2
votes
2answers
69 views

Is it safe to use a secret salted hash of a public id for client to prove ownership of id to a server that knows salt but does not store ids?

I am writing a peering server - the server assigns randomly generated public IDs to users, and I want users to be able to reclaim their ids in the future, but only to be able to claim ids that they ...
2
votes
4answers
64 views

Definition of the term “key”

I've looked in many places (NIST, text books, online resources) and I cannot find an answer to the definition of the term "key" from a semantic point of view. Is it the "key" to cipher-texts (i.e. ...
0
votes
0answers
23 views

Does Paillier Cryptosystem work in different message space? [duplicate]

I have a question about Paillier Cryptosystem. Assuming we have $c = Enc(m) = g^m \cdot r^N \mod N^2$ as the output of encryption algorithm, where $N=p_1p_2$ and $m \in \mathbb{Z}_q \subset ...
0
votes
0answers
31 views

If a DES key correctly decrypts one message, what's the probability it's the real key?

Suppose an adversary gets a message-ciphertext pair $(M,C)$, where $C=DES_K(M)$. They do an exhaustive key reach to locate the lexicographically first key $T$ for which $C=DES_T(M)$. What's the ...
7
votes
4answers
264 views

Alice and Bob's crush

Suppose Alice and Bob both want to determine whether the other has a crush on him/her, but they only wish to share the information if the crush is mutual. Is there a cryptographic protocol that makes ...
1
vote
1answer
42 views

Reducing the keyspace for a brute force attack on a chained 64-bit xor

I have a block of data which I know is encrypted using a chained 64-bit xor (sorry if that makes no sense, I'm not familiar with crypto lingo). I know a little bit about what the plaintext should look ...
4
votes
2answers
71 views

Discrete logarithm over prime modulo: small input, large exponent, larger prime

I am considering using modular exponentiation as a one-way hash function. More specifically, here is the scenario. 1) Input ($m$): the input messages are small (16-bit) 2) Exponent ($e$): the ...
0
votes
0answers
28 views

What crypto scheme should I use on embedded m2m system with assymetric uplink/downlink bandwidth?

I am working on implementing info security into custom m2m radiolink communication system, which has some restrictions: MCU based endpoint can transmit to gateway with packets max 16 bytes long, and ...
0
votes
2answers
83 views

Why are there no OTP ciphers?

We all know the OTP is unbreakable and we all love the OTP (judging by the amount of question on this site). The strength of the OTP is not that it is unable to find a word without the key but you ...
0
votes
1answer
36 views

Decrypting DES - limited information

I have a list of DES encrypted strings/data, they come in two lengths, 32 chars hex (16 bytes) or - I believe - 64 chars. I know the key, which is 8 ascii chars (I might add that I am the rightful ...
0
votes
3answers
21 views

FIPS 113 Computer Data Authentication

on the NIST website for Message authentication There is a mention of 2 approved algorithms, i am curious about the first one. the link to FIPS 113, Computer Data Authentication appears to be dead ...
2
votes
1answer
131 views

Are well designed crypographic codes unbreakable? (NOT ciphers)

Codes are not to be confused with ciphers. It is known that all known ciphers are theoretically breakable except the one-time pad and this isn't what the question is about. Some cryptographic codes ...
1
vote
2answers
439 views

What are words in a HASH algorithms

From wikipedia: "They differ in the word size; SHA-256 uses 32-bit words where SHA-512 uses 64-bit words." In this context what do they mean with words? is it the same as a 32 bit (or 64 bit) block ...
0
votes
2answers
74 views

Can I use the output from a DRBG directly as K for AES, or do I need to use a key generator algorithm?

NIST has 3 validated "Recommendation for Random Number Generation Using Deterministic Random Bit Generators" (DRBG's) that are based on NIST SP 800-90A: Hash_DRBG (based on hash functions) ...
1
vote
2answers
92 views

Why aren't zero-knowledge proofs used for authentication in practice?

I read on Wikipedia that zero-knowledge proofs are not used for authentication in practice. Instead (I think) the server is entrusted with seeing a password in plaintext form, which it should then add ...
0
votes
0answers
34 views

Registration and log in through public key cryptography?

