3
votes
1answer
115 views

Combining two hashing functions

I have been working on a Bloom Filter implementation recently and after a discussion with a co-worker about how many hashing functions to use I told him I was limited with using hashing functions that ...
3
votes
1answer
145 views

Is there a general method to crack this type of fractionating cipher?

I've seen a few puzzles based on a type of cipher in which letters in the plaintext are substituted with groups of characters in the ciphertext. The ciphertext only uses a handful of unique ...
3
votes
1answer
217 views

What is the GnuPG process for going from a passphrase to a symmetric key?

Suppose I use GnuPG to symmetrically encrypt a file like so: gpg --no-options -c --cipher-algo AES256 --no-random-seed-file -o my.out my.file I then provide a ...
3
votes
1answer
123 views

What is a Message Transmission Scheme?

I've been given as an exercise to show an encryption scheme that is CCA-secure but is not a secure message transmission scheme. What is a message transmission scheme, and how does it differ from a ...
3
votes
2answers
141 views

What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
3
votes
1answer
305 views

Purpose of leading zero in PKCS1-v1_5 padding

According to this document the padded message has the following structure: $EM \;= \; 0x00 \; || \; 0x02 \; || \; PS \; || \; 0x00 \; || \; M$ What is the purpose of this null byte at the beginning ...
3
votes
1answer
260 views

What is 'key agility' in relation to symmetric-key encryption?

I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
3
votes
1answer
101 views

OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
3
votes
1answer
546 views

Elliptic Curve Encryption Ciphertext Size

I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal)
3
votes
1answer
261 views

Is there a cryptographic hash function that can be performed with pencil and paper?

Imagine I'm signing up for the 99th new web site this month. I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into ...
3
votes
1answer
192 views

What does this Authentication protocol achieve and what information is shared?

I'm having trouble with the following question from my class: "What is the purpose of the protocol, and how does it achieve this purpose and what shared information does A and B end up after ...
3
votes
1answer
634 views

OpenPGP/X.509 bridge: how to verify public key?

I'd like to use OpenPGP authentication over TLS, but lack of implementations made me use a temporary solution: an OpenPGP/X.509 bridge certificate. The approach is very similar to the approach used ...
3
votes
1answer
179 views

Generator for Group $QR_{N}$

Let $N=PQ$, where $P=2p+1$ and $Q=2q+1$. $P,Q,p,q$ are prime numbers. $QR_{N}$ is the set of quadratic residues modulo $N$. Please help me to prove $QR_{N}$ is a cyclic group. Note: $QR_{P}$ and ...
3
votes
1answer
239 views

Generalizing a CBC-MAC collision with a common final message block

I found this question from a textbook but I don't really understand what it is asking: Suppose $c$ is $1$ block long, $a$ and $b$ are strings that are a multiple of the block length, and ...
3
votes
1answer
853 views

Are there any Javascript CSPRNGs? [closed]

I'm writing some software that requires the use of a CSPRNG with javascript for use in the browser and I'm wondering what libraries are available. Crypto-js doesn't seem to have a CSPRNG I can ...
3
votes
1answer
190 views

Feasibility of using a base 26 LFSR for cryptography by hand

I have been playing with base 26 LFSRs (i.e. using the alphabet) and noticed that the XOR operation for base 26 is just the tabula recta and so can be done very quickly. This made me wonder whether a ...
3
votes
1answer
2k views

RSA square and multiply

If an RSA encryption uses a modulus $n$ of 15000 bits and $e = 3$ or $e = 2^{16} + 1$, how many squarings and multiplications will we need for encryption, and for decryption? Could you please explain ...
3
votes
3answers
279 views

understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
3
votes
1answer
162 views

Stream vs Block cipher: Synchronising and the receiver

I am learning cryptography at school and I was wondering: How are the blocks/streams after decryption synchronized at the receiver to form one long meaningful message? Am I right by saying that ...
3
votes
1answer
76 views

Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?

Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every ...
3
votes
1answer
907 views

RSA key pair generation using PRNG with same seed

I see a lot of Q/A where persons are trying to generate a specific key pair using static data such as a password. Now say we use a known PRNG (dangerous assumption), seeded with a the data as a static ...
3
votes
1answer
350 views

Hamming Distance vs. Index of Coincidence

When analyzing a repeating-key xor cipher to find the key length, I've read about two key methods (assuming there aren't just repeating chunks of ciphertext for Kasiski's method), for some assumed key ...
3
votes
1answer
567 views

Generating an IV for ESP 3DES-CBC

I have an application written in C, running in Linux. It uses IPsec (ESP) (manually putting the IPSec packet together) to send certain packets. The algorithm used ...
3
votes
2answers
684 views

Is there any implementation of scrypt that allows a specific limit on memory?

The answerer has commented that scrypt's memory use is "only a function of r". $\:$ However, he has not addressed my argument that it also depends on N, in one of my comments from over 5 days ago. I ...
3
votes
2answers
220 views

Does impersonating an SRP server give you enough information for an off-line dictionary attack?

