1
vote
1answer
258 views

XOR secret sharing scheme

I was wondering how we can get a secret sharing of $a+b$ from the sharing of secrets $a$ and $b$ themselves by using an XOR secret sharing scheme, where $a_1,...,a_n$ and $b_1,...,b_n$ are the shares ...
2
votes
0answers
63 views

Any functioning system for interactive proof?

My problem is to outsource an array of data and ask the prover to sort the data. I am wonder if there is any working system out there that support interactive proof for the above computation? Or if ...
2
votes
1answer
595 views

How good is using AES CTR mode with initial counter as 0?

Is it advisable to use AES CTR mode with the counter initialized to 0? How good is it in security terms?
3
votes
1answer
176 views

Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?

In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
1
vote
1answer
104 views

Are there any practical examples of breaking a system using linear attacks?

I've read some papers about linear cryptanalysis. But since I am going to give a lecture about it I am looking for an example of breaking a system using this attack. Is there such an example ...
3
votes
0answers
80 views

Hi Sec National algorithm

I'm trying to create a remote controller compatible with HiSec algorithm. It's so old that National (now Texas Instruments) discontinued NM95HS01/02 and docs are unavailable. Does anyone have the ...
1
vote
1answer
90 views

Distinguishing joint probability distributions

Assume that we have a probability distribution $P(X,Y)$ for the joint probability of random variables $X$ and $Y$. Let $P(Y, Z)$ be analogous distribution for $Z$ and $Y$. Based on these we can define ...
7
votes
1answer
366 views

Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ...
0
votes
1answer
254 views

openSSL ECDH private key size

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys? If you look at the ec_key.c file in the openSSL ...
3
votes
2answers
269 views

Definition of a CSPRNG

I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ...
1
vote
1answer
1k views

Are there any Truth Table to Boolean expression converters? [closed]

I am working on Bent functions that are of interest in cryptography. I developed an algorithm that construct such functions. However, I need some tools to calculate boolean expression from the truth ...
2
votes
1answer
134 views

Why does Merkle's Puzzle requires Eve quadratic complexity of effort to break the system?

The way Applied cryptography 2ED explains the puzzle is as follows (I paraphrase it): Bob generates 2^20 messages of the form x,y where ...
2
votes
2answers
176 views

What is the limit of plaintext required to break the Vigenère encryption?

A theoretical question about the Vigenère cipher: Without any knowledge about the key (not even it's length) can we tell how much known or chosen plaintext is needed for the adversary to completely ...
2
votes
1answer
115 views

How does SSL secure the initial handshake?

I'm reading the SSL specs, and it seems that the initial handshake has no authenticity protection at all. What is to prevent, say, an attacker from overwriting the "available ciphers" list with one ...
1
vote
1answer
304 views

What's the difference between the long term key and the session keys?

I'm currently studying secret key cryptography, and I've come across the terms "long-term key" and "session key". What's the difference between these two kinds of keys?
1
vote
2answers
175 views

Are there attacks that break collision resistance but not preimage resistance?

Are there any examples of attacks on hash functions which: break collision resistance and second preimage resistant, or break collision resistance and preimage resistant? I have looked at ...
2
votes
3answers
241 views

OFB or CTR mode without an IV

I'm reading the SSL specs here. The interesting thing seems to be that RC4 is not re-keyed with a new IV for each message. The stream cipher state is simply carried over to the next record. Why is ...
3
votes
1answer
237 views

How can I prove/disprove that a construction yields a secure PRG?

Let $G:\{0,1\}^{*} \mapsto \{0,1\}^{*}$ be a secure PRG. Prove or disprove that the following construction also yields a secure PRG. $$G'(k) = G(k||0),$$ where $||$ denotes the concatenation of two ...
3
votes
1answer
325 views

Subtracting a point in elliptic curve cryptography?

I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption: ...
1
vote
1answer
164 views

With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
6
votes
2answers
2k views

With OpenSSL and ECDHE, how to show the actual curve being used?

Using openssl s_client -host myserver.net -port 443 I can see the cipher negotiated is indeed using ECDHE for session key ...
7
votes
1answer
457 views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
2
votes
3answers
350 views

Some cryptography security questions

I recently had a discussion with a friend of mine about cryptography. As we are both no experts, I thought that I could better resolve are dispute here :-). My friend said that when he used public ...
3
votes
3answers
401 views

Timing Attacks on ECDSA, ECDHE, AES and SHA2

Are there any known timing attacks (both practical and theoretical) on any implementations of the following? ECDSA (I'm aware of this one - are there any applicable to prime fields?), ECDHE (again, ...
0
votes
2answers
115 views

The weak link is the password?

Consider a secure modern block cipher like AES/Serpent/Twofish. I hear everyone say that the complexity is $2^{128}$ for a 128 block cipher. But isn't the weak link the actual hashed and salted ...
1
vote
1answer
2k views

HMAC SHA256 vs RSA SHA256 - which one to use

Salesforce recently announced they are moving away from HMAC SHA256 to RSA SHA256. Why did they make that move?. Any technical factors? Is HMAC really easy to break? ...
2
votes
1answer
68 views

How do I know if a given curve requires a FpCurve F2mCurve or ECCCurve?

