1
vote
1answer
166 views

Password verification

I'm looking for feedback on whether or not this is the proper way to approach password verification without transmitting the actual password. Are there any problems with this scheme. We are working ...
9
votes
1answer
1k views

repeating-key xor and hamming distance

I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
0
votes
1answer
244 views

Is this scheme a provably fair random number generation?

I have thought up a method for generating random numbers between a client and a server which I hope is fair: The client and server decide on a range in advance, $0$ trough $n-1$. The server ...
1
vote
1answer
68 views

What does “securely realize” mean?

I was wondering what "securely realizes" means. I see this in some cryptographic papers but I don't know what it means for a protocol to "securely realize" a function $F$. Is it just a fancy way of ...
4
votes
1answer
167 views

Combining AEAD with RSA

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
1
vote
1answer
347 views

Is it possible to determine a PGP public key from encrypted data?

Is it possible to find out which public key was used to generate the message? Scenario is like this : I got data which is encrypted with a public key. Now a "bad guy" hast the encrypted data, and ...
3
votes
4answers
350 views

Tamper-proofing log files

Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ...
2
votes
1answer
91 views

What happen if a asymmetric crypto-system deals with only one key

Assume there is a crypto algorithm that deals with matrices to encrypt and decrypt. Regardless of the specification of such algorithm, what if the algorithm assumes that two parties can securely agree ...
5
votes
2answers
327 views

Are cryptographic hash functions perfect hash functions?

For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to ...
2
votes
1answer
252 views

Attacking historical ciphers methodology

It's more a theoretical question of how would you approach it. All you know about the ciphertext it's was generated with a historical cipher. The ciphertext appears to be random, BUT it's divided into ...
1
vote
4answers
275 views

Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data?

I am designing a simple and secure stream communication protocol. My idea was to build each message sent to the wire as: (message size || clear text || UHASH(message size || clear text)) $\oplus$ ...
2
votes
1answer
1k views

SHA256 HMAC brute force with chosen plaintext attacks

This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ...
6
votes
1answer
591 views

Quality of randomness on a Linux system with haveged

Has anyone checked if using haveged, a Linux daemon which uses the HAVEGE algorithm, changes the non-deterministic properties of the random data from ...
6
votes
2answers
1k views

Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme

Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme? Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
3
votes
3answers
243 views

Is it possible to work out the hash algorithm from a list of known message-hash pairs?

For example, in my situation I know hash(20) = 486e9638177faf1f34e49910491b77af. I also know the hashes for all values from 0 to 20. Is it possible to work out the ...
4
votes
0answers
175 views

LT codes with Homomorphic hashing

I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and ...
4
votes
3answers
335 views

The utility of elliptic curve cryptography

Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve ...
1
vote
1answer
112 views

Connections between Instance Hiding and Fully Homomorphic Encryption

Another approach taken by researchers for carrying out computations over encrypted data is Instance Hiding. In brief, If a user wants to outsource the computation of a function for a particular input ...
2
votes
3answers
219 views

Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages

I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system. So we have Bob -- The person who sends the message (and knows it's recipients) ...
6
votes
1answer
297 views

Prove that textbook RSA is susceptible to a chosen ciphertext attack

Given a ciphertext $y$, describe how to choose a ciphertext $\hat{y} \neq y$, such that knowledge of the plaintext $\hat{x}=d_K(\hat{y})$ allows $x=d_k(y)$ to be computed. So I use the fact that the ...
3
votes
1answer
176 views

Addition with Shamir secret sharing

When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$. I believe this would be the correct solution (correct me if I'm wrong): Each party ...
3
votes
1answer
657 views

Triple-DES Brute Force

Shannon's paper states: A system is pure if all keys are equally likely and if for any three transformations, $T_i$, $T_j$, $T_k$ in the set, the product $T_iT_j^{-1}T_k$ is also a ...
6
votes
2answers
332 views

A lower bound on the insecurity of CipherCloud?

CipherCloud claims to support , among other things, searchable encryption. A bunch of speculation seems to suggest they did this via some breathtakingly incompetent means( unfortunately such ...
2
votes
2answers
221 views

Chain several RSA encryptions without increasing the message size

I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time. In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
17
votes
1answer
760 views

Should I trust CipherCloud? [closed]

Should I trust CipherCloud's system for "homomorphic encryption" of data in the cloud? Has the security of their system been subject to peer review or other cryptanalysis? Is there any known analysis ...
5
votes
2answers
603 views

Is encrypting a single 128 bit block with AES ECB “safe”

I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
1
vote
1answer
88 views

How to learn the first bit of m in padded RSA

Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing ...
1
vote
1answer
628 views

AES AddRoundKey

Looking at the first step of AES encryption I see that we XOR the key with the plaintext block. Why is the actual key involved at all, why not just use the round keys derived from the key schedule?
3
votes
2answers
338 views

What is the best way to store sensitive information on the client?

