3
votes
2answers
120 views

Clarification on the origin of `01` in this oracle padding attack?

I have found what I believe to be a straightforward explanation of the oracle padding attack here: http://robertheaton.com/2013/07/29/padding-oracle-attack/ I am however getting confused by something ...
2
votes
1answer
627 views

length extension attack on an MD5 hash of a text file of about 10K Bytes?

How much computing time on a typical desktop computer would it take to find a new length and new data to extend a text file of about 10K Bytes with a given MD5 hash?
0
votes
1answer
708 views

Uniform distribution/randomness of characters in the sha256 hash?

I'm using the sha256 algorithm to generate a number in one of my programming projects. A sha256 hash is calculated from three strings: one the user can edit, one the user can view but not edit and one ...
4
votes
0answers
44 views

How does Ring Learning with Errors work? [closed]

I read that Google want to integrate this into HTTPS because it is safe against quantum computers. However, the Wikipedia article might as well be written in Latin because it makes very little sense ...
1
vote
1answer
61 views

HMAC vs CMAC, which is faster?

I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will ...
0
votes
1answer
315 views

RSA and ECDSA Certificate Sizes

Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the ...
8
votes
2answers
134 views

Proof that perfect privacy implies that the number of keys is at least the number of messages

I was reading a proof to the statement: Perfect privacy implies that $|K| = |M|$ where I am pretty sure that $K$ is the set of keys and $M$ is the set of messages. The proof is the following, ...
4
votes
1answer
188 views

How to prove that a function F isn't a pseudo random function

Let $F$ be a length-preserving pseudorandom function. For the following constructions of a keyed function $F' : \{0, 1\}^n \times \{0, 1\}^{n−1} \to \{0, 1\}^{2n}$, state whether $F'$ is a ...
3
votes
1answer
53 views

How to glean info from a message that simply has the letters shuffled?

Suppose someone had published a several hundred page (sensitive) book, but had randomized all of the letters in an order known only to them (e.g. with a vector of random numbers of the same length as ...
1
vote
1answer
66 views

Plaintext for randomness evaluation of cryptographic algorithms?

I’m running an experiment to test the randomness output of many cryptographic algorithms based on INST test suite to measure the randomness of their outcome. However I’m searching to a sample data ...
3
votes
1answer
125 views

TLS RSA Certificate with Elliptic Curve Negotiation

When I look at Google's Public Key in Firefox I get PKCS #1 SHA-256 With RSA Encryption Yet according to SSL Labs Google has EC 256 bits / SHA256withRSA and supports ...
0
votes
0answers
20 views

Secure algorithm for calculating token and comparison

I am trying to define algorithm that would create a irreversible token from IDs, which are 10 digit information, and then would be compared on two different end points. Between end points, only ...
2
votes
2answers
141 views

Ciphertext with uneven letter distribution

I have a ciphertext encrypted with an unknown method. It is part of a challenge (personal quest), so I can not post it. The letter statistics is the following: ...
5
votes
1answer
77 views

Best differential characteristic for this PRF

Consider the following construction of a PRF $F: \{0,1\}^{128} \times \{0,1\}^{64} \to \{0,1\}^{64}$ on 64-bit messages and 128-bit keys. Define $f:\{0,1\}^3 \to \{0,1\}$ by $$f(c,x,y) = \begin{...
0
votes
1answer
29 views

What are the benefits of being able to choose (most of) the public key in a PKC?

We're developing a public key cryptosystem whose ciphertexts are actually much more long than the plaintexts (which, according to this question, is more a benefit than an issue). However, we have a ...
3
votes
1answer
51 views

Is there a problem in a PK cryptosystem if the plaintexts are very small compared to the ciphertexts?

I'm wondering, suppose we have a public key cryptosystem $P = (pk,sk)$ such that $$pk: \{0,1\}^n \to \{0,1\}^{n^2},$$ that is, the ciphertexts are $n$ times longer than the plaintexts (here, $n$ is ...
6
votes
1answer
84 views

Efficiency of oblivious algorithms vs non-oblivious algorithms?

