3
votes
1answer
2k views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...
5
votes
2answers
133 views

ML/NN Cryptanalysis

Is it computationally plausible to use NN/ML to do any of the following tasks? "Real" cryptanalysis. Cyclic neural networks for extended computation, but break the hash all the way through. ...
1
vote
1answer
105 views

How unsafe is to share parts of a password

The best way to ask this question and have a concrete answer is to set a very specific example. This is the example I would be interested in reading an answer to: Consider that my friend Alice has ...
1
vote
1answer
355 views

Encrypting firmware with AES and no IV [closed]

I have an embedded device with a AES CBC engine on it that is used to ensure the integrity of the firmware. I know that CBC mode requires unique IVs to be any good, but I'm unsure if it makes a large ...
1
vote
0answers
351 views

Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
0
votes
1answer
42 views

gnupg: display digest of key [closed]

How can I display what digest algorithm has a key? If I import a public key which has MD5 as digest, I get a warning about this weak algorith. But how can I check, what digest algorithms all my keys ...
2
votes
2answers
1k views

Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?

In the public certificate, an RSA public key specified as 2048 bits long is represented by 540 hexadecimal characters. Converted to base-2, this yields 2160 bits, 112 more than the stated 2048.
8
votes
2answers
1k views

Can someone explain the ECB Penguin?

I've seen the ECB Penguin used to demonstrate why ECB is not a recommended method of encryption, but I do not understand how this translates to text or passwords. Aren't the people who create these ...
2
votes
1answer
156 views

Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent. Can ed25519 be cracked after a certain amount of ...
4
votes
2answers
379 views

Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
1
vote
1answer
97 views

Modular protocol design

What does modular protocol design mean? Why does TLS not have modular protocol design? What protocols have modular design? (IPSec, SSH)
3
votes
1answer
246 views

RFC 3526 - What does pi mean?

In RFC 3526 there are a series of primes listed as standard parameters used for Diffie-Helman. The primes are list in two formats. One is the long format, where the number is given in hex. For ...
2
votes
2answers
213 views

RSA: What happens to restrictions of plaintext n, dependent on p and q?

Ok - i will try to ask my question as clear as possible. Im getting a little deeper into the RSA-cryptosystem. At one point i'm a little confused. We have a plaintext $x$ and ciphertext $y$, with $x ...
1
vote
1answer
252 views

Prime factorization of RSA modulus

Consider RSA public-key encryption with public modulus $N=3953$. Suppose we know that the public keys $e_1=337$ and $e_2=23$ correspond with the decryption information $d_1=3385$ and $d_2=2663$. ...
1
vote
1answer
85 views

OTP sequence uniqueness

Is it possible to use Time-based One Time Password (TOTP) algorithms to generate tokens from multiple channels (where a channel is defined as a "user" using a certain shared key $K_c$ for channel ...
1
vote
0answers
133 views

Safe and computationally efficient way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which ...
1
vote
1answer
251 views

crypto design with AES256 MODE OFB

I have the following APP Design key store (contains 1:n user payload as 1:n key store entries) key store salt (is used to extend to key store password to 256 bits, stored in clear text) key store ...
2
votes
1answer
627 views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
2
votes
1answer
126 views

Pseudo random permutation for arbitrary size domains

Popular block ciphers like AES or Twofish are keyed pseudo random permutations on the domain $\{0,1,\dots,2^{k}-1\}$ with $k\in\{128,192,256\}$ or similar. I'm interested in pseudo random ...
1
vote
1answer
129 views

simple multiplication in GF(8)

I am trying to do multiplication in the GF($2^3$) defined by the irreducible minimum binary polynomial $X^3+X^2+1$. I want to multiply $A(x) * B(x)$ where $A(x) = x$ and $B(x) = x^2$. The ...
1
vote
1answer
105 views

If its possible to derive the public key from a private key, why can't we go in reverse?

I'm looking at source code for BitcoinJ that derives a public key from the private key. ...
2
votes
3answers
249 views

How can we sign a contract digitally between two parties?

I'm trying to sign a contract with another party, without using handwritten signatures. I've just read through Applied Cryptography, but there doesn't seem to be a protocol that can solve this ...
3
votes
1answer
223 views

Proofs by reduction and times of adversaries

I have some difficulties to understand, when we construct a reduction, how we determine the time for the constructed adversary to break a target security property. In general these details are not ...
2
votes
1answer
162 views

ElGamal with elliptic curves I

It is very interesting to see @tylo's answer on ElGamal with elliptic curves. Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its $x$ coodrinate. ...
2
votes
3answers
205 views

Why can't hashes be reversed with toffoli gates?

This is a follow up question to this question: Crack cryptographic hash functions using Toffoli gates?. Suppose there is a hash function $$H(x)=y,$$ where $x$ is the input of the function and $y$ is ...
1
vote
2answers
192 views

Current standard for hash function security parameter?

When designing a hash function, what should be the secure input and output lengths? In particular, what lengths do I need for collision resistance?
2
votes
1answer
183 views

Is this approach to generating a “random” number from a sha512 hash effective?

