13
votes
2answers
244 views

How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
1
vote
2answers
199 views

Certificate Signature Algorithm differs from Signature Algorithm Negotiated for Connection

With the upcoming sunsetting of SHA-1 by browsers I was checking signature algorithms for sites I visit. I'm using Firefox 43.0.2 on Windows. I noticed something interesting when I visited the site ...
1
vote
2answers
43 views

How to check the integrity of a key received through mail using symmetric encryption?

I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To ...
2
votes
1answer
389 views

Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?

I am looking at the Koblitz method for encoding a message as an elliptic curve point. The first step given in the paper I'm reading is: "Choose an elliptic curve and its associated auxiliary base ...
4
votes
1answer
260 views

Solving Vignere Encryption

I'm currently trying to crack a cypher that I believe is Vignere Encrypted and I'm currently stuck. I calculated the key length by finding repeated sequences in the cypher and calculating the the ...
7
votes
1answer
507 views

OpenPGP Signature Packet hashed data

RFC 4880 describes the version 4 signature packet, tag 2, as ...
4
votes
1answer
89 views

If the hash of the multiplication is equal to the multiplication of the hash, how can this be used to leverage an attack?

Assume a hash function $H:\left\{0,1\right\}^*\to G$ where $G$ is a group and assume that finding an inverse in $G$ is easy. How can a preimage efficiently be found using the fact that $H(M_1\cdot ...
3
votes
2answers
102 views

How to find 64 collisions for a hash value?

The first block $M_0$ is one of 64 possible values, whereas the next six blocks $M_1...M_6$ are chosen randomly. The idea is to publish the SHA-1 hash of $M_0...M_6$, wait for the value of $M_0$ to be ...
3
votes
1answer
46 views

SHA256 message bytes

I have been reviewing the documentation for SHA256 and I believe the last two words (64 bits) for each chunk are not used in creating the message schedule. From Wikipedia... Extend the first 16 ...
9
votes
2answers
261 views

Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?

In Diffie-Hellman key agreement between Alice and Bob, Alice computes and sends $g^a$ to Bob, and Bob computes and sends $g^b$ to Alice. Alice then computes $(g^b)^a$, and Bob computes $(g^a)^b$; ...
6
votes
1answer
282 views

What size should the HMAC key be with SHA-256?

I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters. What is the ironclad rule ...
1
vote
1answer
116 views

Which is better? Serialize and then encrypt or Encrypt and then Serialize

Let say in a simple Java program, Considering all the facts, like security and performance, Which is the best way to follow. I tried searching for a answer but proper answer is not out there.
2
votes
2answers
81 views

How do I classify my RSA encryption strength?

So I generated 2 1024 bit prime numbers, I generated N and got a 2048 bit number, does that make my encryption 2048 bit or 1024 bit?
3
votes
1answer
258 views

Which gives better deterministic encryption SIV or Plain ECB mode?

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ? AES-ECB($key$ , $msg$) SIV($key$, NIL , ...
15
votes
2answers
1k views

AES - What is the advantage of a 256-bit key with a 128-bit block cipher? [duplicate]

I'm just trying to wrap my mind around the decision to select the 128-bit Rijndael as the AES cipher, even with 192-bit and 256-bit keys. Even with a 256-bit key, you only get 2^128 possible outputs ...
42
votes
7answers
49k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better? Edit: This question was asked long back when I was ...
7
votes
2answers
98 views

ElGamal in a different group

Can Elgamal be secure in $\bmod {n^2}$? Meaning instead of using a prime order group to use a group where DCR assumption holds?
5
votes
2answers
163 views

AES Inverse Key Schedule

I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already ...
1
vote
1answer
83 views

Are those two distributions indistinguishable?

The Decision composite residuosity problem problem states that is impossible to distinguish between those two ensembles: $\{x^N \mod {N^2} | x \in \mathbb{Z^*_{N{^2}}}\}$ and $\{r \in ...
2
votes
1answer
131 views

Guessing the IV for CBC

If I have the key, the ciphertext under AES-CBC and the plaintext, then how can I guess the initialisation vector?
1
vote
1answer
82 views

What libraries do people use to implement and evaluate cryptography protocols?

I want to implement this credential system: “Anonymous Credentials Light” (PDF). The implementation would involve some zero-knowledge proof and some exponentiation. For some basic group computations ...
5
votes
1answer
61 views

Symmetric encryption algorithms with large IVs and authentication?

Most modern symmetric ciphers require a nonce/IV. If the nonce is reused, security is lost. If the nonce is large enough, it can be generated securely by using a CSPRNG. This avoids needing to keep ...
5
votes
1answer
1k views

How do RSA and ECDSA differ in signing performance?

Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security. What about the processing time to generate a signature ? I've seen figures giving ...
1
vote
1answer
40 views
1
vote
1answer
65 views

setting the MGF hash to a different value other than the regular hash with openssl for PSS signatures

In PKCS1's Probabilistic Signature Mode you have the Hash and the MGF Hash. Both appear to be, by default, sha1, with the OpenSSL CLI client, however, I can change it to sha256 with the following: ...
2
votes
1answer
136 views

Theoretical decryption of RSA

I am currently looking into RSA and have some questions. I am interested in theoretical answers, assuming there is infinite time for decryption. Is it necessary to work out the private-key exponent ...
0
votes
0answers
18 views

HMQV and MQV group representation attack

Currently reading Krawczyk's HMQV paper https://eprint.iacr.org/2005/176 and trying to follow what he says about the group respetnation attack on MQV: It says that for any group of prime order $q$, ...
1
vote
1answer
65 views

PBEWithMD5AndDES Cipher does not check for integrity first?