In a comment to an answer I wrote to another question, CodesInChaos wrote that: "Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search." ...
3
votes
2answers
230 views

Parallel-resistant proof-of-work scheme?

I am looking for a proof-of-work scheme which cannot be effectively parallelized. For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function $f()$, a target ...
3
votes
1answer
261 views

Quantum resistance of Lamport signatures

The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?
3
votes
1answer
643 views

Formal definition of (perfect) forward security/secrecy

In recent weeks the concept of (perfect) forward security/secrecy has been mentioned a lot, primarily in the context of the shocking revelations about NSA eavesdropping. As far as I'm aware, this ...
3
votes
1answer
784 views

Security of authenticated encryption modes gcm & ccm

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
3
votes
4answers
327 views

Is it possible to anonymize web traffic so that the IP Address cannot be determined while still being able to determine distinct IPs?

I'd like to find a way to anonymize IP addresses in web logs to ensure user privacy given the following requirements: If given an IP address, there is no way to look up which requests came from the ...
3
votes
2answers
521 views

What does “message schedule” mean in SHA-256?

I am trying to understand the sha-256 algorithm from FIPS 180-2. I understood the padding and parsing of the message string. However after that it states (page 15): For $i = 1$ to $N$: { ...
3
votes
2answers
184 views

Is this OTP scheme safe?

I have a message $m_1$ and I want to encrypt it by XORing it with two keys $k_1$ and $k_2$: $$c_1 = m_1 \oplus k_1 \oplus k_2$$ So far so good. Now I was wondering if I could create a "fake" result ...
3
votes
1answer
273 views

In ECDSA, how many field operations are used for signature verification?

I am wondering about the computational cost of ECDSA signature verification, in term of multiplications in the base field; and, as an aside, in term of (much cheaper) additions. To make things ...
3
votes
1answer
156 views

implementing long term archive encryption

Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways: The ...
3
votes
1answer
301 views

Addition with Shamir secret sharing

When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$. I believe this would be the correct solution (correct me if I'm wrong): Each party ...
3
votes
1answer
1k views

Triple-DES Brute Force

Shannon's paper states: A system is pure if all keys are equally likely and if for any three transformations, $T_i$, $T_j$, $T_k$ in the set, the product $T_iT_j^{-1}T_k$ is also a ...
3
votes
2answers
443 views

What is the best way to store sensitive information on the client?

I am very inexperienced with cryptography and would like some advice on how to store some sensitive information on client machines. I have some information stored in a central database on my server. ...
3
votes
1answer
193 views

Chosen ciphertext insecurity in an ElGamal variant

I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...
3
votes
2answers
324 views

DSA signatures with related k and unknown payloads

Suppose that we are given DSA parameters $p$, $q$, $g$, a public key $y = g^x$, and two signatures $(r_1,s_1)$ and $(r_2,s_2)$. We are told that $(r_1,s_1)$ and $(r_2,s_2)$ were produced by related ...
3
votes
1answer
383 views

Understanding a Blowfish cryptanalysis

I'm reading a cryptanalysis on Blowfish, and I've come across something that I don't quite get. Let's denote $$\delta = a \oplus a'$$ where a and a' are bytes that cause a collision in some S-box ...
3
votes
1answer
232 views

Anonymity in end-to-end encryption

Considering a scenario of anonymous data transfer between seller and buyer using proxies. If we consider that there are three proxies that are being selected by the buyer to obtain data from different ...
3
votes
2answers
401 views

While generating a random Elliptic curve what are the conditions i have to considerd?

I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy? For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a ...
3
votes
1answer
82 views

Padding in PMAC

How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding. I find the ...
3
votes
1answer
9k views

AES vs Blowfish taking key-length into account

I understand that Blowfish is getting old, but is still a secure algorithm, and that AES is very popular, and is recommended by most people. My question is, how do the two compare when a 256-bit key ...
3
votes
2answers
365 views

CPA Secure Chosen plaintext scheme

The example for IND-CPA secure schemes given is generally: for a random r, Enc_k(m) =(r|| E_k(r) XOR m) where E is a PRF But does the role of r and k really matter--i.e. isn't this equally ...
3
votes
1answer
432 views

Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?

I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and ...
3
votes
1answer
210 views

Is it OK to use a data-encryption key for key wrapping, too?

Our industry (area of cheap networked devices) has a standard that defines the usage of keys for both authentication and encryption using EAX mode of AES. This standard does not define key management, ...
3
votes
3answers
3k views

How do ciphers change plaintext into numeric digits for computing?

For example, in RSA, we use this for encryption: $ciphertext = (m^e \mod n)$ and for decryption. If our message is "hello world", then what number do we have to ...
3
votes
1answer
313 views

Recovering state of modified RC4 key scheduling algorithm

Consider this algorithm: ...
3
votes
1answer
255 views

Does ShaCrypt have the properties which make BCrypt slow on GPUs?

Sha256Crypt / Sha512Crypt are designed based on ideas of BCrypt but use SHA instead of Blowfish because of political requirements. The Sha*Crypt algorithms have the advantage that they are used in ...

15 30 50 per page