10
votes
3answers
460 views

Are these emerging threats against AES affecting your designs?

Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount. The first key recovery attack on the full AES-128 with computational complexity ...
10
votes
3answers
382 views

How broken is a xor of two LCGs?

Suppose we define a PRG as the xor of two LCGs modulo a 64-bit prime: something like the following Python code. ...
10
votes
1answer
2k views

ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
10
votes
1answer
441 views

How random are commercial TRNGS

I'm thinking about buying a USB TRNG. How do I evaluate its randomness? I'm sure some are better than others but which is which? Are thermal-noise better than radio-noise TRNGs?
10
votes
2answers
3k views

What is difference between PRG, PRF, and PRP

Until what I have gotten is: A PRG is generator is a part of PRF that produces pseudo-random values for the function. PRF is semantically secure and has no worries of being invertible. Fine, then ...
10
votes
2answers
347 views

Is RC4 a problem for password-based authentication?

This is a follow-up question to Does TLS use RC4-drop[n]?. As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that ...
10
votes
3answers
304 views

Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such?

Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute ...
10
votes
3answers
413 views

What is a Non-Interactive Zero Knowledge Proof?

I understand the concept of a Zero Knowledge Proof thanks to the easy to understand analogy of Alibaba's cave. However, this seems to require interaction between the verifier and the other party. I ...
10
votes
4answers
591 views

Is there an intuitive explanation as to why only the private key can decrypt a message encrypted with the public key?

I have just learned about using PGP/GPG for email encryption and one thing has always bugged me: How is it possible that a message encrypted with somebody's public key can be decrypted only with that ...
10
votes
2answers
792 views

Can I select a large random prime using this procedure?

Say I want a random 1024-bit prime $p$. The obviously-correct way to do this is select a random 1024-bit number and test its primality with the usual well-known tests. But suppose instead that I do ...
10
votes
2answers
8k views

When to use RSA and when ElGamal asymmetric encryption

If i am not wrong in cryptography there are 2 basic cryptographic schemes for public key cryptography. RSA encryption whose security is based on the infeasibility of solving the factoring of big ...
10
votes
2answers
2k views

Strength of multiple hash iterations?

Is it correct that increasing the iteration possibly decreases the cipher strength but increases the amount of time it would take to find the original hash values if using brute-force on a given hash? ...
10
votes
3answers
916 views

Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)?

Related to "Is it possible to derive the encryption method from encrypted text?". Given ciphertexts generated by any of the major asymmetric ciphers (RSA, ElGamal, ECC, etc..) can these ciphertexts ...
10
votes
3answers
613 views

What is the best way to put a backdoor in an encryption system?

How can you put a backdoor into an encryption algorithm? Are there any techniques that can be used to reduce the time it takes to break a key? I am looking for practical examples encryption schemes ...
10
votes
1answer
579 views

Security of N bit HMAC

Lets say that I am using 128 bit HMAC. How many operations are needed to find a "non secure" message. Is a birthday attack possible?
10
votes
2answers
784 views

Why was the winner of the AES competition not a Feistel cipher?

The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question. However, most many of the AES candidates, and all 3 out ...
10
votes
1answer
2k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
10
votes
1answer
4k views

Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid

When given $p = 5, q = 11, N = 55$ and $e = 17$, I'm trying to compute the RSA private key $d$. I can calculate $\varphi(N) = 40$, but my lecturer then says to use the extended Euclidean algorithm to ...
10
votes
2answers
827 views

Encryption scheme for social-network-like data sharing data via untrusted server?

I am thinking quite a lot lately abut the problem of secure, privacy-preserving social networking. Distributing the network among trusted, preferably self-hosted servers (like Diaspora, GNU Social ...
10
votes
1answer
936 views

Windows 8/Server 2012: Passes FIPS-140-2 despite failing AES-GCM for IV != 96 bits long?

Background Microsoft certifies Windows 7/8 as well as Server 2008 R2 and 2012 to be FIPS-140-2 compliant. Actually they certify just a small crypto core, bcrypt.dll (the library, which is unrelated ...
10
votes
1answer
2k views

Technical details of attack on Android bitcoin usage of SecureRandom

Reports are surfacing that Android's Java SecureRandom class has issues and isn't totally secure. A specific example of how this issue translates to applications is bitcoin, where reports are stating ...
10
votes
2answers
960 views

Deriving Keys for Symmetric Encryption and Authentication

So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
10
votes
1answer
206 views

Shadowed identity in cryptography

I was trying to implement zero knowledge protocol for authentication based on the paper "A Practical Zero-Knowledge Protocol Fitted to Security Microprocessor Minimizing Both Transmission and Memory". ...
10
votes
1answer
481 views

What is the theoretical and practical status of mental poker?