I am running FindBugs with findsecbugs plugin to scan java code for security issues. I am getting "Cipher With No Integrity" error for a Cipher function implemented with "PBEWithMD5AndDES". The legend ...
7
votes
1answer
2k views

What is it meant by a “hybrid argument”?

Can anyone explain (or point to a reference for) what a hybrid argument is in a security proof, and when it's convenient or preferable to use it? Among some of the places where I've seen it ...
3
votes
2answers
132 views

Why is Paillier Cryptosystem called probabilistic?

The definition of Paillier Cryptosystem says that it is a probabilistic asymmetric key algorithm for public key cryptography. Can some body explain why it is called "probabilistic"?
3
votes
1answer
65 views

Is that simple additive homomorphic scheme secure?

I am doing a little cryptography research and stuck with question. Suppose $\bar m$ is a vector of 64-bit numbers. And i want to have an additive homomorphic encryption over them. I choose large ...
6
votes
1answer
221 views

Secure, patent-free alternative to NTRU

I'm working on a P2P communications and chat framework, and am looking for a quantum-secure asymmetric key exchange algorithm which I can use to perform a key exchange of an AES-256 bit key. This is ...
3
votes
0answers
58 views

High-level overview of system architecture of LUKS/cryptsetup (how it works vs. how to setup) [closed]

I've been searching (unsuccessfully) online for a high-level overview of how LUKS/cryptsetup disk encryption works. I am reading through the cryptsetup source code to try to understand what is going ...
22
votes
1answer
8k views

Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?

I'm wondering why we use encrypt-decrypt-encrypt (EDE) sequence in 3DES (also known as DES-EDE, TDES or TDEA) with three keys instead of three times encryption (EEE) with three different keys?
3
votes
1answer
118 views

More rounds after AES related key attack?

In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
4
votes
1answer
81 views

Diffie-Hellman: *assumed* largest prime factor of order of $g$?

I've read in several places: some of my confusions about DDH assumption - comment by Thomas Pornin on his own post Is there a key length definition for DH or DHE? - the answer by Tom Leek that ...
3
votes
1answer
899 views

Feistel cipher vs Substitution-permutation network - number of rounds

So I have been doing for the last couple of days comparison between Feistel cipher and Substitution-permutation network. Now I can say I know a lot about them and their similarities and differences ...
6
votes
3answers
118 views

Homomorphic OR operations

Is there an encryption scheme that provides efficient homomorphic OR operations at the ciphertext space? Of course any fully homomorphic encryption can be used but I do not require or want additional ...
3
votes
2answers
118 views

Is this a correct way of use symmetric encryption?

If I want to encrypt some block of text in AES, but at the time of decryption I don't have a way to check if the symmetric key is the correct one. So I: Generate a randomKey, and use that to encrypt ...
4
votes
4answers
581 views

Are specially designed fonts sometimes used in cryptography?

As a font designer, I was thinking that it would be very easy to design a special font that could either jumble characters of a language (or of a code) or simply (with the features offered by the OTF ...
3
votes
2answers
61 views

Re-sending captured encrypted data

Let’s assume Bob is some algorithmic stock trading machine. Bob takes commands from Alice, who sends messages to Bob. For example: Alice could be sending a message to Bob to stop trading. But if ...
2
votes
1answer
153 views

Do any (non-hardware) RNGs exist which could be used to create an OTP for crypto purposes?

I've stumbled (jobwise) over a system where small messages (512 Bytes or less) are encrypted and decrypted using a simple XOR using a OTP. That OTP is created using a seed based on the individual user ...
2
votes
1answer
2k views

Does IKEv2 protocol have two modes like IKE

IKE Protocol have 2 modes, that modes have different structure. Does IKEv2 protocol have two modes like IKE.
1
vote
1answer
51 views

Can the original message be retrieved from a public/private key signature?

When I sign a message (which has potentialy low entropy) using a private key and I send it without the original message, can the original message be retrieved from the signature(s)? I want to prove – ...
2
votes
1answer
67 views

Data Encryption Standard (DES) S-Boxes

I read that the S-boxes introduce the much needed nonlinear behavior to DES. Can someone give me a lay mans explanation of why the effect of the S-boxes is said to be non-linear?
5
votes
1answer
235 views

Zero-Knowledge Proof of a polynomial

I have two secret values $L_1$, $L_2$, and two Pedersen commitments $C_1 = C(L_1)$, $C_2=C(L_2)$. The commitments $C_1$, $C_2$ are public. Given a challenge $c$, I want to output $d = c*L_1+L_2$ and ...
4
votes
1answer
100 views

How to compare the efficiency of public key cryptosystems, i.e., RSA vs El Gamal?

As part of my Mathematics degree I'm taking a Discrete Mathematics module which partially covers Public Key Cryptography but does not at all enter it in depth. I'm currently working on a project that ...
6
votes
1answer
91 views

What are the relative merits of padding algorithms pkcs7, iso7816, and x923?

I am assuming none of these padding algorithms are "the best"... But what are the advantages and disadvantages of using them? PKCS7 is certainly the most commonly used one, but I am interested in ...
0
votes
2answers
257 views

Lightweight Asymmetric encryption algorithm

I'm an embedded systems researcher, and new in the crypto field. Actually, I need to know if there are any lightweight asymmetric encryption algorithm especially considering the time needed for key ...
6
votes
2answers
175 views

Hardware Random Numbers - How to convert Voltage signal into binary?

I have a physical unit, e.g. a resistor. I bias it with current and measure the voltage. Let us assume that the fluctuations ($\Delta V=V-<V>$) of this voltage signal are random. Now, $\Delta V$ ...

15 30 50 per page