All Questions
1
vote
0answers
67 views
Known-plaintext attack on Blowfish in ECB mode
The protection scheme I faced recently seems so weak nowadays that a simple exhaustive key search would be enough to recover the user key in an acceptable amount of time (it's OK, since almost no ...
1
vote
1answer
87 views
Given a certain entrophy per character, how long should a passphrase be to guarantee key strength?
Given an entrophy of 1.5 bits per character, how long does a passphrase have the be to guarantee a key strength of a 128 bit random key?
Assuming an alphabet of 26, one character takes log2(26)=4.7 ...
-2
votes
2answers
119 views
May the problem with DES using OFB mode be generalized for all feistel ciphers
There is a problem with using DES as the block cipher in OFB mode, eg: the feedback that goes back into the next round will be encrypted with the same key $k$ resulting back into the plaintext IV used ...
2
votes
1answer
94 views
Does the IV need to be known by AES (CBC mode)?
I was thinking about this today and thought I should ask. I think I understand IV's enough to say that they are basically the same thing as Salts when talking about hashes. They are there to improve ...
0
votes
0answers
55 views
How do I generate decryption keys for the IDEA algorithm from the 128 bit key?
I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code:
...
0
votes
0answers
74 views
How secure is this perl script to use an AES encryption on files? [closed]
I am not entierly sure if it is appropriate to ask such a question here, but then again, I don't know a better place. If it is the wrong place, let me know, and I will remove it.
Could someone share ...
0
votes
1answer
38 views
PBKDF2 when dkLen and hLen have the same size
I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key ...
2
votes
1answer
74 views
Question about the definition of a secure PRF
I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF.
I understand the test goes as follows: A challenger picks a function $f$ such that
$f \leftarrow ...
0
votes
2answers
89 views
Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?
If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My ...
1
vote
1answer
65 views
Is there a preferred way/standard on how to transmit an initialization vector for AES encryption
Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
2
votes
2answers
66 views
Case insensitive verification of HMAC / Base64 signature
I am signing a short message using the base64 of an HMAC, like this (python):
...
0
votes
0answers
54 views
How fast can a wrong decryption key be detected using ECC?
When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that?
...
2
votes
1answer
53 views
Why constrain the message lengths in indistinguishability in the presence of an eavesdropper?
I need your help with a very basic concept in cryptography which I can't understand/prove on my own.
I'm trying to prove and understand why, under "indistinguishability in the presence
of an ...
2
votes
1answer
45 views
How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?
I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also ...
3
votes
1answer
53 views
Chosen ciphertext insecurity in an ElGamal variant
I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...
5
votes
0answers
39 views
Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem
If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows ...
3
votes
2answers
78 views
DSA signatures with related k and unknown payloads
Suppose that we are given DSA parameters $p$, $q$, $g$, a public key $y = g^x$, and two signatures $(r_1,s_1)$ and $(r_2,s_2)$. We are told that $(r_1,s_1)$ and $(r_2,s_2)$ were produced by related ...
1
vote
1answer
110 views
Attack on DSA with signatures made with k, k+1, k+2
For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages ...
2
votes
1answer
154 views
Understanding one-way hash functions construction
I understand the needs that lead to the development of cryptography and I am quite familiar with the uses we make of the cryptographic tools.
But, as a programmer, I am conditioned to see them as ...
2
votes
2answers
134 views
How can mega store my login details and still be secure?
I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works:
Upon first signing up for an account you make a ...
1
vote
1answer
73 views
What's the difference between “HashX-512” and “HashX-1024”?
I need to make a Skein hash's, specifically, Skein-1024; however, I only have access currently to Skein-512. Is there any way to utilize a Skein-512 function to get the result of a Skein-1024 hash?
...
5
votes
3answers
297 views
“Weaknesses” in SHA-256d?
According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:
SHA-256d(x) = SHA-256(SHA-256(x))
Apparently, the motivation for ...
3
votes
2answers
122 views
RSA digital signature vs authenticated cipher
I want to provide both confidentiality and integrity for data at rest (many large files stored on disk).
I plan to encrypt the data using AES, which will cover the confidentiality requirement.
So ...
0
votes
2answers
66 views
Voice Call Safety [closed]
When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep.
I was wondering if this procedure is secure against a Man In the Middle ...
1
vote
1answer
91 views
What's the difference between Trapdoor Functions and Encryption Functions?
From Wikipedia:
A trapdoor function is a function that is easy to compute in one
direction, yet believed to be difficult to compute in the opposite
direction (finding its inverse) without ...
1
vote
0answers
47 views
Predicate Encryption supporting disjunctions
I am not sure if I missed some subtlety in the definition of Attribute Hiding found in this paper on Predicate Encryption, but isn't it possible to construct a scheme for Predicate Encryption ...
0
votes
1answer
55 views
How to make a message into a polynomial on NTRU encryption?