I'm able to find a lot of scattered papers on the development of mental poker since RSA proposed the initial solution but no recent report (i.e. after 2005) on what is the status of the problem, eg: ...
10
votes
2answers
9k views

Signatures: RSA compared to ECDSA

I'm signing very small messages using RSA, and the signature and public key are added to every message, which requires a lot of space compared to the actual content. I'm considering switching to ...
10
votes
2answers
580 views

Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
10
votes
2answers
527 views

Why is the salt used only once in PBKDF2, while the password is used often?

The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
10
votes
1answer
377 views

Making ECDSA public keys one bit shorter

In compressed form, ECDSA public keys are one bit larger than the curve size. There are some situations where this extra bit is extremely inelegant. So I had the following idea as a way to remove it. ...
10
votes
1answer
827 views

How can I make my cipher show the avalanche effect?

I am a beginner in cryptography. I designed an password based encryption-decryption algorithm, which uses a random salt and a password to encrypt a message. I'm using SHA-512 for hashing, matrix ...
10
votes
1answer
415 views

Hash function from narrower block cipher operated in CBC-encryption mode?

I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ ...
10
votes
1answer
304 views

Which MACs can be converted into a secure unkeyed hash function?

It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
10
votes
1answer
732 views

GPG/PGP Verification of Revocation

How does one verify a key revocation? After revoking a key and sending the revocation to MIT's keyserver, I noticed that the key is listed as such: ...
10
votes
2answers
391 views

How should one implement a delegated shared trust protocol?

Consider the following (probably naive) scenario. Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
10
votes
0answers
296 views

Shared secret: Generating Random Permutation

-- or: How to Play Poker Without a Dealer I know this question is long but it's a really interesting theoretical problem about shared secrets and multi-party computation. General Problem: "Shared ...
9
votes
5answers
2k views

Galois fields in cryptography

I don't really understand Galois fields, but I've noticed they're used a lot in crypto. I tried to read into them, but quickly got lost in the mess of heiroglyphs and alien terms. I understand they're ...
9
votes
4answers
448 views

Should DES be avoided when developing new systems?

According to wikipedia… DES is now considered to be insecure for many applications However, since it can be broken relatively easy, should it not just be avoided for all applications?
9
votes
3answers
701 views

Entropy of two concatenated random values

In this Intel blog posting, the author claims: The amount of work required to brute-force predict a random value that has n bits of entropy is $O(2^n)$. If you concatenate two values together, the ...
9
votes
4answers
1k views

Is compressing data prior to encryption necessary to reduce plaintext redundancy?

As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy. I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
9
votes
2answers
742 views

Why are bitwise rotations used in cryptography?

Any understanding I have of cryptography stops right around the cipher level. As such, I'm just curious as to why bit shifts and moreover circular bit shift are so prevalent in cryptography.
9
votes
3answers
3k views

What is the relation between RSA & Fermat's little theorem?

I came across this while refreshing my cryptography brain cells. From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally ...
9
votes
1answer
2k views

Why do all SSH-RSA Keys begin with “AAAAB3NzaC1yc”?

My Friend and I have been generating a few ssh2-rsa keys and noticed that all the public keys began with "AAAAB3NzaC1yc". The similarity extended to "AAAAB3NzaC1yc2EAAAABIwAAAQEA" between two keys I ...
9
votes
3answers
661 views

In what way is XXTEA really vulnerable?

I'm looking at using the XXTEA algorithm to encrypt a small amount of data (say, less than 32KB) in the context of a software licensing algorithm. That is, we wish to make it difficult (not ...
9
votes
4answers
782 views

Is there any strong enough pen-and-paper or mind cipher?

Some ciphers are talked about at “Is there a secure cryptosystem that can be performed mentally?”, but (at the time of writing) I don't see an answer. Are they strong enough, or are non-computer ...
9
votes
2answers
529 views

Can AES decryption be used as encryption?

Definition E: AES encryption D: AES decryption x: plain text y: encrypted text k: key In original AES cipher, encryption: y = E(x, k) decryption: x = D(y, k) Then I define the "reverse AES ...
9
votes
4answers
7k views

What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not. Can anyone explain to me how ...
9
votes
2answers
3k views

Are there practical upper limits of RSA key lengths?

Suppose one wanted to use RSA encryption for the sole purpose of sending key bits for use in symmetric crypto systems, a dedicated key exchange system so to speak. And say you didn't think that the ...
9
votes
9answers
412 views

Physical analogue for MACs

What would be a good analogue with which to describe Message Authentication Codes to a person who has little to no understanding of cryptography? For instance, a vault is a reasonable analogue for ...
9
votes
4answers
2k views

What is the difference between a stream cipher and a one-time-pad?

A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$. This key-stream is ...
9
votes
3answers
617 views

UMAC: to what extent is it in use today?

Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the ...
9
votes
2answers
319 views

AES-GCM Disadvantage

What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ...

15 30 50 per page