6
votes
1answer
290 views

Are stream ciphers no longer considered by NIST?

While reading NIST SP 800-90A, "Recommendation for Random Number Generation Using Deterministic Random Bit Generators", I noted that no stream cipher was included among the various specified ...
6
votes
1answer
192 views

Why use variable p, q, g for Diffie-Hellman?

In the book Cryptographic Engineering, it is said that fixing p, q, g for a key negotiation protocol based on DH is a bad idea (page 228 1st ed). But allowing for flexible p, q and g requires a lot ...
-1
votes
1answer
151 views

Integer factorization via geometric mean problem

presume: we have A and B integers, and C - product of multiplication of A and B, A and B are prime numbers (strong or usual) G - is geometric mean of A and B (square root of C) also, we have: if B > ...
1
vote
1answer
235 views

Seemingly simple decryption question

Forgive the very novice question, but... Given an algorithm which, upon inputting an unchanging 4-character string, generates a variable 6-character string, but having no idea what the algorithm is ...
1
vote
1answer
120 views

Tor's integrity verification system?

I am trying to understand the design of Tor(onion router). I am reading the original paper on the 2nd generation onion routing system. Where, under integrity checking on streams, they say, "When Alice ...
20
votes
3answers
17k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
1
vote
1answer
95 views

What type of groups does Microsoft's U-Prove use (Schnorr… etc?)

I'm trying to learn more about the Subgroups implementation of Microsoft UProve. I'm unsure if they are Schnorr Groups or use a different foundation? Can anyone point me to the technical reading ...
3
votes
1answer
207 views

Quantum resistance of Lamport signatures

The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?
2
votes
1answer
176 views

Proof of work for determining whether a number is prime?

I have an idea for a system that would be outsourcing some brute force calculations to many users in hopes of finding divisors of a number. However, there is a possibility that a given number would be ...
2
votes
1answer
264 views

How are Predicate Encryption algorithms implemented?

After a lot of reading on the internet, i can't seem to figure out how Predicate Encryption works. As i read, it consists of 4 algorithms: ...
2
votes
0answers
192 views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is ...
8
votes
1answer
199 views

PAK Diffie-Hellman vs. sharing high-entropy key

In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities: Let users set a (low-entropy) shared password and then perform some ...
3
votes
1answer
98 views

Signing an integer, which may be increased

I have a 64 bit integer. It has some sort of signature so that one can be sure it is valid. Anyone may increase the integer, update the signature, and remove all trace of the old signature. But it is ...
4
votes
1answer
547 views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here http://www-cs-students.stanford.edu/~tjw/jsbn/ecdh.html If I generate a private key for alice I can get ...
3
votes
1answer
297 views

Formal definition of (perfect) forward security/secrecy

In recent weeks the concept of (perfect) forward security/secrecy has been mentioned a lot, primarily in the context of the shocking revelations about NSA eavesdropping. As far as I'm aware, this ...
3
votes
0answers
120 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...
2
votes
1answer
101 views

Is Triple-DES a group?

I know for a fact that DES is not a group, but are any of the Triple-Des versions a group? Why, or why not?
-2
votes
1answer
301 views

Is my one time pad cipher secure?

This is a program that I made for encrypting text files. It uses a one time pad cipher to encrypt the files, but I do not know if there is any holes in my program that could be a vulnerability. Is my ...
-3
votes
1answer
215 views

Which encryption method used to crypt this text? [closed]

This is encrypted text: http://pastebin.com/bsHQ3Xvs It starts with <~ and ends with ~> What's the name of this encryption method?
7
votes
2answers
397 views

Given a message and signature, find a public key that makes the signature valid

Given a message $M$ and a signature $S$, is it feasible to find a RSA public key $(n,e)$ such that $S$ verifies as a valid signature on $M$ (using this public key)? What if we're given one public key ...
2
votes
1answer
119 views

Offline app authentication - embedding hashed password inside an encrypted file

I am working on an occasionally connected app. To allow the users to authenticate I created a profile which is encrypted and placed on the users machine. The first byte of the file contains the IV ...
3
votes
2answers
273 views

What are the standard procedures in cryptanalysis to analyze unknown ciphertext?

What are the "standard procedures in cryptanalysis" to analyze unknown ciphertext? In other words: Are there any protocols, officially acknowledged checklists or something like that which represent a ...
2
votes
2answers
296 views

P = NP and current cryptographic systems

I've recently heard some people claiming that if the fact that P = NP is proven, most (all?) the current cryptographic algorithm considered secure like RSA will be unusable in secure systems. My ...
1
vote
0answers
88 views

Rating a steganographic system using Blum Blum Shub to locate hidden bits

Currently I'm building a toy steganography system based in a web browser. Besides all the obvious issues with building a system requiring extreme privacy into a browser (this is a toy!), I was curious ...
3
votes
1answer
232 views

Elliptic curve parameter generation

I am curious of the details of how one would go about generating elliptic curve parameters. (I know standardized parameters exist, but I'm trying to understand both how they were generated and the ...
7
votes
1answer
1k views

How to communicate by email with forward secrecy and deniability?

