2
votes
1answer
398 views

Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
2
votes
1answer
65 views

How does the possible attack on passwords and salts mentioned in PKCS#5 v2.1 work?

From PKCS#5 v2.1, 4.1 Salt (page 6, emphasis by me), also in v2.0, RFC 2898: In password-based encryption, the party encrypting a message can gain assurance that these benefits are realized ...
2
votes
1answer
159 views

What's efficient MPC protocol for determining if sum's bigger than y?

My secure multi-party computation (MPC) in need is simply to determine if a sum of two private variable is bigger than a given value $y$, as $f(x_0, x_1) = [(x_0 + x_1) > y]$ in which the value ...
2
votes
2answers
228 views

IV Security Clarification

After doing lots of reading on SO and other websites relating to AES cryptography, I am trying to understand the security issues surrounding IV's. There seems to be a lot of confusion and ...
2
votes
2answers
284 views

Generating IV in TLS 1.2

I'm writing a TLS 1.2 implementation (in C#) using a custom protocol. My question is how to generate the IV attached to each message, I don't want to use RandonNumberGenerator because I've heard it ...
2
votes
1answer
130 views

How to derive formulas for addition and multiplication in Jacobian coordinates

Is there a way to derive the formulas for point addition and multiplication on elliptic curves in Jacobian format by yourself? How could I have derived these formulas by myself?
2
votes
2answers
136 views

How to compare two datasets „anonymously”?

Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation: There are 10 defined colors (blue, orange, yellow etc.) There are ...
2
votes
1answer
163 views

Can prepending “junk” be equivalent to an IV when encrypting using CBC?

We are encrypting a small positive integer (1-1000) with a constant key using AES256 encryption. We are considering two approaches to make this secure; use an initial vector (which we then need to ...
2
votes
1answer
65 views

Comprehension question on a signature protocol based on the RSA assumption

We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
2
votes
1answer
233 views

Understanding one-way hash functions construction

I understand the needs that lead to the development of cryptography and I am quite familiar with the uses we make of the cryptographic tools. But, as a programmer, I am conditioned to see them as ...
2
votes
1answer
315 views

What does the expression $1^n$ mean as a function argument?

In a paper about predicate encryption or attribute based encryption, the setup function is mentioned with the $setup(1^n)$ or $setup(1^l)$. I want to know what is meant here. Is it multiples of ones ...
2
votes
2answers
114 views

How can two UProve token holders prove to a 3rd party that they aren't the same user?

Suppose I have two users who are issued two different UProve IDs. The Issuer has guaranteed that one UProve token bearer will never have more than one UProve token ID. How can I use UProve to ...
2
votes
2answers
484 views

Security of Deterministic Encryption Scheme

A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm. Although we ...
2
votes
2answers
118 views

Key Exchange and anonymity issue

If Alice (sender) sends a private message embedded with public key of the Bob(recipient) through onion network, so in this key exchange, does Bob remains anonymous to Alice as Alice knows about the ...
2
votes
1answer
54 views

Equivalents to a physical hat+shaking?

I would like a multiparty protocol, secure in the honest-but-curious model at least, but hopefully other situations as well, that can do the following: every party among $\{P_1, P_2, \ldots P_n\}$ ...
2
votes
1answer
193 views

Can you help me understand how RC4-52 is done using pen-and-paper?

I've played a lot with VIC and enjoy its complexity and effectiveness as a field cipher. However, RC4 has caught my attention lately and I've read there is a RC4-52 variant that can be done by hand. ...
2
votes
2answers
714 views

What data is saved in RSA private key?

What data is saved in RSA private key in openssl? How to view it? Wikpedia says these variables are saved.
2
votes
2answers
196 views

Zero-Knowledge Challenge-Responce Protocol

Good day to everyone. I am trying to implement an e voting system (just for reference -it is not important though-it is described at the Internet Voting Protocol Based on Improved Implicit Security ...
2
votes
1answer
148 views

What information to include is the 'info' input for HKDF?

The RFC states the following: 3.2. The 'info' Input to HKDF While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main ...
2
votes
1answer
237 views

How to represent point-at-infinity in affine coordinate

In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate. Whether x=0 and y=0 can be considered as point-at-infinity in ...
2
votes
1answer
278 views

Digital signatures in SSL/TLS-like protocols

The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ...
2
votes
2answers
156 views

Name for identical operations for encryption and decryption

Is there a name for the property of a cryptographic algorithm that the operations for encryption and decryption are identical, i.e. $E_k(x) = D_k(x)$ and accordingly $E_k(E_k(x)) = x$? An example ...
2
votes
1answer
362 views

Using Chi-Square for Vigenère Cipher

I am writing a program which will use Chi-Square to determine which is the correct keyword for a ciphertext via Vigenère cipher. I came across a website that describes the Chi-Square statistics in a ...
2
votes
1answer
103 views

Using UMAC with stream cypher

I understand that most stream ciphers, due to being applied with a simple XOR, are specially fragile against data tampering, and must be used with some MAC mechanism. So I am investigating the use of ...
2
votes
1answer
80 views

What is the most secure way to let Alice “input” her private key, transfer it to the server and decrypt the message?

What is the most secure way to let Alice "input" her private key, transfer it to the server and decrypt the message? (Then destroy the private key on the server) Every connection is using SSL. ...
2
votes
3answers
1k views

Why does WPA-PSK not use Diffie-Hellman key exchange?

