1
vote
1answer
62 views

Why does a hacker need to crack the key to an encrypted file, instead of just brute forcing the password? [closed]

Most encryption softwares don't seem to have a trial limit. So why would a hacker need to crack the key, or even need to know the salt value, if he can just brute force the 6-8 digit password?
5
votes
1answer
43 views

Terminology for secret sharing

To my understanding, there are two "approaches" to t out of n threshold encryption. In both of them, n shares are given to different shareholders, and at least t of them must agree to "proceed". "...
2
votes
1answer
78 views

Can gnupg master key decrypt something encrypted with subkey?

When creating gpg subkeys, the master key signs and certifies that a subkey belongs to that master. That's ok, but, can master key decrypt something encrypted by a subkey? I guess no, but I want to be ...
0
votes
0answers
30 views

gnupg master key with certificate and authentication capabilities

After researching about GPG and Smartcards I came to a dilemma. The usual setup I've seen more widely is a master key (with SC capabilities) and 3 subkeys (with S, E, A each): ...
1
vote
1answer
70 views

How to calculate secret key size of a CP-ABE scheme

How can I calculate the real size of key in a CP-ABE scheme. For example, I have this GSWV scheme: Fuchun Guo, Willy Susilo, Duncan Wong, Vijay Varadharajan: CP-ABE with constant-size keys for ...
3
votes
2answers
127 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
0
votes
1answer
19 views

What will browser show when a user access website and website present certificate of some other domain with same top level domain [closed]

For example, User tries to access a.example.com and server presents abc.example.com with a.example.com not in SANs list. Will it be just a warning or an error?
0
votes
1answer
50 views

Usage of 3DES for single block

I have a device, HASP, which has functionality to encrypt 8 byte data using 3DES in ECB mode, with three different keys, I am interested how secure is this? I know it might not be most secure, but how ...
3
votes
1answer
275 views

Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
1
vote
1answer
46 views

Attacks on MICKEY 2.0 Stream Cipher

I would like to know if there are any known attacks, besides from side-channel attacks (differential fault attack, correlation power analysis, template attack), against MICKEY 2.0 or MICKEY-128 2.0. ...
2
votes
2answers
367 views

Many consecutive hashes to slow down brute force attack?

I've heard that hash algorithms like bcrypt are more secure because they take longer to complete, and therefore take much longer to brute force, without a ...
5
votes
1answer
143 views

Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve

During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice ...
4
votes
3answers
116 views

Choosing which is public vs private key

When I calculate two RSA keys, what if anything, would make any difference which I call the public vs which I call the private key?
1
vote
1answer
256 views

How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication (...
3
votes
2answers
251 views

Why are recomended RSA key lengths so high? [duplicate]

I was checking for authoritative sources to back up my recommendation of a minimum RSA key length of 1024 and was shocked to find that NIST 800-56Br1 and FIPS 186-4 both recommend at least 2048 bits ...
5
votes
1answer
96 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
10
votes
2answers
937 views

How does hash speed vary based on string length?

Surprisingly I have not been able to find an answer to this question on Google. If I have a function that is based on any of the popular hashing algorithms used for password generation, by what ...
2
votes
2answers
88 views

Semantic Security and Equal Message Length in the Context of Public Key Cryptography

A lot of definitions for semantic security make use an experiment $\text{Exp}$ which is performed between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ that begins as follows: $\mathcal{C}...
0
votes
1answer
81 views

Is it ok to store the plaintext hash of encrypted data

Is it ok to create and store the hash (unkeyed hash function) of a plaintext before encryption or does it lead to vulnerabilities? If it is ok are there requirements for the used hash function and ...
1
vote
1answer
25 views

How is the usual way of using PKCS5/7 when a weird data is given?

PKCS5/7 pads the remaining data elements with a binary representation of how many space requires padding. This is useful and compact but what should I do in the following sample scenario below ? ...
2
votes
4answers
191 views

Are there transitive ciphers (either symmetric and asymmetric)

Say Alice has information that's already encrypted with Bob's key. She wants Bob to decrypt it without knowing what he just decrypted. So she encrypts it with her key and sends it to him, he decrypts ...
1
vote
0answers
45 views

Can anyone tell whether this RHO step of SHA3 is correct?

In rho step of SHA3, I have done right circular rotation whether its correct ?? I am doing in Verilog so I am using concatenation operator for rotation. For x=0 and y=1 that is A[0][1] rotation will ...
0
votes
1answer
94 views

Can anyone breifly explain the 'theta step' of compression box in SHA3?

Can you tell me the 'theta' step of compression box. D[X] = C[X-1] ^ ROT(C[X+1, 1]) In this step all the indices should be taken modulo 5. ...
1
vote
0answers
36 views

Why was AES limited by NIST to a 128-bit block size, although Rijndael could support more? [duplicate]

Rijndael could support block sizes up to 256 bits; this seems to be useful in AEAD. Wht did NIST restrict AES to a 128-bit block size?
2
votes
1answer
2k views

Simulation-based security?