Recently, plenty of researchers are looking at designing efficient data-oblivious algorithms. Roughly speaking, an algorithm is said to be data-oblivious if its data access patterns are independednt ...
4
votes
2answers
73 views

Chance of finding the right key by exhaustively searching on half of the key space

An exhaustive search of half the key space requires $2^{n-1}$ work and provides the right answer 75% of the time. If the attacker finds the key, he knows the answer. If he doesn't find the key, he ...
13
votes
2answers
617 views

Is braid-based cryptography proven insecure when looking towards post-quantum cryptography?

Braid groups has drawn the attention of cryptographers for a few years, as a promising platform for post-quantum cryptographic protocols. The security of the proposed schemes mostly relied on ...
12
votes
2answers
349 views

How were shift amount constants in MD5 found?

The md5 specification gives a series of 4 rounds to execute over a 16-word block. Each round has a repeating sequence of 4 shift amounts (s in ...
0
votes
1answer
38 views

PBKDF2 with the same salt for all IDs

I have a unique identifiers that I would like to keep secure and provide information about it through tokens. These tokens should be verifiable after using the same algorithm on other end system with ...
5
votes
1answer
100 views

How to prove a function is pseudorandom function?

I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell. I am using a function having $F_{k}$ = $A_{k}(B_{k}(r,m),r)$, the random number is generated using the ...
26
votes
1answer
6k views

How was the special DES key 0E329232EA6D0D73 found?

The DES key 0E329232EA6D0D73 has the unusual property that decrypting a ciphertext block consisting entirely of zeros gives a plaintext block consisting of eight repetitions of the same byte (0x87). ...
3
votes
1answer
73 views

How to compromise the privacy of NaCl encrypted messages, when nonce is reused?

I want to know to how break NaCl encryption when a nonce is used more than once for a given key private key. According to PyNaCl docs: It is VITALLY important that the nonce is a nonce, i.e. it is ...
0
votes
1answer
53 views

What is a simple information authentication protocol for constrained devices?

Background: I have an application where devices will poll information from some source on the network. These devices are very basic and have modest processing and memory capabilities. Hashing (and ...
11
votes
0answers
267 views

AMD's implementation of RDRAND instruction

The latest AMD programmer manuals, dated June 2015, include the RDRAND instruction in the instruction set. For completeness, it lacks ...
1
vote
1answer
60 views

RSA key generation gives d=1

I was reviewing RSA by hand. I picked 53 and 59 as my primes. For e I picked 5. When I solved for d using extended euclid, I got 1 which obviously doesn't decrypt anything. I checked my answers online ...
4
votes
0answers
39 views

Cracking a PRNG by observing ranks within groups of its output

Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...
3
votes
3answers
67 views

Keyless Signature Infrastructures as a secure Post-Quantum Scheme

I came across a company that relies on hashing, similar to block chain technology. They explicitly stated in their white paper that hash based cryptographic schemes are inherently post-quantum ...
1
vote
1answer
53 views

Can we use a sort of “hash” function in CTR mode instead of a block cipher? [duplicate]

CTR mode does not use the decryption function at all, only the encryption function. This may suggest that a different primitive that has this "one-way" property could do the trick. For instance, I ...
1
vote
0answers
28 views

Authenticating a range of a ciphertext

I have some data that I CTR-AES-256 encrypt already. I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc). But none of ...
2
votes
1answer
194 views

2DES vs. two-key triple encryption, with no decryption step

So studying double encryption (double DES) and understanding why it is subject to a meet-in-the-middle attack, I tried to see if the same attack could be applied to a triple encryption with only two ...
0
votes
0answers
15 views

PAN authenticatable irreversible tokenization algorithm

I need to implement algorithm to create authenticatable irreversible tokens from PAN, without using any secrets. Is it possible? Is there any standards for that from associations? I was thinking ...
1
vote
1answer
97 views

Encrypting a string as smaller pieces vs. encrypting it as a whole

Is there any difference between these two ways to encrypt a string using FPE? Say the string has the format is specified by this rule First part is in the set $S = \{\text{AA,AB,AC,BA,BB,BC,CA,CB,CC}...
-3
votes
0answers
33 views

What does the encyption part of RSA entail?

