5
votes
0answers
115 views

Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
6
votes
2answers
463 views

Is perfect-forward secrecy achieved with RSA?

I am new to cryptography and am going through the book Understanding Cryptography by Paar and Pelzl. From what I understand Symmetric key distribution systems like Kerberos do not provide PFS ...
13
votes
2answers
1k views

AES-GCM Disadvantage

What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ...
0
votes
1answer
134 views

Noise bound in FHE over the integers

I'm studying the paper Fully Homomorphic Encryption over the Integers by Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan. I have questions about the proof of Lemma A.1. In page ...
2
votes
1answer
63 views

Symmetric-key login protocol

I'm trying to analyze a login protocol based on symmetric key cryptography. I'm just starting out, so this may very likely be a very bad idea, but nonetheless I'd like to hear your thoughts on it. ...
4
votes
1answer
204 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
3
votes
2answers
170 views

PGP String to Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
3
votes
1answer
115 views

Is this an acceptable All-or-Nothing Transform?

I was thinking about AONTs, and designed the one below, I call it CHANT for Chained-Hash All-or-Nothing Transform; it's my very first shot at something of the sort, and was hoping I could get your ...
2
votes
1answer
69 views

Encrypted files in an encrypted partition or folder

Recently I started wondering about multiple encryption and found pages upon pages of posts and debates about the security of cascades. Now, don’t worry – I'm not looking for someone to discuss a ...
2
votes
0answers
172 views

Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i): Identification based on PK decryption and witness. Consider the following protocol: $A \leftarrow B: h(r), B, P_A(r,B)$ ...
3
votes
1answer
236 views

Test Vectors for ciphers

While implementing ciphers (/hash functions, ...), I often face this problem: Where to find test vectors for it; so that I can guarantee my program is correct. It is generally a tedious job to find ...
1
vote
2answers
205 views

Public key Issue - same key pair as existing one? [duplicate]

My question is a bit naive, but what if someone generates the same RSA key pair as someone else? This person would have the same private key and so would be able to decrypt messages not intended to ...
2
votes
2answers
203 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
4
votes
1answer
97 views

OTT service using FPE

Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an ...
4
votes
1answer
186 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
6
votes
1answer
95 views

The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme ...
4
votes
3answers
303 views

Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication. We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting ...
2
votes
1answer
250 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
0
votes
1answer
434 views

Known plaintext attack on ElGamal encryption

Assume that Alice uses Bob’s ElGamal public key ( = 2, Yb = 8) to send two messages $M = 17$ and $M' = 37$ using the same random integer $k = 9$. Eve intercepts the ciphertext and somehow she finds ...
4
votes
1answer
154 views

Compression function to guarantee randomness of one time pads?

First of all, I would like to note that I am not building my own crypto. I am simply curious and would like to learn. What I am wondering is this: if we are worried about randomness of something ...
2
votes
0answers
121 views

Understanding Lattice based cryptosystem [closed]

I have heard that there is one paradigm of Public key cryptosystem, called Lattice based crytography. Further, its security claims are such that it will not be affected even if the quantum computers ...
1
vote
1answer
230 views

Whitening and randomness extraction

The Von Neumann randomness extractor is explicitly mentioned in the randomness extractor page of Wikipedia, but strangely enough that page does not contain any reference to whitening the results of an ...
3
votes
2answers
130 views

CSPRNG that cannot be used as random extractor

Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any ...
5
votes
1answer
259 views

Elliptic Curve Cryptography

I have been trying this for a while. But I couldn't get it. How can I determine the point of intersection of the tangent line at (0, 0) on the curve $y^2 + y = x^3 + x^2$ ?
3
votes
1answer
397 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
2
votes
1answer
75 views

Should I calculate two CMACs over two different strings that share common bytes?