I read about zero knowledge proofs. Let's say you want to create an account at a website. You choose a password $p$ and from $p$ you derive deterministically a public & private key pair $(e,d)$ ...
2
votes
1answer
62 views

Yubico's take on U2F key wrapping

I've been reading up on Yubico's implementation of U2F. What I understand so far is that two things are calculated. So upon registration first you calculate a private key by $PrivateKey = ...
1
vote
0answers
45 views

Why does the ElGamal signature have the specific form that it does?

In the original paper, ElGamal(1985) starts his discussion of signatures by saying: "The signature ..... is chosen such that the equation: $\alpha^m = y^r r^s \text{mod p}$ (equation 3 from the ...
0
votes
2answers
92 views

SHA-512 partial preimage

I was looking at how SHA-512 works, and I have a question. Imagine I want an input $N$ of 512 bits whose hash in hexadecimal starts with the digits 12345678. How ...
1
vote
2answers
93 views

Integer encryption preserving equality

I have read too many different options for encryption that I now feel quite lost. I need a simple, secure (don't we all) scheme for encrypting integers (32-bit) with the following requirements: ...
1
vote
1answer
48 views

Zero knowledge / proof of knowledge sudoku solution

I recently started a coursera course "cryptography 1" provided by Stanford university. In one point when explaining zero proof knowledge the instructor mentions the following: Almost any puzzle ...
2
votes
1answer
33 views

Why must the sender and receiver be synchronised in synchronous stream ciphers?

I would like to know why the sender and receiver must be synchronized in synchronous stream ciphers as said in Synchronous stream cipher. Why is there no synchronization between the sender and ...
3
votes
1answer
83 views

Is it safe to derive two different keys with the same password and key derivation function using two different salts?

I would like to know if the following process would harm the security of a fictional system if the persisted data would be stolen: in this system a user has a single password. The password will be ...
1
vote
0answers
73 views

Paillier Encryption: problems with double encryption

Given have two public keys $k1$ and $k2$, $E_{k1}(E_{k2}(m_1))$ and $m_2$. Is it possible to calculate $E_{k1}(E_{k2}(m_1 + m2))$? (or with multiplication instead of addition) At a first glance, I ...
0
votes
1answer
42 views

Why Might XOR's Lead to Hash Functions Lacking 2nd Pre-image Resistance?

My hash function is as follows: Cut the string in half (assume even length of 2m) XOR's the two halves together Take the result of the XOR and pass it to a function (a one-to-one and "onto" ...
1
vote
0answers
42 views

Matsui's Linear attack on DES P box

I'm trying to understand Matsui's linear attack on DES and I have something I don't understand in his paper. In his paper he say that: $NS_{5}(16,15)=12$ (which is OK) and from that he say that: ...
0
votes
2answers
46 views

Looking for encryption algorithm not subject to known-plaintext attack with IV reuse

I've encountered an interesting problem where we can basically say the following: We need to encrypt messages, but we have no room to store IVs. We can synthesize IVs; however an attacker would be ...
1
vote
2answers
75 views

What does ⊕ mean in cryptography?

Can someone please help me with the question below? Explain why 0 ⊕ x ≠ 1 ⊕ x, whatever the value of the bit x. Hence, explain why flipping a bit in the plaintext produces a predictable ...
1
vote
2answers
73 views

How to attack the Two Time Pad?

I encrypt 2 random keys with the same 'one' time pad. You can get both encrypted keys. You don't know anything besides the size. Is there a way to attack the two time pad in this scenario? And what ...
1
vote
1answer
29 views

How do revocation certificates work in PGP?

I've already read how to build and upload them, but I'm wondering how revocation certificates work, what informations they hold and so on. Suppose my private key is compromised, but I have a ...
0
votes
0answers
46 views

arithmetic calculation problem to quadratic arithmetic program

I am reading the Pinocchio paper (verifiable computation): http://research.microsoft.com/pubs/180286/pinocchio.pdf The paper is rather hard for me. I am considering this calculation problem: ...
0
votes
3answers
43 views

Question about decryption

I have a question about decryption. Let's say I have a bunch of files that are encrypted. Someone gains access to those files, and finds out that he already has one of them, unencrypted. My question ...
0
votes
1answer
53 views

Bilinear map + commitment

Let $\mathbb{G}_1,\mathbb{G}_2,\mathbb{G}_T$ be yclic group of the same order and $ e: \mathbb{G}_1 \times \mathbb{G}_2\rightarrow \mathbb{G}_T$, such that $u\in \mathbb{G}_1, g \in \mathbb{G}_2, ...
0
votes
1answer
39 views

Are more S boxes more secure in a SP-Network?

