2
votes
0answers
109 views

How well analyzed are giant block length ciphers?

I have heard about ciphers that have a block length of 256 megabytes... That is huge. How well are they understood by the encryption community? I'm referring to PMC Ciphers. Has anyone used such a ...
3
votes
1answer
282 views

Difference entity authentication and implicit key authentication

From the Handbook of Applied Cryptography, in discussions of key sharing algorithms, I see definitions: Implicit key authentication is when one party is assured that no other aside from a ...
5
votes
2answers
233 views

Pen-and-paper one-way function for externally-anonymous survey

When conducting surveys, an Administrator might send an Enumerator to survey a Respondent. For "sensitive" questions (e.g. about embarrassing behavior), the Respondent may be fine with the truth being ...
2
votes
1answer
851 views

AES encryption with multiple keys

I would like to encrypt some data using a combination of multiple keys. There would be two keys: a client keys that would be generated for each client and a single server/application key used by ...
12
votes
1answer
434 views

Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?

A recent paper by Göloğlu, Granger, McGuire, and Zumbrägel: Solving a 6120-bit DLP on a Desktop Computer seems to "demonstrate a practical DLP break in the finite field of $2^{6120}$ elements, using ...
2
votes
1answer
101 views

Encrypt user email but be able to find user by email

Sorry for my dumb question, but it's better to ask dumb question than to do dumb things silently. I want to encrypt user email in my DB so that if someone stole the DB (and not the key) - he won't be ...
-2
votes
1answer
725 views

University for Crypto grad study [closed]

(I thought twice before asking this question and quite reluctant to type as well, but I think this would be helpful). I am an undergrad student and choose theoretical computer science as my major. ...
1
vote
1answer
157 views

How to verify a shared secret using only AES?

I have two devices that need to verify that they both are in possesion of the same secret key. One of the devices is a very limited embedded device that only has AES128 available, no SHA or other hash ...
1
vote
0answers
45 views

Conditions for proving that a signcryption scheme is secure

If I'm able to prove that any scheme satisfies confidentiality ad unforgeability conditions, will it be a valid signcryption scheme, without explicit signature and encryption parts ?
0
votes
1answer
120 views

Size of Parameters in Polynomial Key-Splitting Algorithm

I've seen the elegant way of splitting a key among different people so that only a certain number need to be present to re-compute the key, yet nobody has enough information to re-compute the key on ...
2
votes
1answer
205 views

Why is verification using DSA slower than verification with RSA?

We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this? DSA parameter generation: choose prime number $p$ choose prime number $q$ such ...
2
votes
2answers
448 views

Why RSA uses {d,n} as private key instead of {e,n}?

While studying the RSA algorithm I referred to some books and some sites such as RSA (wikipedia) and all of them chose {d,n} as the secret (private) key and release {e,n} as the public key but as d ...
1
vote
1answer
150 views

Which keys are necessary to decrypt Application data in a SSL connection?

I'm debugging an application which communicates between client and server using a SSL/TLS connection, and want to capture and analyze the sent data. Are the client write keys and server write keys ...
0
votes
1answer
105 views

what actually the function for e(g,g)^xy

I doing a project using ABE "Attribute-Based-Encryption" but i didn't understand what actually the function for $e(g,g)^xy$. Just tell what's the calculation need to perform here. I gone through no of ...
7
votes
2answers
183 views

Linkable ring signature scheme

I need an implementation of linkable ring signature, a ring signature which allows identifying whether two signatures belong to the same signer. It has important privacy-related applications, like ...
1
vote
1answer
228 views

Key sizes for discrete logarithm based methods

I have a question regarding the key generation process of methods that are based on the discrete logarithm problem. This site gives some good insights, but I don't fully grasp it I think: ...
22
votes
2answers
788 views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows ...
3
votes
3answers
507 views

Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
13
votes
3answers
6k views

Recommended skills for a job in cryptology

First let me apologize if this is an ill posed question. Let me also note that I do not in any way seek a comprehensive answer, simply your thoughts on what makes for a valuable asset to a company ...
2
votes
2answers
195 views

What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?

I'm working with the affine representations of points of the Secp256k1 elliptic curve (from Bitcoin). I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed ...
2
votes
1answer
150 views

How does the birthday attack work in AUTH and UF-CMA games?

In the AUTH and UF-CMA games, an adversary is required to forge a ciphertext or message/tag pair to win the game. Given an encryption scheme $E$ and a PRF $F$, let $\hat{E} = C || F_k(C)$ and $C = ...
3
votes
1answer
325 views

How much data can I encrypt with AES before I need to change the key in CBC mode?

In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted. It seems that ...
1
vote
1answer
139 views

Do I need to keep a 64-bit version number secret?

Assume the following structure: version | iv | ciphertext | HMAC(version | iv | ciphertext | ..., key) The version starts out ...
11
votes
1answer
616 views

Is Wikipedia's table about SHA-2 collisions correct?

I was looking a Wikipedia article on SHA-2, and the "Comparison of SHA functions" table seems to indicate that SHA-2 is less secure than SHA-1. Is this true, or is the table wrong / misleading? ...
0
votes
1answer
136 views

What key length is required to keep simple keyed “hash” secure?

