0
votes
1answer
62 views
How to hash a structure that needs to include that hash's outcome?
so I am busy writing a TCP protocol in which I send a "packet header" with each packet of data. This packet header is a structure that contains information about the data that was sent. I want to ...
4
votes
1answer
106 views
Injecting salt into PyCrypto KDF - useful?
I have noted some sources indicate that when using a KDF like PBKDF2 (alternatively) some advocate injecting the salt at the time of execution - like this:
...
1
vote
1answer
76 views
Attacking AES/CCM with random IV
A cryptosystem is using AES-128 in CCM mode with random IV.
Suppose an attacker capable of:
asking the cryptosystem to encrypt a single plaintext as many times as he wants; and
asking the ...
2
votes
1answer
112 views
Are digital signatures secure for signing lots of small messages?
I need to sign the numbers from 1 to 1 billion (literally this, it's not an analogy) using a digital signature and then send these numbers in a particular order to someone. The message is not private ...
-1
votes
1answer
52 views
Solving a discrete logarithm using GDlog
I am trying to calculate an x, such that t = g^x mod p (I need to crack a weak elgamal encryption for university). I found gdlog, but I cant figure out how I can use the input to calculate my x. Here ...
6
votes
2answers
184 views
RSA leak bits to factor N
Suppose you randomly generate large primes p and q as in RSA, and then tell me N=pq but not p or q.
Then, you would like to actually let me factor N, except you should tell me as few bits of ...
4
votes
2answers
210 views
Why is SRP not widely used?
SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations?
I tried to ...
-2
votes
3answers
119 views
how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media?
I want to store a password securely on a storage (suppose in a usual unencrypted file).
I use this password as AES key to encrypt itself (using AES-ECB) & then store it on the media (the password ...
0
votes
3answers
205 views
Implementing secret reconstruction in Shamir's Secret Sharing
I am trying to implement Shamir's secret sharing in C++.
I have got the generation of shares working.
However, I am very confused with the reconstruction of shares. I get the part on how three users ...
1
vote
2answers
102 views
Is there any strong enough pen-and-paper or mind cipher?
Some ciphers are talked about here, but I don't see an answer, are they strong enough, or are non-computer ciphers more or less just a toy and one should abandon using them for practical purposes?
0
votes
2answers
170 views
What's the difference between AES and earlier block ciphers?
Is there any difference except speed and key and block size from user's point of view?
Or does AES have something that ideal block cipher doesn't have?
1
vote
1answer
128 views
Indistinguishability attack example
I want solve the next exercise. The author defined the experiment for the cryptosystem $\Pi$, the adversary $A$ and the security parameter $n$ as follows
$\mathsf{PRIV_{EAV}}(\Pi,A,n)$
The ...
2
votes
2answers
149 views
How to derive two keys from one password
What is the best way to generate two independent symmetric keys from one user-entered password or passphrase?
Would using both scrypt and pbkdf2 achieve this?
1
vote
3answers
466 views
Is AES really used for Top Secret stuff?
I've read almost everywhere that AES-256 can be used for Top Secret material (in the US). Is it really used or is it some kind of decoy to hide the more advanced algorithm they might use ?
0
votes
1answer
47 views
recommendation for steganography tool? [closed]
I am trying to find a good and referenced steganography tool to make some tests, it its freeware it would be great. Does anyone knows any recommended tool for this task? I have found some free ...
1
vote
1answer
83 views
Elliptic Curve is DH function or PKI?
can we reuse same ECC key on TLS for long terms or it must be used just once? (i mean can we use ECC like RSA?)
is there patent free ECC implementation ?
-1
votes
1answer
92 views
What length should the padding be when encrypting or signing with RSA?
Does it matter what length the padding is? If so - what length should it be?
(Another point: Should it be random?)
3
votes
1answer
177 views
CBC-MAC , fixed length, all blocks returned
CBC-MAC, with fixed length message.
Is it safe to return all ciphered blocks instead of the last?
My intuition says it is less secure, since is gives an attacker more information.
But how could one ...
2
votes
2answers
99 views
encrypt message with one digest 0-9 instead of 01-26
How much will the security of one-time pad decrease if I use one digit from 0-9 instead of 1-26?
for example plaintext = "blue" and ...
1
vote
1answer
122 views
Encrypt a single file, chunk-by-chunk, each chunk using different key (AES)
Encrypt a single file, chunk-by-chunk, each chunk using different key.
I am a security newbie (only took 2 security courses before)
But currently I am using this encryption method for my Android ...
6
votes
2answers
150 views
Have I understood pedersen commitment correctly?
I want to do a one-sided integer commitment scheme. I.e. the whole process must be non-interactive where I at one point first publicly reveal some data and then at a later time reveal the committed ...
-1
votes
2answers
55 views
Book Didactic Security Notions [closed]
I want study more about cryptography reading papers, but I have a problems to understand few concepts: security notions, random oracle model, IND-CCA, ... etc. I began study this concepts by internet: ...
3
votes
4answers
255 views
Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash?
$H(s,r)=d$ is a function that hashes the secret string $s$ with a salt $r$, and returns a digest $d$.
