1
vote
1answer
136 views

Secret Sharing Encryption

Suppose Alice shares a secret block cipher key, $K_{AB}$ with Bob, and a different secret block cipher key, $K_{AC}$ with Charlie. Describe a method for Alice to encrypt an m block message such that ...
3
votes
1answer
296 views

Standard format to encode AES cipher and random IV

As far as I understood, a secret key (same length as CBC block size) and an initialization vector (IV) are needed to decrypt a AES-256-CBC encrypted string. As the IV should better be random, it has ...
1
vote
1answer
38 views

Is hashing data with dynamic keys still worth effort?

some years ago it took long time to "decrypt" hashes because they took slow cpu to brute force. Nowadays they use graphic cards for stuff like this and can do this most time in less than 20 Minutes ...
7
votes
2answers
222 views

How does the simulator of the special-honest verifier zero-knowledge property works?

I’m a bit confused about what the simulator of the special-honest verifier zero-knowledge property of a $\Sigma$-protocol is supposed/allowed to do and how to prove that it is indeed efficient (i.e. ...
1
vote
2answers
62 views

Can one construct OTPs without using XOR?

The typical version of the one-time-pad (OTP) uses XOR to combine a key pad and a message. ($c=m\oplus k$) Now let's assume some other scenarios which have the practical application of blinding. Do ...
3
votes
1answer
70 views

NTRU test vectors

Where can I find NTRU test vectors? In some research work in 2001, it is stated that test vectors were not publicly available at the time. Then in this ESSS1v2 standard under IEEE1363 here , the ...
2
votes
0answers
65 views

What are the current known weaknesses/attacks on quantum key distribution?

I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or ...
2
votes
1answer
128 views

Security impact of signing small data using RSA

I have an application which consists of a client and a server. Both have a pair of public and private key (RSA). For communication, both sign their messages and send them to the other part. So a ...
3
votes
0answers
48 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
3
votes
1answer
136 views

How to generate a large random number from smaller ones?

I'm using a function randInt that takes as input two integers as upper and lower bounds (inclusive) and outputs a pseudorandom number in that interval. ...
0
votes
0answers
69 views

How can I calculate the probability of collisions of a hashing algorithm?

I'm pulling a “Dave” and I'm designing my own hashing algorithm. Not that I intend to use it, I'm not certifiable or anything, I just want the challenge of creating something. I'm not going to get ...
1
vote
2answers
160 views

Modular Multiplicative Inverse and RSA?

In trying to understand this specific part of the RSA algorithm, I found this online: $$e \cdot d = 1 \pmod{(p-1)\cdot(q-1)}$$ Therefore: $$e \cdot d \cdot d^{-1}= d^{-1} \cdot 1 ...
1
vote
0answers
333 views

How to calculate the avalanche effect in aes-256?

I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key. I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using ...
0
votes
0answers
116 views

How can I compare two hash algorithms?

In studying the algorithms of cryptographic hash functions, I have tried out a few (educated) modifications to the code for academic purposes only. For example, I modified the algorithm by applying an ...
1
vote
0answers
65 views

Understanding a faulty Needam-Schroeder protocol

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses $N$ (nonce) and sends to C (trusted ...
1
vote
1answer
124 views

Padding size with a CBC Block cipher in TLS

I'm currently looking at an encrypted Client Finished message in Wireshark from a TLS session. The cipher suite that was agreed on in previous messages was ...
0
votes
0answers
84 views

How do we generate AES S-BOX?

I am new to AES and I am too much confused about the generation of S-box in AES. I don't have any idea of $GF(2)^8$ field and how the things are happening around. Please answer this question with a ...
5
votes
3answers
270 views

Order of MACing and Encrypting in TLS

I've been working through how TLS1.0 works, and think I've basically understood most of it. One thing I can't seem to find a explanation of though is the order in which MACing and encrypting should ...
3
votes
0answers
91 views

Worst case to average case in Ring LWE

I am currently trying to understand this Ring LWE article and I have a question. I don't understand how to apply Lemma 5.11 in order to get the worst case to average case reduction in Lemma 5.12, as ...
1
vote
0answers
265 views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
1
vote
1answer
69 views

Factors of the group order to secure against Pohlig-Hellman

I am looking into the security of Diffie-Hellman and the discrete log in general. To make sure an attacker can not use Pohlig-Hellman to solve the discrete log quickly we need to make sure that the ...
4
votes
1answer
171 views

Cryptographic random numbers for key generation

I am trying to understand how a cryptographic library works (for example, one that provides assymetric encryption such as RSA), but I'm running into a few problems about the key-generation. There are ...
0
votes
0answers
22 views

Defining correct secured channel from endpoint to server

I'm new to cryptography and have a question regarding encryption usage. The scenario is as follows: I have an endpoint hardware device (CPU - ARM A7 1.2 ghz) which runs Ubuntu 14.04. This hardware ...
3
votes
1answer
145 views

Base point in Ed25519?

