2
votes
1answer
299 views

Why is RSA usually limited to messages up to 1 block

I'm wondering why RSA encryption usually is only used for messages that fit into one block. For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution ...
2
votes
2answers
307 views

Simple homomorphic crypto for 32-bit integers

I'm looking for a simple way to perform homomorphic crypto on 32-bit integers. My only requirement is that I can add and subtract from the plaintext value without actually decrypting it. The crypto ...
2
votes
1answer
346 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = ...
2
votes
2answers
138 views

High Power Computing for Crypto Research

Obviously, much of cryptography requires the assumption that adversaries have bounded computing power. So, I was wondering, are there any fields in cryptographic research for which high power ...
2
votes
1answer
124 views

What's the strategy for future directions in cryptography? Bigger numbers/faster searching, or new methods, say, of factoring?

I'm taking a course in cryptography, and I would value any comments. This is not too technical a question, but more about directions or strategy in cryptography. My question is, is public key ...
2
votes
3answers
1k views

ANSI X9.31 standards for generating random numbers

The NIST-Recommended Random Number Generator Based on ANSI X9.31 Appendix A.2.4 Using the 3-Key Triple DES and AES Algorithms has 3DES being used three times for each 64-bit block of random data ...
2
votes
3answers
143 views

Public keys and their protocols

I'm having difficulties understanding exactly what this protocol means: $S \to D : \{N_S , S\}K_D$ $D \to S : \{N_S , N_D \}K_S$ $S \to D : \{N_D \}K_D$ "where $S$ represents the supervisor’s ...
2
votes
2answers
2k views

RSA 4096 bit key benchmark

is there any benchmark for RSA 4096bit long keys on general computers ? how many encryption decryption possible per second ? all benchmarks only show 1024 and 2048 benchmarks :(
2
votes
1answer
455 views

Diffie-Hellman is Post-quantum secured?

If Alice and bob have a secure channel for key-exchange and mallory don't man-in-the-middle attack them but in the future eavesdrop connection and see the key exchanged, can mallory break it like RSA ...
2
votes
1answer
208 views

What is an oracle adversary?

I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
2
votes
2answers
126 views

Can you use the same key to provide a signature and a MAC?

Apologies if this is a stupid question, but I'd be grateful if someone could provide an answer. I'm assuming that you need to use different keys to provide these functions, is that correct?
2
votes
2answers
402 views

Modifications of CBC-MAC

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. This post is very long, but this is because I remind here 2 long definitions. At the beginning I want to remind the ...
2
votes
2answers
589 views

Avalanche noise RNG for one-time pad use

I came across this little HRNG widget and was really intrigued as I have been looking for a decent but afordable source for truly random bits to use in a one-time pad. The question is, would a HRNG ...
2
votes
1answer
296 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key ...
2
votes
1answer
248 views

Proving correctness of pseudorandom generator construction given existing pseudorandom generator

Say if I have a given pseudorandom generator G which takes a k-bit input and outputs a 3k-bit number. How should I show that a specific construction using this pseudorandom generator is valid? For ...
2
votes
1answer
170 views

How could block encryption in counter mode be secure from viewpoint of entropy?

A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for ...
2
votes
1answer
3k views

How to decrypt AES in CBC

i am having problems understanding how CBC works! I know that it is a chain and the IV is XORed with the PT but then what? I mean we encrypt it with key k and the result is the CT which we use for the ...
2
votes
2answers
479 views

Can I make a cipher (ex: Vigenère) harder to break?

The Vigenère cipher can relatively easy be broken when the key size is small compared to the size of the message. One first finds the length of the key, and then uses frequency analysis to actually ...
2
votes
1answer
251 views

Conforming Randomness To An Alphabet

Imagine that we're trying to create a function to generate a random string conforming to a user-supplied alphabet. That way, users can generate random strings with given characters. Something like: ...
2
votes
1answer
153 views

Format of NONCE in Initialization Vector (IV)

When we talk about a Number used ONCE (NONCE) in Initialization Vector (IV), is it required to use numbers only? Is is possible to use letters or special characters?
2
votes
3answers
2k views

RSA Proof of Correctness

Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm? And why is it needed? I can't say that this or this helped me much, I'd like a more detailed and newbie ...
2
votes
1answer
845 views

“Signing” with public key

For this question, the following caveats and assumptions hold: There exists a 2048-bit RSA key pair used exclusively for signing/verification The private key is kept completely private There exists ...
2
votes
1answer
563 views

Replay attack prevention under strict conditions

Say I have a request-response protocol and the task to make it immune to replay attacks. The requirements are as follows: The defense mechanism cannot rely on the clocks of the parties. The defense ...
2
votes
1answer
301 views

How to properly add ECDSA private keys?

I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the ...
2
votes
2answers
235 views

Algorithm Design for only Mutual Information Sharing

Bob and Alice each have a bit string they want to keep private. They each want to know what the bitwise AND of their two strings would be without telling the other or anyone else listening to their ...
2
votes
1answer
199 views

Can A PRNG Be Used To Generate Multiple Private Keys for ECDSA?

Suppose Alice seeds a cryptographically strong Pseudo Random Number Generator with a truly random number, and keeps it secret. Alice then uses the output of the PRNG to generate several 256-bit ...
2
votes
1answer
703 views

How does Output Feedback mode use the initialization vector?

