2
votes
2answers
197 views

Can the premaster secret generated by SRP be used as a secure private key?

It seems like the pre-master secret generated during the SRP protocol would make a good source to generate a shared private key using a secure hash to compress it down into a 128/256 symmetric key. ...
4
votes
1answer
92 views

Length-preserving all-or-nothing transform

Is there any known way to construct a length-preserving all-or-nothing transform? In other words, a secure all-or-nothing transform where the length of the output is the same as the length of the ...
4
votes
2answers
2k views

Is a 1024-bit DSA key considered safe?

I created my PGP key in 2000. I’ve revoked the older, weaker sub-keys in favor of a 4096-bit RSA one, but the primary key is 1024-bit DSA. I read on Wikipedia that… NIST 800-57 recommends lengths ...
0
votes
2answers
472 views

RSA decrypting of a huge file by parts [closed]

I need to decrypt a huge file that I own previously encoded by myself with a RSA public key (it's possible for this step using a symmetric algorithm key). Problem is that I can't load it in my ...
1
vote
1answer
86 views

Non-commutitive and nonassociative algebraic structures in cryptography

Are there any cryptographic algorithms or primitives that have been developed and studied that make use of non-commutative or non-associative algebraic structures such as quaternion integers or ...
8
votes
2answers
3k views

Why is asymmetric cryptography bad for huge data?

I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length. Why is this? I know about hybrid encryption, which uses symmetric encryption to ...
3
votes
1answer
437 views

Symmetric encryption mode where ciphertext size is plain text size

I've had many questions on Stackoverflow on how to minimize the output of a cipher - during encryption of course - to the same size as the input. Obviously this is possible for a single block of ...
-1
votes
1answer
152 views

What does it mean that a protocol realizes “strong mutual authentication”?

What does it mean that a protocol realizes "strong mutual authentication"? And What does it mean that a protocol realizes "weak mutual authentication"? Can you define them formally ? I have found a ...
1
vote
2answers
78 views

Key cracking: Prefer many small texts over one large text?

If an attackers sets out to crack the symmetric key of e.g. AES-CTR, would they prefer to have access to many small cryptotexts or one large cryptotext? I.e. is it more interesting for the attacker to ...
2
votes
1answer
67 views

TLS - sharing 1792 bits of unidirectional keys

I've just watched a video on the TLS protocol and learnt that it uses unidirectional keys (meaning keys for both sides, from browser to server and from server to browser). Given that the server uses ...
4
votes
2answers
120 views

Use of less than secure random numbers for 'a' during an SRP proof of password

With Secure Remote Password protocol SRP6a random numbers are used for s, a and b. Where ...
4
votes
4answers
586 views

Why isn't the alternating step generator used more often?

According to the Wikipedia entry for the Alternating Step pseudorandom number generator, there is no public cryptanalysis for this device since it was invented back in 1987 by C.G. Gunther. I have ...
1
vote
0answers
133 views

Safe and computationally efficient way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which ...
2
votes
2answers
817 views

Berlekamp-Massey algorithm: case when sequence length is less than double the length of the LFSR

Suppose that we have a sequence of $N$ digits which is produced by a Linear Feedback Shift Register (LFSR) and the shortest such LFSR is of length $L$. A very important tool in cryptanalysis of stream ...
2
votes
1answer
106 views

Strategy for random CTR initial counter values

Alice has a secret key which she uses to encrypt messages in CTR mode. CTR mode is critically vulnerable to counter reuse, and Alice has a problem: she has terrible memory and no pen to write anything ...
4
votes
4answers
309 views

Given $n$ bits, how many “truly random” sequences/numbers can be constructed?

Suppose we have $n$ bits, so we can have $2^n$ different bit sequences. Some sequences don't look random, say, all $1$ or $0$. There are also other patterns like $10101010…$, $11001100…$ and such. ...
1
vote
1answer
79 views

Algorithm accepting every passphrase to fool unlegit user [closed]

I'm looking for specific names and literature on crypto algorithms that accept every passphrase input by the user, in order to 'decrypt' - even with false passphrase - and present the unlegit user ...
3
votes
1answer
469 views

Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: it uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
0
votes
0answers
61 views

What are the consequences of not checking the server mac in a TLS connection?

The context for this question (it's quite involved) can be found in this document: https://docs.google.com/file/d/0B15itpMWb2ztWTJrYTgzX204OVU However, I want to make it clear that you don't have to ...
-2
votes
2answers
116 views

Python KDF - Master Key and Derivatives

The encrypted file can be opened by following combinations (either any 2 DK, or 1 MK): DK1 + DK2 DK1 + DK3 DK2 + DK3 DK1 + DK2 + DK3 MK Any heads-up with Python ...
2
votes
2answers
139 views

Is a collision attack possible on MD5 if message is known partially

Is it possible to find $m'$ such that $\operatorname{MD5}(m'||m_1)=\operatorname{MD5}(m_1||m_2)$ if I know $m_2$ and $\operatorname{MD5}(m_1||m_2)$? Is this a collision or a preimage attack? Also in ...
5
votes
1answer
169 views

What functions allow for practical indistinguishability obfuscation?

Recently, there has been a major theoretical breakthrough in program obfuscation, in the area of indistinguishability obfuscation. Background: Indistinguishability obfuscation is a form of program ...
1
vote
2answers
438 views

which of these is more secure (bcrypt vs srp)

OK, here's the two different ways I was thinking about making the authentication for the login thing to store the passwords securely. The first is the following. Client hashes password ...
9
votes
3answers
663 views

Elliptic Curves of different forms

Looking at http://safecurves.cr.yp.to/ to find a safe curve, I find that most curves described here are of a different form from that generally used. In Bouncy Caslte, for example, ...
4
votes
1answer
297 views

FHE - Brakerski's “Scale Invariant” Scheme

I thought the current state of the art for fully homomorphic encryption was Brakerski, Gentry and Vaikuntanathan's scheme (BGV) based on standard/ring LWE employing modulus switching for noise ...
8
votes
1answer
697 views

How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?