The paper "High-speed high-security signatures" by Bernstein et al. introduces the Edwards curve Ed25519. Concerning the base point $B$, it says that $B$ is the unique point $(x, 4/5)\in E$ for ...
1
vote
1answer
152 views

Proving security of TLS handshake with ProVerif

Background For my dissertation I am working on an application protocol for which I require a TLS session. I am looking to achieve Perfect Forward Secrecy, which means I have selected ephemeral ...
11
votes
2answers
239 views

Attacking RSA signature verification that ignores padding

I am looking at a RSA signature verification that is quite obviously flawed and am wondering if there's a way to exploit that flaw in practice. Signature is generated using RSA with PKCS 1.5 padding, ...
0
votes
2answers
186 views

How is message length involved in public/private-key encryption?

I've just read this question regarding why to sign only the hash of a message. I kind of understood the answer, but the question arisen is now: Why can I encrypt any text messages with the same ...
3
votes
1answer
111 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
2
votes
1answer
221 views

Any reason to use Shamir given faster XOR threshold secret sharing algos?

TL;DR: Is the Kurihara algorithm really what it purports to be (dramatically faster but equally secure replacement for Shamir Secret Sharing)? ...
3
votes
0answers
100 views

Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
3
votes
1answer
106 views

Why would you use a weaker hash function than cipher strength?

Some cryptographic libraries (like “Bouncy Castle”) support many modes where the maximum number of bits which can be produced by the hash are significantly fewer than the cipher strength. For ...
2
votes
0answers
177 views

What are the constraints on using GCM with a tag size of 96 and 128 bits

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST ...
3
votes
1answer
93 views

How can recovered 5-letters plain text help me to recover reused OTP key

I have 10 cipher texts ciphered with One Time Pad (OTP) using the same key. I need to recover the key (or in other words, to recover the 11th cipher text which I assumed would require me to recover ...
2
votes
1answer
176 views

Mathematical formula for switching the key for OTP?

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
4
votes
1answer
289 views

Formula for the number of expected collisions

Say we have a hash function that produces $n$ bit outputs. From the birthday problem that after around $\sqrt{2^n}$ different inputs to the has function, we can expect a collision. Say instead that ...
0
votes
0answers
42 views

Signatures with Hybrid Encryption

Typically, in public-key settings, sign-then-encrypt has been used to provide confidentiality and integrity. However, most public-key cryptosystems use hybrid encryption. I've been searching around ...
3
votes
1answer
64 views

Are deployed MACs IND-CPA?

There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk ...
0
votes
0answers
54 views

Public key of a split key without calculating private key

I am searching for a secret splitting scheme where the private key doesn't exist, since each party chooses their own secrets. The other parties should however still be able to calculate the public ...
2
votes
2answers
780 views

How to encrypt dates using format preserving encryption and avoid collisions

I'm encrypting with an FPE algorithm in C#. What I did is convert the date I want to encrypt to the day of year value and a year value like so. ...
2
votes
1answer
103 views

Memory hard password based key derivation functions?

How are memory hard functions designed for the purpose of password based key derivation? To protect against a brute force attack from a parallel machine. What design could work well with Skein? The ...
1
vote
1answer
125 views

SSL pinning - how to safely hide the certificate?

We are doing an iPhone app and read multiple forums which says SSL pinning makes it possible to avoid man in the middle as we trust our web services server through the certificate which will be pre ...
0
votes
0answers
24 views

How to change radix in FFX

http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/ffx/ffx-spec.pdf tells me that radix should be an arbitrary input determined by the user. However, I do not understand how this ...
0
votes
1answer
141 views

Simple example to describe Bilinear mapping

Notation : $\mathbb{G}$ is an additive group and $\mathbb{G}_T$ is multiplicative group of prime order $q$. Bilinear mapping $e: \mathbb{G} \times \mathbb{G} \rightarrow \mathbb{G}_T$ has to satisfy ...
1
vote
2answers
82 views

Indistinguishability game hop

I am trying to prove that changing an input in a security game from a randomly permuted set to a set that is permuted using a pseudorandom permutation (PRP) results in a negligible distinguishing ...
4
votes
1answer
130 views

UKS attack on KEA protocol

I'm trying to understand the UKS attack on KEA protocol. This is described in this paper: Security Analysis of KEA Authenticated Key Exchange Protocol So to summarize: KEA protocol: UKS ...
5
votes
0answers
265 views

What is the original SKID3 protocol?

While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it. The basic structure is the following: (1) A --> B: rA (2) B --> ...
2
votes
1answer
159 views

Extension of a password hashing algorithm using Fibonacci

I am right now taking a class named Applied Cryptography and our final project is to create a password hashing method using at least one existing algorithm and then add additional steps to make it ...
3
votes
1answer
833 views

Authentication using AES

I need to implement an authentication mechanism in an embedded environment which does not support floating point operations but has an AES accelerator module which allows for encyption/decryption ...
2
votes
1answer
193 views

Why is the definition of Special-honest verifier zero-knowledge probabilistic?

Let $P$ be a prover willing to prove to a verifier $V$ that he knows a witness $w$ satisfying $(x,w) \in R$ for some relation $R$ and some common input $x$. As found in the literature, $P$ can use a ...
0
votes
1answer
67 views

What is ε in differential privacy?

In ε-differential privacy, what does the ε refer to? Is it privacy value or the notation used? Can anyone provide an example of differential privacy?

15 30 50 per page