All Questions

152 views

How to calculate bit strength of Integer Factorization Cryptography (IFC) such as RSA using Python

I would like to know how to calculate the bit-strength of Integer Factorization Cryptography (IFC) such as RSA by using Python. I gathered it is based off the complexity of factorizing the modulus ...
96 views

key-exchange with websockets in node.js

I do not see how someone would distribute a “key/key agreement” without exposing it to a MITM! I would consider it to be strange if the answer is “via a HTTPS or TLS connection” because – if this is ...
72 views

Is HMAC padding the same as bcrypt?

I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions. I am interested in what bcrypt does to the ...
109 views

Ballot box with multiple parties. All can read it, or none can read it

I am trying to create a decentralized moderation system for the game Diplomacy, a game for seven players. In each round of a face-to-face game, each player writes their moves on paper then puts it in ...
249 views

RFC 5959 specifies the encrypted storage of private keys based on PBKDF2-HMAC-SHA-256 and AES encryption (in ECB mode). Is there a particular reason AES is used, instead of simply XORing the key ...
120 views

User-specified PBKDF2 password, salt, and iterations limits

For a decentralized login where a user is left to select the password, salt, and iterations, what minimums for each should be enforced? In other words, because none are ever stored by the ...
106 views

Protocol composition [closed]

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
138 views

Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?

Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ...
170 views

Parallelized Pollard's Rho algorithm for ECDLP + Jacobian coordinates

My implementation of the parallelized Pollard's Rho algorithm is using Jacobian coordinates to avoid the costly inversion operation when performing point addition. I am wondering if there are any ...
236 views

Fast hashing into elliptic curve

Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard? By fast, I ...
56 views

Fiat–Shamir: why do r and s have to be smaller than n?

I have a question regarding the Fiat–Shamir identification protocol. In this source (pdf) for example it says on pages 9 and 10 that the random commitment $r$ and the private key $s$ have to be ...
109 views

Does knowing multiple hash of the same content make it more likely to generate original plain text?

Say I'm trying to brute force the original plain text of an SHA256 hash, does knowing the RIPEMD160 hash of the same text help? In other words, does providing access to hash values of the same text ...
99 views

LFSR and Markov chain question [closed]

This may seem an elementary question about LFSRs, and their link to Markov chains. LFSRs show Markov chain behaviour in that there can be a transition matrix defined over the LFSR, this follows from ...
65 views

