0
votes
0answers
44 views

Factorization of a number obtained by a modular multiplication operation can reveal factors of the used operands?

Consider a number $r$ obtained by: $r=a \cdot b \mod n$ Can knowing the factorization of $r$ reveal some information (bits) of $a$ and $b$ ?
0
votes
1answer
42 views

Break El-Gamal Algorithm by knowing the value of the random k

In El-Gamal Algorithm, the public key is $(p, g, A)$, and the secret key is $(a)$, in order to encrypt some data, the sender generate a random $k$, where: $(C_1, C_2) = (m.A^{k} \pmod{p}, g^{k} ...
4
votes
1answer
106 views

Hard-core predicates: should the adversary be given $1^n$?

In most (all?) classical sources such as the book of Goldreich (2001), hard-core predicated are defined thus: A polynomial-time computable predicate $b : \{0,1\}^* \to \{0,1\}$ is a hard-core of a ...
2
votes
1answer
138 views

Hash length extension attack - SHA256 to 512 - impossible, correct?

Just want to be sure about something before I sign off on a method we're about to put into place. We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the ...
7
votes
1answer
208 views

Logjam: “composite order subgroups” explained for TLS developers and system admins?

I have read the recent logjam paper Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice. On page 11 in the Recommendations section, they state: ...
1
vote
1answer
342 views

The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the ...
0
votes
0answers
161 views

Finding Patterns in Encrypted Data

I am looking for an application (Windows) or code example that might help me find patterns in an encrypted file. I have a ciphertext for which I want to see when a key is repeated. I am not trying ...
1
vote
1answer
70 views

one-way deterministic hash for low entropy input?

My problem is the following: we have a low entropy data called ID. (personal id number of 10 decimal digits plus a sum, and it contains a date) We want to create a data (H) which is the same for the ...
1
vote
1answer
66 views

Decryption of Huffman code

I know that Huffman is not a encryption method, but I have a bit-stream that I know it's Huffman coded. However, the tree/table that maps the codes to real characters is not available. Surprisingly, ...
0
votes
0answers
47 views

prepaid meters that rely on a disconnected system

i have some experience with cryptography in the banking sectors, mostly in block ciphers like DES 3DES etc. im interested in prepaid electricity meters as it is a number that is generated from a ...
0
votes
2answers
116 views

Is it possible to have identical public keys for different ciphers?

Is it possible (and is there any research I can read) to have 2 key pairs for different ciphers, for example RSA 1024 and some yet to be released EC (or other asymmetric cipher) than uses 1024 bit ...
-3
votes
3answers
200 views

Would this method deliver a perfectly non-malleable encryption for at least two blocks? [closed]

Disclaimer: the algorithms I present here (and in other messages) are used as a hands-on way to learn about developing crypto algorithms, (and might also be of interest for other curious people), not ...
0
votes
1answer
36 views

HTTPS and plaintext authentication

I have client connecting a server over HTTPS to send and retrieve data. The client always connects through HTTPS The certificate is known to the client beforehand (hard coded into the software) The ...
0
votes
1answer
166 views

Why exactly Blowfish max key length is 448

Could anyone, please, tell me history of birth of Blowfish algorithm? Specifically, what is substantiation of Blowfish key length to be in range from 32 till 448 bits? Why, for example, it wasn't ...
1
vote
2answers
129 views

Severity of Cooking NIST P Curve Constants

Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
-3
votes
1answer
121 views

Can i get a list of over hard and long RSA keys? i think i have found a vulnerability in RSA Algorithm [closed]

al-right, I need some examples of hard and long RSA keys cause i think i have found vulnerability in RSA. i need you to give me few hard Values of n (which is pxq) and i will tell you what p and q ...
0
votes
1answer
72 views

How to perform homomorphic multiplication in ElGamal?