$r$ may be arbitrarily chosen and each $r$ returns a different $d$.
For any $d$, $r$ is known from ...
1
vote
2answers
148 views
Is it worth applying a MAC on data in a HSM?
I'm building a basic HSM out of an Arduino, and am using the following scheme to store data:
Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction).
Secondary ...
1
vote
2answers
96 views
How to compare two datasets „anonymously”?
Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation:
There are 10 defined colors (blue, orange, yellow etc.)
There are ...
0
votes
0answers
37 views
Interesting game: decipher the following sequence [closed]
Decode the following sequence:
KROWE
MOHSI
HTDEY
OJNEI
The original cipher is printed in such matrix format
0
votes
3answers
96 views
Padding of Original Message in MD5
what should I do if my original message is greater than 64 bits? what is the process of padding in MD5?
As described in Internet Security: Cryptographic Principles, Algorithms and Protocols, page ...
0
votes
1answer
51 views
chaining rsa with ecies
In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric ...
5
votes
1answer
116 views
Proof that padded RSA is CPA-secure
I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA:
${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
1
vote
1answer
48 views
Adversary Two Stages
I am read this paragraph and I have a doubt.
"An adversary to PKC $\Pi$ is given by two probabilistic polynomial
time algorithms, $A = (A1; A2)$. In the first stage, the "find"
stage, the ...
2
votes
1answer
119 views
Why does key generation take an input $1^k$, and how do I represent it in practice?
In my lecture, the lecturer said:
Let $K$ be the key generation algorithm. Given a security parameter represented in unary, $1^k$, $K(1^k)$ will output a keypair $(pk; sk)$, known as the public ...
-1
votes
1answer
41 views
Sematically Secure McEliece
I am read the Lemma 2 (pp13) in the paper [1]. Here a make a question Why "for any $Hash_z$ and any $Gen$"? The author of paper reply
The reason why "for any $Hash_z$ and any $Gen$" is that if ...
3
votes
2answers
207 views
toy hash algorithm
I'm looking for a toy hash function, where the idea is to have high school students break (i.e. find a collision) a hash function by hand, in order to teach them how one way functions and hashing ...
0
votes
2answers
247 views
Custom crypto library in C
I will be making (in the near future) an app that will contain some pretty heavy crypto. As it is possible that my app will be ported to different devices (initially it will be iOs only, but Mac, ...
1
vote
1answer
100 views
Secure order preserving hash function
Is there a construction of an order preserving hash function that keeps the preimage property of a crypto hash function? By order preserving hash function (OPHF) i mean for $x<y$ then $OPHF(x) < ...
4
votes
2answers
160 views
what is the difference between Scrypt and PBKDF2
After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2 or am I missing something?
As far as I understood, the similarity is:
both are using ...
0
votes
1answer
50 views
Certificate == signed public key
For primes p and q used to create a keypair, I understand that the following operation is used to create a signature :-
M ^ d (mod N)
where d and N have their usual meanings and M is the message. In ...
1
vote
2answers
123 views
risk of attacker decrypting RSA ciphertext without public or private key
As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
1
vote
1answer
70 views
Counter Mode: static IV but different keys [duplicate]
Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue?
I know that in CTR mode, same key-iv ...
1
vote
2answers
90 views
standard way to authenticate parties with public keys without certificates
Is there some standard protocol for mutual authentication of two parties when there is possibility to use public key cryptography? The problem is that two parties can use public key cryptography but ...
0
votes
0answers
87 views
Adding and multiplication in jacobian coordinates
How can I derive formulas for adding and multiplication of 2 points in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
1
vote
0answers
70 views
Question about proof of knowledge defintion?
I am just reading the "soundness"-definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover $P$ and a verifier $V$. $P$ convinces $V$ to know a secret ...
-1
votes
1answer
41 views
Determine the Identity of Caller [closed]
Let me explain my situation.
I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
0
votes
1answer
99 views
RSA - Ecrypting the same data with the same public key = same ciphertext?
If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow?
The most obvious way is encrypting the guessed plaintext with my public key and the same parameters ...
3
votes
1answer
166 views
Secure encrypt-then-sign with RSA
I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt.
However, I have encrypted data that I need to sign, to prove the author of ...
1
vote
0answers
68 views
Is OAEP reversible?
Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for ...
3
votes
1answer
85 views
implementing long term archive encryption
Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways:
The ...
1
vote
1answer
84 views
How can a key pair be derived from an arbitrary hash?
If I correctly understand the concept of a "brain wallet" in BitCoin, you start with a passphrase, generate the hash of the passphrase, then somehow derive a public / private key from that to use as ...
1
vote
0answers
59 views
Algorithm digipass-like
I'm pretty sure there are famous algorithms for my problem, but I don't have enough knowledge in this field, so I need your lights.
Here si the problem :
Alice sends key X to Bob.
Bob has an ...
3
votes
2answers
192 views
AES - plaintext is smaller 128 bit - how to expaned?
we are currently developing a little AES implementation in a crypto-course at university.
As far as I know, AES uses 128 bit blocklength, so all data that will be encrypted will get split up into ...
