2
votes
1answer
562 views

Meet-in-the-middle with checking complexity

In regards to meet in the middle type attacks, I have been considering the amount of operations in order to successfully find a key given two sets of plaintext / ciphertext pairs. All of the sources I ...
1
vote
1answer
65 views

PKCS#11: Can C_GetMechanismInfo() return CKR_OK on a disabled mechanism?

According to PKCS#11 v2.20, "C_GetMechanismInfo obtains information about a particular mechanism possibly supported by a token." Does that mean ...
1
vote
0answers
253 views

RSA Attack with some known values

There is an RSA implementation which I need to attack to get the encrypted messages. Some of the values are known. Plain text value for input. So if I enter a message, say it "A", the plain text is ...
3
votes
2answers
226 views

How to hash a list of multiple items?

In some protocols, a key is derived from a hash of many parameters (K=H(param1,param2,param3)) Is there a hash function that takes many parameters as input ? Or we can simply use a function like ...
5
votes
1answer
208 views

How can I take advantage of repeated patterns in non random RSA prime factors?

I am researching vulnerable RSA moduli which are composed of primes generated with poor entropy. Having a list of these primes I searched for variable sized repeated patterns among them and I noticed ...
0
votes
1answer
163 views

The security of an encrypt and MAC

I would like to know what is the security of an encrypt and MAC with different keys for each transaction For example: the one time pad with k1 and the HMAC with k2 ...
1
vote
0answers
69 views

LogSpace Merkle Traversal

I am studying LogSpace Merkle Tree Traversal algorithm in "Post Quantum Cryptography". I don't understand the Table 1 on page 58. My question is: Why within of the $2^h$ rounds for $NEED_h$ exist ...
2
votes
1answer
114 views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
1
vote
2answers
341 views

Using IV buffer after altered inside a Rijndael CBC Encryption/Decryption process as IV for next message?

When sending a block to be decrypted or encrypted, with RijndaelCBC, we input the data to decrypt/encrypt and an IV for syncing and to prevent identical outputs for identical inputs. This question is ...
2
votes
1answer
158 views

Proof of correctness of a homomorphic ElGamal sum

Let's suppose we are using the exponential ElGamal as a public-key encryption scheme, so that we encrypt $g^m$ instead of $m$, for some generator $g$. Let $x$ be the private key, and $h=g^x$ be the ...
8
votes
3answers
237 views

AES CTR with similar IVs and same key

Lets say there is a piece of software that uses AES CTR to encrypt different messages using the same key but with slightly different IVs So for example, a 16 byte IV, the 2nd 8 bytes are always the ...
3
votes
1answer
135 views

Hamming Distance vs. Index of Coincidence

When analyzing a repeating-key xor cipher to find the key length, I've read about two key methods (assuming there aren't just repeating chunks of ciphertext for Kasiski's method), for some assumed key ...
2
votes
1answer
397 views

HMAC-SHA1 input size

I know that the HMAC is a message authentication code that uses a cryptographic key in conjunction with a hash function (SHA1 , MD5, etc.). The HMAC output is 160 bits for HMAC-SHA160 and 256 bits for ...
3
votes
2answers
150 views

Can you really insert the text you want in one-time pad?

The Wikipedia article "One-time pad ~ Authentication" says : For example, an attacker who knows that the message contains "meet jane and me tomorrow at three thirty pm" at a particular point can ...
6
votes
2answers
184 views

Multiple iterations of AES for key derivation?

The keepass password manager uses multiple rounds of AES for its key derivation, as described here. I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common. ...
3
votes
2answers
258 views

Finite fields and ECC

I understand modular arithmetic(or at least I think I do!) and I've tried to read and learn about how the Math in RSA works(and I think it went pretty well). I've been reading up on ECC and it looks ...
3
votes
1answer
172 views

How secure is this use of Ziv-Lempel encoding?

