6
votes
4answers
3k views

What are the requirements of a nonce?

Sometimes I read that a nonce has to be a random number but I disagree. A nonce just can't repeat itself. You could increase in by 1 every time if you are sure it would never repeat.
6
votes
1answer
3k views

Low Public Exponent Attack for RSA

I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
6
votes
1answer
2k views

Is a known plaintext, ciphertext, and public-key a viable attack on RSA?

Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key. Alice and Bob each have their public- and private-key pairs ...
6
votes
2answers
531 views

Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?

There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
6
votes
1answer
1k views

Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?

I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
4
votes
1answer
206 views

Is there a format preserving cryptographically secure hash?

I want a way to 'scramble' strings (like words, names) in a predictable way but I don't ever want to (myself or anyone else) be able to 'unscramble' the strings. I found that perhaps what I am ...
4
votes
1answer
795 views

What is a smart card?

In many cryptographic protocols, some information is transmitted within smart cards. So, what is a smart card? Is it a physical card? What are they used for in cryptographic protocols?
4
votes
2answers
3k views

How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ...
2
votes
1answer
543 views

How can I calculate the Rijndael SBox?

I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
1
vote
2answers
760 views

Combining multiple symmetric encryption algorithms - implications?

I was just wondering if I add more security by combining two or more symmetric encryptions on a plain text. For example: Plaintext → AES → Twofish → Serpent Of ...
12
votes
1answer
324 views

RSA with probable primes

I am a bit of a newbie to RSA encryption, so please be patient. I understand that for a 4096 bit RSA, the numbers p and q should be prime. And to have the best security, the p and q should both be ...
11
votes
5answers
1k views

Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
10
votes
2answers
819 views

Can AES decryption be used as encryption?

Definition E: AES encryption D: AES decryption x: plain text y: encrypted text k: key In original AES cipher, encryption: y = E(x, k) decryption: x = D(y, k) Then I define the "reverse AES ...
10
votes
1answer
634 views

How random are commercial TRNGS

I'm thinking about buying a USB TRNG. How do I evaluate its randomness? I'm sure some are better than others but which is which? Are thermal-noise better than radio-noise TRNGs?
10
votes
4answers
3k views

What is the difference between a stream cipher and a one-time-pad?

A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$. This key-stream is ...
9
votes
6answers
11k views

Difference between encrypting something and hashing something

What is the difference between encrypting something and hashing something? in what situations would I want one or the other?
8
votes
1answer
2k views

What is a tweakable block cipher?

Pretty simple question - but I can't seem to find much information about it. What exactly is a tweakable block cipher? How do they differ from traditional block ciphers? What is the 'tweak'? Is it ...
8
votes
8answers
619 views

Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
7
votes
0answers
354 views

Security of RSA for paranoids with padding?

RSA for Paranoids (RSAP) (in cryptobytes v3n1), also known as Unbalanced RSA, is a variant of RSA proposed in 1995 by Adi Shamir, as a mean to increase the RSA public modulus size while keeping ...
7
votes
2answers
1k views

Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?

The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
7
votes
1answer
583 views

CBC key lifetime, or, “how big is too big?”

IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB. My case isn't using IPSec, ...
7
votes
1answer
2k views

Deterministic nonces in CTR mode

I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
6
votes
1answer
497 views

How random is the shared secret in the Diffie Hellman key agreement

How random is the value $ZZ$ in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
6
votes
1answer
1k views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
6
votes
2answers
1k views

Constructing a block-cipher from a hash function

It is possible to use a hash function to construct a block cipher with a structure similar to DES? Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it ...
6
votes
5answers
5k views

Why do we need asymmetric algorithms for key exchange?

In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
6
votes
2answers
488 views

What is the key strength reduction encrypting only 160 bits of data using RSA1024 for signatures?

I am attempting to determine the strength of an incorrectly implemented 1024 bit RSA signature scheme. The weakness in the implementation is that the padding data lacks random numbers. As a result, ...
6
votes
1answer
981 views

Why doesn't preimage resistance imply the second preimage resistance?

Let the preimage resistance be defined as »given a hash value $h$, it is hard to find any message $m$ such that $\operatorname{hash}(m)=h$«, and let the second preimage resistance be defined as »given ...
5
votes
1answer
238 views

Entropy when iterating cryptographic hash functions

Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings: $$ \DeclareMathOperator{\H}{H} \DeclareMathOperator{\SHA}{SHA-256} \H(x) : \left\{0,1\right\}^{n} \mapsto ...
5
votes
1answer
1k views

AES mixcolumn stage

I'm studying AES, and am having problems with the "mixcolumn" stage. I read about finite fields, but I still don't know. How do I construct $GF(2^8)$? ...
5
votes
2answers
2k views

In RSA, why is it important choosing e so that it is coprime to φ(n)?