In a previous question, I described a particular keyed "hash" that mapped a 5-digit input code into a 5-digit output code. It used a 8-bit key which is very insecure - more than 99% of the time, you ...
10
votes
1answer
441 views

How random are commercial TRNGS

I'm thinking about buying a USB TRNG. How do I evaluate its randomness? I'm sure some are better than others but which is which? Are thermal-noise better than radio-noise TRNGs?
-1
votes
2answers
187 views

Perfect Secrecy, two Definitions

I'm reading the proof of the implication "Def 2.1 $\Rightarrow$ Def 2.4" in these slides about Adversarial Indistinguishability and Perfectly-Secret Encryption. I have a doubt in the slide 10. Here it ...
2
votes
1answer
145 views

Is this algorithm secure?

I recently found this site, proposing a hashing algorithm for passwords. They describe the following: pad the password on both sides with SHA1(email) to ...
0
votes
2answers
144 views

Physical Level Encryption

What types of algorithms that are capable of signing a message are out there that run on a physical level, e.g. lacking the infrastructure of a standard PC, no memory, processor or motherboard in the ...
1
vote
2answers
296 views

Are there any hand ciphers not obsoleted by computer cryptanalysis? [duplicate]

Computerized cryptanalysis has obviously made formerly "secure" hand ciphers like Playfair, Four Square, and the Hill Cipher obsolete because they can be defeated in seconds. But is there a hand ...
-2
votes
1answer
383 views

How to calculate cycles per byte [closed]

Sometimes, websites and scientific papers that introduce and/or handle cryptographic algorithms also provide speed-analysis and tables comparing the individual performance of cryptographic ...
-1
votes
2answers
321 views

Why this k parameter is in unary in adversary PPT algorithm? [duplicate]

While reading some text on cryptography, I found that algorithm $A$, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message ($y$) and ...
3
votes
1answer
261 views

Alternatives to HMAC + CBC?

I'm looking at using HMAC + CBC. The combination looks like this: ciphertext = AES256(text, k1) data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext Where: ...
2
votes
2answers
700 views

Is Base64(SHA1(GUID)) still unique like the original GUID?

Basically what the title is; GUIDs are unique by design. If you run the GUID through SHA1 and then Base64 the hash, will the resulting string have the same guaranteed uniqueness as the GUID, or not?
2
votes
2answers
376 views

What are the potential security impacts of using CRAM-MD5 for Emails, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. But ...
3
votes
1answer
136 views

When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?

I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w ...
1
vote
1answer
256 views

Polynomial multiplication and division in2^128

I want to multiply and divide polynomials, and implement the extended Euclidean algorithm for polynomial greatest common divisors, over a Galois Field of size $2^{128}$. Moreover, I want to use the ...
2
votes
1answer
401 views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...
1
vote
1answer
146 views

Is this a sensible cryptographic protocol intending to reduce the impact of compromised security?

I'm in the process of designing a cryptographic protocol which will reduce the impact an attacker will have if they gained root access to a server storing data. The basic crux of it is that keys ...
1
vote
2answers
548 views

Generate fixed length cipher text from arbitrary length plaintext

Using an encryption algorithm like AES, is it possible to generate a fixed length cipher text no matter how long the plain text becomes?
3
votes
1answer
453 views

Hill-cipher, disordered alphabet

I am going to apply a simple substitution cipher to my input, then encrypt the result with a Hill cipher. How can this be broken, in a chosen-plaintext threat model? In other words, instead of the ...
1
vote
2answers
276 views

Help me describe/identify this challenge-response protocol/algorithm?

My area of expertise is reverse engineering, specifically embedded systems. I do attack cryptographic systems, but this largely involves key recovery or exploiting the implementation. I was asked to ...
2
votes
2answers
173 views

Is Functional Encryption about Access Control over encrypted data alone?

Informally, In functional encryption system , a decryption key allows a user to learn a function of the encrypted data. But all i see is that the function acts as an access control over the data. ...
1
vote
0answers
41 views

calculating beta for elgamal elliptic curves [duplicate]

Suppose we use elgamal elliptic curves for secure communication. Bob selects a prime $p$, an elliptic curve $E$, a point $\alpha$ on $E \pmod p$, and a secret integer $f$. Suppose that Bob has ...
2
votes
2answers
347 views

SHA-1:Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output?

Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output? What is the probability that a 160-bit SHA-1 hash output contains at least 128 1's?
2
votes
2answers
815 views

True random numbers generated by sensors

Is using sensor raw data a good way of generating true random numbers? I mean using an IPhone's gyro/accelerometer raw output as a base for generating an array of true random numbers.
2
votes
2answers
285 views

Generating IV in TLS 1.2

I'm writing a TLS 1.2 implementation (in C#) using a custom protocol. My question is how to generate the IV attached to each message, I don't want to use RandonNumberGenerator because I've heard it ...
0
votes
1answer
55 views

PKCS#11: Which CKK_types are supported by CKM_PKCS5_PBKD2?

On Solaris there's a function pkcs11_PasswdToKey() which is a wrapper of C_GenerateKey(). I made a simple test and it turned out ...
2
votes
1answer
217 views

What is a fair exchange scheme?

The Wikipedia entry Fair exchange has only two lines, and the only paper I can find describing such a protocol is extremely complicated. Is this a new field in cryptology or can someone give an ...
0
votes
1answer
76 views

Encrypting a broadcast channel

We're building a data service that is expected to go out through a single "fat pipe" channel. The design requirement says that the data in the channel must be protected by authentication and ...

15 30 50 per page