7
votes
2answers
457 views

Is FIPS 140-2's “Continuous random number generator test” practical?

Section 4.9.2 of FIPS PUB 140-2 specifies, amongst other things, a "Continuous random number generator test." Here are the relavant bits: If each call to a[n] RNG produces blocks of n bits ...
2
votes
3answers
106 views

Securing content and login with “same” password

I'm writing a client application that wants to store some secret information with a storage service. The client has to authenticate the user with the service and the service should not be able to ...
3
votes
2answers
2k views

How to perform file encryption using 128-Bit AES?

I am confused, how can I encrypt a file using 128 Bit Advanced Encryption Standard? Do I need only to encrypt the file name and it's content or is there something that I need to do to encrypt it? Is ...
0
votes
2answers
232 views

How secure would this code be against cryptanalysis?

Simple version: Create software that takes a database of the dictionary, alphabet, and phrases. Randomly generate a database of random strings of letters/numbers/symbols of varying length. Randomly ...
3
votes
1answer
92 views

How HOTP values are validated according to RFC 4226

In Section 7.2 "Validation of HOTP Values" of the HOTP spec (RFC 4226) it says, in part, The HOTP client (hardware or software token) increments its counter and then calculates the next HOTP ...
8
votes
2answers
256 views

Efficient Incremental Updates to Large Merkle Tree

I have a data set with 300 Million entries and every 5 minutes 4000 random entries in this table change. I need to calculate the merkle root on this data set to validate integrity multiple times ...
11
votes
2answers
838 views

Practical consequences of using functional encryption for software obfuscation

I came across this article, which describes a method, developed by UCLA CS professor Amit Sahai et al, for using functional encryption in order to achieve software obfuscation. The paper that the ...
1
vote
1answer
137 views

Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
111 views

salting with password hash to improve security?

Would something like the following improve security (against rainbow attacks, not brute force)? Assume that $P$ is a user-chosen password, and the objective is to obtain a hash $H$ for password ...
4
votes
1answer
164 views

Swapping Key and IV in AES? Safe?

I have an application where I want to be able to send an encrypted file, and then mete out "keys" that allow the receipient to decrypt the file from a certain point to the end of the file. Actually, ...
2
votes
2answers
120 views

Finite fields in elliptic curve

I have an elliptic curve defined over finite field where $S_1=aP$ . Is it valid to say that $S_1P$ can also be computed. $P$ is the generator of the group. What my real question is that. Should '$a$' ...
1
vote
1answer
182 views

Discrete log problem with modulus prime

I am a bit confused on the hardness of the discrete logarithm problem. Does it become intractale only when it is mod n, where n is a large composite number (Like RSA key). What about if it is mod a ...
6
votes
1answer
142 views

What is the difference between Shor's algorithm for factoring and Shor's algorithm for logarithm

There is a paper from Peter W. Shor from 1994: http://www.csee.wvu.edu/~xinl/library/papers/comp/shor_focs1994.pdf "Algorithms for Quantum Computation: Discrete Logarithms and Factoring", and I have a ...
4
votes
1answer
168 views

Why are there $ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
1
vote
1answer
110 views

Does it necessarily mean that an RSA moduli generated with poor randomness is not random?

In 2012 a group of researchers collected a large amount of RSA moduli and calculated their greatest common divisor in order to find common factors between them. By finding a common factor they could ...
3
votes
2answers
146 views

How to Compute C^2 in AES MixColumns Matrix?

In mix Columns we have: $$C(x) = \{03\}X^3 + \{01\}X^2 + \{01\}X^1 + \{02\}$$ In Viktor Fischer's Paper on MixColumn and ...
5
votes
1answer
226 views

AES-SIV security

I am invesigating the AES-SIV (rfc 5297) based block cipher. The construction of the S2V is lying on the AES-CMAC and dbl and XOR operation. Given a AAD the size of L and in the 128bit block ...
3
votes
1answer
89 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But ...
2
votes
0answers
155 views

How does identification currently work with the German identity card? [closed]

Since 18th of December 2010 Germany makes use of an identity card that should allow electronic authentication: (image source: commons.wikipedia.org) From a users perspective, the authentication ...
3
votes
2answers
234 views

Can I combine two PRNGs to make use of more seed data?

I have 320 bits of seed data (actually 512 bits of data with 320 bits of entropy, derived from a Diffie-Hellman shared secret and nonces). The PRNG I am using at the moment is the android version of ...
3
votes
1answer
182 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
1
vote
0answers
141 views

Can you help me clear a confusion about small subgroup attack on HMQV?

First,i want to show you with a picture how the HMQV works. There are some notations you might not familiar, it doesn't matter. I just want to show you the procedure. Next it's an attack on HMQV ...
3
votes
3answers
184 views

Construct a random permutation from a random function?

How can we construct a (pseudo) random permutation from a (pseudo) random function ? I've seen a method from Luby-Rackoff which allows to construct a PRP of length $2N$ from a PRF of input/output ...
0
votes
1answer
71 views

Different patterns of different paterns, wildcard [closed]

I'm not realy experienced with programming and such but I am wondering if the following could be implemented in, lets say, python we have the following ciphertext sequence ...
4
votes
1answer
234 views

Authenticated encryption mode for stream cipher?

E. g. block ciphers have GCM or OCB, that take single cryptographic primitive (block cipher) and provide both authentication and encryption. Are there similar constructs for stream ciphers, which ...
2
votes
2answers
136 views

Zero-knowledge proof using quadratic residue: why two options?