How can I process Initialization Vector inside the Block Cipher Encryption box (using for example AES) together with the Key? Will I encrypt the Initialization Vector like a block of plaintext? So ...
2
votes
3answers
461 views

RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
2
votes
1answer
155 views

Signature scheme with two private keys, neither derivable from the other

Is there any scheme, ideally one widely used or at least widely available, where you can treat both the signing and verifying keys as secret? Basically, the functionality I'm looking for is this: ...
2
votes
2answers
197 views

Is there a cumulative commitment scheme?

For a certain application I need a commitment scheme where each user could make a commitment, and a single verification operation could verify all the commitments simultaneously, faster than single ...
2
votes
3answers
1k views

Dictionary attack on pass-phrases on common algorithms

I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
2
votes
1answer
45 views

Do data-dependent rotations have any advantage over fixed rotations?

There are many ARX ciphers, however most use fixed rotations. I know data-dependent compared to fixed rotations are: patented harder to implement constant time more expensive in hardware harder to ...
2
votes
1answer
70 views

How many of primitive point on the elliptic curve?

In elliptic curves for cryptography, I know $nG=O$, where $G$ is a base point represented by $G=(x_g,y_g)\ on\ E(F_P)$, where $n$ is Order of point $G$. For example, $P(0,6)$ is a primitive point on ...
2
votes
2answers
94 views

What is primary security in ECC?

I read the following paragraph in a book about Elliptic Curve Cryptography, but didn't understand it: The primary security in ECC is the parameter $n$; where $n$ is Order of point $G$, that is $n$ ...
2
votes
1answer
80 views

Why is this cryptosystem insecure?

Can someone help me see the flaw in this cryptosystem? Note: This is homework and it is due today at 1:30pm. An answer before that is not expected; I'd just like to understand what the flaw is. ...
2
votes
1answer
42 views

Is XCBC where k2 and k3 might be the identical, secure?

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding. ...
2
votes
1answer
58 views

How secure is a lagged fibonacci sequence for encrypting brief messages?

Say I start with a 26-letter keyword and convert the letters into 26 integers (A=0, B=1...Z=25) nr[0] to nr[25]. Then I create a stream, nr[26] onwards, with a lagged fibonacci sequence where nr[n]= ...
2
votes
1answer
75 views

Encrypted read-only message queue

I'm creating a prototype for a messaging queue with some custom logic (can't re-use any existing solution). One requirement is to have all messages encrypted. There are three classes of nodes ...
2
votes
1answer
60 views

Can adding nonces make challenge response authentications weaker?

In a custom protocol we want to replace an aged tiger32 based challenge response authentication. I suggested that we use something existing, so threw HMAC into the room. As per wikipedia it works as: ...
2
votes
1answer
90 views

Calculate the RSA private exponent from the CRT parameters

I am trying to make the RSA structure of Openssl manually, knowing the public key ($n$, $e$) and the CRT parameters $p$, $q$, $d_P$, $d_Q$, and $u = q^{-1} \mod p$. That is, I want to get the $d$ ...
2
votes
1answer
163 views

Hashing passwords

The common way to store passwords in web applications is this form: $$hash(password||salt)$$ Does it make sense to store them in the following form instead:? ...
2
votes
1answer
234 views

Will I be able to (ab)use a FIDO U2F compliant hardware token to decrypt data?

I have heard good things about the emerging "FIDO U2F" standard. I am especially interested in having a JavaScript API for cryptographic functions that I can access through a plug-in in a browser. ...
2
votes
1answer
93 views

What's causing the poor randomness in this program: the LCG, or the program logic itself?

(Crypto Gods, I should begin by stressing that I haven't lost my mind: I'm not doing this in real life, I'm just trying to understand the theory behind what's happening. With your help, hopefully I ...
2
votes
2answers
72 views

Maximum password length in PBKDF2

Haven't found any clear cut answer in Google so its up to you guys: DK = PBKDF2(PRF, Password, Salt, c, dkLen) Here, what is the upper limit of password length? ...
2
votes
2answers
94 views

Diffie–Hellman Ephemerality Nomenclature

Below is a short excerpt of available DH cipher suites available on a machine. I understand EDH is ephemeral DH, and that ECDH is for Elliptic-Curve DH which is computationally faster. ECDHE is both ...
2
votes
1answer
54 views

Constant data as input to hash

I want to use hash function on some data, and part of this data, might be constant for a certain period. The output of the hash function is used as authentication data (MAC). I want to know if there ...
2
votes
3answers
96 views

Does 3-DES take approximately the same time to encrypt 1B and 1KB?

I am using 3-DES to encrypt some data in Java. I decided to run some tests and plot some graphics to decide how to optimally pack data for its encryption (see how encryption/decryption time behave ...
2
votes
1answer
75 views

Is my implementation of a PRG at least intuitively secure?

I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism. Basicly I take a random ...
2
votes
2answers
94 views

Storing encryption key

It's my first time using stackexchange! So, I am doing a password manager in Java. But now I am VERY confused because of the encryption. There will be the program login, where the user types its ...
2
votes
2answers
106 views

Collecting entropy: can I use timing of reading as a separate source from the reading itself?

I'm implementing an entropy gathering program. For that I collect 2 bits from two gpio-pins connected to a random source. I whiten this stream of bits using the von Neumann decorrelation algorithm. ...

15 30 50 per page