Is there a reason, why in pre-shared key mode, Wi-Fi session key is not secured with something like Diffie-Hellman but instead is derived from PSK key and some information exchanged in clear during ...
2
votes
1answer
123 views

efficient authentication with broadcast encryption?

(I am not a crypto expert, so I apologize if the terminology I use is incorrect.) Suppose I have the following simple broadcast encryption scheme for securely sending content to $n$ authorized ...
2
votes
2answers
141 views

What are the cryptographic assumptions in the Dolev Yao model?

In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox. Does blackbox here mean that the primitive is to be considered CPA ...
2
votes
2answers
2k views

RSA 4096 bit key benchmark

is there any benchmark for RSA 4096bit long keys on general computers ? how many encryption decryption possible per second ? all benchmarks only show 1024 and 2048 benchmarks :(
2
votes
1answer
342 views

using Post-quantum asymmetric ciphers instead of RSA

We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks ...
2
votes
1answer
249 views

Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
2
votes
1answer
600 views

Shamir Secret Sharing - Threshold decryption implementation

I'm implementing Shamir secret sharing in C using OpenSSL. I've split up the private key and I'm ready to start decrypting the original message using some of the shares. I set $n = 5$ (5 shares ...
2
votes
2answers
161 views

RSA keys finding when messages are known

I have this situation, where, in a game, people send messages to each other (game moves etc...) These messages need to be encrypted, and should only be readable by the destination person. I am using ...
2
votes
4answers
448 views

One time pad key exchange

If two parties want to communicate with securely using OTP , how is the key ( that is lengthy as plain text) shared with other party for decryption ?
2
votes
1answer
254 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key ...
2
votes
1answer
317 views

server side Javascript security

It is accepted that the javascript library lacks the ability to create an adequate PRNG. My understanding that this was mainly due to the limits of a sandboxed browser enviroment that javascript ...
2
votes
1answer
559 views

How to test distribution of a hash function?

From what I've found, it is generally accepted a cryptographic hash function like SHA-2 has an evenly, randomly distributed output. Is there a way to test this without running through the entire ...
2
votes
1answer
1k views

Calculating the inverse modularity of the determinant for Hill cipher

I'm trying to decrypt a message encrypted with Hill Cipher, but I don't understand how to find the determinant so it solves the equation $det * 1/det = 1 mod 26$. The determinant for my key matrix is ...
2
votes
1answer
281 views

What are the safe ways to derive HMAC key using block cipher?

Suppose we have a state of block cipher initialized with some key unknown to us, that is, we have the state after running key schedule, but we have no access to actual key or subkeys, all we can do is ...
2
votes
1answer
596 views

Self-expiring symmetric keys, or: cryptography in absence of secure deletion

I can encrypt some data D using a random symmetric key K, obtaining a ciphertext C, and then encrypt K with my public key Pub and obtain H. So far so good: I can only decrypt C if I have H and my ...
2
votes
2answers
262 views

Security considerations for partially shared password databases

Programs like KeyPass and 1Password store password database files encrypted by a single password. If someone knows the protecting password ("Vault Key"), they can read the entire database ("secrets"). ...
2
votes
1answer
154 views

How is the EAX-mode used in EAP-PSK (RFC 4764)?

According to the specification of RFC 4764, contents in EAP's third message and fourth message are required to be encrypted by AES-128 in EAX mode (also called protected channel). In RFC 4764, the ...
2
votes
2answers
189 views

Stream cipher malleability

Considering a stream cipher that produces a ciphertext $c$ from a message $m$ and a key $k$ is it possible to apply operations (multiplication and/or addition) directly to $c$ without knowing the key ...
2
votes
1answer
172 views

How many different keystreams can I produce with AES in Counter Mode?

I'm using a 64-bit nonce (incremented between the streams) and a 64-bit counter (incremented within a stream) for AES in CTR mode. How many different key streams can I produce with this setup?
2
votes
1answer
280 views

Generating a cryptographically secure, many-time use, symmetric encryption key

I need to generate a 256 bit encryption key described by the adjectives in the title. Currently I intend to create the key using this RNG. Is this a secure manner of creating the key, given that it ...
2
votes
1answer
310 views

Using “Additional Authenticated Data” as a secondary key

In implementing a cipher in GCM or CCM mode, you are provided the option to add "Additional Authenticated Data" (AAD). This AAD is required for decrypting the cipher text, and seems to be used when ...
2
votes
1answer
594 views

Generating a strong unique Initialization Vector

How can I determine if I am generating a unique and strong Initialization Vector? If my mode is generating Keystream? Is there any scientific explanation in generating a unique and strong ...
2
votes
2answers
156 views

Byte location of plaintext vs ciphertext when using a block cipher or stream cipher

I know that when you use a stream cipher you are just XOR'ing the plain text with the PRNG stream, such that you know if a specific byte is in position 3 of the plain text it will still be in ...
2
votes
1answer
240 views

Regarding matsui's Paper on Linear Cryptanalysis of DES

I's going throught the the Paper by Matsui on Linear Cryptanalysis of DES . In that he says $NS_{5}(16,15)=12$ And then in the next paragraph he says considering the expansion and permutation phases ...
2
votes
1answer
131 views

Separate Read and Write Keys in TLS Key Material

Why does the TLS protocol use different symmetric keys for receiving and sending data? Isn't it enough to have a single key used for both reading and writing?

15 30 50 per page