0
votes
0answers
27 views

Probability of IV/key reuse

I generate randomly both an initialization vector (IV) and a symmetric key (key) to feed an authenticated encryption scheme. How much IV/key combinations can I generate until the same combination ...
2
votes
1answer
146 views

In HMQV, can one use multiple identities with one public key?

The HMQV protocol has 2 "identity" fields $\hat{A}, \hat{B}$ that are used in the dual signature - and it tries to guarantee that any properly-generated session key is only shared by a single $(A, B, ...
1
vote
1answer
65 views

What are coding schemes for timing channels

I know we can hide information in the inter-packet delays, e.g. we can generate a code-book that each code-word corresponds to a message and is generated by realization of a specific random process. ...
0
votes
0answers
30 views

Has anybody implemented BGN cryptosystem to multiply two plain texts?

I have tried to use this code as follows, http://stackoverflow.com/questions/33581962/bgn-implementation-in-java but the issue is, when it generate the pairing, the output is in GTfiniteelement (for ...
5
votes
1answer
98 views

Transforming SHA-512 into SHA-512/256?

Based on my skimming over FIPS 180-4 it looks like the only difference between SHA-512 and SHA-512/256 is the initial hash value and the fact that the final output is truncated to 256 bits. My ...
3
votes
1answer
54 views

Difference between FleXOR and Free-XOR

I would like to know the differences between FleXOR and Free-XOR. I searched in the web but I couldn’t understand the information I found. I understand that there are both cryptographic methods as ...
2
votes
1answer
34 views

What's the difference between PBKDF and SHA and why use them together?

I've been reading a little bit about hashing lately and according to AgileBits, they use "SHA512 within PBKDF2" in their new vault file. I've looked in Wikipedia for both names and I know PBKDF2 is a ...
2
votes
2answers
66 views

TWO Fish MDS and PHT

Twofish was an AES candidate and it uses 4x4 Matrix as MDS followed by a PHT. The Branch Number of MDS and PHT is 5 and 2 Respectively. from formula Branch Number = Minimum of [HammingWeight(Input) ...
3
votes
2answers
61 views

Is Schannel supposed to use SHA1 for (EC)DHE params?

I captured a TLS 1.2 handshake on my server (WIN2012.R2/IIS 8.5) and noticed that SHA1 is being used to hash ECDHE parameters despite both the server and client(s) supporting SHA2 signatures. ...
6
votes
2answers
62 views

How to test implementation of primality tests like Miller–Rabin?

The Miller-Rabin primality test is an algorithm for checking if number is a prime. What would be best way to test implementation of such algorithm (or any primality test in general)?
21
votes
2answers
2k views

Why is PuTTYgen-created RSA public exponent(e) not in {3,17,65537}?

As far as I know, RSA public exponent(e) should be one of {3,17,65537}. However, I found PuTTYgen-created RSA public exponent(e) is 0x25(37) by default,as follows, (PuTTYgen version: 0.66) I am ...
3
votes
2answers
120 views

What is a purpose of reducing lattice basis?

This may be too broad question but it is not. I have been studying lattices for few months now, more specifically I studied: lattice problems ($SVP$, $CVP$ and etc.) lattice cryptography in post ...
-2
votes
1answer
72 views

What is the security gain of applying Two S-boxes in Different Ways?

In a 128-bits Feistel Cipher: I need suggestions about two variations of the Round Function Variation-1 $64$ bit input is divided into $8$ bytes Byte $0,1,2,3$ are substituted with Sbox1 Byte ...
-1
votes
1answer
43 views

How do you work out the private key in a RSA cryptosystem knowing a certain public key?

The public key: n = 85 and e = 19 I know that n is the product of two prime numbers, now is it right of me to figure them out by process of elimination which I got p or q equals 17 and 5. Or is ...
0
votes
1answer
54 views

Zero Knowledge Proof extended Schnorr - average secrets

I am trying to compute and an overall average number of given secrets from inside the commitments. I have the following set-up: Three commitments; $C_{1}(id, num, r) = g_{1}^{id} g_{2}^{num} ...
1
vote
1answer
56 views

Are the following schemes based on a pseudo-random permutation secure?

