4
votes
1answer
122 views

Is there any function that does not suffers birthday problem?

I am eager to know that if there is any function that does not suffer birthday problem and how to prove it formally that the function is not suffering the birthday problem.
4
votes
2answers
128 views

Integer factorization still hard with Hamming weight hypothesis?

Consider the following problem: Factorize a $n$-bit integer $c$ knowing that it is the product of two integers with known Hamming weight $h$. Is there a way to prove that this is still hard? I have ...
4
votes
2answers
77 views

How to implement 1-out-of-n OT from 1-out-of-2 OT?

How can I implement a 1-out-of-$n$ oblivious transfer protocol from 1-out-of-2 OT protocol which is resistant against passive corruption? Assume we can access 1-out-of-2 OT $n$ times.
4
votes
2answers
172 views

Encrypt-then-HMAC implementation - am I doing it right?

I want to implement authenticated encryption using C#. There is a dot net class called encryptAndAuthenticate, but it is only supported on windows 8 or later, and I need the code to also work on ...
4
votes
1answer
111 views

What problems with “random” data would cause this result from Ent?

I'm playing around with a novel kind of source of "random" data and Ent is currently giving me results like this: Entropy = 7.977080 bits per byte. Optimum compression would reduce the size of this ...
4
votes
1answer
121 views

Calculation of the avalanche effect coefficient

Given a strict avalanche criterion matrix/dependence matrix for a hash function,how do I calculate the avalanche coefficient for it. I want to calculate a single parameter(value) which represents the ...
4
votes
2answers
110 views

If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption. If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number ...
4
votes
1answer
49 views

Could a strong round function be immune to slide attacks

An excerpt from the wikipedia article on slide attacks states: ...The only requirements for a slide attack to work on a cipher is that it can be broken down into multiple rounds of an identical F ...
4
votes
1answer
97 views

Exposed raw RSA private key operation

Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA ...
4
votes
1answer
60 views

Is WPA2(PKS) AES vulnerable to 4 way hand shake and brute force attack?

I can easily crack a WPA TKIP using a dictionary/brute force method, provided that I collect the four way handshake. Is the same method possible on WPA2 AES? I cannot find any articles about '4 way ...
4
votes
2answers
85 views

Does a key derivation function always generate an even distribution of bits in the resulting key?

I am a student of crypto. During our study course, we went into the AES-128 algorithm. All the examples given used an initial key k, 128 bits and we only briefly touched on the key derivation of ...
4
votes
1answer
78 views

Can a list of hashes with property $X_{n+1} = \operatorname{SHA-256}(X_n)$ loop?

This is the situation: I have a list of hashes where each hash is always the SHA-256 of the one above it. If I keep going down the list it must at some point loop since there can only be $16^{64}$ ...
4
votes
1answer
61 views

Is there any more asymetric-time permutation than x^3 (mod p)?

I've been using "asymetric-time bijective functions (or permutations)" for several practical uses. I've applied them to solve problems in software-attestation and proof of unique blockchain storage. ...
4
votes
2answers
150 views

What's the issue with Apple's backdoor?

I was reading Apple's public letter here regarding the "backdoor" that they have been asked to create. I'm very unclear exactly what the issue is. There was no backdoor in the encryption algorithm ...
4
votes
3answers
119 views

Common Modulus Attack not reproducible

I want to calculate a simple example of the RSA common modulus attack. However, the result is not correct and I do not find my mistake. p=$29, q=37, n=p*q = 1073, \phi(n) = 1008, e1 = 5, e2 = 11$ ...
4
votes
1answer
74 views

How to change the master password in a password manager

For a personal project, I'm building a password manager, based off the project in this syllabus from Stanford http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/proj1.pdf Since I don't exactly have ...
4
votes
1answer
68 views

What algorithm to use to rotate values in a predefined manner and be able to decrypt them back to the original?