My correspondents and I would like to communicate privately by email. We used to employ PGP but that might have been shooting ourselves in the foot. PGP doesn't have forward secrecy. If any of our ...
1
vote
1answer
100 views

What is meant by this notation in the ElGamal key generation process?

Alice chooses i) A large prime $p_A$ (say 200 to 300 digits) ii) A primitive element $\alpha_A$ modulo $p_A$, iii) A (possibly random) integer $d_A$ with $2 \le d_A \le p_A-2$. Alice ...
3
votes
1answer
240 views

How does partial key escrow work?

It is being speculated that one of the ways that NSA leaker Edward Snowden may have created his "insurance policy"--distributing sensitive documents to various individuals with instructions to ...
1
vote
1answer
126 views

What should the size of the private exponents in Diffie-Hellman key exchange for TLS be? [duplicate]

I'm using TLS with a Diffie-Hellman key exchange to negotiate the symmetric keys. How long should the exponents be?
4
votes
1answer
156 views

How do you find the inverse degree of a hash function?

I am trying to learn cryptanalysis on the Keccak hash function. One of the papers on zero sum distinguishers talks about Keccak having inverse degree of 3. I am unable to figure this out: how do you ...
4
votes
1answer
137 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
4
votes
2answers
534 views

uniqueness of the RSA public modulus

What is the probability that two separate RSA public moduli are the same? For example, consider a 2048-bit modulus. The number seems to be huge, but the choice for prime factors p and q is much more ...
3
votes
1answer
177 views

Advantages/disadvantages of different message numbering schemes

For a stream of packets, where each packet is individually encrypted with a block cipher, it's desirable to have each encrypted packet only valid for that position in the stream. A message number ...
0
votes
2answers
172 views

How is SSL secure from rogue Certificate Authorities?

There's one thing that I've never quite understood about SSL (which perhaps means I don't understand SSL at all): how is SSL secure from rogue Certificate Authorities? This is probably best ...
2
votes
0answers
72 views

Is this any recognizable encoding or cipher? [closed]

I've been watching the Marble Hornets videos on YouTube (basically, an independent film series about a group of kids chased by the "Slender Man"), and in this video I saw something interesting. ...
1
vote
1answer
195 views

modular exponentiation as a one-way-hash

As far as I can tell most one-way hashes apply some iterated encryption algorithm to the input data. What would be the issues with a one-way hash based on some fixed large prime p and a generator g ...
1
vote
0answers
134 views

Best Asymmetric Encryption Standard for Communications? [closed]

I'm new to the standards of encryption. I understand the math behind RSA really well. I'm wanting to design an application for private peer to peer communications using RSA and wanted to know what ...
3
votes
2answers
1k views

Finding a keylength in a repeating key XOR cipher

In an old cryptography FAQ, I found the following step described for determining a the length of the key a cipher was repeatedly XORed against: Discover the length of the key by counting ...
2
votes
0answers
107 views

Is it possible to derive the midstate of a sha256 hash?

Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc". (In PHP: ...
1
vote
0answers
259 views

Non-malleable file encryption using AES XTS 256?

I'm looking to do file encryption of a bunch of individual files, some small, some quite large. The files will be write-once/read-many, so I could use CBC, however, since the read-access needs to ...
4
votes
1answer
349 views

Simple protocol for 1-out-of-2 oblivious transfer

I'm trying to explain the concept of 1-out-of-2 oblivious transfer to folks who haven't seen this idea before. I can explain what properties it provides, but it's also helpful if I can show a simple ...
3
votes
3answers
253 views

Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
3
votes
2answers
240 views

Map Bytes to Number

Using node.js crypto library I can generate cryptographically strong bytes. How can I use this to generate a random number between 0 and 9999 (both inclusive)?
1
vote
2answers
145 views

Digital Signature Scheme Count

My question is How I will be able to count digital signature Scheme that can sign many documents with one private key. There are signature scheme as long as exists private keys in the keys spaces? or ...
7
votes
3answers
2k views

What are some disadvantages of homomorphic encryption schemes?

I'm doing some self-teaching / research for my own benefit in homomorphic cryptography. I've studied both additive and multiplicative schemes (Pallier and RSA respectively), but all I can seem to ...
0
votes
1answer
87 views

Signature with appendix

I see sometimes signatures schemes with appendix. This is about signatures schemes in which the message is needed in the verification algorithm, that is, the ouput of the signature algorithm is of the ...
2
votes
1answer
172 views

How did they factor RSA-704?

I don't understand the 'Wiedemann algorithm' works. Can someone explain the factoring of RSA-704 in an easy way?
2
votes
1answer
398 views

Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
3
votes
2answers
428 views

If we can find prime numbers larger than 17 milion digits, why can't we find all 1024bit primes? [duplicate]

"Largest Known Prime Number Discovered; Has 17,425,170 Digits" http://www.sciencedaily.com/releases/2013/02/130213225424.htm If we can find prime numbers larger than 17 milion digits, why can't we ...
1
vote
1answer
108 views

How to build a secure AE scheme with generic composition?

I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed ...

15 30 50 per page