4
votes
1answer
133 views

Consequence of a change on the Guillou-Quisquater Protocol

In the Guillou-Quisquater Protocol, the prover convinces the verifier that he knows an $e$-th root of an element $y \in \mathbb{Z}^*_n$ ($p, q, e$ are primes, $n = pq$ and $e$ is coprime with ...
2
votes
1answer
78 views

IV larger than block size of cipher?

Is there any advantage to using an IV larger than a cipher's block size? Say I'm using AES-256 in Galois Counter Mode (GCM). My file format looks like this: ...
3
votes
2answers
211 views

What is the use case for XOF functions (i.e. SHAKE128/256)?

FIPS 202 defines 2 functions: SHAKE128 SHAKE256 As extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...
1
vote
1answer
79 views

Time complexity of trial division

Suppose $n=pq$, where p,q are prime numbers. let $p ( \le q)$ be the smallest prime, then we know that $p \le \sqrt{n}$. In trail division, we check $n \mod i$ for the values of $i$ from 2 to ...
3
votes
2answers
171 views

Is there any relation between two strings with the same MD5 hash?

Is there any relation between two strings with the same MD5 hash? For example these two strings: ...
6
votes
1answer
2k views

How can an S-Box be reversed?

So, as an exercise to greater understand some things about cryptography, I decided to try and implement GOST 28147-89, which uses eight 4x4 S-Boxes. I can grasp the concept of putting 4 bits through ...
2
votes
3answers
350 views

Prevent replay attack without storage

I am designing a set of low-power sensing motes. Each mote will communicate to a central base over RF. I want the mote to be able to authenticate itself with the base, and send its data without being ...
3
votes
1answer
65 views

Forcing participants to be honest in Secure Multiparty Communication

Alice and Bob engage to compute a secure function f(a,b) where a and b must be present in a ...
2
votes
1answer
106 views

Hash and salt or salt and hash?

People say "hash and salt", but aren't you supposed to salt password the first, and then hash it? So that means its called "salt and hash" right?
1
vote
1answer
543 views

Cracking secret key of a MD5 hash?

I have a MD5 hash which is obtained by hashing certain strings appended by a pipe character ( | ). (I know the values of these) A secret key is added as a suffix to this (I don't know the secret key). ...
5
votes
2answers
19k views

FIPS 140-2 Compliant Algorithms

Is there any reference to check the list of encryption & signing algorithms which are compliant to FIPS 140-2. After an exhaustive search I could find only "AES". Any suggestions would be much ...
1
vote
1answer
53 views

Help with pseudorandom functions

I started a new lecture this year about crypto and I've had a few problems in the first few weeks with the exercises we got. I would appreciate a "guide" on how to solve problems like the following ...
2
votes
1answer
147 views

Encryption that can only be decrypted once?

I want to encrypt a message so that it can only be decrypted once. I know that we can use nonces to do this when we exchange data over a communication channel, but in my case the cipher text will be ...
0
votes
0answers
41 views

Why we use operating modes in cryptography? [duplicate]

Why we use operating modes (CBC , . . ) in cryptography? i mean what is the essential of use it ?
0
votes
1answer
77 views

what problem happen if we always use IV Zero in CBC Mode? [duplicate]

i have a question about CBC operating mode. what problem happen if we always use IV Zero in CBC Mode?
1
vote
1answer
144 views

Confused with 128-bits AES round numbers

The key size used for an AES cipher specifies the number of repetitions of transformation rounds that convert the input, called the plaintext, into the final output, called the ciphertext. The ...
1
vote
0answers
60 views

Calculating Phi(M) and D for RSA decryption given p,q,e

I've been given a message in 4 digit numbers but it doesn't seem to work when I use my calculated values for phi(m) and d. If I'm correct phi(m) = (p-1)(q-1) correct? And d is given by ed = ...
2
votes
1answer
165 views

RSA vs ECDSA/ECDH

So we've been using RSA for a while now. I wonder, is it still secure? I'm wondering whether surveillance agencies can at this point read traffic encrypted with say, TLS_ECDH_RSA_WITH_AES_128_GCM? ...
-2
votes
1answer
36 views

Test vectors representation

The test vectors listed in https://github.com/cantora/avr-crypto-lib/blob/master/testvectors/Mickey-v2-128-unverified.test-vectors Are represented as Hex strings? I'm sure that the key is, because ...
3
votes
0answers
60 views

Which precautions to protect against side-channel attacks on ARX ciphers?

