0
votes
0answers
8 views

Enhanced Security Services / CAdES for PKCS7 - multiple signers for SignerInfo's?

In RFC5652, Cryptographic Message Syntax (CMS), section 5.3. SignerInfo Type, there's a sid field that maps to this: ...
-3
votes
0answers
32 views

OPE ON SYNONYM BASED RANKED KEYWORD SEARCH

I had already studied, order preserving encryption(ope) is suitable for ranked keyword search. But i want to use order preserving encryption(ope) for synonym based ranked keyword search. it this ...
2
votes
1answer
59 views

How can you produce visual cryptography?

I would like to be able to "code" images such as the one seen here on Wikipedia. Is this generally produced with software, or does this require complex programming? Ideally, I would love to be able ...
2
votes
1answer
51 views

Possible to determine equivalence of hash codes from different hashing functions?

Let $H_{1}(x)$, $H_{2}(x)$, ..., $H_{n}(x)$ be a list of $n$ secure one-way hash functions such that for a given input $x$ each $H_{i}(x) \neq H_{j}(x)$ when $i \neq j$. Give one hash function to ...
0
votes
0answers
30 views

Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
1
vote
1answer
41 views

Why should $a,b < N$ for Montgomery Reduction?

In Montgomery reduction, when calculating $a \times b \mod N$, it is required that $a \lt N$ and $b \lt N$. I think $0 \le T \lt N \times R$ is enough for the Montgomery Reduction. Rationale: Let ...
0
votes
0answers
23 views

RC4 via nonlinear mixer — sound?

We implemented a rc4 (ARC4) variant for creating a cryptographic stream - question is: Is this sound? (I'll give an example for 32 bit variant, though 64 bit/larger is possible) Algorithm is as ...
0
votes
0answers
21 views

For each of the following modifications to the Merkle-Damgard transform, determine whether the result is collision resistant or not

$(a)$ Modify the construction so that the input length is not included at all (i.e., output $z_B$ and not $z_{B+1}=h^s(z_B||L)$). $(b)$ Modify the construction so that instead of outputting ...
3
votes
1answer
44 views

Safety of AES ECB when used with openssl_seal function

I'm trying to use PHP to encrypt files with a public key. I'm using the function openssl_seal that "encrypts data by using RC4 with a randomly generated secret key." RC4 is considered unsafe so the ...
1
vote
1answer
72 views

How is wpa2 authentication structured

I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes. First, I am trying to ...
0
votes
3answers
49 views

Let $G$ be a PRG. Are the following $G'$ constructions based on $G$ necessarily PRGs?

$G$ is a PRG where $|G(s)| > 2 \cdot |s|$. $G'(s) = G(s0^{|s|})$. $G'(s) = G(s_1...s_{n/2})$, where $s = s_1...s_n$. My question here is whether my own proposed solutions are correct and do ...
1
vote
2answers
49 views

How to formally prove that a given hash construction is collision resistant or not?

Is there a precise procedure or strategy to follow in order to prove in a formal way the (not) collision-resistance of a certain given hash construction? I.e. let $H_1$ and $H_2$ be two hash ...
1
vote
1answer
44 views

Is there a standard for public key encrypting and signing short messages?

Some systems, that operate over flaky bearers, need to send signed, encrypted messages that are entirely self contained - i.e. send a single 300 byte UDP rather than have a 10Kb, two-way, certificate ...
0
votes
0answers
37 views

Question about OR operation in fully homomorphic encryption

This page (which won't let me post a comment, sadly!) describes how the original FHE paper by Craig Gentry describes FHE. (Other references to this stuff can be found on this question.) It mentions ...
2
votes
2answers
72 views

Combine two sha512 hashes to a single hash

Assume I have two data fragments: $Frag_1$ and $Frag_2$. I can build sha512 hashes the usual way with $SHA512(Frag_1)$ and $SHA512(Frag_2)$ and then hash the two fragments appended to each other: ...
1
vote
1answer
22 views