I am currently working on the following task: Let F be a pseudorandom permutation. Consider the encryption scheme for the message space $\{0, 1\}^n$ defined as follows: $Gen(1^n)$ chooses ...
-1
votes
0answers
6 views

Effective ways to find partial sha1 collision [migrated]

I need to find 2 different string and compare their hash value. Both string must contain "abc". I looking for the first eight character that are the same and stop. I have been running for more than 24 ...
0
votes
1answer
43 views

How are security proofs done in ABE Schemes?

I have been studying several ABE schemes and I understand the security assumptions and the several types of security models used for the security game between the Challenger and the Adversary. What ...
1
vote
1answer
31 views

Why does Carter-Wegman MAC have 2n-bit output?

The Coursera course on Cryptography 1 has a section about Carter-Wegman MAC. Here is the image of slide: Now my question is both $F$ and $S$ output $n$-bit strings. We XOR two $n$-bit strings and we ...
1
vote
0answers
39 views

DTLS 1.2 Finished message

I am implementing DTLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. Below is my client finished message Can anyone explain this message? How many bytes for verify data? Is there ...
0
votes
1answer
43 views

CPA on theoretical OTP with CBC mode

Body of question Note: this is THEORETICAL exercise. I understand OTP and CBC does not get along. I have to find a CPA on CBC enc-mode using OTP as the encryption algorithm, s.t a new key is ...
2
votes
1answer
90 views

RSA Encryption problem for Discrete Math

I am doing practice problems for my upcoming final exam, and am having trouble with this RSA encryption problem. If any one could check to see if i did these correctly, it would be greatly ...
0
votes
1answer
58 views

How to decrypt an RSA ciphertext given an oracle providing the lower 8 bits of decryptions?

I have access to an oracle that can encrypt and partially decrypt a number with RSA-1024 algorithm. For encryption: \begin{equation} C = M^e\bmod n \end{equation} But for decryption, result will ...
2
votes
1answer
45 views

How do you prove an encryption scheme is IND-CPA or IND-CCA?

I know for proving a scheme is not IND-CPA or not IND-CCA you can construct an Adversary which has an unfair advantage in an experiment/game, but how would you prove a scheme is IND-CPA or IND-CCA?
0
votes
2answers
468 views

How does hash function in Elgamal signature scheme prevent existential forgery attack?

I have heard that hashing the message M prevents an existential forgery attack. I was wondering how.
2
votes
1answer
73 views

How to construct Hash function of type $H:\{0,1\}^x \times G \mapsto Z_p^*$?

In many cryptographic protocols design, I have seen the statement 'Choose a Hash function $H:\{0,1\}^x \times G \mapsto Z_p^*$ i.e a hash function which takes as input a binary string of finite ...
3
votes
1answer
37 views

Is the following 4 digits code generator secure and non-deterministic?

In a C# WCF service, I need to send a 4 digits code by SMS to validate a user account/password. For security reasons, the code has to be non-deterministic (so that a malicious user/hacker should not ...
1
vote
1answer
61 views

How is the block size of a block cipher related to how susceptible the block cipher is to a birthday attack?

For example what can you say about how susceptible Triple-DES is to a birthday attack due to the fact that it has a block size of 64-bits.
0
votes
1answer
46 views

Secret construction

Given set of random strings $w =\{s_1, s_2, s_3 ... s_n\}$ are there any algorithms to construct single master secret $S$ from them? Subsequently we should be able to deconstruct the $S$ back to ...
1
vote
1answer
108 views

tls 1.2 finished message stucture

I am implementing TLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. According to RFC 5246 finished messages have {verify_data[verify_data_length]} and verify_data = PRF(master_secret, ...
1
vote
0answers
24 views

Security of randomized data dependant key schedules?

An example to demonstrate the point with two Feistel networks: Cipher A: \begin{align} roundkey = hash(key || counter)\\ roundkey = hash(key || roundkey)\\ left = left\oplus hash(roundkey || ...
-1
votes
0answers
28 views

Block Cipher vs PRP in CBC?

