1
vote
2answers
2k views

Initialization vector length insufficient in AES

I use AES with AES/CBC/PKCS5Padding with the following encryption and decryption code sections in Java: ...
1
vote
2answers
240 views

One-way function and factoring

I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
1
vote
2answers
313 views

How to generate successive stream-cipher keys?

I've identified a weakness in a distributed simulation system I'm looking at, and I'm looking for some advice on how to fix it. Clients initially negotiate an authentication token with a login server ...
1
vote
2answers
537 views

Can md5 be used for encrypting data?

I know that md5 shouldn't be used for password hashing because of collisions and possibility of making dictionary attacks e.g. using rainbow tables. But what about ...
1
vote
1answer
270 views

Verifying the integrity of ciphertext using the cleartext hash?

I want to be able to verify the integrity of a ciphertext by providing the cleartext hash, for this to work it would need to: $$hash(crypt(cleartext)) = f(hash(cleartext))$$ Where $f$ is an ...
1
vote
1answer
3k views

c# Correct Triple Des Block Encryption Usage

I found the below code online, but in its original state, the encryption was not using any padding (Padding.None), and was encrypting in blocks of 8. I wasn't able to get this code to properly encrypt ...
1
vote
1answer
55 views

Exchanging Keyspace and Message space in PRF

Suppose there is a secure PRF $F: K \times X \to Y$. Then is $F': X \times K \to Y$, defined by $F'(x,k):=F(k,x)$, a secure PRF? In my opinion it should be because exchanging the keyspace with ...
1
vote
1answer
111 views

How to select $g$ in Paillier Cryptosystem

For my cryptography class project in university I have selected Paillier Cryptosystem as a course project ...
1
vote
2answers
112 views

How could Fully Homomorphic Encryption support power operations?

Fully Homomorphic Encryption (FHE) enables arbitrary functions computed on encrypted data, because it supports both addition and multiplication. But I wonder if FHE supports power operations. For ...
1
vote
1answer
33 views

Alert protocol in TLS

Assuming the alert protocol is encrypted AFTER a session has been established and the structure below, how does the client know whether to expect encrypted data or not? ...
1
vote
1answer
28 views

How to invalidate decryption key in multi user model?

I want to develop an application that will allow a user to create a public/private key pair, and encrypt it symmetrically with a key such that once they enter their password, they will be able to ...
1
vote
1answer
77 views

Rock-paper-scissors over network, how to protect from cheating server?

I'm trying to design cryptographic protocol to play Rock-Paper-Scissors with two parties, neither trusting each other, nor trusting server they use for communication, so game is 'provably fair'. So ...
1
vote
1answer
121 views

Traitor-tracing PRF

I'm looking for a pseudorandom function (PRF) with "traitor-tracing" properties. More specifically, I'd like there to be multiple equivalent keys, so I can give different parties different keys, but ...
1
vote
1answer
200 views

Hashing fundamentals

I have some ideas floating around my head for exploring hashing functions, but I want to make sure what I think I know is actually true, before basing a house of cards on it :) Let’s start with some ...
1
vote
1answer
56 views

Convincing “someone” on the (in)validity of DH tuple without revealing $u,v$

Is there a way of convincing someone on (in)validity of Diffie Hellman tuple $<g, g^u, g^v, g^{w}>$ without giving away $u,v$. or at least solve the Decisional Diffie Hellman Problem without ...
1
vote
1answer
149 views

Strange Password Hashing

I know about PBKDF2, bcrypt, scrypt, etc. and while I'm not a crypt professional, I think I understand why are they better than just "hash(pass+salt)". But a colleague of mine surprised me with the ...
1
vote
1answer
74 views

Simplified Fiat-Shamir example generates wrong output

I am trying to implement the Fiat-Shamir identification protocol, however the end results always fail to match. I am using algorithm's description from here. Preparation: Select 2 prime integers ...
1
vote
1answer
71 views

Modular protocol design

What does modular protocol design mean? Why does TLS not have modular protocol design? What protocols have modular design? (IPSec, SSH)
1
vote
1answer
136 views

