0
votes
2answers
158 views

NIST tests for AES [closed]

How to do the benchmarking of a self implementation of AES algorithm using NIST test suites? I am unable to find enough material on the internet regarding this.
6
votes
2answers
940 views

Could an HMAC be used as a hash?

MD5 is considered broken and SHA-1 is closely following, but HMACs built around either are still considered relatively secure. It makes me wonder if MD5 and SHA-1 HMACs can be used as secure hashes. ...
5
votes
1answer
123 views

Proof of RSA security dependent on public key exponent

I am writing a (high-school) paper on the public key exponent's (in textbook RSA - no padding is discussed!) significance in terms of time and security. The time part is done; as for the security part,...
4
votes
2answers
87 views

Importance of random number generation in Schnorr's signature

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signing process (as described in wikipedia) requires the generation of a random bit $r$. I am wondering ...
6
votes
1answer
358 views

What advantages does Keccak have over Blake-2?

Keccak/SHA-3 is new NIST standard for cryptographic hash functions. However, it is much slower than Blake-2 in software implementations. Does Keccak have compensating advantages?
10
votes
1answer
123 views

K Friedman - two texts explanation

I read the $K$-Friedman test to determine the period of a Vigenère ciphertext, and I understand something like this: $K$-Friedman test tries to find out what period of the cipher by calculating some ...
8
votes
1answer
127 views

Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
7
votes
1answer
103 views

Default algorithm for scalar multiplication of elliptic curve points by the MIRACL Library

What is the default algorithm used by the MIRACL-Library [1] for elliptic curve cryptography systems to perform scalar-point multiplication with curves of Weierstrass form satisfying the equation : $y^...
4
votes
2answers
146 views

Is there an asymmetric encryption algorithm where the public key cannot be derived from the private key

Is there an encryption algorithm that will produce a public key and a private key such that the public key cannot be generated using the private key. For example, if the private key is compromised ...
4
votes
0answers
52 views

What is the correct definition of the blowfish F-function?

The Blowfish cipher uses a so called F-function which uses S-Boxes (S[i], i=0,1,2,3) to ...
3
votes
1answer
126 views

Counting points on elliptic curve over binary field

How to count number of rational points on elliptic curve over binary field?
8
votes
1answer
386 views

Uniformly distributed secure floating point numbers in [0,1)

Is there any way to generate cryptographically secure uniformly distributed floating point numbers in the interval [0,1)? For example, in Javascript, there is ...
3
votes
1answer
106 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...
8
votes
1answer
148 views

Is CPU timing jitter a usable entropy source?

In some virtualized environments, the only source of entropy available is CPU timing jitter. Can one get enough entropy from this source for practical uses? Also, is this secure against local side-...
2
votes
2answers
93 views

Is the security of an HMAC equally important as the security of the cipher itself?

I'm a little unclear on how hash based MAC works... So I would like to know, is the security of your hash function as important as the security of the overall cipher? Basically, if you can crack the ...
3
votes
1answer
200 views

end-to-end encrypted chat app with symmetric + public key encryption, TLS and cert pinning

A big drawback of end-to-end encrypted messaging services is that, as soon as you lose your device, you lose all your messages. Your private key is gone after all. I was wondering though, wouldn't it ...
-1
votes
1answer
85 views

NIST PRIMES - cryptography

I have a problem, If I have $p = \text{P-192} = 2^{192} - 2^{64} - 1$ with the base $2^{64}$ so, $2^{192} \equiv 2^{64} + 1 \pmod p$ the same that $(p=\text{P-192})$ or $2^{256} \equiv 2^{128} + 2^{...
4
votes
1answer
102 views

Does rsa-oaep provide or not plaintext integrity in addition to confidentiality?

My own understanding (possibly wrong of course) of RSA-OAEP encryption scheme is that it provides plaintext integrity (in addition to confidentiality) due to MGF function which for encryption ...
1
vote
1answer
58 views

What is the viability of a hybrid vigenere cipher?

So a vigenere cipher's main weakness is that you can use frequency analysis on each alternated alphabet, and thus crack the cipher with relative ease... But that implies that you know what the ...
6
votes
3answers
198 views

Why does DES implement so much Cross Wiring?

I've been going through DES, and I find that most of the blocks simply Reshuffle the input, which may be termed as "Cross Wiring". This include IP, IP-1, PC-1, PC-2 and even Expansion (although this ...
3
votes
1answer
195 views

Homemade Randomized RSA

Considering the following encryption scheme where RSA is used to encrypt a plaintext m and then we choose a random r and compute: $$A = r + m^e \bmod N$$ and $$B = r^e \bmod N$$ So the ciphertext is ...
4
votes
2answers
254 views

Why is 2048-bit RSA always paired with 320-bit ECC?

You may already have noticed that most smart cards ship with 2048-bit RSA support and 320-bit ECC over GF(p) support. You may have already asked yourself "why exactly 320-bit?". Now I remember having ...
-1
votes
1answer
233 views

What is the difference between key size and block size (for AES)

We are working on AES and want to develop a website which should provide an encryption facility but we are not understanding the difference between key and the block size. More appropriately what does ...
4
votes
1answer
558 views

Curve25519 vs “Million Dollar Curve”

Quoting from the Million Dollar Curve website: By using publicly verifiable randomness produced in February 2016 by many national lotteries from all around the world, we propose to generate a ...
1
vote
1answer
33 views

Would buffering socket send resist timing attacks

I have been reading and thinking about timing attacks on cryptographic systems. The answer to this question mentions the following: "The way to defend against timing attacks is to make sure the time ...
4
votes
1answer
317 views

Difference between Hardware implemented algorithm and software implemented one?

