3
votes
1answer
89 views

UKS attack on KEA protocol

I'm trying to understand the UKS attack on KEA protocol. This is described in this paper: Security Analysis of KEA Authenticated Key Exchange Protocol So to summarize: KEA protocol: UKS ...
5
votes
0answers
26 views

What is the original SKID3 protocol?

While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it. The basic structure is the following: (1) A --> B: rA (2) B --> ...
1
vote
1answer
108 views

Extension of a password hashing algorithm using Fibonacci

I am right now taking a class named Applied Cryptography and our final project is to create a password hashing method using at least one existing algorithm and then add additional steps to make it ...
3
votes
1answer
340 views

Authentication using AES

I need to implement an authentication mechanism in an embedded environment which does not support floating point operations but has an AES accelerator module which allows for encyption/decryption ...
2
votes
1answer
61 views

Why is the definition of Special-honest verifier zero-knowledge probabilistic?

Let $P$ be a prover willing to prove to a verifier $V$ that he knows a witness $w$ satisfying $(x,w) \in R$ for some relation $R$ and some common input $x$. As found in the literature, $P$ can use a ...
0
votes
1answer
38 views

What is ε in differential privacy?

In ε-differential privacy, what does the ε refer to? Is it privacy value or the notation used? Can anyone provide an example of differential privacy?
0
votes
0answers
3 views

How to use /dev/urandom with PHP to get CS random numbers [migrated]

I need to create random integers between the values of 0 and 10,000,000, and I will need several million such numbers. The numbers must be as close to a CSPRNG as possible in that should (for example) ...
4
votes
1answer
68 views

AES storing the length within the encrypted data versus storing it outside

I need to strip off padding after decrypting AES(CBC)-encrypted data (I have control over encryption and data transmission), so have looked at adding the length of the original data to the payload ...
2
votes
1answer
29 views

MDC-2 recommended IV values?

I'm currently reading Menezes' "Handbook of Applied Cryptography", and in it, when describing the MDC-2 cryptographic hash function, has the following line: Choose the 64-bit non-secret constants ...
1
vote
1answer
91 views

Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs ...
0
votes
0answers
25 views

How to reconstruct hash value to the original format? [duplicate]

I would like to know how I can reconstruct a hash value such as 558f68181d2b0c9d57d41ce7aa36b71d9 to its original format (734). I have used a code in matlab, which provided me with an hash output, ...
2
votes
1answer
85 views

Is there a secure source of entropy on a typical microcontroller?

On a device that does not have a hardware RNG, what is the best source for entropy? Some options and pitfalls floating around: Use the ADC to read something analog: can become deterministic if ...
0
votes
1answer
58 views

RSA signature attack check on lowest 16 bytes - Implementation

I am referring to solution given in this question I need help to implement Poncho hint in this comment: As the first question i have an RSA signature of 1024 bit applied on an hash (MD5) of the ...
8
votes
1answer
1k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
1
vote
0answers
28 views

FFX Encryption over alphabet of arbitrary radix

I understand how standard numeric FPE using a halved string in cycled Feistel networks is constructed and operates. I then read the paper regarding FFX encryption which should allow for any non-binary ...
-3
votes
1answer
43 views

RSA problem - how to find $d$ [duplicate]

For example, let $p = 3$ and $q= 11$, choose $e = 3$. What computation I have to apply in order to find the corresponding $d$? I know it's 7, but I want to know the exact process to be applied to find ...
0
votes
0answers
24 views

Enterprise message bus encryption [migrated]

I'm contemplating using Amazon's Simple Queue System as the basis of an enterprise message bus. According to Amazon, the contents are not encrypted, which means the application(s) will have to handle ...
0
votes
0answers
39 views

RSA Encryption: What happens if n is a factor of the message M? [duplicate]

From what I have learned about RSA encryption, the message M and the modulo n must be coprime because Euler's theorem only holds for coprime numbers? for example, what happens if I choose p = 3, q = ...
2
votes
1answer
56 views

Can string lookups be vulnerable to timing attacks like array lookups are?

Per “Can non-assembly crypto libraries truly be secure against timing attacks?”, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and ...
4
votes
2answers
173 views

Customizable Crypto Algorithms in Hardware

Several companies offer customized cryptographic algorithms, for example Crypto AG (www.crypto.ch/en/company): The individually created customer algorithms are unknown to anyone else and are not ...
2
votes
0answers
30 views

Public SRP verifiers or public hash chain “public keys” when secret is low entropy password

I want to set up the following: An untrusted server should host user sessions and authenticate users without knowing their passwords or being capable of creating a fake user session in the user's ...
0
votes
1answer
35 views

Key exchange resilience to DoS attack

I am designing a user registration protocol for a system where I control both clients and servers. The aim is to establish a symmetric key for subsequent authentication, while minimizing the work ...
2
votes
2answers
80 views

Is Checksum to file back decoding possible?

So, I was having this weird thought. If the checksums(MD5 or SHA...) are unique to any file and are modified if any part of the file is edited, why cant the checksums be decoded back to get the ...
2
votes
1answer
66 views

Is Cramer-Shoup backdoorable?

We recently had the question whether it's possible to have multiple private keys with one public key for the cramer-shoup cryptosystem. There it was stated that finding such "secondary" private keys ...
2
votes
1answer
54 views

CP-ABE for threshold cryptography

I would like to know if there is any research work using CP-ABE for threshold cryptography? I want to know also if applying CP-ABE for threshold cryptography would overcome other techniques.
2
votes
1answer
52 views

Extend OTP on random data?

If Alice and Bob both start with a shared OTP $P_0$, which is 256-bytes long, and Alice wants to send a 512-byte message, would it be secure to send the first 256 bytes with standard OTP (...
7
votes
1answer
116 views

Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...
2
votes
1answer
59 views

In SSL and TLS, why is there a separate Change Cipher Spec Protocol rather than including a change_cipher_spec message in the Handshake Protocol?