I'm looking to run a small raffle but i'd like people to be able to verify that the number chosen was fair. I know some sites use a "Provably Fair" system to achieve this where user input is combined ...
2
votes
2answers
91 views

Should tweak be unique per message?

Since tweaks are like IV,Salt for block cipher inputs . Should they be unique for each message ? If they are to be unique per message then what is the advantage of giving tweak directly into the ...
3
votes
2answers
416 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
6
votes
2answers
306 views

If attacker knows salt and hash, how is salt effective?

Maybe I'm missing something, but if my salt and hashed/salted password are stored in the same place, how is salting any more secure than just hashing? Does this just rely on attackers not knowing how ...
5
votes
4answers
145 views

Is there a standard way to extend the output of a hash?

Say I have a hash function, a state-of-the-art hash function that we would all approve of that produces a fixed number of bits (n) as output. (I'll call it HASH.) Is there are a standard way to ...
1
vote
0answers
139 views

Hash function that is efficient on GPU and poorly suited to ASIC

I have such requirements to the hash function in my project: operating on 32-bit data, not mathematically breakable (built on existing hashes known to be secure), free of branching, as much as ...
1
vote
0answers
58 views

What does the notation $1^n$ stand for? [duplicate]

I'm seeing this all over my Katz and Lindell book and I don't see where they introduced it.
0
votes
2answers
100 views

Needed: signature over a collection of hashes

I'm looking for some kind of crypto-based data structure that will allow me to produce a signature over a set of hashes. Call this a SignedSetOfHashes. I want to be ...
4
votes
1answer
196 views

a doubt in Rijndael's key expansion sizes

I've often heard/read that AES key sizes 256 & 192 would be weaker than 128 or not stronger as expected from the size increase, but I've never seen a proof. How does one proof the strength of a ...
2
votes
3answers
347 views

RSA assumption and cryptography

The RSA assumption states that it is hard to find $m$, given $c = m^e \bmod{n}$, $e$, and $n$ (for appropriate choice of $n,e$). Suppose that there exists an algorithm, $D(c,e,n)$, that finds $m$ in ...
1
vote
2answers
314 views

How can I simulate and measure brute force hacking using RSA?

I want to implement brute force hacking using RSA. How can I simulate and measure time duration? What software (or software-based simulator) would be needed?
1
vote
1answer
84 views

Hashing a uuidv4 + time to create a unique id

First, I am no crypto expert although I am doing the MOOC. I have an item which has as id: uuidv4 When I create this item: I create a new uuidv4 check if it already exists and if not, I store it ...
-1
votes
1answer
440 views

Is the random data at the end of my decrypted message supposed to be there?

This is my PKCS#5 & AES/ECB Python 3.3 code: ...
3
votes
2answers
166 views

One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on ...
3
votes
1answer
331 views

Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?

I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines: Consider routine 2.2.7 of ...
-1
votes
1answer
131 views

How to determine which type of crypto is used in a text file? [closed]

is there a tool or a way to determine which type of crypto is used in this type of text: ...
3
votes
0answers
187 views

Prove preimage resistance property

Let $ f : \{0,1\}^* \rightarrow \{0,1\}^n$ and $ g : \{0,1\}^* \rightarrow \{0,1\}^m$. $h$ is created by concatenate f and g: $ h : \{0,1\}^* \to \{0,1\}^{n+m}$ with $h(x) = f(x) || g(x)$. How do I ...
0
votes
1answer
102 views

AES CBC encoding of decomposable OAuth2 tokens

We're building a stateless RESTful API that relies on the content of OAuth2 tokens to identify users and what they have access to. Users authenticate with other means and are given a token, which they ...
0
votes
1answer
202 views

Unique, anonymous online authentication

Is there a way to authenticate users online without knowing their real identity yet preventing them from registering twice? If not, what is the least amount of information you would need? If it helps, ...
3
votes
1answer
76 views

Collecting entropy from a stream to a file

I have a potentially infinite stream of data originating in some physical phenomena that may expose random behavior (due to quantum effects, thermal noise, the butterfly effect in chaotic dynamical ...
1
vote
1answer
190 views

Generating Diffie-Hellman parameters efficiently

I am working on an Android project for school and I am supposed to do a DHKE (Diffie Hellman Key Exchange). Everything works well. The problem is that it takes a lot of time (really a lot) to ...
1
vote
1answer
246 views

What are some restrictions when converting Montgomery Curves into Weierstrass Curves?

I want to represent a Montgomery Curve (curve25519) in Weierstrass form as a personal exercise. After doing some math and referencing the conversion equation at ...
1
vote
1answer
108 views

Diffie-Hellman explicit key confirmation

Suppose I wanted to add explicit key confirmation to Diffie-Hellman key exchange, would the following scheme be secure? Alice selects a random $a$ and sends $g^a \mod p$ to Bob Bob selects a random ...
11
votes
3answers
783 views

What is a Non-Interactive Zero Knowledge Proof?

I understand the concept of a Zero Knowledge Proof thanks to the easy to understand analogy of Alibaba's cave. However, this seems to require interaction between the verifier and the other party. I ...

15 30 50 per page