1
vote
0answers
102 views

Career advice for our readers [closed]

I am a first year math PhD student with work experience and an MS in math. Do you have any advice regarding internships involved with cryptography and other mathematics other than the NSA? Thanks.
3
votes
2answers
1k views

Why is AES not a Feistel cipher?

I am studying for an exam right now. And I wanted to make sure I got this point correct. AES is not a Feistel cipher because the operations in AES are not invertible. Is the above statement ...
1
vote
0answers
165 views

How to perform benchmark of block/stream ciphers?

I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption). To get general ...
2
votes
1answer
408 views

Why does second pre-image resistance imply pre-image resistance

I am studying hash functions. I can understand why collision resistance implies second preimage resistance, but I don't get why second preimage resistance should imply first preimage resistance. ...
3
votes
1answer
108 views

What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)

I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived ...
4
votes
1answer
123 views

When would one prefer a proof of knowledge instead of a zero-knowledge proof?

I've just realized I find it hard to distinguish between these two terms (proof of knowledge, and zero-knowledge proof), specially where only the latter seems to be used in many cryptographic ...
1
vote
2answers
172 views

Shamir's Secret Share [duplicate]

I'm not quite sure the benefits of working over a prime modulus in Shamir's secret share- but doesn't limiting the numbers you pull from make the secret easier to guess? Instead of being over the real ...
2
votes
2answers
2k views

What makes RSA secure by using prime numbers?

I am just learning about the RSA algorithm. Looking at the first two steps: Choose two distinct prime numbers $p$ and $q$. Compute $n = pq$. I have some probably stupid questions: Why do $p$ ...
1
vote
0answers
53 views

How does Dissent protect against Sybil Attacks?

Dissent claims to be able to be resistant to Sybil attacks. Dissent seeks to offer accountable anonymity, giving users strong guarantees of anonymity while also protecting online groups or forums ...
2
votes
1answer
139 views

What are the possible cryptographic implications of Zhang's proof of the Twin Prime Conjecture?

Earlier this year, Yitang Zhang published a proof of a weakened form of the Twin Prime Conjecture. I'm wondering if any of the new mathematical machinery he developed has uses in cryptography or could ...
1
vote
1answer
159 views

Security Consideration on The Use of Random Number in Digital Signature

key-exchange protocol allows two parties to establish a shared key over public network. Lacking of authentication the original Diffie–Hellman key exchange is insecure under man-in- -the-middle ...
2
votes
1answer
214 views

How much does a successful Distinguishing Attack “break” the attacked stream cipher?

I started reading about the most recent cryptanalysis of RC4 and it's variants. One of the papers I just finished reading ("Two Linear Distinguishing Attacks on VMPC and RC4A and Weakness of RC4 ...
2
votes
0answers
75 views

Can you help me understand this “Message Modification by Meet-in-the-Middle” related to Tiger Hash? [on hold]

I found this paper that explains how to attack a reduced round tiger hash, but I'm having a hard time understanding some of the mathematical notation. Could someone explain the section "Message ...
1
vote
0answers
51 views

Algorithm for sharing secret information with redundant keys [duplicate]

I have an information that I would like to encrypt and give it to someone else. I would like to encrypt it using N separate passwords (say 5) and give each password to some other persons. However the ...
1
vote
1answer
102 views

Is there a developer's resource that ties encryption methods and strengths to the appropriate usage scenarios?

I'm not looking necessarily for implementations in any language (although it would help to list those resources as well), but what I am most interested in is a discussion of what advantages and ...
4
votes
2answers
197 views

Is this a structural weakness of Feistel networks?

I'm doing a lot of reading about Feistel networks. Something occurred to me a bit ago that I hadn't realized previously, namely that in any Feistel construction there are bits of the plaintext that ...
1
vote
1answer
431 views

RSA Decryption with Private Key but no public exponent

I manually set the RSA private key, given the private exponent and modulus. When I use this key to decrypt a message encrypted using a public key (also set with public exponent and modulus) seems to ...
1
vote
0answers
425 views

How is the initial permutation of DES created?

I am creating a program in C language with DES (Data Encryption Standard) functionality, but don't know how to apply the initial permutation. Is it achieved by swapping the values? If "yes", then ...
-2
votes
0answers
1k views

encryption and decryption time for RSA-crt in java? [duplicate]

I try compute execution time for encrypt and decrypt data has 1024 bit = 128 byte in RSA-crt algorithm. I need this results. But I believe this result wrong. because big diffrent between execution ...
5
votes
1answer
103 views

Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?

I'm basically looking at this construction to turn a tweakable blockcipher $E_c(x)$ taking a key $k$, nonce $n$, counter $c$ (forming tweak $t = c||n$) and an input $x$ into a PRF on an ...
1
vote
2answers
2k views

How to decode an OTP message?

First off, I'm extremely sorry if this comes off as a "homework dump", but to clarify, it isn't. I don't want the answer, I want to know how to get to the answer. My cryptography professor gave us an ...
2
votes
2answers
232 views

Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
1
vote
1answer
323 views

Dual_EC_DRBG and OpenSSL on a Mac

Since there is not much info anywhere on the Internet related to this: Does anyone know if OpenSSL's default CSPRNG is Dual_EC_DRBG or not? Their wiki is not very clear… Related to the first ...
10
votes
3answers
371 views

How broken is a xor of two LCGs?