What is the difference between using a Block cipher and a Pseudorandom Permutation in Cipher Block Chaining mode, which is better?
1
vote
1answer
52 views

Handshake SSLv2, SSLv3, TLS

Can someone confirm that SSLv2, SSLv3, and TLS have the same Handshake process (ClientHello/ServerHello, ..., ClientKeyExchange ...)? If not, can you tell me the main differences between theses three ...
0
votes
0answers
53 views

Crack multiple One-Time-Pads with same key [duplicate]

I've got 12 pads, all with a length of 50 characters, except the last one. I also know, that the key has got a length of 50 and that the key has been re-used on all of the 12 pads. What do I have to ...
1
vote
1answer
73 views

Properly storing an E-mail Password

I'm creating a messaging application that will use an outlook account to send an email. However, I'm unsure about the proper steps to store the e-mail password on the user's computer. Suppose I had ...
0
votes
1answer
42 views

Difference between single-pass and two-pass MACs

I am having trouble understanding where the count of "passes" come in. What constitutes a pass in the context of message authentication codes? How are single-pass MACs achieved?
1
vote
1answer
38 views

How to increment the counter value for CTR mode?

I am testing CTR mode on STM32 board. I want to know how the auto increment of counter happens and what is the method to follow if I have to increment the counter manually.
0
votes
0answers
27 views

check user signed in group signature

I have $N$ users, all of them creating a group digital signature. Also I have user $A$. How can I check if user a signed or not signet in this signature? Is it possible ? Are there other methods how I ...
1
vote
1answer
69 views

Is it safer to use timestamp in REST authentication?

I am working on a personal project to build a REST authentication system which authenticate clients via three parameters: ...
5
votes
1answer
26 views

What security checks do I need for SRP-6a?

I'm implementing an SRP-6a login system. What security checks do I need to do? Note that the modulus is sent to the client at algorithm startup. Here is the list I have so far. I'm using the ...
1
vote
0answers
33 views

How to break a Quagmire 3 cipher?

What would be a good way to go about attacking a Quagmire 3 cipher? I understand that it is polyalphabetic with a key and an indicator. I have started by taking the cipher text, taking every n-th ...
4
votes
1answer
67 views

Statistical tests for PRNG that generates a sequence which is not binary

Is there a pratical application to PRNG that generates a sequence which is not a binary one? A ternary, quaternary sequence, for instance. If so, how can we test this? Is there any alternative test ...
2
votes
0answers
38 views

Is this PRG secure?

$G$ is a safe PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$. Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$. Is $G'(S)$ a secure PRG? ...
-2
votes
1answer
21 views

How to find HEXA value of String [closed]

This may be very easy thing, but i am just unable to understand this. I have a string "Hi", and in HEXA its written like this ...
0
votes
1answer
40 views

Security of AES CTR with multiple messages containing the same known plain text

I have this scenario: The same plain text (that is part of an unkown bigger message) is being ecrypted multiple times using AES 128 CTR with a random key, the key is being transfered encrypted using ...
7
votes
2answers
65 views

Conditions for a successful Differential Power Analysis attack

From this paper, there are two conditions for a successful DPA attack: i) there exists an intermediate variable in the implementation that is correlated with the power consumption and ii) ...
-3
votes
1answer
40 views

Binary fast exponentiation method

Evaluate $17^{93} \mod 23$ \begin{align}e &= 93\\ &= 1 × 2^6 + 0 × 2^5 + 1 × 2^4+ 1 × 2^3 + 1 × 2^2 + 0 × 2^1 + 1 × 2^0\\ &= |\ 1011101\ |_2 \end{align} Then we have: ...
0
votes
1answer
15 views

DROWN - decrypting ServerVerify message is not enough?

I have read this article, but I can't understand why after decrypting ServerVerify, the client needs to send the export grade PMS again... When exploiting these flaws the attacker will send its ...
5
votes
2answers
166 views

Should HMAC-SHA3 be preferred over H(C(k,M))?

If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC. ...
0
votes
0answers
11 views

Rotate values in predefined manner

I want to create a Server S1, that publish a different value every 10 minutes on the internet. The value looks something like f7826da6-4fa2-4e98-8024-bc5b71e0893e. ...

15 30 50 per page