How to make a message into a polynomial on NTRU encryption? for example how we can conver 'hello world' to polynomial...
i have read the converting operation on IEEE Std 1363.1- 2008, but i can't ...
4
votes
1answer
98 views
Client and server using same SSL certificate - any issues?
I'm working on software where multiple components will communicate with each other using SSL.
There would be one central component acting as a server, which would also require the clients to present ...
5
votes
1answer
98 views
Using encryption schemes for identification
I've been researching how to implement a post-quantum SSL-like connection authentication, especially correct identification&authentization of the server/client. Because good post-quantum digital ...
2
votes
0answers
97 views
Single-purpose symmetric encryption scheme for single files
I'm writing a simple password manager program that will encrypt/decrypt a single file (it's size will most likely stay under a few K). This is my initial file format design:
...
4
votes
1answer
103 views
Which MAC scheme is quantum resistant?
will HMAC survive Grover algorithm ? if not then which MAC scheme provide post-quantum security ?
1
vote
2answers
78 views
Can two rc4 encoded messages be XORed and decrypted if encrypted with the same key?
If I have the following:
E1 = RC4(M1, K);
E2 = RC4(M2, K);
If two different messages M1 and M2 are encrypted with the same key, K, can the key be recovered by ...
1
vote
2answers
95 views
It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?
I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
1
vote
1answer
201 views
What does the expression $1^n$ mean as a function argument?
In a paper about predicate encryption or attribute based encryption, the setup function is mentioned with the $setup(1^n)$ or $setup(1^l)$. I want to know what is meant here.
Is it multiples of ones ...
2
votes
2answers
151 views
Why are RSA key sizes almost always a power of two?
I know that other bit sizes are possible, e.g. this HTTPS server seems to have a 9000 bit key https://www.ssllabs.com/ssltest/analyze.html?d=qqq.gg, but it's very rare that one sees a key not of size ...
2
votes
2answers
114 views
one-time pad key related attack [duplicate]
In one-time pads we always say do not use same key twice to encrypt ASCII messages, but if we use a random key to XOR a random ...
0
votes
2answers
51 views
How can two UProve token holders prove to a 3rd party that they aren't the same user?
Suppose I have two users who are issued two different UProve IDs. The Issuer has guaranteed that one UProve token bearer will never have more than one UProve token ID.
How can I use UProve to ...
2
votes
2answers
85 views
How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?
In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring?
The private key is an ...
0
votes
0answers
79 views
How to choose between AES-CCM and AES-GCM for storage volume encryption
We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
2
votes
1answer
71 views
Potential vulnerability in DH key selection - am I understanding this right?
I'm reading through a DH implementation, and I think I found a potential hole.
Public $p$ and $g$ values are properly selected.
A candidate secret value $\bar a$ is pseudo-randomly selected such ...
2
votes
1answer
101 views
How to design a practical and secure MAC scheme?
I am sorry, but I need to introduce some concepts which are not directly related to cryptography to make myself clear, I hope I won't stun you with this ... (I'd rather explain it here than redirect ...
6
votes
1answer
104 views
Is SpookyHash vulnerable to HashDoS?
Aumasson, Bernstein and Bosslet did an excellent job demonstrating fatal weaknesses in MurmurHash and CityHash, but what about SpookyHash?
My first uneducated guess is that it would be much harder to ...
7
votes
1answer
190 views
Alice trusts Bob only when Bob trusts Alice
some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her.
Is this something ...
2
votes
2answers
146 views
Assymetric password encryption - Viable? Which algorithm?
We have an application that requires cleartext passwords for user authentication because of the authentication mechanism in use (RADIUS/CHAP), which unfortunately we cannot change. Since we don't want ...
2
votes
1answer
85 views
Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?
I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
2
votes
1answer
110 views
Is this hand cipher any more secure than the Vigenère cipher?
I know that inventing one's one crypto always sucks, but the problem is that hand ciphers are usually 1. very insecure 2. very slow. This is an attempt to make a relatively secure, keyable, and ...
-5
votes
1answer
39 views
AES ENCRYPTION ALGORITHM [closed]
What is the amount of decrease in the probability of decrypting a data encrypted using an AES algorithm? (That is by introducing each round out of ten whole rounds, how the probability of decryption ...
0
votes
1answer
156 views
What is the probability of breaking the AES algorithm?
I am doing a project which requires the encryption to be done using AES. Is it really possible (technically) to crack AES?
If yes, please tell me:
What is the probability of breaking AES?
How ...
3
votes
1answer
76 views
How to use HMAC for large ciphertexts over TLS
HMAC used to secure chosen cipher-text attacks. if we are encrypting a large file (video) and sending it over TLS for decryption, how server can check MAC for ciphertext when we didn't sent whole of ...
1
vote
1answer
94 views
which asymmetric cipher provide highest performance?
to get highest performance Which asymmetric cipher provide fastest encryption/decryption ? ECC or DH ? what key size is recommended today ?