Diffie-Hellman in the wild

Say we have a public network and lots of peers. Each may need to communicate with another peer. Would there be any huge security issue to each peer making the the public part of their key openly ...
0
votes
3answers
182 views

zendo data size restrictions

zendo is a new mobile phone app which encrypts messages using a one-time pad: http://techcrunch.com/2015/03/24/one-time-pads-ride-again/ users have to meet in person and exchange a key via a qr ...
5
votes
1answer
51 views

Elligator-2 against curves over Fq, q mod 4 = 3

It appears that the conditions for applicability of Elligator-2 against many of the SaveCurves curves, where $q \mod 4 = 3$ will inevitably poke a hole in the bit-string set over $(0, 1, .. (q-1)/2)$. ...
2
votes
0answers
32 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
5
votes
2answers
547 views

KCV and compatibility with block cipher modes of operation

There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ...
2
votes
1answer
36 views

Is a 256 bit HMAC-SHA256 key compromised if the tail is used for identification?

Using a truncated hash of a key seems to be a safe way to identify the key (i.e. key fingerprint), but what about truncating a key itself in the case of HMAC-SHA256? Example: ...
0
votes
1answer
34 views

Stern identification scheme to signature scheme

I'm trying to understand the comment in the page 103 of the book Postquantum Cryptography. about convert the identification Stern procedure for signing. Can you write an example of signature of this ...
3
votes
3answers
46 views

How does the birthday paradox apply to random keys?

I'm developing a web app where I wish to use pseudorandom keys for items, perhaps akin to Imgur. I was thinking about how many combinations I need to reduce the chance of someone guessing any random ...
1
vote
1answer
47 views

Determine if encryption is safe against CPA

The following encryption scheme encrypts each block of length $n$ of the plaintext separately: $c_i = k_1 \oplus F(k_2 \oplus p_i)$ Where $F$ is a strong pseudo-random permutation (i.e. it is easy ...
2
votes
2answers
79 views

Digital Signature Attack

In a typical digital signature scheme in which in order to sign we compute: hash of the message: $h(m)$ resulting hash signed with the private key $[h(m)](private key)$ If there were a collision ...
3
votes
4answers
353 views

Combining several symmetric ciphers using XOR

I have seen a talk by Rüdiger Weis, where he says that you can combine two symmetric ciphers using XOR. According to him, that has the effect that its sufficient if only one of the ciphers is secure. ...
5
votes
1answer
270 views

Compact digital signature for noisy data

The question asks for a signature scheme, with a public verification procedure, that is tolerant to minor alterations of the signed data during its transmission [possibly in analog form over some ...
3
votes
1answer
40 views

SHA512 vs HKDF key expansion

I'm working on a secure file storage server. This server allows users to upload and download files based on a "seed". This "seed" is a 128-bit value. From this 128-bit seed, we run SHA512 to derive a ...
2
votes
2answers
245 views

Is Encryption without knowing the input directly possible at all?

I know the question is rather unusual, but let me clarify what I'm searching for: There is one person, lets call her $Alice$. $Alice$ has $n$ plaintexts $t_1..t_n$ and $n$ public keys $pk_1..pk_n$ of ...
2
votes
1answer
29 views

Using scrypt to generate key + IV/nonce together

Is there any security issue in using scrypt for Key + IV/nonce generation? In other words, can I safely use only a salt for scrypt and derive the nonce along with the key? For example: I have data I ...
4
votes
1answer
84 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
-2
votes
1answer
65 views

Shuffleless PRNG function with non-repeating values?

I need a simple PRNG function of type: Integer = PRNG(n, maxval) as I would like to count from 0 to maxval, not in a linear manner, but in a pseudorandom manner where I still use every value, but ...
1
vote
2answers
107 views

Is entropy being lost when the hash of a secret has a specific format?

