2
votes
2answers
90 views

Are all stream-ciphers IND-CPA?

A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode ...
2
votes
3answers
77 views

Reasons for components of AES

I started reading "Cryptography: theory and practice" by Stinson, and I am trying to understand the reason behind the choices for the different components of AES since they seem quite arbitrary. In ...
2
votes
2answers
92 views

Is there a cryptographic algorithm which is immune to side channel attacks?

Is there any cryptographic algorithm immune to side channel attacks based on scan chain? In VLSI point of view.
2
votes
1answer
178 views

How does ROTL work?

what does ROTL stand for? I know it does left shifting but what about the acronym? When we do a left shift, do we take the leftmost bit and add it at the end, by making the second bit the first, and ...
2
votes
3answers
447 views

decrypt numbers multiplied by a certain floating point number

A friend has about 10K numbers in a an excel sheet. He wanted to encrypt these numbers in order to share the file with a 3rd party that will help him reorganize the tables. What he did, to hide the ...
2
votes
1answer
144 views

Discrete logarithm modulo a smooth number

I am solving the discrete logarithm problem modulo $N$. $N$ is a composite number, I found its factors — lots of small primes and two big primes ($> 2^{50}$). Does the factorization of $N$ somehow ...
2
votes
1answer
120 views

Rounds in cryptography

I need to make it clear I know nothing about crypto so in that context I'm hoping to clear up some confusion: As I understand it a "round" in a cipher is one encryption operation and a cipher like ...
2
votes
2answers
86 views

Is there an alternative AES schedule?

I'm currently reversing an AES implementation for disk encryption. The odd thing I'm stumbled about is a key schedule where the encryption round keys are not the same as the decryption round keys (in ...
2
votes
2answers
277 views

Can RSA signing be implemented on top of RSA encryption/decryption?

I need to use RSA-SHA256 signing. Unfortunately not all Microsoft CryptoAPI providers support that. It's possible that I might get a handle to a CryptoAPI provider that can just encrypt/decrypt with ...
2
votes
1answer
168 views

Does the size of a ECDSA key determine the hash algorithm?

I am a bit lost in understanding what I read on authentication, signature, etc. For instance, is the size of the ECDSA keys produced by ssh-keygen -t ecdsa -b 256 ...
2
votes
2answers
370 views

salsa20 is invertible, useless in CTR mode?

I'm reading the salsa20 spec (sorry for the newbie question, i'm really a newbie here). Every paragraph ends with : "this operation is invertible", I suppose the whole salsa20 algorithm is. If I use ...
2
votes
1answer
431 views

CMAC vs HMAC security strength

From the perspective of a Birthday Paradox attack, isn't it true that CMAC based on AES-128 is weaker than HMAC-SHA-1? The attack on CMAC-AES-128 requires about $2^{64}$ operations whereas the same ...
2
votes
2answers
350 views

Cryptographically Secure Hash Algorithm with Very Specific Property

First of all, I apologize if this is a stupid question, but I don't have any background in cryptography. I'm looking for a secure hash algorithm $H$ with the property $H(K_1+n)\oplus ...
2
votes
1answer
256 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
2
votes
2answers
241 views

Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
2
votes
2answers
315 views

Polynomial representation of the affine part of the AES S-box

I have been reading up on the polynomial representation of the AES Sbox (PDF: “Essential Algebraic Structure Within the AES” by Murphy and Robshaw) and I can't get it to produce the correct output. ...
2
votes
2answers
208 views

Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?

As in the title, given $g$, $g^{ab}$ are big elements in a prime group $Z_p$ and $b$ in prime group $Z_r$ ($p > r$, $g$ is one generator of $Z_p$). $a$ is unknown and also in $Z_r$, is finding ...
2
votes
2answers
121 views

How is this affine function a pair wise independent permutation?

Can anybody explain how the below is true ? $I_n$ denotes the set of all n-bit strings, ${\{0,1\}}^n$. (..) Let $A$ be a finite field then the permutation $f_{(a,b)}(x) = a \cdot x + b$, ...
2
votes
2answers
664 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
2
votes
3answers
153 views

Do sites store login password with hash? If so, can people can use hash collision to log in?

I was researching about hash, and I thought, If sites store passwords with hash algorithms, then can't this happen: User A has the password 'hello' User B finds out the hash code of the password of ...
2
votes
2answers
256 views

Password-based encrypted key storage?

RFC 5959 specifies the encrypted storage of private keys based on PBKDF2-HMAC-SHA-256 and AES encryption (in ECB mode). Is there a particular reason AES is used, instead of simply XORing the key ...
2
votes
1answer
625 views

Is AES key length a size of the key or entropy?

While educating my self I'm having hard time to understand what an 128 bit AES key actually means? Is it a key length or entropy? Please explain to me trough following example (assuming AES): ...
2
votes
2answers
769 views

Does the secret key used in AES have to prime?

I’ve looked around this site and the web quite a bit, but can’t find a definitive answer on whether or not the secret key $k$ used in the AES crypto-system has to be a prime number? Or can you just ...
2
votes
1answer
146 views

Constants Differ in SHA1 implementation

I am trying to understand why the constants differ in this SHA1 implementation: https://code.google.com/p/crypto-js/source/browse/tags/3.1.2/src/sha1.js ...
2
votes
2answers
197 views

Perfect Forward Secrecy in TLS

I read that TLS does PFS using Diffie Hellman. However, DH can be used even without certificates - so how is DHE-RSA better than plain DHE? Is DHE a insecure algorithm, that DHE-RSA is needed?
2
votes
1answer
311 views

SHA256-based stream cipher

Can anyone comment if the stream cipher described here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced ...
2
votes
2answers
120 views

Do we need symmetric cryptosystems?