When choosing the public exponent e, it is stressed that $e$ must be coprime to $\phi(n)$, i.e. $\gcd(\phi(n), e) = 1$. I know that a common choice is to have $e = 3$ (which requires a good padding ...
4
votes
1answer
325 views

Is knowing the private key of RSA equivalent to the factorization of $N$?

Given the RSA modulus $N$ the fastest method to factor it is of sub-exponent order. But, now if I know the private key $d$ of RSA, does that mean I can factor $N$ efficiently?. It intuitively seems ...
4
votes
1answer
3k views

Why, or when, to use an Initialization Vector?

i'm trying to figure out when an Intialization Vector (IV) should be used. There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
4
votes
4answers
1k views

Webapp password storage: Salting a hash vs multiple hashes?

For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better. But, if bad guys steal your ...
3
votes
1answer
1k views

ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, signature-based approach is used. After we've implemented it ...
3
votes
2answers
2k views

Attacking 2DES efficiently

Meet in the middle on 2DES uses $2^{56}$ memory. Given the fact that the attacker has only $2^{45}$ memory. How can the attacker adjust the attack so even with this memory limit, it will still be more ...
3
votes
2answers
3k views

Why is AES not a Feistel cipher?

I am studying for an exam right now. And I wanted to make sure I got this point correct. AES is not a Feistel cipher because the operations in AES are not invertible. Is the above statement ...
2
votes
2answers
299 views

How to verify a number encrypted with an unknown key

Alice and Bob are going to follow the protocol below. Are there any crypto-constructions to help Bob verify the correctness of the answer he gets?: Alice encrypts a set of numbers using some ...
-1
votes
2answers
366 views

Shamir Secret sharing - Can share generator keep x values secret?

I'm wondering, in Shamir secret sharing, can generator of the shares, keep the x values which are used in evaluating the polynomial to obtain y values (i.e., the shares) secret, and whenever the ...
10
votes
1answer
1k views

Related-key attacks on AES

According to Wikipedia: Related-key attacks can break AES-192 and AES-256 with complexities $2^{176}$ and $2^{99.5}$, respectively. What are the requirements for these attacks (i.e how many ...
9
votes
3answers
838 views

Elliptic Curves of different forms

Looking at http://safecurves.cr.yp.to/ to find a safe curve, I find that most curves described here are of a different form from that generally used. In Bouncy Castle, for example, ...
9
votes
3answers
523 views

Is it reasonable to assure that p-1 and q-1 aren't smooth?

I came across the requirement that, in RSA, $p-1$ and $q-1$ shouldn't be smooth, shouldn't consist of lots of small factors. Therefore my question: How complicated is it to check whether $p-1$ is ...
7
votes
3answers
3k views

Relative merits of AES ECB and CBC modes for securing data at rest

I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data. I assume the ...
7
votes
1answer
596 views

Why are elliptic curve variants of RSA “chiefly of academic interest”?

Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
7
votes
1answer
815 views

A fair peer-based coin-flipping protocol?

I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight. This is how my idea ...
7
votes
1answer
194 views

In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?

In the 1978 RSA paper, it is recommended, among other things, to choose primes $p$ such that $(p-1)$ has a large prime factor $u$. This was motivated by Pollard's p-1 algorithm. Further, the authors ...
5
votes
1answer
286 views

Is HMAC needed for a SHA-3 based MAC?

HMAC does nested hashing in order to prevent Length Extension Attacks. Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that ...
5
votes
2answers
259 views

Is multiplicative secret sharing secure?

I suggested mulitiplicative secret sharing in an answer to another question, but noted that I wasn't sure if it was even secure and was hoping someone would comment on the security. Since no one did, ...
5
votes
2answers
1k views

Why can't the IV be predictable when its said it doesn't need to be a secret?

I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should ...
4
votes
1answer
894 views

Luby-Rackoff theorem confusion

The Luby-Rackoff theorem states that if a round function is a secure pseudorandom function (PRF) then 3 rounds are sufficient to make the block cipher a pseudorandom permutation (PRP). PRPs are ...

15 30 50 per page