I am very inexperienced with cryptography and would like some advice on how to store some sensitive information on client machines. I have some information stored in a central database on my server. ...
2
votes
1answer
155 views

Can prepending “junk” be equivalent to an IV when encrypting using CBC?

We are encrypting a small positive integer (1-1000) with a constant key using AES256 encryption. We are considering two approaches to make this secure; use an initial vector (which we then need to ...
2
votes
0answers
69 views

PKC McEliece + $S$ + $P$ [closed]

I am trying implement the McEliece crytosystem in SAGE. My question is How I will be able to choose the appropriate matrix $S$ and $P$?. I ask this because when I trying obtain the vector $\hat{m}=mS$ ...
3
votes
2answers
132 views

GPG and PAR2 error correction data from the plain archive, will it compromise security?

I have the following scenario: Archives compressed with 7z, hundreds of MiB in size GPG to encrypt the archives (binary, without ASCII armor) PAR2 to create error correction data Question 1. ...
8
votes
1answer
2k views

How can scrypt be improved to counter GPU mining

I know scrypt was designed to lessen the GPU/ASIC advantage. We now have litecoin as a real-world example of this. However, it hasn't worked out perfectly. Most coins are mined by GPUs, although the ...
1
vote
2answers
152 views

How secure is passing a MAC to Python's random.seed before using random.choice to generate a MAC?

I'd like to use Python's random.choice seeded with a HMAC-SHA1 tag to generate a MAC encoded in a variable set of chars. ...
3
votes
1answer
400 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
2
votes
2answers
227 views

Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies­-Meyer or Miyaguchi-Preneel are ...
5
votes
1answer
234 views

In textbook RSA with low public exponent, how big does a random message needs to be?

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
2
votes
1answer
171 views

What's the probable usage of Interlock Protocol

I've recently read some articles about the Interlock Protocol, Article by Ron Rivest and Adi Shamir. I'm wondering if it is possible to protect Key-exchange under Public-Key cryptography from the ...
6
votes
1answer
2k views

Why exactly is Blowfish faster than AES?

I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
0
votes
1answer
391 views

Ciphertext-only attack on Simplified DES

Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
4
votes
1answer
168 views

Is it safe to assume Salsa20 to be a PRP?

Often in security proofs a certain block cipher is assumed to be a pseudorandom permutation or PRP. I wonder if this goes for stream ciphers as well, and specifically for Salsa20. If limit ourselves ...
2
votes
2answers
268 views

Keys required for cryptography

I am reading an article on cryptography at following location: http://www.entrust.com/resources/pdf/cryptointro.pdf Historically, encryption systems used what is known as symmetric cryptography. ...
1
vote
2answers
351 views

Does key authentication in SSH protect from MitM?

How do cryptography in SSH(2) work (secure channel establishment, authentication)? Does key authentication in SSH(2) protect from MitM by providing authentication and integrity and why?
1
vote
0answers
109 views

Perfect secrecy and change of plaintext probability distributions

How to prove that if a cryptosystem has perfect secrecy for a given plaintext probability distribution then it will have perfect secrecy for all other possible plaintext probability distributions? Do ...
1
vote
0answers
35 views

Encrypted Functions with Fully Homomorphic Encryption [duplicate]

While Fully Homomorphic Encryption schemes facilitate carrying out computations over encrypted data, can the function that has to be evaluated be encrypted too ? For example, if i have some programs ...
6
votes
1answer
342 views

Correct way to map random number to defined range?

Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX. What is the best way to map this random number to a ...
2
votes
0answers
138 views

Correct way to truncate data to a range [duplicate]

2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm. I want to take a stream of k trusted random ...
1
vote
1answer
1k views

decryption many time pad [duplicate]

I have eleven ciphertexts that were encrypted with the same key (which I don't know). I want to decrypt the last ciphertext. I read similar question like Many time pad attack but I can't solve my ...
2
votes
0answers
135 views

How can I prove that this encryption scheme from a random oracle is secure?

I am reading this example: A random oracle is an ideal object. What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
2
votes
1answer
63 views

Comprehension question on a signature protocol based on the RSA assumption

We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...

15 30 50 per page