So far the first 16 bytes of each encrypted file are the IV. I would like to store some more information regarding the ...
7
votes
1answer
124 views

Verifiable, Distributed Secret Santa Assignments

My family was planning a secret santa and I thought about how I might write a little web app to dole out these secret assignments. But the downsides to this approach are obvious: there's no way for ...
3
votes
2answers
114 views

Strange MAC algorithm

I'm working with a payment provider which uses the following algorithm for signing messages: The merchant is securely given a secret key k, known to them and the ...
1
vote
1answer
112 views

What is the use of segments in Cipher Feedback Mode (CFB)

In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
2
votes
0answers
176 views

Consequences of AES without any one of its operations

Suppose AES-$128$. There are $4$ operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey. Question: If I remove one of the following opearations, what will happen to ...
1
vote
2answers
46 views

Condition on Vector Boolean Function to be Bijective

Suppose the vector boolean function be $$\begin{align} f:F^n_2 \longrightarrow F_2^n \\ (x_1,\dots ,x_n) \longrightarrow (x_2,\dots x_n,g) \\ \\ g:F^n_2 \longrightarrow F_2 \\ (x_1,\dots ,x_n) ...
3
votes
1answer
394 views

AES with weak keys

Suppose that the key generation is insecure; each key bit is independently generated, but the value of each key bit is '$1$' with probability $0.90$. These keys are used in AES. What is an efficient ...
2
votes
2answers
201 views

RSA-KEM construction

"Create a random key for CCPA2 scheme, encrypt m, send it along with a PK encryption of the symmetric key. " Say in the process, the KDF is HMAC, then: get a random key (128-bit) C1 = encrypt ...
1
vote
3answers
104 views

How a file is encrypted?

I thought encryption algorithms(like AES) are used to encrypt texts,so how a file or folder(containing pictures,videos,...) is encrypted?What is encrypted exactly?
10
votes
3answers
3k views

What is the most secure hand cipher?

By "hand cipher", I mean a symmetric cipher for which encryption and decryption can can both be performed with a pencil on graph paper, consuming about 10-20 seconds per character by a proficient ...
1
vote
3answers
135 views

Are modified implementations of cryptographic algorithms a good idea?

Are modified implementations of standard cryptographic algorithms better that the standard versions? Since the algorithm is not standard, is it harder to break? Is it safer?
0
votes
1answer
43 views

CSPRNG's (ELI5) What's the purpose of multiple seeds/ regenerating sources of entropy (i.e. /dev/random)?

Why is there a need to generate more than one high entropy seed? It would seem like if the original source of entropy is high quality, than some 512 bits should be more than enough to seed a CSPRNG ...
0
votes
0answers
53 views

Permutation parity after cycle-walking

Let $E$ be a random even permutation of the set $\{0\dots n-1\}$. We construct a permutation $P$ of the set $\{0\dots m-1\}$, for some $m\le n$, using cycle-walking; that is, computing $P(x)$ is as ...
2
votes
5answers
533 views

Can hashing become encrypting?

hashing some data and encrypting data share some similar attributes. Surely this is why "Difference between encrypting something and hashing something" has been asked. The point of this question is ...
1
vote
2answers
131 views

Using bcrypt derived keys for encryption?

Sorry for this ignorant question but I am currently weighing up the advantages and disadvantages of BCrypt over PBKDF2 and from what I have read BCrypt is considered more secure but from what I have ...
0
votes
0answers
25 views

Hokkaido (proof-of-Work system) and pseudo-random permutation table

This question is regarding a proof-of-work system suggested in this article "Cryptology ePrint Archive: Report 2005/356". The outset goal of the Hokkaido algorithm is to provide a task to somebody's ...
2
votes
1answer
270 views

what are the security benefits of LUKS?

Aremed with only basic crypto knowledge, I'm trying to understand the security benefits of LUKS over plain-mode dm-crypt. Hopefully this is a good place to ask. Given the LUKS header contains ...
0
votes
1answer
50 views

Why has SSL v3 not yet been upgraded to a higher version with stronger principles, what are the dependencies and issues to do so?

SSLv3 is almost 18 years old; why has it not been updated to a more advanced version with stronger rules and structure. What have been the issues and dependencies in doing so till now???
0
votes
1answer
103 views

RSA: Fermat-Euler Theorem - coprimality of message and modulus [duplicate]

I understand the implication of the Fermat-Euler theorem and how it applies to RSA and the detailed explanation by user Ninefingers at What is the relation between RSA & Fermat's little ...
1
vote
1answer
218 views

IPsec authentication and encryption lgorithms

I am looking for the implementation of IPsec security algorithms for both authentication and Encryption. Is there any open source implementation available for the same ? And if someone supposed to ...
0
votes
1answer
232 views

Extending key sizes in Salsa20 and ChaCha?

