All Questions
4
votes
1answer
221 views
OpenPGP Signature Packet hashed data
RFC 4880 describes the version 4 signature packet, tag 2, as
...
4
votes
1answer
421 views
Deterministic nonces in CTR mode
I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
4
votes
1answer
114 views
In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?
In the 1978 RSA paper, it is recommended, among other things, to choose primes $p$ such that $(p-1)$ has a large prime factor $u$. This was motivated by Pollard's p-1 algorithm. Further, the authors ...
4
votes
0answers
78 views
RSA security assumptions - does breaking the DLP also break RSA? [duplicate]
Possible Duplicate:
Would the ability to efficiently find Discrete Logs have any impact on the security of RSA?
I'm wondering if breaking the DLP, that is the basis for ElGamal and DSA, ...
4
votes
2answers
297 views
Does RSA padding have to be unpredictable if the payload is?
I'm trying to understand the precise requirements on padding when using RSA for encryption.
Suppose Alice uses RSA to encrypt a payload $M$ that cannot be guessed (say, a random nonce): Alice send ...
4
votes
2answers
201 views
Provable Encryption
Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key?
Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
4
votes
3answers
899 views
Why programming languages don't provide simple encryption methods?
In c#, there is a namespace called System.Security.Cryptography and there are many classes in this namespace, which help developers encrypt and decrypt data. ...
4
votes
5answers
461 views
Software implementation of a commutative cipher?
I've got an application (detailed below) that calls for the use of a cipher that is commutative. I've been doing some googling & reading, and there are two algorithms that seem to get mentioned ...
4
votes
1answer
484 views
How does a key wrapping like RFC 3394 secure my cryptographic keys?
So I'm messing around in the BouncyCastle library with the RFC 3394 AES Key Wrap engine and I'm trying to understand the benefit of it.
The problem I'm running into is how to store keys securely on a ...
4
votes
2answers
900 views
Is the following statement about PRG true or false?
Is the following statement true?
If $G: \{0,1\}^k \rightarrow \{0,1\}^n$ is a PRG, then so is $G':\{0,1\}^{k+l} \rightarrow \{0,1\}^{n+l}$ defined as $$G'(x.x')=G(x).x'$$ where $x \in \{0,1\}^k$ and ...
4
votes
2answers
359 views
ElGamal signature without calculating the inverse
Last time I asked a question of this type on math.se it was redirected here, so I hope this one is also appropriatete for crypto.se.
I stumbled uppon this question in some textbook.
Propose a ...
4
votes
1answer
1k views
What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?
I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key.
How serious is this weakness?
Also, is AES less effected ...
3
votes
2answers
182 views
Is there a way to do fair exchange between two parties who don't trust each other?
Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
3
votes
1answer
122 views
Should the secret key of Shamir's secret-sharing algorithm be interpreted byte by byte?
Should the secret message of Shamir's secret-sharing algorithm be interpreted and processed byte by byte?
Interpreting it byte by byte makes it easier to process, but in case one of the shareholders ...
3
votes
1answer
69 views
How hard are discrete logarithms problems in $\mathbb Z^{*}_{n}$ and $\mathbb Z^{*}_{n^2}$, where $n$ is the RSA $n=pq$
Use the notations form the Wikipedia article Paillier Cryptosystem
, assume that the chipertext $c$ and $c^{\lambda} \mod n^2$ are both given, is it possible to compute $\lambda$ easily?
3
votes
0answers
96 views
CBC with fixed IV but changing data [duplicate]
Possible Duplicate:
Using CBC with fixed IV
I am using AES in CBC mode.
For some reasons I have some issues for transmiting the IV. So I am using a fixed IV.
If the first 128bits of the ...
3
votes
1answer
202 views
How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?
When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure:
Using PBKDF2 with then entire 128 bit ...
3
votes
3answers
130 views
Can I use PGP to sign a message without providing cryptographic non-repudation?
The difference between a digital signature and a MAC is non-repudiation. A message with a digital signature proves that only the sender could have signed the message, whereas a message with a MAC ...
3
votes
2answers
175 views
Two step encryption
Is there any asymmetric cryptography algorithm which will allow recursive encryption.
...
3
votes
3answers
328 views
Relative merits of AES ECB and CBC modes for securing data at rest
I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data.
I assume the ...
3
votes
3answers
630 views
Hill Cipher known plaintext attack
I know a plaintext - ciphertext couple of length 6 for a hill cipher where its key is a [3x3] matrix.
Based on what I've read and learned, to attack and crack keys of [n x n], if we know a plaintext ...
3
votes
1answer
180 views
Are there secure stream ciphers that cannot be parallelized?
Are there any stream ciphers (or a deterministic random number generators, that should work as well I guess?) that cannot be parallelized?
So for example if I seed it with a specific value, and then ...
3
votes
1answer
179 views
A discrete-log-like problem, with matrices: given $A^k x$, find $k$
Let $p$ be a large prime; we will work in $GF(p)$. Let $A$ be a $n\times n$ matrix. Also, let $x$ be a $n$-vector and $k$ a positive integer.