I'm reading patent application US 20120278897 A1 — “System and method of sort-order preserving tokenization”. Near the bottom they describe their token generation algorithm, which basically involves ...
1
vote
0answers
38 views

How does a cracker know if they've broken AES-CBC encryption? [duplicate]

How does a cracker know if they've broken CBC or stream encryption? With hashe cracking one would know because you have the password that you started with to test. But for CBC decryption, you have a ...
7
votes
1answer
243 views

Is there a cryptographic function or system in which it becomes HARDER to break as time passes?

Is there a function or system which is time depending in which the effort required to brute force the decryption increases with time? It is easy to break encryption from many years ago because ...
8
votes
1answer
475 views

Why restricting SHA3 to have only two possible capacities?

I just read the presentation slides of John M. Kesley (from NIST) for his invited talk at CHES 2013 about SHA-3 and learned that NIST is going to standardize Keccak with a possibly modified padding ...
8
votes
1answer
1k views

Diffie-Hellman: choosing wrong generator “g” parameter and its implications of practical attacks

In traditional DH one chooses two shared parameters: a large prime "p" and base "g", which is primitive root mod "p". Suppose generation algorithm is broken and "g" generates only a subgroup (group ...
2
votes
1answer
130 views

RC4 system pitfalls

A system fell into my neck, where lots of files are splitted into several segments and encoded via RC4. RC4, because client side - slow computer, slow flash arithmetic ops - can only decode big blobs ...
5
votes
1answer
110 views

Authentication protocols for authenticating devices to a server

The requirement is to authenticate 1000s of devices to a server when the devices try to contact the server. The problem I face is that all authentication protocols require some kind of shared secret ...
4
votes
1answer
166 views

Why no swapping block in the last round of DES?

Round 16 on the encryption side, and round 16 on the decryption side of DES have no swapping module. Why is it like this? Can anyone provide any justification? This is my homework question.
8
votes
3answers
306 views

Should I delete cryptographic data from memory?

When dealing with cryptographic data, is there a chance that attacker recovers portion of data I used in my program? Should I try to delete every bit of keys and encrypted data that I used, overwrite ...
5
votes
3answers
386 views

Perfect zero knowledge for the Schnorr protocol?

Can somebody explain (or point to a reference) why the Schnorr protocol cannot be proved zero knowledge?
2
votes
1answer
101 views

Do any (non-hardware) RNGs exist which could be used to create an OTP for crypto purposes?

I've stumbled (jobwise) over a system where small messages (512 Bytes or less) are encrypted and decrypted using a simple XOR using a OTP. That OTP is created using a seed based on the individual user ...
9
votes
1answer
2k views

ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
5
votes
1answer
237 views

KDF and number of iterations for GPG

I gather, from reading the GPG manual, that symmetric encryption based on a password uses one of a variety of Key Derivation Functions (KDF). Although not explicitly mentioned I assume that PBKDF2 is ...
1
vote
3answers
470 views

Lagrange Interpolation for finite field GF(2^8), for Secret Reconstruction

I'm using Lagrange's Interpolation technique to reconstruct the secret from a set of point pairs (x,y). Since I only need the secret, not the whole polynomial, I have simplified the reconstruction ...
2
votes
1answer
201 views

random number generator and seed

I'm working with openssl cryptographic libraries, I'm new to all these cryptographic stuffs and slowly I'm learning all these. I have a doubt regarding random number generator, I'm using ...
1
vote
1answer
111 views

The “Square Root” Solution of Oblivious RAM Simulation

I am reading the paper Software Protection and Simulation on Oblivious RAMs by Oded Goldreich and Rafail Ostrovsky. And I wonder about the description of the "Square Root" solution of oblivious RAM ...
4
votes
1answer
1k views

Multiplication/Division in Galois Field (2^8)

I'm attempting to implement multiplication and division in $GF(2^8)$ using log and exponential tables. I'm using the exponent of 3 as my generator, using instructions from here. However I'm having ...
9
votes
1answer
203 views

What is the origin of the word “Keccak”?