The classic DES uses 8 different fixed S boxes. If computer memory was not an issue, would say 800 different S boxes be more secure? I'm thinking of a SP-network that would only run on a server like ...
0
votes
3answers
62 views

Is the Salsa20/ChaCha20 keystream generation one-way?

Is it possible to recompute the Salsa20 or ChaCha20 key in a realistic time if the keystream and the nonce are given to an attacker? Or is the keystream generation one-way, like a cryptographic has ...
1
vote
1answer
93 views

Is this variant of SRP useful?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
1
vote
1answer
48 views

Rabin-Williams, blinding and size of Integer r?

I was reading the paper Breaking the Rabin-Williams digital signature system implementation in the Crypto++ library. The library uses blinding, but it was not enough to stop key recovery. But my ...
0
votes
1answer
54 views

Adding a Random component to CBC MAC in order to enlarge the tag space

CBC MAC that is using AES as the underlying block cipher, has tag space of 2^128. If we add a random single block, concatenating it with the tag, and encrypt it again in AES CBC mode, with additional ...
0
votes
0answers
27 views

Known plaintext attack to CFB mode

How does a known plaintext attack on a block cipher in CFB mode work? I only see the following: If an attacker knows the plaintext $P_i$ he can recover the key $K_i = C_i \mathbin{\oplus} P_i$ from a ...
3
votes
1answer
63 views

Paillier cryptosystem preserve ordering of sums for two integer sequences

According to Paillier cryptosystem the product of two ciphertexts will decrypt to the sum of their corresponding plaintexts. I have two separate integer sequences X and Y that have same number of ...
0
votes
1answer
100 views

Permuted vectors

Consider we have two vectors $v_1, v_2$ of size $n$, and each vector contains $n$ elements. We permute the vectors as: $\pi (k_1,v_1), \pi (k_2,v_2)$. Where $\pi (k_i,v)$ denotes a permutation of a ...
7
votes
1answer
82 views

Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?

A 2DES like cipher $c=E^{(2)}_{K_2}(E^{(1)}_{K_1}(p))$ where both halves have an $n$ bit key is vulnerable to a meet-in-the-middle attack. Meet-in-the-middle using a big table Create a table ...
2
votes
4answers
96 views

Password length versus hash length?

If a system hashes passwords with a 256-bit long hash, are passwords (which are not necessarily alphanumeric, can be any value per byte (0-255)) longer than 32 bytes useless under the context in which ...
5
votes
1answer
82 views

Adding two public keys

secp256k1 (the signature scheme used by Bitcoin) has the interesting property that you can add two public keys to get a combined key that requires both private keys to produce signatures for. Is ...
1
vote
1answer
45 views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
1
vote
1answer
14 views

Key iteration count while using random keyfile larger than master key

If I were to have a 4096-bit file of random data (/dev/random) used as a keyfile for LUKS, would there be any benefit to having a key iteration count higher than 1? My reasoning is that the attacker ...
10
votes
2answers
2k views

If you hashed a hash an infinite number of times would you end up with a unique hash?

If you took a hashing algorithm for example MD5 and repeatedly passed the output hash back into the algorithm an arbitrarily large number of times would you eventually end up with one unique hash? My ...
2
votes
1answer
38 views

Use of Lamport's Signature as a primitive

Is Lamport's One Time Signature used as a primitive to construct any other cryptographic protocols?
2
votes
1answer
157 views

How does ROTL work?

what does ROTL stand for? I know it does left shifting but what about the acronym? When we do a left shift, do we take the leftmost bit and add it at the end, by making the second bit the first, and ...
1
vote
1answer
66 views

Image sharing without data overhead

The idea is to share n images among n persons so that all images can be reconstructed by someone in possession of all shares. However, there must not be any data overhead (which means the shares sent ...

15 30 50 per page