I am trying to secure my RF communication in which one RF package consists of two separate segments. I need to make sure that one segment of one packet is not replaced with a valid segment of some ...
3
votes
2answers
762 views

Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
2
votes
1answer
1k views

Probability that two different files can have same MD5 hash for both an unencrypted and encrypted version (AES256, same key between files)

This math is way over my head, and don't even know if it can be done, but here are the assumptions: Take unencrypted File [Fu] of variable length, but assume 100KB as an example. Let File [Fe] be ...
4
votes
1answer
157 views

Key Derivation from random salted seed, HMAC and HMAC based KDF

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing ...
0
votes
2answers
131 views

Elliptic curve group over a prime finite field $F_p$

If $p$ is a big prime, and the elliptic curve $E$ is defined over $F_p$ by the equation $y^2=x^3+ax+b$ where $a,b\in F_p$. The point on $E/F_p$ together with the infinite point $\mathcal{O}$ form a ...
2
votes
3answers
131 views

Does 3-DES take approximately the same time to encrypt 1B and 1KB?

I am using 3-DES to encrypt some data in Java. I decided to run some tests and plot some graphics to decide how to optimally pack data for its encryption (see how encryption/decryption time behave ...
2
votes
0answers
67 views

Where is the OID and ASN.1 specified for AES_CMAC?

I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under ...
0
votes
1answer
267 views

Vigenère cipher: Security when key length and plaintext length are the same

I have read the Vigenère cipher is secure as long as the key length is the same as the length of the data to be ciphered. Is this true in cases where the same key is used multiple times. In that case ...
1
vote
1answer
111 views

Adding an IV to an AES implementation

I have an embedded project that requires AES, I seem to have found an AES implementation that fits the bill here: http://www.literatecode.com/aes256, but it does not include an IV. Are there any ...
0
votes
1answer
140 views

Is MAC-then-encrypt with stream ciphers secure?

While thinking about this recent question about a hash-then encrypt design, I reread the MAC-encrypt vs. encrypt-MAC question and noticed this answer quoting a paper showing that MAC-then-encrypt is ...
8
votes
2answers
2k views

How does a rolling code work?

I have general questions regarding rolling codes. Basically there is a sender and a receiver. Both have a sequence generator. The receiver checks if the received sequence matches the newly generated. ...
1
vote
0answers
128 views

Universal hashing techniques based on matrix multiplication

The article here says below, about a universal hashing technique based on matrix multiplications. "However, there is a little known method based on using a random matrix. It has lots of advantages - ...
6
votes
3answers
502 views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
-1
votes
1answer
116 views

Textbook RSA with exponent e=3 [duplicate]

I remember $e=3$ is a bad choice for textbook RSA. But I can't really recall why. What happens if I choose $e=3$? Can I retrieve the message by simply calculating $\sqrt[3]{c}$? Why can't I do that ...
1
vote
2answers
213 views

Different padding rules for Merkle–Damgård and Keccak/sponge function

We learned that length padding was used in Merkle–Damgård where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
2
votes
1answer
124 views

Secure way to store fixed size string of digits

I need to store a string of digits (0-9) of a fixed size in my database securely. I've already performed a rainbow table attack on a plain hash, and it broke it in a matter of seconds. One option I ...
1
vote
1answer
143 views

Which algorithm do you recommend for practical use to generate unique passwords for each website?

So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm ...
-1
votes
0answers
95 views

Calculating periodicity of a pseudo random number generator (Middle-square method) [closed]

Below is a Python code that calculates the periodicity of the middle-square method for a given 4 digit-numbers: ...
2
votes
2answers
234 views

Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
5
votes
3answers
662 views

RSA with modulus n=p²q

I've been wondering what would happen if the RSA modulus would be $n=p^2q$ instead of $n=pq$. I feel like there is an obvious security flaw (as there is with most modifications). Would this choise of ...
1
vote
1answer
181 views

MAC using a modified CBC mode of operation

I'd like to know whether the following modified CBC-MAC is secure (given a fixed IV). Source: an old course on Network Security Are there some obvious attacks I can't see?
2
votes
1answer
85 views

Is my implementation of a PRG at least intuitively secure?

I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism. Basicly I take a random ...
1
vote
1answer
82 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
3
votes
0answers
119 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
2
votes
1answer
39 views

Validity of authentication scheme?

Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie ...

15 30 50 per page