2
votes
1answer
674 views

Question about the definition of a secure PRF

I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF. I understand the test goes as follows: A challenger picks a function $f$ such that $f \leftarrow ...
2
votes
2answers
253 views

It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?

I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
2
votes
2answers
1k views

Even passwords are vulnerable to hash collision attacks?

As stated in this page large documents hashed using md5 maybe vulnerable to collision attacks. My question is even passwords of 6-30 character are vulnerable to such hash collision attacks? If yes, is ...
2
votes
3answers
136 views

How comparable is OFB to a one-time pad?

This is a rather trivial question, I just want to see if I get the concept right. In OFB you generate a pseudorandom stream based on some nonce, and you XOR that with the message to get the ...
2
votes
2answers
245 views

How to efficiently generate a stream of independent, but biased random bits?

Usually, in cryptography, one is interested in debiasing a stream of independent (true) random bits, and several algorithms exist to do this. What about the converse? Let's assume I have a stream of ...
2
votes
2answers
292 views

FIPS 140 compliance for encrypted files

Does FIPS 140-2 require specific key sizes, or does it have specific requirements for the data? In other words, if I encrypt a file, how I can check whether it is FIPS-compliant or not? Does only the ...
2
votes
1answer
208 views

RSA Key generation Public exponent too big

I'm currently writing a paper about RSA (a self-chosen subject). I'm writing about the key-generation in RSA, and I have problem finding the public exponent e. I have chosen p = 61 and q = 53. Then ...
2
votes
2answers
471 views

AES key expansion vs. a hash

Is there something special about the AES key expansion algorithm that makes it secure, or it is a compromise between security and speed? For example, say with a key I expand it by taking pbkdf2(key) ...
2
votes
2answers
442 views

How can I add more rounds to AES?

I'd like to understand a bit more about the AES key schedule if anyone would mind explaining that. For instance, why is the way the schedule generated (with recursive xors and occasional ...
2
votes
1answer
566 views

Proving that a scheme is not IND-CPA-secure

Suppose I want to prove that a given symmetric encryption scheme is not IND-CPA secure. The first thing I do is to define a specific adversary that attacks the scheme. How can I proof neatly, (using ...
2
votes
2answers
539 views

Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. It's the task from two-years ago exam. At the bottom I reminded one definition. Let $(Gen_E,Enc,Dec)$ be an ...
2
votes
2answers
432 views

Modifications of CBC-MAC

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. This post is very long, but this is because I remind here 2 long definitions. At the beginning I want to remind the ...
2
votes
1answer
714 views

Why do we need in RSA the modulus to be product of 2 primes?

I think I roughly understand how the RSA alorithm is working. However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$. I vaguely know it ...
2
votes
1answer
415 views

Is there another resource for Carter-Wegman-style message authentication?

I'm wondering if there are other resources that cover Carter-Wegman style message authentication, besides the sources themselves. Is there an online text or a book that covers their ideas? I'd ...
2
votes
1answer
235 views
2
votes
3answers
422 views

PRNG taking advantage of very large seed

Can anyone suggest a good (CS)PRNG algorithm that takes advantage of having a very large (ideally arbitrarily large) seed? I'd like to use several kilobytes, perhaps several hundred kilobytes, of ...
2
votes
1answer
470 views

Can we trust digital signatures?

Consider that Alice wants to send a digitally signed message to Bob. Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
2
votes
1answer
153 views

Does it make sense to use slow hashes in digital signatures?

For storing passwords, it seems that the use of intentionally slow hash functions (like PBKDF2 and bcrypt) is now recommended. This is because most hashes are designed to be fast, which also makes ...
2
votes
1answer
380 views

Padding for the TEA

Sorry if this is a noob questions, but I finally figured out how to implement the Tiny Encryption Algorithm in C++. My question is what to do about padding the key and the plaintext? I know that ...
2
votes
2answers
1k views

How to get the keyword from a keyword cipher?

I was given a ciphertext and now I am trying to break it via looking for the keyword. This is a keyword cipher. So: PlainEnglish: ABCDEFGHIJKLMNOPQRSTUVWXYZ If ...
2
votes
1answer
1k views

How to sign a message using RSA?

Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits. I don't know much about cryptography, but I can get these numbers ...
2
votes
1answer
8k views

How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
2
votes
1answer
2k views

Big-O Notation: Encryption Algorithms

I am currently completing a dissertation concerning the encryption of data through a variety of cryptographic algorithms. I have spent much time reading journals and papers but as yet have been ...
2
votes
2answers
1k views

Symmetric vs. Asymmetric cryptographic approaches to data security

I know the basic differences between Symmetric vs. Asymmetric cryptography, but I'd love to know more details: Exactly why is the asymmetric approach slower than the symmetric? Why does it make ...
2
votes
1answer
75 views

Rapidly changing passwords?

Suppose you need to authenticate yourself to a program with the password - but the program's source code is public, the program doesn't have access to any private information and all your ...
2
votes
3answers
283 views

Realize a MAC using a Pseudo-random function?

Given a pseudo-random function and assuming that we do not have any other tools, How can we construct a MAC? I believe this can be done. Would like to know if there is more than one way of doing ...
2
votes
1answer
3k views

Secure way to transfer data over NFC?

I am currently writing a payment system to accept payment details from an NFC enabled smartphone (BlackBerry 9900) to a Windows client (C#.NET) I am currently having two issues relating to security: ...
2
votes
2answers
298 views

Is EKE attackable by a brute-force password search?