What is the best practice to accomplish this? For example, let's have an initial value abc123456 and a seed secret_hash. I want ...
4
votes
1answer
104 views

Contrasting Key Rotation Requirements : Asymmetric vs. Symmetric Ciphers

I'm trying to contrast key rotation requirements for asymmetric and symmetric ciphers. In the case of symmetric ciphers, we have the results such as the so called "CBC Theorem" (stated on pg. 24 of ...
4
votes
1answer
80 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
4
votes
1answer
143 views

Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?

I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed: ...
4
votes
1answer
99 views

Are EC public/private keys significantly weakened by having a known byte?

I would like to use different EC keys for different purposes in an app, and I would like to easily see the purpose for which particular key (pair) was generated. With ~65K attempts, I can generate a ...
4
votes
2answers
90 views

How were semagrams encrypted in the pre-digital era?

Historically messages in languages that use alphabets have been encrypted manually according to some kind of algorithm (e.g. mono- and poly-alphabetic ciphers). But how wew messages encrypted in a ...
4
votes
3answers
181 views

Is there a way to prove equality of plaintext that was encrypted using different public keys?

Imagine if Alice encrypts message to Bob (using public key $P_{bob}$) and then Bob encrypts the same message to Carol (using $P_{carol}$). Is there a way for Bob to prove that: $P_{carol}$ was ...
4
votes
1answer
59 views

State level “Weak Diffie-Hellman” working for SRP too?

I've read about the "Weak Diffie-Hellman" attack (paper, website), where a resourceful entity like a state can pre-compute values for known primes to aid solving the discrete logarithm problem for ...
4
votes
1answer
108 views

Effect of message length on collision attacks

I know that message collisions are supposed to be hard to calculate for a good cryptographic hash. Given 1k worth of data, it's hard to find another 1k worth of data that collides with the same hash. ...
4
votes
3answers
156 views

Safe curves in Weierstrass form?

I would like to implement a protocol using elliptic curves. I'm thinking of using MIRACL so using curves in their Weierstrass form is preferable as it they are supported by this framework. I don't ...
4
votes
1answer
97 views

Are shorter password hashes safe?

How much can I shorten a password hash before it begins to impact security? Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF. From what I've seen, it's typical to use 256 ...
4
votes
1answer
80 views

Adding two RSA private key

We've constructed a new private RSA key from two known private RSA keys $Priv_1$ and $Priv_2$ as follows: $$p = next\underline{}prime\left(\frac{Priv_1(p) + Priv_2(p)}{2}\right)$$ and $$q = next\...
4
votes
1answer
148 views

ECDH and ECDSA in PGP with known public key

How are used ECDH and ECDSA in combination with public key ? Usually these methods are used for establish a secret themselves, ...
4
votes
1answer
99 views

Do Curtmola et al.'s IND-CKA1/2 security definitions protect against search pattern leakage?

In the article Searchable Symmetric Encryption: Improved Definitions and Efficient Constructions, Curtmola et al. propose adaptive and non-adaptive (indistinguishability and simulator-based) security ...
4
votes
1answer
142 views

What procedure to use to verify a raw public key (TLS ECDHE_EDCSA ciphersuite)?

Contrary of verifying a certificate which is a well-known procedure, I am wondering what the procedure is to verify a raw public key 'certificate' (https://tools.ietf.org/html/rfc7250). This ...
4
votes
1answer
907 views

POODLE attack on TLS 1.2

The POODLE attack uses the way block ciphers in CBC mode are decrypted in combination with the packet's padding to determine some byte's value. From what I understand, even TLS 1.1 can be vulnerable (...
4
votes
2answers
100 views

A periodic PRNG based on hash function?

I need a PRNG which provides 128 bytes numbers. Let's say that given a symmetric key $K$ and an internal state $s$ I use the PRF HMAC-SHA512 this way: The output is PRNG($K, s$) = HMAC-SHA512$_K$($s$...
4
votes
3answers
181 views

Randomness in Public Key Encryption

For a scheme to be at least CPA secure, one has to randomize the scheme. In case of a secret key encryption scheme, the used randomness will typically become part of the cipher text as in the case of ...
4
votes
1answer
133 views

Proving set membership in less than log(N) bandwidth

I have an unchanging set of unique items, and I want my server to show one of those items to a client, then cryptographically prove that the item is part of the set. How I do this currently: ...
4
votes
3answers
151 views

How does the birthday paradox apply to random keys?