I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
3
votes
1answer
130 views

Homomorphic Encryption - Smart Vercauteren Batching

I'm going through Smart and Vercauteren's paper "Fully Homomorphic SIMD operations" and had a question about some notation used in the paper. In section 2 of the above it is stated that for each ...
1
vote
1answer
127 views

Brute force RSA cracking

Suppose one had a complete list of primes up to $2^{n+1}-1$. Then wouldn't one be able to crack an $n$-bit RSA public key in time $O(\pi(2^{n+1}-1))$, making RSA insecure? Thanks, René
3
votes
1answer
205 views

Why must IV be sent with each packet?

I was reading about Encrypt-then-MAC and everywhere I go it seems people include the IV with the ciphertext generated for each message then MAC that and send all the information concatenated. Why do ...
4
votes
2answers
124 views

Is ”generating transcripts that are indistinguishable from actual messages in a signature scheme” not universal forgery?

In the Pointcheval paper “Security arguments for digital signatures and blind signatures”, they have proved the security of Schnorr signature for existential forgery under adaptively chosen-message ...
2
votes
2answers
120 views

Comparing two values without revealing them

Suppose Alice wants to prove to Bob that t1 is less than t2. t1 and ...
1
vote
1answer
231 views

BigInteger in Java and Randomness

I'm looking for some PRNGs and – as I have been using Java for a long period of time – I thought that the BitInteger class, together with the ...
5
votes
1answer
148 views

Universal Circuits in Indistinguishability Obfuscation Candidate Construction

I am currently working on an implementation of the candidate construction for an indistinguishability obfuscator that was recently proposed by Garg et al. The relevant paper can be found here. ...
2
votes
1answer
137 views

Does this protocol provide Perfect Forward Secrecy / are there potential security flaws?

We have a HMAC key (128 bit/16 bytes) an AES key (128 bit/16 bytes) an AES IV (128 bit/16 bytes) a random salt (128 bit/16 bytes) Each packet is signed with a HMAC (SHA256) After each packet is ...
1
vote
1answer
386 views

Value of “counter” when decrypting AES in CTR mode?

If – when using AES in CTR mode – you decide to use the setup where you combine the IV and the block count value into a single value, as suggested here, the first 12 bytes are your IV and the last 4 ...
2
votes
1answer
203 views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
4
votes
4answers
245 views

What is the difference between authenticating and signing a document?

Authenticating a document means to verify it is from the sender. But it seems like signing a document also verifies it’s from the sender. What exactly is the relationship or difference between ...
3
votes
2answers
338 views

What are the standard procedures in cryptanalysis to analyze unknown ciphertext?

What are the "standard procedures in cryptanalysis" to analyze unknown ciphertext? In other words: Are there any protocols, officially acknowledged checklists or something like that which represent a ...
0
votes
1answer
136 views

ECDSA: Retrieving non-random k [duplicate]

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
4
votes
1answer
359 views

Mixing Entropy Sources by XOR?

Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG). Can I mix them ...
1
vote
1answer
84 views

How can a digital signature algorithm incorporate a random data if it is to be authenticated on a separate system

I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others ...
10
votes
6answers
947 views

Why does PBKDF2 xor the iterations of the hash function together?

The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively: $U_1 = PRF(password, salt)$ $U_2 = PRF(password, U_1)$ … $U_n ...
6
votes
1answer
346 views

Perfect Forward Secrecy with NaCl

I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application. From what I understand, all Bob needs to to decrypt a ...
3
votes
2answers
492 views

Generate a unique 64 bit numeric database key from a string without collisions at $2^{32}$ birthday threshold?

What is the best way to generate a unique 64 bit numeric database key from a string? For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...
1
vote
1answer
68 views

Fiat-Shamir security problem question

I am trying to understand the Fiat-Shamir identification protocol, but have a problem with understanding how this protocol is supposed to be save, even if you repeat it several times. I am using ...
2
votes
1answer
127 views

Pseudo random permutation for arbitrary size domains

Popular block ciphers like AES or Twofish are keyed pseudo random permutations on the domain $\{0,1,\dots,2^{k}-1\}$ with $k\in\{128,192,256\}$ or similar. I'm interested in pseudo random ...
3
votes
1answer
164 views

AES-128-CTR message integrity: Construction of HMAC

(Note: This post is not about "rolling my own", but rather trying to deepen my understanding of the underlying structures.) I'm having difficulties finding clear answers to some questions about the ...
1
vote
1answer
129 views

Are those RSA keys flawed?

I used rsa-json.native to generate RSA keys for a node.js application that will use secure-peer later to connect two clients with each other. Now I have 2 questions: In secure-peer/index.js I've ...
5
votes
4answers
2k views

What are the requirements of a nonce?

Sometimes I read that a nonce has to be a random number but I disagree. A nonce just can't repeat itself. You could increase in by 1 every time if you are sure it would never repeat.
5
votes
1answer
138 views

How can one detect if a hash function doesn't have a full image?

Suppose we have a hash function $H: \{0,1\}^* \mapsto \{0,1\}^n$, that doesn't get all the $n$ length bitstrings as a value for any input, but is otherwise secure. Can that fact be detected? For ...

15 30 50 per page