As part of an assignment I have to encrypt and decrypt the following two block message (115, 209), using two primes (p = 17, q = 13). e = 5. I computed n to be 221 (17 * 13) and I confirmed that e ...
33
votes
2answers
17k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is pubic? What ...
3
votes
3answers
109 views

DIY message level security?

This might be in danger of being too elementary a question for this community but I'm hoping for expert help: Assuming that TLS is not enough to protect messages transmitted between a client and a ...
1
vote
0answers
25 views

Anonymous Identity-based broadcast encryption use single common key or different keys

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. In some cases, they use some function $f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ ...
4
votes
0answers
75 views

Would LWE problem be still secure if error were like this $e=2e_1$?

In the Learning with error problem, if the error term $e$ from equation $b=<a,s>/q+e$ were of this kind $e=2e_1$, where $e_1$ is chosen according to the probability distribution for the LWE ...
8
votes
1answer
103 views

How to calculate active s-boxes from branch number?

If MDS in AES has branch number 5 (so 5 active s-boxes in 2 rounds), wouldn't that mean 4 rounds of AES has $5*2=10$ active s-boxes? AES paper says it has 25 ($5^2$?) active s-boxes in 4 rounds. How ...
4
votes
1answer
43 views

What are the differences between X9.31 RSA operation and PKCS#1 RSA operation?

NIST and other - mainly older - standards often don't just mention PKCS#1 RSA algorithms but also X9.31 RSA algorithms. What are the differences between X9.31 and PKCS#1 (v2.1) with regards to key ...
1
vote
1answer
28 views

RSA I2OSP & OS2IP in RSAPSS verification

I started working with RSA two weeks ago. But I coudn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algo. I am ...
4
votes
2answers
423 views

Key recovery when AES ECB is used for short but repeated messages

My question is based on the specification of the protocol LoRaWAN and especially on the part 6.2.5 Join-accept message. It is said that the join-accept message is encrypted using AES ECB. This is (...
4
votes
0answers
42 views

Security proof in (Ciphertext-Policy) Attribute-Based Encryption

I am having hard time understanding the security proof in Attribute-Based Encryption, especially in Ciphertext-Policy Attribute-Based Encryption. To do reduction in CP-ABE scheme, how do I check that ...
1
vote
1answer
49 views

What does this advantage statement signify?

In many Attribute Based Encryption papers I see this line... The advantage of an adversary A in this game is defined as Pr[b' = b] − 1/2. Can someone explain what it means to me? I assume it means ...
4
votes
1answer
778 views

What is adversary's advantage in cryptography and why we use it?

The definition of adversary's advantage seems a bit odd for me and I am wondering why do we use it to measure the power of an adversary rather than just use the probability of a PPT adversary ...
4
votes
1answer
98 views

Does Coppersmith's method always finds non-trivial factor of integers of the form $n=a(2^k b+1)$ assuming $1 < a<2^k b +1$ and $b < n^{1/4-0.05}$?

Crossposted from mathoverflow. Got an argument and numeric evidence that pari's implementation of Coppersmith's method finds non trivial factor of integers of certain form under some assumptions very ...
0
votes
2answers
43 views

What info should be signed with a digital signature to provide entity authenticaton for DH?

$i \to r\colon\; g^x\bmod p$ $r \to i\colon\; g^y, \langle g^y,g^x\rangle_r$ $i \to r\colon\; \langle g^x,g^y\rangle_i$ Looking at run 2, I am trying to work out why it is necessary to include $g^x$ ...
-1
votes
0answers
29 views

Finding Probability in simulation of identity-based encryption [duplicate]

I have found such kind of demonstration in security proof. I don't know concept of $\epsilon$ and why $\frac{1}{2}$. Moreover, why subtraction is done $$|Pr[B(P,aP,bP,cP,e(P,P)^{abc}=1]-Pr[B(P,aP,bP,...
0
votes
0answers
9 views

Error when decompress smime file [migrated]

I receive this file from my friend. I use command to decompress it: openssl cms -uncompress -in myfile.txt -out content.txt but there are error: ...

15 30 50 per page