I've written implementations of Salsa20 and ChaCha that accept 384 and 448 bit keys. It was fairly trivial to implement, the 'sigma' constant is replaced with key material, and the counter, (which was ...
2
votes
2answers
270 views

Can RSA signing be implemented on top of RSA encryption/decryption?

I need to use RSA-SHA256 signing. Unfortunately not all Microsoft CryptoAPI providers support that. It's possible that I might get a handle to a CryptoAPI provider that can just encrypt/decrypt with ...
2
votes
1answer
61 views

ASCII input to HMAC weaker than raw bytes?

In various cryptographic programs I've written (most have been toy problems, but this current one is not) I have taken a slothful approach to performing a message digest (hash) of numerical input. I ...
2
votes
1answer
118 views

Why is this cryptosystem insecure?

Can someone help me see the flaw in this cryptosystem? Note: This is homework and it is due today at 1:30pm. An answer before that is not expected; I'd just like to understand what the flaw is. ...
13
votes
2answers
828 views

Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?

Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We ...
0
votes
1answer
52 views

TLS - self encrypting to avoid tls setup, secure?

I am in doubt : of course one can create a tl connection between a client and a server. But what if the client sends self encrypted with, say, blowfish, data to the server? The goal is that the ...
1
vote
1answer
90 views

Random Permutation polynomial

I need to know, please: (1) Is there anyway to pick uniformly at random permutation polynomial in a field of prime order? (2) Are there many permutation polynomials in a field? (3) In a finite ...
1
vote
0answers
29 views

Pros and cons between HOTP and TOTP [duplicate]

I'm reading the RFC6238 (TOTP) and RFC4226 (HOTP) standards and can't get which one is to prefer? I've searched around a bit and it seems like TOTP is the one that is most used, but some argue that ...
1
vote
0answers
34 views

Why HMAC=H(message|key) is unsafe? [duplicate]

As mentioned in wikipedia, HMAC=H(message|key) is not safe, but I don't know the reason. Anyone can tell me why? or give me an example? Thank you in advance.
0
votes
0answers
30 views

openssl - Recommended way to encrypt and sign S/MIME messages using openssl

OpenSSL has two command line tools, cms and smime, that can encrypt and sign S/MIME messages. Both can specify ciphers and ...
0
votes
0answers
42 views

Validity of ElGamal signature variation

I'm trying to solve excersise 7.6 from Hoffstein - Introduction to Mathematical Cryptography page 459 (http://goo.gl/oRyInT) Let $p$ be a prime and let $i$ and $j$ be integers with $gcd(j, p − 1) = ...
0
votes
1answer
70 views

What is “electronic” in electronic codebook (ECB)?

This is an honest question regarding terminology. I believe that I understand why one mode to use a block cipher is called a codebook. But I wonder why electronic as a work appears here? Is it fair ...
0
votes
0answers
45 views

Test framework for hash functions for collision resistance?

I have two questions about the assessment of collision resistance in hash functions. Given a hash-function what would be the next step to inquiry about it's collision resistance / probability of ...
-1
votes
1answer
82 views

What does $\mathbb Z_p^*$ contain?

I have a prime $p = 7$ and was tasked to select a random value in $\mathbb Z_p^*$ in my signature scheme. What does the full range of $\mathbb Z_p^*$ contain in this case? Is it $\{0...7\}$ or ...
0
votes
1answer
253 views

How can we prove that two discrete logarithms are equal?

Suppose there are two elements $a = g^x$ and $b = h^x$, where $g$ and $h$ are generators in $Z^*_p$ and $p$ is a large prime. How can we prove that $a$ and $b$ have the same discrete logarithms with ...
1
vote
0answers
85 views

Opinion on my idea for storing credit cards securely

I've been thinking of ways to store credit cards securely, I thought of this: Take the users credit card info Put the card info in a standard format "Full Name/Card Num/Security Num/Expiry ...
0
votes
0answers
61 views

How can I calculate the size of an encryption key?

I have encryption algorithm that has two variables are used as encryption key. How can I calculate the size of the encryption key. I will show an example of what the variables can be: ...
-1
votes
1answer
97 views

what is SALSA20 Nonce and its requirements [duplicate]

what is the source of nonce in SALSA20 algorithm. basically who provides the value of nonce in SALSA20 algorithm

15 30 50 per page