One question I had to answer in my crypto exam today was: Do we need symmetric cryptosystems? As it stands, that's probably a debatable question, so I'd like to reformulate this as: Are ...
2
votes
4answers
278 views

Construct an encryption algorithm using hash function [duplicate]

We know that Cryptographic hash function is generally a one-way function where we can't retrieve the original message. On the other hand, encryption is a two-way-function where we get the original ...
2
votes
2answers
274 views

How does compression before encryption leak info about the input?

Apparently current best practices recommend that you do not compress before you encrypt. For example in this blog entry (*): http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ It ...
2
votes
1answer
127 views

Why do we apply the concept of circuit in homomorphic encryption schemes?

I am a beginner to the concept of homomorphic encryption. One thing that makes me very confused is why we use the circuit concept or approach to homomorphic encryption. Gentry's paper does not discuss ...
2
votes
3answers
370 views

How is a public key actually used to encrypt something?

One thing cryptography articles never seem to explain is how the message actually gets encrypted. You get this long-winded lecture on number theory which ends with, Ta Da! and we have a public and ...
2
votes
2answers
435 views

Seed / reseed DRBG too often?

There are limits to how much you can use a the DRBG before you have to reseed it, but are there any limits to how much you must use it before reseeding? Take the following scenarios as an example… ...
2
votes
2answers
214 views

Impact of distinguishing between random text and cipher text?

In theory, distinguishing cipher text from random text is considered insecure for any PRP algorithm. Say for example - due to Patarin's proof with about six rounds of Feistel Network - the attacker ...
2
votes
2answers
159 views

implication of tweak on bruteforcing a block cipher

Consider a KPA attack, where the attacker gets known plain text and the corresponding cipher text. Since the encryption algorithm is known, he can brute force all possibilities of key bits. What is ...
2
votes
2answers
310 views

Two-dimensional S-Box

Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ Where $S$ is S-box, $m_1$ - 16-bit plain text, $k_1$ and $k_2$ is two parts of 16-bit key. If S-box is standard then this ...
2
votes
1answer
214 views

Elliptic Curve Factorization: Why are elliptic curves suited for this kind of task?

Currently I'm working on a presentation of a paper that talks about the factorization of large numbers. In the paper elliptic curves are presented as a way to factorize large numbers. After hearing a ...
2
votes
1answer
286 views

Why restrict nonce/IV and counter to specific sizes?

When setting up a nonce/IV and counter (e.g. for AES-GCM-128), why are the nonce/IV and counter restricted to specific sections (e.g. random nonce/IV in first 8 bytes and counter in last 8 bytes)? ...
2
votes
2answers
2k views

How to find generator $g$ in a cyclic group?

As generator $g$ is use in DH how to find combination of prime $p$ and $g$? eg: if we choose $p=23$ its generator is $7$ (given in book) how to find it?
2
votes
1answer
254 views

Why is verification using DSA slower than verification with RSA?

We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this? DSA parameter generation: choose prime number $p$ choose prime number $q$ such ...
2
votes
2answers
569 views

What are the potential security impacts of using CRAM-MD5 for Emails, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. But ...
2
votes
2answers
1k views

True random numbers generated by sensors

Is using sensor raw data a good way of generating true random numbers? I mean using an IPhone's gyro/accelerometer raw output as a base for generating an array of true random numbers.
2
votes
1answer
335 views

Is the DES algorithm in OPENSSL random?

Look at the hex dumps of encrypted1.bin and encrypted2.bin . They both have same password A which was used to encrypt sampletext ...
2
votes
2answers
735 views

Can two rc4 encoded messages be XORed and decrypted if encrypted with the same key?

If I have the following: E1 = RC4(M1, K); E2 = RC4(M2, K); If two different messages M1 and M2 are encrypted with the same key, K, can the key be recovered by ...
2
votes
2answers
647 views

What are the differences between proofs based on simulation and proofs based on games?

what are the main pros and cons of proving the "security" of a crypto scheme under simulation proofs instead of game based proofs?
2
votes
2answers
227 views

Does it take brute force to find a pair of plaintext and ciphertext that each follow a certain condition, given an AES encryption key?

Suppose that I have an AES key $K$, and I'm instructed to find a plaintext such that the first 32 bits of the plaintext are some string of bits $S_1$, and the last 32 bits of the ciphertext once the ...
2
votes
3answers
3k views

AES-GCM and its IV/nonce value

I was reading about the differences between the GCM and the CBC more here and I have a follow up doubt on the same. In the CBC mode the person who performs the encryption is the one who provides the ...
2
votes
1answer
3k views

AES key length greater than 256 bits - is it dangerous to do an implementation outside of the standard?

I'm making a digital-asset manager written in ActionScript 3, it will be used to manage highly sensitive information. I'm using the AS3Crypto library (which has quite a good reputation) to implement ...
2
votes
2answers
321 views

Speeding up partially known plaintext preimage recovery attack on MD5

Suppose there are three messages A, B and C of different length, that are 16 DWORDs in ...
2
votes
2answers
310 views

What cipher mode is suitable for independantly decryptable short messages?

I'm building a small VoIP client which transmits encrypted audio data via UDP, and some packet loss is expected, so each packet will need to be decrypted separately even if others in the stream don't ...
2
votes
3answers
433 views

Safety of DSA key parameters sharing

I'm looking for a solution to use in a context where I need to be able to generate new asymmetric key pairs quickly (using a widely recognized algorithm, and EC-DSA is not applicable). It sounds like ...

15 30 50 per page