Where does the word or acronym Keccak come from? Guido Bertoni, Joan Daemen, Michael Peeters, and Gilles Van Assche. Keccak sponge function family main document. Submission to NIST (updated), 2009. ...
2
votes
3answers
310 views

Implementing a one-time pad without binary?

This is a program that I found which takes a purely alphabetical message, converts the letters to their ASCII values and combines them with the ASCII values of an alphabetical key (wrapping around ...
3
votes
1answer
215 views

Generating an IV for ESP 3DES-CBC

I have an application written in C, running in Linux. It uses IPsec (ESP) (manually putting the IPSec packet together) to send certain packets. The algorithm used ...
7
votes
6answers
335 views

Do ciphertexts leak information about their algorithmic creators?

If an adversary holds thousands of encrypted files that were encrypted with the same cipher, can he determine which cipher method had been used on the files? Assume that the adversary has no prior ...
-1
votes
1answer
71 views

Is size Q equal to size SHA(Q)? [closed]

Assume d is a 128 bit random integer and P is base point of an elliptic curve and Q = dP is a point on the elliptic curve and SHA is a hash function with 128 bit output, my question is: Is size Q ...
8
votes
4answers
258 views

Is there a public key encryption scheme with optimal key size?

Symmetric encryption schemes such as AES have known security levels equal to their key sizes (i.e. breaking an encryption with an $n$ bit key needs about $2^n$ work steps). Elliptic curve encryption ...
1
vote
2answers
311 views

Quadratic residue problem on composite integers

Its believed that the quadratic residue modulo $n=p·q$ for large primes $p$ and $q$ is intractable, which forms the basis of some cryptosystems. However, it is solvable if the factors of $n$ are ...
4
votes
1answer
179 views

hardware and software optimizations for Salsa20

I'm using the Crypto++ implementation of Salsa20 for a software project we are working on and I'd like to know if there are any SSE or software optimizations that will increase the speed of the CSPNG? ...
3
votes
2answers
210 views

Is it possible that two distinct RSA moduli share both of their prime factors?

I am using an algorithm (can be found here1) that can compute efficiently the GCD of multiple RSA keys. It intended for RSA keys that were generated with low entropy and may have one of their primes ...
7
votes
2answers
227 views

Why have hashes when you have MACs?

It would seem to a naive eye that if you have a MAC, you have a hash function: use a key that all the parties know (such as all-bits-zero). A potential application would be a resource-constrained ...
1
vote
1answer
155 views

Does CBC encryption of a hash provide authenticity?

Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other ...
1
vote
0answers
349 views

Keepass Twofish plugin security

Keepass is a well known open-source password manager program, with plugin support. One of the offered plugin is a twofish encryption mode of operation in lieu of the build-in AES algorithm ...
5
votes
1answer
267 views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
1
vote
1answer
110 views

Three-way key exchange with elliptic curves without pairing

Assume that there are three users, each with their own secret key $d_i$ and the corresponding public key $Q_i = d_i \cdot P$, such that $Q_i$ is a point on an elliptic curve and $P$ is a base point on ...
-2
votes
1answer
103 views

what is pairing in cryptography? [closed]

Let $G_1, G_2$ be additive groups and $G_T$ a multiplicative group, all of prime order $p$. Let $P $ in $G_1, Q $ in $G_2$ be generators of $G_1$ and $G_2$ respectively. A pairing is a map: $e:( ...
5
votes
1answer
200 views

What does ''latency'' really mean when a block cipher is partially unrolled?

Typically,I think latency should mean the time from the first plaintext input to the first ciphertext output, when the block cipher is not totally unrolled (such as AES unrolled with 2 rounds). If I ...
-1
votes
1answer
69 views

The specification of modern, non-communicating cipher machinery [closed]

I'm looking for references, papers or guidance on a class of system which I have not seen widely discussed. Consider powerful electronic machinery which remains in the custody of communicating ...

15 30 50 per page