Bitcoin's mini private key format works by brute forcing random data to produce a secret so that when appending ? and then hashing with sha256 it will produce a ...
1
vote
1answer
47 views

variant of Diffie–Hellman key exchange protocol

Motivation Consider the following variant of Diffie-Hellman key exchange protocol for two parties: Assume Alice and Bob share $\mathbb{G}$ of order $q$ generated by $g$ Alice samples $a$ ...
2
votes
1answer
21 views

Possible to detect if a message is PGP encrypted/signed (ciphertext)

Let's say I have a text field somewhere (i.e. an interactive user submitted text field on a PHP script, or a console application. Basically anything that accepts user input.) How can I detect if said ...
2
votes
1answer
586 views

HMAC-SHA1 vs HMAC-SHA256 for data storage

Reading the question “HMAC-SHA1 vs HMAC-SHA256”, I figured out that the known attacks on SHA1 don't apply to its HMAC version. So, HMAC-SHA1 is quite strong right now. In a protocol like SSL, if it ...
0
votes
1answer
123 views

Self-Convergent Hashing

What is the name of an algorithm that hashes its result as an embed of larger set of data that results back to the hash? For instance where $f(x)$ is the hashed result and $x$ is the dataset, and ...
5
votes
1answer
98 views

Is full Homomorphic encryption quantum resistant?

Since most of our asymmetric encryption algorithms are going to be out-of-date in a couple of year due to Shor's algorithm, I was wondering about the future of FHE schemes. I have found this paper, ...
10
votes
2answers
917 views

What is the difference between Shannon entropy and saying that tossing a 6-sided die 100 times has more than 256-bit entropy?

I'm confused. I thought that tossing a 6-sided die 100 times had a greater than 256-bit entropy because $6^{99} < 2^{256} < 6^{100}$. (A similar concept appeared in this XKCD comic, where ...
-1
votes
1answer
25 views

How ECDH algorithm selects modulus value?

I am curious to know how an ECDH algorithms select a module value, if both ends A & B can generate same shared key using the public key of each other ? If I understood DH correctly, both A and B ...
1
vote
0answers
30 views

Small subgroup attack on Diffie-Hellman

I am trying to understand the small subgroup attack on Diffie-Hellman. I will present the attack and try to explain why it works. Let be a group $\mathbb{Z}_p^*$ where $p$ is a large prime, so the ...
1
vote
0answers
10 views

keytool -genseckey -alias TDES -keyalg DESede -keysize 128 works within jre/bin folder but not when the keytool.exe is on another location [migrated]

I would like to create a TDES key with size 128bits and 2KTDES key with 192bits for authentication in a Desfire smart card. Hence I have used the keytool to generate the jceks with the following ...
2
votes
1answer
91 views

Why isn't a table used to solve the large number factoring problem?

Lots of modern encryption (RSA comes to mind) are based on the fact that factoring large numbers is hard. However, multiplying large numbers is much easier, and table lookups are very easy. Since ...
2
votes
1answer
65 views

What is this encryption system called?

Let's say you want to break down a message, for simplicity it is just a bit $0$ or $1$, $m$ into two messages $(m_1, m_2)$ as follows: If $m =0$, then $(m_1, m_2) = (0, 0)$ with probability $1/2$ and ...
1
vote
1answer
49 views

public key cryptography and authentication for cross-platform network application

I'm developing network based application for control and telemetry on Linux based embedded system. I'm using ZMQ network library and Google Protocol Buffers serialization library for communication ...
1
vote
0answers
30 views

Testing PRNG quality from ECC public keys?

Having a large set of ECC public keys $P_i = n_iB$ on a fixed curve $E$ over a prime field, is there a way to determine if coefficients $n_i$ were generated using a bad PRNG? In other words, can a ...
7
votes
4answers
185 views

Is it possible to get an RSA encryption key by comparing the unencrypted and encrypted file?

Exactly what the title says. If I have a RSA encrypted file, and the exact same file but decrypted, can I tell the key that was used from that information?
1
vote
0answers
24 views

Small n attack, how it works

I'm studying the Lamport's Hash one-time password scheme. This is the scheme: Alice wants to authenticate herself to Bob from a workstation that knows nothing about her. Alice only knows her ...
0
votes
1answer
52 views

File encryption with AES CTR mode

I understand that encrypting files in CTR mode is not perfectly safe, because it potentially leaves the files open for cryptanalysis, if the attacker has access to previous versions of the same files. ...
0
votes
0answers
10 views

Javascript equivalent to new SecretKeySpec(bytes[], “HmacSHA512”) [migrated]

what javascript equivalent code for following java code. SecretKeySpec key = new SecreatKeySpec(Bytes[], "HmacSHA512"); how can i acheive this in javascript ?? ...

15 30 50 per page