In recent crypto there has been a trend to design ciphers using only the ARX set of instructions - i.e. additions (modulo $2^{32}$ or $2^{64}$), rotations (by a fixed constant) and XORs, examples ...
1
vote
1answer
883 views

Trivium example

I started learning cryptography from Understanding Cryptography book of Christof Paar and Jan Pelzl. Here is the problem I have solved but I want to be sure that it is correct. Assume the ...
2
votes
2answers
178 views

Why do 1st and 3rd key have to be the same in 2 key 3DES?

From this answer: However, that wasn't the only situation they had in mind; they also considered the case where someone implemented 2 key 3DES in hardware (which the first and last subkeys ...
1
vote
0answers
63 views

If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

Say we construct a pseudo-random number generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back ...
13
votes
4answers
3k views

Why is RSA encryption key based on modulo $\varphi(n)$ rather than modulo $n$?

While calculating RSA encryption key we take modulo $\varphi(n)$ rather than modulo $n$. I can’t understand why it’s done this way.
3
votes
1answer
64 views

MD5 Hash outputs not produced

Are there any hash outputs not produced by the MD5 hash function? I need to use it as a placeholder for an empty hash while comparing two hashes.
1
vote
1answer
52 views

How many Hashes to find a digest of 2^{n−k}?

Given an n-bit cryptographic hash function $H$, how many messages should we expect to hash before finding a message $x$ such that $H(x) < 2^{n−k}$ for some integer k? My take: Shouldn't it simply ...
0
votes
1answer
69 views

Is a nonce considered 'secret' enough for HMAC?

We're implementing a mobile application which communicates with a web service, and on first install the user sends its deviceid to the web service (over TLS, unauthenticated at this point) - which ...
2
votes
3answers
687 views

Computational feasible to reverse MD5SUM?

This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size $N$ whose MD5SUM is $X$? For example, ...
17
votes
3answers
4k views

Cryptanalysis to reverse engineer a hash?

I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question. I have inputs and outputs from an ...
2
votes
1answer
85 views

Is Shoup's Practical Threshold Signatures considered secure?

I am planning to use threshold cryptography in a Java application. So far, I have only found ThresSig and a ECDSA implementation used in TwoFactorBtcWallet. However, ThresSig is based on a 15-years ...
1
vote
1answer
79 views

Where can I get the correct and precise algorithms for elliptic curve cryptography?

I have been asked to implement cryptographic operations using elliptic curves. I would like to get precise algorithms for various processes like key generation, digital signature and verification. I ...
2
votes
2answers
79 views

Easy hash function collision

I'm designing a cryptography-breaking assignment for a college-level introductory security course, and I'm looking for a hash function which is reasonably easy (but not too easy) to generate ...
0
votes
1answer
69 views

If PRF is non invertible, why does Ctr-mode work?

I am currently taking Dan Boneh's Cryptography I course online. I have just finished the segment discussing the Cipher Block Chaining and Counter-Mode. I am having difficulty understanding why ...
-2
votes
1answer
65 views

How do we solve Shammir 2,3 sharring scheme where arithmetic is modulo?