So I'm trying to properly implement the EKE protocol and I'm using C# with the Windows CNG and ECDH key exchange. I need to use this because it's FIPS certified and all that jazz. So what I'm ...
2
votes
2answers
128 views

Can AES in CCM or GCM counter mode interoperate with AES in “plain” counter mode (CTR)?

I am exploring the use of Windows CNG to replace some OpenSSL-based code that takes advantage of AES in counter mode. From the outside, everything should look the same after the switch. The section ...
2
votes
2answers
104 views

PRNG determinism (and java.security.SecureRandom)

Looking at getDefaultPRNG() in java.security.SecureRandom makes me very unsure about how to use it. On my desktop, it uses sun.security.provider.NativePRNG, which reads from ...
2
votes
1answer
68 views

For which RSA moduli, precisely, is $e=d$ for all $e$?

This question shows that there are at least two valid RSA moduli $n$, namely $35$ and $91$, such that for any $e$ coprime to $\lambda(n)$, $$e^2\equiv1\mod\lambda(n)\text.$$ Reading the linked ...
2
votes
2answers
145 views

What is a q-type assumption?

I've seen the term "$q$-type assumption" used in a few papers without a definition. A google search doesn't seem to come up with anything useful either (except the same papers without a definition). ...
2
votes
2answers
146 views

Has there been any cryptanalysis of AES under a non-uniformly distributed key?

The standard security property demanded of a blockcipher is that it be a pseudo-random permutation; i.e., given a uniformly random key, the blockcipher should be computationally indistinguishable from ...
2
votes
1answer
116 views

Is this modified Schnorr signature scheme secure?

Signing Let y = g^x, which is your public/private keypair. Let r = g^v, for random v Let c = H(M) Let z = (v + cx) mod q The signature is the pair (r,z) Verifying g^z = ry^c mod p We further ...
2
votes
1answer
320 views

What weaknesses in Hash_DRBG did NIST find and fix?

Matthew Green states in the Practical Kleptography presentation (video, at about 12:15) that Hash_DRBG (from SP800-90A) as originally proposed by NSA had potentially exploitable flaws or bugs and that ...
2
votes
2answers
221 views

DES Encryption Algorithm all 64 bits for key instead of 56 bits

Would a DES algorithm that uses all 64 bits for the key instead of just the 56 bits be more secure? I have been thinking about it but those 8 bits used for parity are very useful and but including ...
2
votes
1answer
130 views

Can Bitcoin HD public keys be used for symmetric encryption?

I asked this at bitcoin.stackexchange.com first, but it seems that this is more of a crypto-question anyway. I'm interested in using a Hierarchical Deterministic Bitcoin wallet branch as a "shared ...
2
votes
2answers
347 views

Chosen plaintext attack on textbook RSA decryption

Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key. Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$ Compute $C’ = C (r^e) \bmod n$ Submit $C’$ as a chosen ...
2
votes
1answer
198 views

SHACAL in SHA-256

I was reading about hash functions, namely SHA, and I read that it is made of the Merkle-Damgard construction. And then the text said that the compression function used is based on the Davis-Meyer ...
2
votes
1answer
348 views

Interleaving bytes to make an effectively larger block size

Will applying a 16 byte bit block cipher such as AES over a 256 byte block to in the following way result in a much stronger cipher:- Apply block cipher with first key digest to each 16 byte group. ...
2
votes
2answers
156 views

Skein or Keccak stream cipher construction

I am wondering if using Skein or the Keccak hash algorithm in this construction (as a stream cipher) is secure: $H$ = Keccak or Skein hash with a 256 bit output $K$ = The main 256 bit random key, ...
2
votes
2answers
208 views

OCB nonce usage

I've just come across this piece of code in Bouncy Castle's implementation of OCB Mode: ...
2
votes
2answers
443 views

Can I crack an AES string if I have all these parameters?

This is for a challenge at followthewhiterabbit.trustpilot.com: Knowns: The algorithm is AES (Rijndael) Blocksize: 128 Keysize: 256 You only need to find the first 6 bytes of the ...
2
votes
1answer
228 views

generate hash of all handshake messages for verify data (DTLS)

I am trying to create a DTLS client finished packet, where I need to generate verify data for handshake hash is need. And here I want to know how to generate handshake hash. As of now I am doing like ...
2
votes
3answers
144 views

Do sites store login password with hash? If so, can people can use hash collision to log in?

I was researching about hash, and I thought, If sites store passwords with hash algorithms, then can't this happen: User A has the password 'hello' User B finds out the hash code of the password of ...
2
votes
1answer
120 views

Is it possible to get better randomness by using multiple PRNGs?

I don't know if this question even makes sense, but: Is there be any benefit or impact to some sort of hierarchical (e.g. a PRNG drives the decision for which PRN to pull from a set of PRNGs) or ...
2
votes
3answers
158 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
2
votes
1answer
122 views

Does this protocol provide Perfect Forward Secrecy / are there potential security flaws?

We have a HMAC key (128 bit/16 bytes) an AES key (128 bit/16 bytes) an AES IV (128 bit/16 bytes) a random salt (128 bit/16 bytes) Each packet is signed with a HMAC (SHA256) After each packet is ...
2
votes
2answers
130 views

Reductionist proofs of decisional problems to computational

Are they any reductionist proofs where an attacker $\mathcal{I}$ for a well established computationally "hard" problem $\mathsf{Π}$ is employing an attacker $\mathcal{A}$ who we assume is able to ...
2
votes
1answer
92 views

RSA private exponent primality

I know that the public exponent is always a prime, but what about the private exponent? Is it always a prime too?

15 30 50 per page