Prime factorization of RSA modulus

Consider RSA public-key encryption with public modulus $N=3953$. Suppose we know that the public keys $e_1=337$ and $e_2=23$ correspond with the decryption information $d_1=3385$ and $d_2=2663$. ...
1
vote
1answer
64 views

simple multiplication in GF(8)

I am trying to do multiplication in the GF($2^3$) defined by the irreducible minimum binary polynomial $X^3+X^2+1$. I want to multiply $A(x) * B(x)$ where $A(x) = x$ and $B(x) = x^2$. The ...
1
vote
1answer
78 views

Diffie-Hellman explicit key confirmation

Suppose I wanted to add explicit key confirmation to Diffie-Hellman key exchange, would the following scheme be secure? Alice selects a random $a$ and sends $g^a \mod p$ to Bob Bob selects a random ...
1
vote
1answer
133 views

Known vs. Chosen (plaintext and ciphertext) and RSA

I want to know whether I can break RSA (textbook) with known plaintext/ciphertext attacks. Known plain-text Let $c$ be the ciphertext and $m$ the plaintext. $$c = m^a \mod n$$ Since all I have is ...
1
vote
1answer
84 views

Hill cipher is not perfectly secure

I am on cryptography course and there is a homework question to show that Hill cipher doesn't have perfect security. So assume we have an cryptosystem $(P,C,K)$, where $P = C = \mathbb Z_{26}^N$ and ...
1
vote
1answer
58 views

Addition-only PHE in F#

Using homomorphic encryption, I would like to be able to take an encrypted integer and either add 1 or -1 for a new encrypted value. I do not want the encrypted value to be recoverable - just the ...
1
vote
1answer
85 views

Usage of Fermat primes in RSA

Why are Fermat primes ($2^{2^n}+1$) useful as $e$ (the public key) in RSA encryption? I understand why $2^n+1$ primes are useful, because they would simply be ...
1
vote
1answer
136 views

AES mode for file encryption

I'm working on software that should eventually result in a crypto file system similar to encfs. So far, i have a user password that goes through PBKDF2 using ...
1
vote
2answers
119 views

AES-CBC and IV — Encrypting multiple blocks of a file with the same IV?

I have large files which are broken into blocks of 512 KB and uploaded to a server. In my DB I store the IV, and the user knows the security key themselves. When downloading, I use the same IV and ...
1
vote
2answers
137 views

Are the SHA family hash outputs practically random?

Say I hashed the output from a random number generator (with nonce), would the resulting SHA256 hash be as random as the inputted number? And If I used the first 5 hex characters, and then used the ...
1
vote
1answer
74 views

Trustless, Multiparty Random Number Generation

I've been having trouble with coming up with a random number generator that produces a random number between two parties. My current scheme is this: User 1 gives user 2 the hash of their randomly ...
1
vote
1answer
197 views

In this example, which is a premaster secret, and which is a master secret?

In the context of this data, as shown in the image below, which one is a pre-master-secret and which one is a master-secret. It looks to me as if the final value of 2, for Alice and Bob is a ...
1
vote
1answer
57 views

Sample RSA-style signature confusion

I'm trying to study a simplified TLS-style protocol, including verifying RSA signatures. It's an attempt to verify using only a valid certificate. However, I can't manage to get anything to verify ...
1
vote
2answers
70 views

Can a zero knowledge proof (or MAC) be generated from human-typable input?

Edit: My goal is to create a voting scheme that doesn't require a lot of crypto infrastructure to be deployed on the client side. Smartcards, and tokens are impractical for these purposes. I ...
1
vote
1answer
127 views

How should I manage Diffie-Hellman parameters on a Web Server?

Is there a best practice for Diffie-Hellman parameters (p, g, and q) used on a web server? The server is using ephemeral keys, but should the parameters be rotated on a regular basis? Is it OK for ...
1
vote
1answer
368 views

Find the key to a Vigenère cipher, given known ciphertext and plaintext

I have the ciphertext and the plaintext. Is it possible to know the key? If not, what do I need to find it?
1
vote
1answer
71 views

How do we arrive to the equation for solving D in RSA?