I am currently stuck at an exercise for my Cryptography Class in University which is: Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout$12345$" to her bank (encrypted). ... 2answers 132 views Signing a document: which algorithm to use? What I want to do is to digitally sign a document. I am new to cryptography and was wondering what issues to take into account. The only criteria is that a textual document signed should produce a ... 0answers 83 views Mutual authentication with Public Key and session Key I am trying to understand two protocols for mutual authentication and if they are secure or not.$K$is the session key, and it's calculated$k=H(TimeStamp)$. Are the following both cases secure? ... 2answers 215 views Using PBKDF2 twice with different argument order I'm pretty sure this is a really bad approach (in theory), but one of my clients is doing this and I was wondering… How bad it is to perform pbkdf-2 in this way (with 2000 iterations)? ... 1answer 97 views Length-preserving all-or-nothing transform Is there any known way to construct a length-preserving all-or-nothing transform? In other words, a secure all-or-nothing transform where the length of the output is the same as the length of the ... 5answers 360 views Choose a random number that is different from a bunch of other secret numbers I'm looking for an algorithm where n participants each have a different secret number between$[0..x]$(and where$x$is known) and where the participants then select randomly another, non-secret, ... 1answer 169 views SHA1 collision event probability after n iterations There are String1 and String2 - some variables-strings. The probability of collision for different ... 1answer 250 views Is HMAC needed for a SHA-3 based MAC? HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ... 2answers 69 views SHA1 multipart calculation Is it possible to combine SHA1 digest values to get the SHA1 of the concatenated parts ? I know the "S1" SHA1 of "part 1" and the "S2" SHA1 of the "part 2" and I would like to know the SHA1 of the ... 1answer 89 views Non-commutitive and nonassociative algebraic structures in cryptography Are there any cryptographic algorithms or primitives that have been developed and studied that make use of non-commutative or non-associative algebraic structures such as quaternion integers or ... 0answers 73 views RSA: Common modulus attack problem [duplicate] I understand in theory how the common modulus attack works (as described here: how to use common modulus attack?) Though, I did not understand completely how it worked with a negative$s_i$. Since ... 2answers 78 views Key cracking: Prefer many small texts over one large text? If an attackers sets out to crack the symmetric key of e.g. AES-CTR, would they prefer to have access to many small cryptotexts or one large cryptotext? I.e. is it more interesting for the attacker to ... 1answer 327 views AES VS PRNG+HASH+XOR I was thinking of doing symmetric encryption using just hashing and simple XOR encryption. It would work as: Alice and Bob share a symmetric key Alice manages to send an (authenticated) IV to Bob ... 1answer 68 views TLS - sharing 1792 bits of unidirectional keys I've just watched a video on the TLS protocol and learnt that it uses unidirectional keys (meaning keys for both sides, from browser to server and from server to browser). Given that the server uses ... 2answers 122 views Basic attacks on McEliece; finding S and P Take a McEliece cryptosystem with public generator matrix$G' = S G P$where$G$is a generator of a secret code with known fast decoding (not necessarily a Goppa code over$\mathbb{F}_2$),$S$is ... 2answers 408 views Trial divisions before Miller-Rabin checks? I'm trying to understand prime number generation (more correctly, the primality checking) as described in Handbook of Applied Cryptography. The context is circa pages 145 - 150, and specifically ... 1answer 453 views How to calculate inverse affine transform in AES from forward affine transform? In AES the forward affine tranformation matrix is defined as:$$\begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& ... 1answer 239 views curve25519 weak points for contributory behaviour The Diffie-Hellman on curve25519 is usually calculated using the base point$(9,…)$which induces a cyclic subgroup of$G:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times F_p))$with index 8, i.e. there is a ... 1answer 143 views Functions that are only second-preimage resistant? Are there functions that satisfy the second-preimage resistance property without satisfying the others (preimage and collision resistance) ? I'm looking about such functions that compress data (exit ... 2answers 175 views What are good combinations of public key algorithms or primitives for long term security? There has been talk in literature about doing multiple encryption with different block ciphers or stream ciphers several times before, and the benefits and risks of such efforts. There may be hidden ... 1answer 118 views Strategy for random CTR initial counter values Alice has a secret key which she uses to encrypt messages in CTR mode. CTR mode is critically vulnerable to counter reuse, and Alice has a problem: she has terrible memory and no pen to write anything ... 2answers 516 views RSA decrypting of a huge file by parts [closed] I need to decrypt a huge file that I own previously encoded by myself with a RSA public key (it's possible for this step using a symmetric algorithm key). Problem is that I can't load it in my ... 1answer 84 views Algorithm accepting every passphrase to fool unlegit user [closed] I'm looking for specific names and literature on crypto algorithms that accept every passphrase input by the user, in order to 'decrypt' - even with false passphrase - and present the unlegit user ... 1answer 522 views Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: it uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ... 0answers 61 views What are the consequences of not checking the server mac in a TLS connection? The context for this question (it's quite involved) can be found in this document: https://docs.google.com/file/d/0B15itpMWb2ztWTJrYTgzX204OVU However, I want to make it clear that you don't have to ... 2answers 123 views Python KDF - Master Key and Derivatives The encrypted file can be opened by following combinations (either any 2 DK, or 1 MK): DK1 + DK2 DK1 + DK3 DK2 + DK3 DK1 + DK2 + DK3 MK Any heads-up with Python ... 2answers 143 views Is a collision attack possible on MD5 if message is known partially Is it possible to find$m'$such that$\operatorname{MD5}(m'||m_1)=\operatorname{MD5}(m_1||m_2)$if I know$m_2$and$\operatorname{MD5}(m_1||m_2)$? Is this a collision or a preimage attack? Also in ... 1answer 127 views Brute force RSA cracking Suppose one had a complete list of primes up to$2^{n+1}-1$. Then wouldn't one be able to crack an$n$-bit RSA public key in time$O(\pi(2^{n+1}-1))$, making RSA insecure? Thanks, René 2answers 122 views Use of less than secure random numbers for 'a' during an SRP proof of password With Secure Remote Password protocol SRP6a random numbers are used for s, a and b. Where ... 1answer 238 views Compact digital signature for noisy data The question asks for a signature scheme, with a public verification procedure, that is tolerant to minor alterations of the signed data during its transmission [possibly in analog form over some ... 1answer 140 views Does this protocol provide Perfect Forward Secrecy / are there potential security flaws? We have a HMAC key (128 bit/16 bytes) an AES key (128 bit/16 bytes) an AES IV (128 bit/16 bytes) a random salt (128 bit/16 bytes) Each packet is signed with a HMAC (SHA256) After each packet is ... 4answers 313 views Given$n$bits, how many “truly random” sequences/numbers can be constructed? Suppose we have$n$bits, so we can have$2^n$different bit sequences. Some sequences don't look random, say, all$1$or$0$. There are also other patterns like$10101010…$,$11001100…$and such. ... 1answer 389 views Mixing Entropy Sources by XOR? Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG). Can I mix them ... 1answer 90 views How can a digital signature algorithm incorporate a random data if it is to be authenticated on a separate system I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others ... 1answer 69 views Fiat-Shamir security problem question I am trying to understand the Fiat-Shamir identification protocol, but have a problem with understanding how this protocol is supposed to be save, even if you repeat it several times. I am using ... 2answers 550 views Generate a unique 64 bit numeric database key from a string without collisions at$2^{32}\$ birthday threshold?

What is the best way to generate a unique 64 bit numeric database key from a string? For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...