I've been reading Introduction to Modern Cryptography by Katz and Lindell as an introduction to cryptography. The book seems to use the term 'simulator' when it talks about a game like, for instance, ...
0
votes
0answers
56 views

Importance of timing attack resistance with AES

I've implemented AES in my library with several variations: a straight C version, a version using x86 SSSE3, and a version using x86 AES-NI. The SSSE3 and AES-NI implementations are constant-time, ...
0
votes
1answer
32 views

One Step Decryption For Multiple Chained Encryptions

If we have a encrypting function f(x, y) (x for input, y for key) and let's say we composite this function n times inside itself with the same y (like f(f(f(x, y), y), y)) and set the output to be z. ...
0
votes
0answers
18 views

Length Extension Attack on SHA1 [duplicate]

I am trying to understand how to perform a length extension attack on a SHA1 hash function that is used as a MAC (where the key is prepended to the hash output). If I am given the message, ...
4
votes
2answers
150 views

What's the issue with Apple's backdoor?

I was reading Apple's public letter here regarding the "backdoor" that they have been asked to create. I'm very unclear exactly what the issue is. There was no backdoor in the encryption algorithm ...
3
votes
1answer
84 views

Question about HMAC with SHA1

I would like to make sure I understood HMAC. Wikipedia declares it like: $$\operatorname{HMAC}(K,m)=H((K\oplus\text{opad})||H((K\oplus\text{ipad})||m))$$ If I want to use HMAC-SHA1, am I correct to ...
3
votes
1answer
117 views

How to encrypt a symmetric key with a shared secret?

I am reading this article (pdf) on the Diffie–Hellman key exchange. It states the following: At this point, the Diffie-Hellman operation could be considered complete. The shared secret is, after ...
2
votes
1answer
82 views

Construction of division polynomials

I'm trying to understand the construction of the division polynomials used in Schoof's algorithm. I firstly followed this report of Charlap and Robbins. I stuck with the definition of the leading ...
1
vote
0answers
27 views

Is it possible to encrypt a message with two different keys (or maybe a public key) such that ciphertext will be decrypted with either of the keys? [duplicate]

I have an app that I store sensitive user data which requires user to set a password to login the app and I use this password as key to encrypt the data. Now, I want to add an option to login the app ...
1
vote
0answers
44 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
0
votes
0answers
54 views

How to measure performance for ABE Schemes

I have these 3 Schemes: 1) J. Bethencourt, A. Sahai, and B. Waters, "Ciphertext-policy attribute-based encryption" 2) F. Guo, Y. Mu, W. Susilo, D. Wong, and V. Varadharajan, "Cp-abe with constant-...
2
votes
1answer
70 views

Understanding Diffie-Hellman - Choosing a bad g

I am taking a class on Cryptology, and I'm having a hard time understanding the potential pitfalls of Diffie-Hellman. Specifically, the professor gave the following problem: Alice and Bob want to ...
0
votes
0answers
38 views

To understand Feistel permutations in md5

Recently I am trying to understand the md5 algorithm.In this algorithm 4 Feistel permutations FF,GG,HH and KK are used.I have faced a problem to understand the FF. The FF is defined as $FF(A,B,C,D|m_j,...
1
vote
2answers
32 views

Unclear about the importance of Initialization Vectors

I was reading about Ruby ciphers and found this: Although the key is generally a random value, too, it is a bad choice as an IV. There are elaborate ways how an attacker can take advantage of ...
11
votes
2answers
295 views

Are there any real protocols secure in the random oracle model that have been broken in practice?

Has any protocol ever been proven secure in the random oracle model and then broken in practice, despite the use of a good hash function in the actual implementation?
0
votes
1answer
41 views

Is there any place where I can find test vectors for point addition and doubling of ECC?

I want to extensively test my implementation of point addition and doubling. I have only one test vector with me. I need more values to test. In the web, I could find test vectors only for key pair ...
2
votes
0answers
25 views

Are there unreachable MD5 hashes? [duplicate]

Are there any known MD5 hashes that can´t occure, no matter what (finite) input is taken? Thanks
2
votes
0answers
43 views

Can a secure MAC break if the adversary is given oracle access to Verify?

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
5
votes
0answers
146 views

Is F5 still a viable steganography algorithm? [closed]

I am currently developing a steganography application and have been studying the F5 algorithm by Westfeld. I keep on seeing from various literature and open source projects (e.g. from GitHub) that it ...
0
votes
1answer
56 views

How to encode a message to MD5?

I have faced a problem to understand MD5 algorithm.My question is weather the original input message is converted to binary value in MD5 before using the input message as parameter in four Feistel ...
4
votes
3answers
367 views

Homomorphism and Zero Knowledge in FIPS 140-2 compliant systems

I am analyzing a system that needs to be at least level 3 FIPS 140-2 compliant. The system may leverage from homomorphic and Zero Knowledge constructs, but, as far as I can see, the algorithms ...
-1
votes
2answers
86 views

How do they implement MAC in TLS?

I recently read questions about "MAC then Encrypt/Encrypt then MAC" which made me curious about how they actually use the algorithm. MAC only calculated once either case (according to what I read). ...
4
votes
0answers
63 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
3
votes
1answer
109 views

Question on 3DES keys

The official NIST publication I saw says for federal applications 3DES with three keys should be used. I have such questions: what does it mean federal? Does it mean for industrial applications that ...
1
vote
1answer
90 views

Finding collisions in SHA1

I am trying to find two collisions in SHA1 for the 50 least significant bits. I was wondering if there was a way to efficiently do this without having to brute force all of the possible hash outputs? ...
3
votes
0answers
21 views

Would using a symmetric list of subkeys in a Feistel cipher make our messages vulnerable to oracle attacks?

Suppose I have a Feistel cipher structure that has $16$ rounds. I come up with $8$ subkeys $k_1,k_2,...,k_8$ to be used for the first $8$ rounds and then assign the rest of the keys so that $k_9=k_8,...

15 30 50 per page