We have been shown that DE is congruent to 1 mod phi(n). How do we arrive to the real equation for figuring out d that is d = e^-1 mod phi(n). I want to know the entire process. I am just curious, ...
1
vote
1answer
110 views

Weak Stream Cipher cryptanalysis

Hi I have a stream cipher which uses a keystream of: F(r) || F(r+1) || F(r+2) || ... Suppose F(r) is the RSA encryption algorithm: ...
1
vote
2answers
187 views

scrypt and bcrypt for benefits of both?

I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory. Couldn't you just hash something with ...
1
vote
2answers
180 views

Shamir's Simple Sharing Scheme - preventing partial recovery of data

In SSSS, if you recreate the original secret with one of the decoder inputs being slightly damaged (e.g. one or two chars incorrect), you receive a slightly damaged version of the original secret. So ...
1
vote
1answer
62 views

What is the difference between a bijective random oracle and a random permutation?

Assume $S$ be a finite set $O$ be a random oracle from $S$ to $S$, such that $O$ is bijective $f$ be a random permutation of $S$ Is there any difference between $O$ and $f$? Does it makes any ...
1
vote
1answer
112 views

Homomorphic Encryption, LWE, and Practical Applications

I've been reading Brakerski and Vaikuntanathan's Efficient Fully Homomorphic Encryption from (Standard) LWE. When the authors discuss a small modulus p used for the transition from (n, log q) to (k, ...
1
vote
1answer
76 views

Applying differential cryptanalysis to ciphers with addition mod $2^{32}$

I am studying differential analysis and have a question. Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ (Plaintext $m_1$ xor with key $K_1$, then result goes into an ...
1
vote
1answer
67 views

Is the following aggregation scheme private?

Is the following scheme private? By private i mean an untrusted aggregator (UA) cannot reveal anything other then an aggregate function output on plaintext data Each party holds a secret key $k_i$ ...
1
vote
1answer
56 views

Why send a challenge with CHAP?

I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP). Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash ...
1
vote
1answer
83 views

Efficient parameters for group Diffie-Hellman

I want to implement a basic version of Diffie-Hellman key agreement for groups. So, my key is $K=g^{abc} \mod p$. Following this, the parameters I would need to transfer would be $K_a = g^{bc}$ etc. ...
1
vote
2answers
162 views

Why can we always assume that $Gen$ algorithm choose key uniformly?

Talking about a (symmetric) encryption scheme $\Pi=(Gen,Enc,Dec)$ where $Gen$ take the security parameter $n$ as input and generates a key $k$ of length $n$. Generally speaking we say that $Gen$ ...
1
vote
1answer
51 views

order between adversaries and type of resources given

We have a game $G0$ for which an adversary $A$ has access to a certain amount of ressources. Let us suppose that the maximum advantage for the adversary to win this game is $Adv_{G0}$. If we modify ...
1
vote
2answers
97 views

Scalar Multiplication on Elliptic Curves

In the elliptic curve: $y^2 = x^3 + 20x + 13 \bmod{2111}$. Using the point $P=(3, 10)$ I am wondering how to multiply this point by the scalar $57$? I realize I can write $57*P$ as $2^5*P + 2^4*P + ...
1
vote
1answer
75 views

Why have 4th and 5th steps in Needham-Schroeder Protocol?

Why have 4th and 5th steps in Needham-Schroeder Protocol? It is said "These steps assure B that the original message it received (step 3) was not a replay.". But what is a replay here? And I don't ...
1
vote
1answer
501 views

What does AES256-CTS-HMAC-SHA1-96 mean in relation to Kerberos?

I'm not completely clueless as to what it means, but I'd like to understand it at a higher level. The highest encryption type used by Active Directory domain controllers for Kerberos authentication ...
1
vote
2answers
113 views

PPT eavesdroper able to output $m_{0}$ and $m_{1}$ of different lengths

I've read the following two questions and their answers: Messages of different lengths and one-time computationally-secret Why is a non fixed-length encryption scheme worse than a fixed-length one? ...

15 30 50 per page