In the zero knowledge proof using QR, why do we even bother with the server sending us $b = 0$ back? As I understand it, the server selects $b = 0$ or $b = 1$. If $b = 0$, then the client (Alice) ...
2
votes
1answer
384 views

Converting Ed25519 public key to a Curve25519 public key

I understand that: $$x_{montgomery} = \frac{1 + y_{edwards}}{1 - y_{edwards}}$$ Using the libsodium ed25519 implementation, I have tried to write the following: ...
1
vote
1answer
90 views

Can we give access to controlled functionality in Fully homomorphic encryption schemes?

Homomorphic encryption schemes are PKE schemes with an additional special method Evaluate. Evaluate method takes input any function (as boolean circuit) and encrypted inputs of the function and ...
5
votes
2answers
193 views

Why does OAEP have 2 rounds with 2 random oracles?

I strive into understanding why OAEP has two rounds of computations and not just one. I.e: Wouldn't it be safe to hash the random number r and XOR it with the original message?What security risks if ...
3
votes
2answers
148 views

Quadratic residuosity problem reduction to integer factorization

How can one show how to reduce the quadratic residuosity problem to an integer factorization?
2
votes
0answers
74 views

Could BREACH be used to determine an HTTPS URL?

I was reading this article and had a question.... http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/ As I understand it TLS/SSL work in ...
6
votes
1answer
221 views

Finding where I am in a linear recurrence relation

Suppose I have a linear recurrence relation $$a(n) = c_1 a(n-1) + \dots + c_k a(n-k) + d,$$ where the constants $c_1,\dots,c_k,d$ are given and the initial values $a(0),\dots,a(k-1)$ are given as ...
4
votes
1answer
394 views

Practical uses of Manipulation Detection Code (MDC) and IGE

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of ...
1
vote
2answers
207 views

Derive a key from public data using a secret master key

Users in my system will be given a device that contains a 128-bit AES user key. The user key will be derived from 64 bits of public data related to the user, which is unique but very predictable (i.e. ...
6
votes
1answer
243 views

understanding forking lemma

Every time when I read a paper that has digital signature, when it comes to prove the security of a digital signature scheme, many chances that the author will use the forking lemma. The forking ...
3
votes
1answer
179 views

Clipper chip (SKIPJACK) key exchange protocol

According to the Wikipedia page for NSA (emphasis mine): However, NSA's Fortezza hardware-based encryption cards, created for the Clipper project, are still used within government, and NSA ...
1
vote
1answer
202 views

Question on monoalphabetic substitution

Question: A stream of cipher operates on a data stream of 6-bit characters using a simple mono-alphabetic substitution technique. Estimate and explain the number of different substitution ...
4
votes
2answers
190 views

CTR mode nonce with aggressive key rotation policy

I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce. Normally ...
3
votes
1answer
198 views

Explain the 'Breaking 104 bit WEP in less than 60 seconds' paper

Could you explain the 'Breaking 104 bit WEP in less than 60 seconds' paper, without skipping too much technical details. Could you an answer questions, like: how is '1.24/256' a significant ...
4
votes
1answer
533 views

Why elgamal is still discussed

As I understand, if two users have a shared key, it is possible to encrypt a message using symmetric key encryption. So when a secret key is shared through Diffie-Hellman asymmetric key exchange, it ...
7
votes
2answers
414 views

What is the purpose of using different hash functions for the leaves and internals of a hash tree?

I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the ...
14
votes
4answers
804 views

Is Wiener's attack on RSA extendable to larger keys with low hamming weight?

Using small private exponents with RSA improves performance. However, it has been shown (Wiener, 1990) that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the ...
2
votes
1answer
296 views

Digital Signature size requirement

What is an approximate length for a digital signature (SHA) given the following? Using RFID tags, size ranging from 100 to 2000 bytes (8000 bits), our project is setting aside a portion for a digital ...
2
votes
0answers
119 views

Security of a 3-party key exchange protocol

I am trying to find attacks on a theoretical protocol or prove its security. An initiator wants to establish a shared key with a responder with help of a trusted server. We have the following roles: ...
4
votes
1answer
213 views

Why is feed-forward mechanism used in hash functions?

The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ...
5
votes
1answer
175 views

Why use variable p, q, g for Diffie-Hellman?

In the book Cryptographic Engineering, it is said that fixing p, q, g for a key negotiation protocol based on DH is a bad idea (page 228 1st ed). But allowing for flexible p, q and g requires a lot ...
1
vote
2answers
78 views

Lamport-Diffie + attempting to invert OWF

I am studying Lamport-Diffie signature scheme and in my lecture present the follow algorithm for attempting to invert the one way function $f$, where $f$ is used to compute the public key of this ...
6
votes
1answer
208 views

Did Merkle invent cryptographic hashing?

Chapter II of Merkle's 1979 PhD thesis is titled "One Way Hash Functions." The chapter appears to be the first reference to cryptographic hashing. The chapter has no references. Is there an earlier ...
1
vote
0answers
87 views

Merkle path authentication

In point 4 of the Algorithm 4.2 (Classic Merkle Tree Traversal) of *"Post_Quantum_Cryptography.pdf"* shows *"Stack_h.update(2)"* each stack receives two updates. I am trying understand to understand ...
2
votes
1answer
236 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key ...

15 30 50 per page