Suppose we are given $p$, $A$, $x$, and $y$. The goal ...
3
votes
0answers
125 views
Finding where I am in a linear recurrence relation
Suppose I have a linear recurrence relation
$$a(n) = c_1 a(n-1) + \dots + c_k a(n-k) + d,$$
where the constants $c_1,\dots,c_k,d$ are given and the initial values $a(0),\dots,a(k-1)$ are given as ...
3
votes
3answers
452 views
How will Cryptography be changed by Quantum Computing?
I realise this isn't a 'yes or no' question, and I apologise for asking something that could be seen as a discussion thread, but I had to ask.
I'm currently doing an EPQ in CS (specifically how QC ...
3
votes
4answers
279 views
Which block cipher modes of operation allow a predictable IV?
Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique ...
3
votes
1answer
120 views
Encrypt array of int for individual retrieval
I have limited exposure to cryptographic terminology, so please bear with me.
My end goal is to encrypt integer IDs, before transmitting them to a web client in a list of search results, in a way ...
3
votes
1answer
112 views
How to communicate authentication tag for GCM?
I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?
3
votes
1answer
224 views
What's the reason for applying the hash twice when hashing with salt?
One of the typical approaches to computing a salted hash is this:
hash(salt+hash(secret))
where hash is something like SHA-256 hash function - taking any size ...
3
votes
1answer
329 views
Advanced Encryption Standard Algorithm Secret Key
just a follow up question with this question..
How does the key schedule of Rijndael looks for keysizes other than 128 bit?
A 256-bit key can still encrypt a block of plaintext in 128 bit?
but in ...
3
votes
3answers
350 views
What is the PRG period of stream ciphers such as RC4 or Salsa20?
I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example.
Let's say I want to encrypt a very ...
3
votes
1answer
102 views
Does security under ROM imply exactly what?
I'm not sure I understand really the implications of proofs of security in the random oracle model. Does a proof of security in ROM translate to a reduction of security of the crypto-system to the ...
3
votes
1answer
178 views
How can one share information using the 'host-proof' paradigm?
I am attempting to make a web-based secure password management and sharing utility, both as an academic exercise and to fully understand and feel safe about using it.
I really like the idea of a ...
3
votes
1answer
535 views
Why not use CTR with a randomized IV?
I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
3
votes
3answers
590 views
A simple block cipher based on the SHA-256 hash function
I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
3
votes
2answers
194 views
Feedback on rolling my own entropy gatherer
First of all, I don't recommend doing this. This was something I created when I didn't know better and didn't have a solution available to me.
Long ago I created my own entropy gather for a ...
3
votes
3answers
128 views
Authenticating data generated by a particular build of an open source program
[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.]
My ...
2
votes
2answers
132 views
Why is $h(H, m) = E(m, H) \oplus m$ insecure?
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are ...
2
votes
0answers
114 views
Correct way to truncate data to a range
2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm.
I want to take a stream of k trusted random ...
2
votes
1answer
251 views
Is a known plaintext, ciphertext, and public-key a viable attack on RSA?
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.
Alice and Bob each have their public- and private-key pairs ...
2
votes
2answers
112 views
Timing attack on modular exponentiation
It is known that computing $a^x \bmod N$ takes $O(|x| + \mathrm{pop}(x))$ multiplications modulo $N$, where $|x|$ is the number of bits of $x$ and $\mathrm{pop}(x)$ is the number of $1$ bits (Hamming ...
2
votes
1answer
166 views
Are there any practical implementation of a homomorphic hashing or signature scheme?
A homomorphic hash function is a function $H : A \to B$ between two sets with some algebraic structure $(A, *)$ and $(B, \star)$ such that
$H$ is collision resistant, i.e. it is hard to find $x \neq ...
2
votes
1answer
59 views
Using UMAC with stream cypher
I understand that most stream ciphers, due to being applied with a simple XOR, are specially fragile against data tampering, and must be used with some MAC mechanism. So I am investigating the use of ...
2
votes
1answer
126 views
What is “Blinding” used for in cryptography?
What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
2
votes
1answer
98 views
RSA Without Padding?
I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message.
Given that an ...
2
votes
0answers
163 views
Is there a practical zero-knowledge proof for this special discrete log equation?
We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal. Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$. There are two parties, Alice and Bob:
Alice knows: ...
2
votes
2answers
280 views
Why is a non fixed-length encryption scheme worse than a fixed-length one?
I have the following definition (highlights by me):
An (efficient secret-key) encryption scheme $(Gen,Enc,Dec)$, where $Gen$ and $Enc$ are PPT algorithms and $Dec$ is a Deterministic Polytime ...
2
votes
1answer
217 views
Why are elliptic curve variants of RSA “chiefly of academic interest”?
Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
2
votes
2answers
246 views
Can I build a secure tweakable block cipher from a normal one by adding key and tweak?
Let (E,D) be a secure block cipher.
Consider the following tweakable block cipher:
...
2
votes
1answer
306 views
Is there a standard for OpenSSL-interoperable AES encryption?
Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64).
I hear it's some sort of OpenSSL interoperability thing a b c.
Is there some ...