I am trying to get secret S and I have 3 values (2,2)(6,3)(4,9) and know that modulo is 13. I tried using Lagrange basis polynomial and got 8 but I am not sure if that is right and also I cannot find ...
3
votes
1answer
100 views

A “one time pad” can be thought of a Vigenere cipher with

A "One Time Pad" can be thought of a Vigenere cipher with... An infinitely long key A secure symmetric key Multiple ciphertext alphabets A columnar transposition I had this question come up ...
-3
votes
0answers
78 views

Private and public keys, how do they relate mathematically? [closed]

Assuming everyone here knows the basics of a public private key, then you know the keys are mathematically related. My question is, what is the math? I really would like an in detail algorithm of the ...
0
votes
1answer
84 views

How can one protect against a Man In The Middle attack during key exchange without using certificates?

Besides using a certificate to defend against a man in the middle attack during a key exchange, what methods can be used?
7
votes
3answers
896 views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
1
vote
1answer
102 views

Why is RSA encryption version 1.0 not specified in an RFC?

I saw that there are three RSA encryption versions, as follows: RSA encryption version 1.5 (RFC 2313) RSA cryptography specification version 2.0 (RFC 2347) RSA cryptography specification version 2.1 ...
9
votes
1answer
861 views

Is TEA considered secure?

Wikipedia claims that the best attack on the surprisingly simple TEA block cipher, that isn't a related-key attack, has a time complexity of $2^{121.5}$. So despite how unsophisticated the cipher ...
1
vote
1answer
5k views

What does AES256-CTS-HMAC-SHA1-96 mean in relation to Kerberos?

I'm not completely clueless as to what it means, but I'd like to understand it at a higher level. The highest encryption type used by Active Directory domain controllers for Kerberos authentication ...
3
votes
2answers
178 views

What is sent on the initial communication with Kerberos?

When a user wants to communicate with another user (let's say Alice and Bob), what is sent over the network during the initial communication? Alice uses her Kerberos client and enters her password ...
0
votes
0answers
41 views

What is the DK function when generating an AES key for Kerberos 5?

I'm trying to understand RFC3962. So far I understood everything, except for the last part: generating the derived key from the PBKDF2 output. To generate an encryption key from a pass phrase and ...
1
vote
1answer
45 views

Is it possible to have self-authenticated message?

Consider a text with $n$ words which $m$ words of it can be replaced with an equivalent word. Therefore we have $2^m$ different texts with the same meaning. For example "You are {so/very} ...
1
vote
0answers
21 views

Proving for a single input vs several inputs. Is there any difference?

I am working on a new protocol for pattern matching. While defining the ideal functionality, it is possible to say: Alice sends $p$ and Bob sends $T$ to the ideal functionality. i.e. searching for ...
0
votes
0answers
26 views

How do I check if the secret key polynomial of the ATV-FHE (NTRU based) scheme is invertible?

I want to implement the ATV-FHE scheme as described here https://eprint.iacr.org/2014/039.pdf. To generate the secret key polynomial I compute f = 2*u + 1 , with scheme parameters chosen such that ...
0
votes
0answers
18 views

Encrypted vs unencrypted digital signatures [duplicate]

Is there a difference in terms of security between An encrypted stream of bits obtained by encrypting a plaintext concatenated with it's signature $ C = E_k(plaintext||\sigma)$ where $E$ is a ...
2
votes
3answers
195 views

Hash email address with a non-random salt for moderate security?

Crypto noob here. I have an application that has only moderate security requirements (internal use, limited audience). I want to send a unique url with a token in it to each user. If anyone has the ...
2
votes
3answers
107 views

Three party coin flipping protocol with only 2 active participants

Is there a coin flipping protocol where: Alice, Bob and Carol don't trust each other, and The coin is flipped only by Alice and Bob, and The result must be trusted by all three participants.
1
vote
0answers
87 views

When would you use KP-ABE over CP-ABE?

When would you use KP-ABE over CP-ABE or vice versa? I started this question as I am having problems abstracting the pros and cons between KPABE and CPABE. This is not an assignment question. I have ...

15 30 50 per page