How can I compute homomorphic multiplication in ElGamal? That is: Given two ciphertexts $(R_1,c_1)$ and $(R_2,c_2)$ corresponding to plaintexts $m_1$ and $m_2$ under some public key; how can I compute ...
0
votes
1answer
165 views

RSA Signature : Process of Sign the message and Verify

I have read that the RSA numeric signature works as the following: Generation of keys : $p,q,N,e,d$ Process of signing the message $m$ (which is BigInteger) : it uses the secret key $sk=(p,q,d)$ so ...
0
votes
1answer
76 views

What should I think about these unique certificate serial numbers [closed]

I was looking at the serial numbers of the certificates for www.google.com and wordpress.com. Wordpress was listed by openssl as: 04:0B:D4:F8:25:88:C5 This serial is listed as the serial for both ...
4
votes
1answer
375 views

How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?

Wikipedia claims: A secure block cipher can be converted into a CSPRNG by running it in counter mode. This is done by choosing a random key and encrypting a 0, then encrypting a 1, then encrypting ...
0
votes
0answers
22 views

Is sending encrypted message and signed message a secure way of transmitting data? [duplicate]

I know that the industrial standard is normally sending data in the following format: Send Encr(msg, Sign(msg)) Is the following way a secure as well? ...
0
votes
1answer
122 views

Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?

I'm aware that MD5 is broken, and collisions have been found for it. I'm interested in other hashes (SHA-1, SHA-2, SHA-3) when truncated to the same digest size, i.e. 128 bits. The time complexity of ...
1
vote
2answers
102 views

Does this chat protocol exist?

I want to implement a secure chat via mobile. I´ld like to know if the following protocol for key agreement – which can use any asymmetric encryption – exists. Suppose Alice and Bob are two clients ...
1
vote
2answers
270 views

Elliptic Curve Cryptography Encryption and text representation implementation

I'm writing a coursework and right now I've implemented the ECDSA algorithm, but I also need to encrypt and decrypt small text files (.txt) using elliptic curve cryptography. The problem is that I do ...
0
votes
3answers
102 views

Is the hash function defined in this exercise collision-resistant?

I have this problem: "Let ${\rm Enc}_k(m)$ a safe block encryption system. We define a hash function $H(m)$ as follows: $m$ will be concatenated with $0$ until $|m|$ is a multiple of ...
0
votes
1answer
33 views

Strenght of TLS handshake

I asked this question recently but I was told it is not save to simply send over the identifier for your crypto method you want to use. for example, say the server has crypto method 3 5 and 6, the ...
2
votes
2answers
170 views

Post-quantum authenticated encryption

It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong. However, these statements are always made ...
0
votes
1answer
110 views

Rsa Key Exchange Protocol

Moderators: Maybe this question will be move to other sub-forum. My question is Anybody know some link with a tutorial of how implement the RSA key exchange protocol using java for chat comunication?
2
votes
3answers
127 views

Can spatial filters be used to factor composite numbers?

$Z=(N-XY)^2$ is a surface with absolute minima ($0s$) anywere $Y=N/X$. I know this question is naiive, but shouldn't it be possible to apply a lossy compression filter to this function which ...
2
votes
0answers
76 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
2
votes
1answer
278 views

Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure

Any thoughts on how this can be done? Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for ...
3
votes
1answer
114 views

Do hand-based hash functions / MACs exist?

Is there research on a hash function or a MAC that can be executed without computers? I know there's a lot of history on hand-based ciphers and the OTP can easily be excecuted by hand. (By using ...
1
vote
1answer
68 views

Are digital signatures using preprocessed paper pads possible?

My idea was, given that a computer could produce some sort of lookup tables on paper, could then a human use those lookup tables to create a system for digital signatures? This was really an idea for ...
0
votes
0answers
74 views

What are some hashes that do not exhibit the avalanche effect?

I do not know much about cryptography. But, I'm in a situation where I need a hashing method that does not exhibit the avalanche effect. I tried Googling but couldn't find anything.
1
vote
1answer
51 views

Could this alternative hash based MAC construction be as, or even more secure than an HMAC?