In SSL and TLS, why is there a separate Change Cipher Spec Protocol rather than including a change_cipher_spec message in the Handshake Protocol?
1
vote
1answer
38 views

ssh-keygen DH Primality Testing

I'm pretty familiar with using ssh-keygen to create groups that go in the /etc/ssh/moduli file for the Diffie-Hellman Group Exchange in openssh. Reading over the man page, it says "By default, each ...
5
votes
2answers
85 views

More efficient and just as secure to sign message hash using Ed25519?

According to the Ed25519 paper, the (potentially long) input message is hashed twice (see Section 4 page 12 steps 1 and 3). This webpage has a nice diagram toward the bottom that illustrates this, ...
4
votes
2answers
125 views

Implementing CBC Encryption Using Decryption

I've implemented this algorithm, which, working from the end of the message backwards, creates a valid CBC ciphertext from any plaintext, using the block cipher's decryption operation instead of the ...
0
votes
1answer
36 views

can cramer-shoup public key have two difefrent private key?

since I am new to Cramer Shoup algorithm I want to know is it possible to have 2 different private key for a public key due the key pair generation algorithm that Cramer Shoup use? I know that in ...
3
votes
0answers
29 views

Is modular Barrett reduction usable for Ed25519?

I currently try to implement Ed25519 following this draft. I have implemented every field operation except the reduction by the group order $q$ (in chapter 5). I looked for a reduction algorithm and ...
1
vote
1answer
41 views

Signature Verification: High level

I'm trying to understand how certificate signing and verification works conceptually. I know the classic example with asymmetric cryptography- the sender encrypts data with public key of receiver, ...
0
votes
0answers
7 views

How to correctly convert TAG value to the right format so that to Verify HMAC? [migrated]

I'm working on HMAC generation and verifying to check data integrity. I can correctly generate the MAC value but when sending it through socket to another program for verification, I faced with ...
0
votes
1answer
34 views

Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?

After the introduction of McBits, I was interested what security notions are neccessary for IND-CCA2 security of integrated encryption schemes (IES, following the key encapsulation mechanism / data ...
1
vote
1answer
86 views

Is the GOST block cipher broken?

Is the GOST cipher broken or known to be weak and insecure? Please try to simplify your answer since I am a programmer and not a cryptographer and please consider this web page and tell me if the ...
1
vote
1answer
45 views

Encryption algorithms larger than 256 Bit for “big data” encryption?

I'm somewhat new to encryption. When looking at encryption programs for big data, I frequently see a maximum of 256 bits. Why do we generally restrict our (symmetric) keys to 256 bits? Can more ...
2
votes
1answer
68 views

One time pad ciphers in emails

In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? The distribution of the keyword would pose no problems since I would ...
1
vote
0answers
13 views

Are there any paper/human strong crypto systems? [duplicate]

Are there any paper/human executed crypto systems that have reasonable strength? I am aware of a few candidates so far Solitare from Cryptonomicon https://en.wikipedia.org/wiki/Solitaire_(cipher) ...
0
votes
1answer
31 views

ElGamal in $Z^*_{p^n}$

If $p$ is an odd prime and $n$ natural,it is known that the group $Z^*_{p^n}$ is cyclic.Explain why the selection-choice of the group $Z^*_{{3^{1000}}}$ for the construction of a cryptosystem ElGamal ...
5
votes
3answers
266 views

What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...
1
vote
1answer
46 views

How AES treat string input to encrypt data and what will happen if the cipher key is less than that expected?

The official docs of AES have several example of how hexadecimal or byte input can be encrypted. I have some problem about the input text and cipher key. My question is: How can encrypt string input ...
2
votes
2answers
64 views

What is the advantage of AEAD ciphers?

What is the advantage of AEAD ciphers? Why is the TLS working group pushing for them? I thought modern cipher suites require SHA256 for authentication. What advantage is there to including Poly1305? ...
0
votes
0answers
15 views

Cryptanalysis on two time pad ciphers? [duplicate]

One time pad ciphers are unbreakable if the message is encrypted correctly and if only used once. However if used more than once, it becomes decipherable. How come? Also, would it be smart to use one ...
1
vote
2answers
45 views

Let $F$ be a PRF, is the following $G(x)=F_{0…0}(x)∥F_{0…1}(x)|| … ||F_{1…1}(x)$ a PRG?

$F$ is a PRF with $n$ bit key, input, and output length. I know the answer is "NO it isn't!", but I can't understand why. Is that because on any input $x$, the keys for every $F$ in the concatenation ...
0
votes
0answers
34 views

How to verify perfect secrecy of a cryptosystem? [closed]

I’m playing with a self-made encryption algorithm: “a new approach to data encryption” by Suhail Yazji (video available at youtube.com/watch?v=h1kABn5dfXc). How can I prove my algorithm to be ...
2
votes
2answers
83 views

Present an attack for the combination of OTP and textbook RSA

Let $N=p \times q$ where $p$ and $q$ are two primes. Compute $\Phi (N) = (p-1)(q-1)$. Choose $e$ s.t. $1 < e < \Phi(N)$ and $gcd(e,\Phi(N))=1$. Compute $d = e^{-1}(mod \ \Phi(N))$. ...
1
vote
0answers
34 views

Prove that certain amount of data was stored

I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ...
2
votes
2answers
69 views

Can we solve the Hidden Number Problem in $GF(2^n)$?

Is it possible to solve the Hidden Number Problem in extension fields? In particular in $GF(2^n)$? Let's suppose an attacker knows some least/most significant bits of $r_i = a_i \times k$ in a given ...

15 30 50 per page