In the articles about cryptography I see the words Hardware implemented and Software implemented. I'm curious to know what is the difference between them? In the other words, even in the computer ...
3
votes
0answers
104 views

TPM's monotonic counters

I am reading the TPM Design Principles v1.2 §17 and do not feel I fully understand the example they give on how the counters would work. Apparently monotonic counters are used to prevent replay ...
5
votes
2answers
554 views

Can elliptic curve (25519) be used to encrypt file?

This is probably a simple question, but I haven't been able to see it stated anywhere. Is it possible to directly encrypt a file (of any length) with some form of EC using the 25519 curve. I know it'...
4
votes
0answers
230 views

Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
3
votes
1answer
72 views

Security of this scheme

I am developing a software and I am not sure if it is completely secure. I have 22 Mb of data to encrypt used multiple times, random IV (generated using RAND_bytes from OpenSSL lib) and password ...
1
vote
1answer
34 views

Multi Party System with n-1 adversaries

Novice here. Is there a MPC function where no information is leaked even if all parties are not trustworthy ?
1
vote
0answers
21 views

TPM specification physical presence requirements

I am looking at TPM Main-Part 1 Design Principles_v1.2_rev116_01032011 and on page 69 of pdf, equivalent to page 57 of the document itself,there is comment on physical presence as follows: "Observe, ...
2
votes
1answer
50 views

Is the IV value in Davies Meyer construction public?

I am learning the construction of Davies-Meyer to construct a hash function from block ciphers. The definition that I found is $$H_i=E_{m_i}(H_{i-1})\oplus H_{i-1}.$$ where $E_k$ is a block cipher ...
1
vote
1answer
472 views

How is El Gamal different from Diffie Hellman Key Exchange [duplicate]

I am Reading RSA and Public-Key Cryptography by Mollin and I can't make out how El Gamal is different from Diffie Hellman Key Exchange. Any thoughts?
4
votes
1answer
121 views

How does encryption work in elliptic curve cryptography?

So I think I understand a good amount of the theory behind elliptic curve cryptography, however I am slightly unclear on how exactly a message in encrypted and then how is it decrypted. So my ...
1
vote
0answers
23 views

change in bits leads to change in rounds the reason? [duplicate]

In AES algorithm why there are 10 rounds for 128 bits whats the reason behind it like we have in raid storage technology or something else
1
vote
1answer
53 views

TCG design specification of TPM and nonce creation

I am reading TPM Main Part 1 Design Principles (PDF) which states: The creation of all nonce values MUST use the next $n$ bits from the TPM RNG. I do not know what this means, or how to find out ...
0
votes
1answer
112 views

Making both the IV and salt public for PBE with AES-CFB

Is it okay to make both the IV for AES-CFB and the salt for PBKDF2 public? Does this action of mine compromise security in any way? I have an implementation of this cipher and had previously asked a ...
0
votes
0answers
23 views

Key equal to IV [duplicate]

If I will use for AES encryption in CBC mode key that is equal to IV, how this change security (IV will be secret)?
2
votes
1answer
219 views

Lattice based attack on RSA

Let $n=pq$ be the RSA module and at least one of $p,q$ is a weak prime.It is proved that the number of such $1024$bit $n$ is at least $2^{759}$. With lattices we can factor these $n$ in a second (I ...
1
vote
0answers
42 views

Keys and key-stretching when authenticating requests?

I'm making a REST application and still a bit confused about this issue. basically, to authenticate incoming requests, I give out userId, issued timestamp, expiry timestamp (normally 3 months after ...
4
votes
2answers
126 views

Is there such a thing as a hash function with a fixed size input?

That seems like it would be a useful primitive. Using it in place of a block cipher in the Merkle–Damgård construction would give a variable-length hash, maybe without the tricky business with related ...
1
vote
1answer
125 views

Encrypting passwords

I am using Android's keystore to generate a key which is protected by fingerprint authentication. This key can be used to encrypt any secrets. In my case, I want to encrypt a user password (which is ...
1
vote
2answers
162 views

AES key equal to IV (CBC mode)

Application uses AES in CBC mode with 128 bit key. In this implementation key is always same and is equal to IV. Can attacker get the key or decrypt data? If he knows: First and second blocks of ...
1
vote
1answer
78 views

Why does NaCl's crypto_auth have twice the security level of crypto_onetimeauth?

The crypto_auth function produces a 256-bit HMAC, with a 512-bit version also available. But the crypto_onetimeauth function (...
1
vote
1answer
114 views

Is super encryption (aka “multiple encryption”) always good?

I'm trying to use super encryption (also known as “multiple encryption”) with AES in CFB mode with IV and password salting and AES in CTR mode both without padding. I first use AES CFB and then AES in ...
5
votes
2answers
688 views

Which bitwise operations are used in SHA-256?

From the wikipedia entry on SHA-256 I'm a bit confused about which operations actually go into the algorithm. From the pseudo code it appears the operations are $\texttt{xor}$, $\texttt{and}$, rotate, ...
3
votes
0answers
36 views

Is EFS vulnerable to Chosen plaintext attack?

I have some backed up files encrypted with EFS and I lost the EFS certificate thus unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key (...
2
votes
0answers
24 views

Why do we need Merkle–Damgård strengthening [duplicate]

Reading through some manuals, wikis and other documentation I'm learning about Merkle–Damgård construction. I understand why padding beginning with '1', followed by '0's is needed, but I can't ...
1
vote
0answers
49 views

How secure is 'Plain Old RSA' [duplicate]

Let's say I use RSA encryption, it's 2048 bits and I use a simple character padding scheme, every character is turned into a 3 digit number and strung together, then encrypted. Saying that no message ...

15 30 50 per page