Suppose we define a PRG as the xor of two LCGs modulo a 64-bit prime: something like the following Python code. ...
3
votes
1answer
304 views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
6
votes
2answers
572 views

What is the security loss from reducing Rijndael to 128 bits block size from 256 bits?

As you know in the past few weeks it has emerged that NIST/NSA have been involved in weakening encryption standards over a long period of time so that they can retain the ability to break encryption ...
1
vote
3answers
262 views

Extracting only the entropy

(I cleaned up the question a bit, It was previously titled "extracting entropy without hashing" .. thus some of the comments / answers) I'd like to extract the entropy of data without injecting ...
2
votes
1answer
572 views

OpenSSL padding

I would like to know how much padding OpenSSL algorithms expect.
2
votes
1answer
166 views

Bandwidth and block size for Paillier cryptosystem

Can someone clarify what is meant by the terms cryptosystem bandwidth and block size for public key cryptosystems; The context is the Paillier cryptosystem and its Damgard-Jurik generalisation. My ...
2
votes
3answers
495 views

Using Whirlpool hashing function to encrypt data

I've read that the Whirlpool hash function can produce footprints that could be used as a pseudorandom generator. Is it "OK" to use it to encrypt some data using something like the following? ...
1
vote
1answer
554 views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
3
votes
1answer
103 views

md5sum collision question

I've been reading the wikipedia page, trying to get a better understanding of how to produce a collision. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities The wikipedia page above states: ...
4
votes
2answers
511 views

With a true random number generator at hand, how to implement one-time pad?

I have a Raspberry Pi single-board computer that happened to have an hardware true random number generator, based on some quantum effects on the processor silicon, baked into its BCM2835 chip and I ...
2
votes
1answer
197 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
4
votes
2answers
2k views

Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
0
votes
1answer
56 views

What makes adaptive memory attack difficult for the adversary?

On page 11, definition 2 of "Simultaneous Hardcore Bits and Cryptography Against Memory Attacks", the paper outlines the following steps (PK,SK) public key and secret key are generated by defender ...
0
votes
1answer
171 views

Is my understanding of CPA indistinguishability experiment correct?

Following are steps to conduct Chosen Plaintext Attack (CPA) indistinguishibility experiment $PrivK_\mathcal{A,E}^{eav}(n)$. $\mathcal{A}$ is the adversary $\mathcal{E}$ is the encryption scheme ...
8
votes
2answers
1k views

Does Microsoft use Dual_EC_DRBG by default?

So, as we all know, Dual_EC_DRBG contains an NSA back door. At this point, there is no reason to call it a "potential" or even an "alleged" back door; the presence is obvious even to the NY Times. As ...
-3
votes
1answer
256 views

List of available symmetric & assymetric ciphers [closed]

I was looking all over the Internet list of ALL existing symmetric and asymmetric ciphers. I know that there's, for example, AES, DES, Blowfish, DSA. But how about more? Where to find such list?
3
votes
1answer
422 views

Proof that IND$-CPA implies IND-CPA?

I've read a few papers recently that used a notion of security called "indistinguishability from random bits/strings" under chosen plaintext attack, also called IND\$-CPA. See e.g. ...
2
votes
1answer
223 views

Is it safe to use GZIP to avoid padding related attacks

I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different ...
4
votes
2answers
390 views

Why is AES considered to be secure?

The security of RSA is based on the integer factorization problem, which is a very well defined and understood mathematical problem. This problem must be solved in order to fundamentally break RSA. ...
2
votes
1answer
247 views

Can I use SHA1 as license key?

I have recently started looking into creating secure, while not validating against an external server, software product keys. The idea I have had is to create a key consisting of two parts firstly a ...
-1
votes
1answer
98 views

Can someone explain how this unpadded RSA formula works?

Taken from http://en.wikipedia.org/wiki/Homomorphic_encryption, $\mathcal{E}(x_1) \cdot \mathcal{E}(x_2) = x_1^e x_2^e$ $\bmod\; m = (x_1x_2)^e \;$ $\bmod\; m = \mathcal{E}(x_1 \cdot x_2)$ What is ...
2
votes
2answers
75 views

How to get the same calculation result on an untrusted computer, while withholding some information?

Consider this command on a trusted computer: result = function(public data, secret data) or shorter: r = f(p,s). How could a ...
0
votes
1answer
55 views

blinding a hash vs. sending the hash directly

So with blind signatures you have two parties - A and B. A has a message that they want B to sign so A creates a hash of their message, blinds it, and then sends it to B to sign. That, as I understand ...
1
vote
1answer
127 views

Generating keys with HKDF from Diffie Hellman agreement

In order to generate multiple session keys from a Diffie Hellman key agreement protocol, I'm trying to use the HKDF to generate this session keys. The HKDF algorithm uses an Extraction-Expand ...
18
votes
5answers
2k views

What is the lowest level of mathematics required in order to understand how encryption algorithms work?

What mathematical fields of knowledge would be required in order to get a good understanding of encryption algorithms? Is it basic algebra, or is there a "higher education" mathematical field ...
8
votes
1answer
194 views

Is the inverse of a secure PRP, also a secure PRP?

If a block cipher is a secure PRP, is it's inverse a secure PRP as well? My intuition says yes but I'm not exactly sure. On a related note, if a block cipher is a secure sPRP, is it's inverse a ...
3
votes
1answer
173 views

How would I make a secret notation alphabet more secure?

Disclaimer: I was looking for a place to ask this question on SE and this site seems to be the most fitting. If this question doesn't belong here, feel free to redirect me. Just out of boredom and ...

15 30 50 per page