I'm developing a web app where I wish to use pseudorandom keys for items, perhaps akin to Imgur. I was thinking about how many combinations I need to reduce the chance of someone guessing any random ...
4
votes
1answer
162 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
4
votes
3answers
142 views

Calculating $\mathbb F_{p^2}$-rational points of an elliptic curve defined over $\mathbb F_p$

How can I calculate points on an elliptic curve defined over $\mathbb F_p$, for example $y^2 \equiv x^3 + 1 \pmod p$, with coordinates in $\mathbb F_{p^2}$? (points might have complex number format in ...
4
votes
2answers
107 views

Brute-force attack given multiple hash prefixes

(Context: I'm auditing some code which I suspect to be insecure, but I'd like to be able to quantify this.) Suppose you have a 56-bit secret key ($secret), and ...
4
votes
1answer
187 views

Authenticate a short message with redundant encryption instead of using a MAC?

I have a short message that’s exactly 128 bits of length. The message serves as a time-limited authorization token for a database. It contains a permission profile ID (64 bits) and an issue timestamp (...
4
votes
2answers
697 views

How does a certificate authority issue a digital certificate?

I am new to cryptography and I want to know the details of how a Certificate Authority issues a digital certificate. From what I know (please correct me if I'm wrong at any parts of my explanation): ...
4
votes
1answer
381 views

How does ECDHE_RSA key exchange mechanism work?

Using Wireshark, I found these data exchanged with google.com over TLS: Client Hello possible cipher suites and possible curve types (eg. secp256r1) sent Server Hello cipher suite selected ...
4
votes
1answer
231 views

Can the same random number be used in encryption and signing?

In several public key algorithms, the person running the algorithm must generate a random number (that's separate from the key). Can this random number be the same for an encryption and a signature? ...
4
votes
1answer
241 views

How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?

Given a cryptographic hash function $h$, for example SHA256, how hard is it to find plaintexts $a,b,c$ such that $$h(a)\oplus h(b)=h(c) \text?$$
4
votes
2answers
183 views

Can a secret message be securely transmitted within a MAC tag?

A sender wants to transmit an ultra secret code $M$ which could be either 'go', 'stop' or 'wait'. This could be any selection of code words really and adopted for any use such as transmitting short ...
4
votes
1answer
218 views

Security of RSA with $\gcd(pq, (p-1)(q-1))\ne 1$

The Congress of ThéOùÇa enacted that civilian use of any public-key encryption system is authorized on the territory of ThéOùÇa, subject to meeting certain security requirements published by the ...
4
votes
1answer
91 views

Can we run a probabilistic function on ciphertext with Functional Encryption (or Attribute Based Encryption)?

In the definition of functional encryption ($FE$): $FE.Setup(1^k)$ takes as input the security parameter $1^k$ and outputs a master public key $fmpk$ and a master secret key $fmsk$. $FE.KeyGen(fmsk, ...
4
votes
1answer
173 views

Generic group model: use of polynomials in the proof of the master theorem

I've been looking at the paper of Boneh, Boyen, Goh Hierarchical Identity Based Encryption with Constant Size Ciphertext which contains a general theorem (Theorem A.2) about the advantage of an ...
4
votes
1answer
94 views

Statistical tests for pseudorandom permutations

I'm implementing a format-preserving encryption scheme similar to those described in the literature. I want to sanity test my PRP using some statistical tests like TestU01. However, I'm not sure how ...
4
votes
1answer
2k views

What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?

The DES retail MAC, also known as ISO 9797-1 mode 3 with DES, computes the MAC of a block of data using a 16-byte (112 bit) key. It can be seen as CBC-MAC using simple DES with the first half of the ...

15 30 50 per page