I'm trying to read a public key into Bouncy Castle (secp256k1) and need to choose from the following objects FpPoint; FpCurve; or ...
3
votes
1answer
392 views

RSA with modulus product of many primes

I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with ...
1
vote
1answer
76 views

How do you use the Tiger hash function with GPG?

I've searched Google and the GnuPG documentation and I haven't been able to find an answer. Some pointers in the right direction would be greatly appreciated.
2
votes
2answers
257 views

What does the linear assumption over bilinear groups mean?

In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say: In both schemes we rely on the linear assumption over bilinear groups. What ...
0
votes
0answers
49 views

What is the default type of salt for encryptions in Heimdal Kerberos?

I am trying to figure out what the salting mechanisms are for various kinds of encryptions in Heimdal Kerberos. In section "4.11 Encryption types and salting" of the Heimdal Kerberos documentation it ...
3
votes
4answers
471 views

Do any non-US ciphers exist?

Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples. Are there any public ciphers produced by other states, China or Iran for example? ...
1
vote
1answer
2k views

Can AES use PKCS#5 padding

From What is the difference between PKCS#5 padding and PKCS#7 padding, I understand that PKCS#5 is defined for 8 byte block sizes. Does this rule it out as a padding option for AES since AES has a ...
1
vote
2answers
102 views

Is it possible to decide the base of a discrete logarithm?

Given $R$, a prime $p$ and two bases $g_1$ and $g_2$, is it possible to decide if $R = g_1^r$ mod $p$ or $R = g_2^r$ mod $p$ without knowing $r$?
2
votes
2answers
193 views

Hypothetical unknown cipher - security in obscurity?

I'm curious what would happen in the following scenario: Suppose an attacker gets a hold of a cipher-text of sufficiently large length. And suppose he has the means to verify a successful decryption. ...
2
votes
0answers
118 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
4
votes
2answers
309 views

Which crypto libraries/programs do we have the most confidence in? [closed]

I have recently begun studying crypto. If it's one thing I have learned it's that we should not implement our own crypto. Therefore we should look to using existing software and libraries. When I ...
1
vote
2answers
169 views

Can you get two unpredictable hashes from the same message with, e.g. SHA1?

I'd like to create a database of questions and answers so that an attacker with access to the database can't obtain either the questions or the answers. If H0 and ...
3
votes
2answers
638 views

Why is sharing the seed and using SecureRandom “deterministically” so bad?

I've recently been reading an article about "using cryptography to store credentials", and I would love it someone explained this in more detail… Up until Android 4.1, Android used a SecureRandom ...
2
votes
1answer
138 views

Good Encryption Exponent

I have placed a bet that I can create a public key such that my adversary will not be able to crack (decrypt) it for at least one week. For my primes $p$ and $q$, I chose very large numbers that are ...
1
vote
2answers
101 views

Password as it relates to various encryption schemes

Suppose you have 2 drives you want to encrypt using different encryption algorithms, as an example: AES256 and Twofish. I am aware that using the same password for both could potentially weaken ...
6
votes
2answers
692 views

Knowing pre-encryption data, can we find the private key CryptoLocker used?

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files. If we know ...
2
votes
1answer
122 views

How do I prove that this PRNG is easily distinguished from a random sequence of numbers (modulo m)?

I was studying Crypto, and this question came up. Using a PRG like the multiplicative congruence generator: $b_{i+1} = a \cdot b_i \mod m$ How do I prove that the output of this PRG, or any PRG's ...
2
votes
1answer
154 views

How to design a cryptographically secure file hosting service

How one would go about design something like Google Drive/Dropbox providing the following features: files are encrypted and decrypted on the client files can be synced between devices the service ...
1
vote
1answer
329 views

RSA decrypt long messages (javascript)

I am attempting to encrypty/decrypt a long message in RSA using javascript (with crypto-js and jsbn libraries). I posted this on stackoverflow too but I figured someone here on crypto might be able ...
3
votes
2answers
170 views

Isn't the deterministic property of (EC)DSA a security problem?

From what I read in Wikipedia's article "Elliptic Curve DSA ~ Security", the "deterministic" generation of $k$ can help prevent certain type of attacks (such as the one happened to Sony). However, ...
1
vote
1answer
159 views

Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

I am trying to prove that: "If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken." Can you help me to prove it? Is there any proof to the relation between ...
4
votes
5answers
370 views

Would it be possible to generate the original data from a SHA-512 checksum?

So, I have a file that is XY Exabytes big. I create a SHA-512 hash from it. Are there any theoretical chances that I can retrieve the original data just from the sha512 hash? Also, are there any ...
3
votes
2answers
215 views

Is there a companion algorithm for OTP to ensure integrity and/or authentication?

One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved: Fast generation of independent and identically distributed random variables Perfect key ...
2
votes
1answer
155 views

Having 4096 bit keys and short (< 256 byte) messages, can I simply use the key as OTP?

Assumptions: Alice and Bob use (cryptographically secure, hardware-rng generated) 4096 bit keys. Each message is encrypted using a new key; meaning: once a key is used, it's destroyed. Alice and Bob ...

15 30 50 per page