Begin hashing (Key||Message) Encrypt the hash state (or some part of it, such as the first 128 or 256 bits), with the key. Add the encrypted hash state to the ...
3
votes
1answer
107 views

Inversion Free Direct Conversion between Twisted Edwards (X,Y,Z) and Montgomery (X,Z)

The Wikipedia page for Montgomery curves shows how to convert points on a twisted Edwards curve to and from points on an equivalent Montgomery curve. However, their description and the original ...
3
votes
3answers
2k views

What is the difference between online and offline brute force attacks?

I read some papers saying a certain scheme is secure for offline brute force attacks, but vulnerable to online brute force attacks. I wonder the difference between the online and offline brute force ...
2
votes
1answer
41 views

Does failure of indistinguishability of encryptions imply lack of CPA-security?

Suppose we have an encryption scheme that fails the indistinguishability of encryptions test. That is, given messages $m_0, m_1$ and a ciphertext $c_b = Enc_k(m_b)$, where $b \in \{0, 1\}$, the ...
2
votes
1answer
67 views

On composition of encryption schemes

If we composed (as in function composition) multiple CPA-secure encryption schemes would the result also be CPA-secure?
0
votes
1answer
108 views

Is there an asymmetric One-Time-Pad? [duplicate]

Is there something like a perfect asymmetric crypto-algo? Is there proof that there must be one or not. From a logical point of view it seems to be possible to design such algorithm if your keysize is ...
1
vote
1answer
79 views

Chosen-plaintext attack

Let F be a block cipher with 128-bit block length. Consider the following encryption scheme for 256-bit messages: to encrypt message $M=m_1∥m_2$ using key $k$ (where $|m_1|=|m_2|=128$), choose random ...
0
votes
1answer
119 views

Which of the following hash functions is collision resistant?

Let $H: M \to T\ $ be a collision resistant hash function. Which of the following is collision resistant: $ 1.H'(m) = H(m \big\| m)$ $2.H'(m) = H(m) \big\| H(0)$ $3.H'(m) = H(m) \oplus H(m)$ ...
0
votes
0answers
91 views

Which of these is a secure MAC?

Let (S,V) be a secure MAC defined over $(K,M,T)$ where $M = \{0,1\}^n$ and $T =\{0,1\}^{128}$. Which of the following is a secure MAC: $S'(k,m) = S(k,m)[0,\ldots,126]\quad and \quad V'(k,m,t) = ...
2
votes
1answer
82 views

How to securely store data? / How to securely encrypt a file? [closed]

How do I safely encrypt a file? or formulated differentely: How do I safely store the data of my application in a file? Note: Using established tools isn't an option for this. The tasks need to be ...
6
votes
2answers
300 views

Is the HMAC construction really neccessary for a fixed length message?

The HMAC Construction is defined as: Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) ) This was designed because a simpler construction such as: ...
2
votes
2answers
412 views

Is One Time Pad considered Chosen-Plaintext Attack Secure?

If we're considering Chosen-Plaintext Attack setting, then the adversary has access to the Encryption Oracle right, and we know that OTP is only considered secure if we use the key only once. How ...
1
vote
0answers
70 views

How do I verify a reset token if the token is hashed in DB?

I've been searching around the web for best practice how-to on secure password reset system (email with reset url), and the idea to hash the token in the database, which I did not implement at first, ...
1
vote
1answer
61 views

CCA secure or not?

Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r || (F{_k}(m) \bigoplus r \bigoplus 0^n)$ , where r's value is random. Is this ...
0
votes
1answer
124 views

Computational indistinguishability with Example

Based on computational indistinguishability definition no PPT algorithm can distinguish $X$ from $Y$, where $X=\{X_n\}_{n \in N}$ and $Y=\{Y_n\}_{n \in N}$ are ensembles of probability ...
2
votes
0answers
47 views

Proposed unidirectional authentication scheme

I've been looking around for a way to authenticate a client to the server and deliver a message, but in a unidirectional fashion - that is, the client sends messages to the server, but the server ...

15 30 50 per page