All Questions
6
votes
2answers
202 views
Why do public keys need to be validated?
For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
6
votes
2answers
263 views
Toy cipher — does it have a name?
When I was perhaps nine years, I borrowed a book from the library on various maths and CS topics. It outlined various simple ciphers, including one that I used a lot, just for fun. I can't remember ...
6
votes
1answer
638 views
Why does the PKCS1 RSA private key structure contain more than just exponent and modulus?
The ASN.1 spec for the PKCS1 RSA private key format is as follows:
...
6
votes
2answers
299 views
For public-key encryption, why does COA resistance imply CPA resistance?
My professor told me:
If a public-key crypto-system is secure against ciphertext-only attacks,
then it is also secure against a chosen-plaintext attack.
Why is this true? Is there a proof that ...
6
votes
2answers
249 views
Key Length & Hashing
I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit.
I am using the SRP protocol for authentication (a ...
6
votes
3answers
512 views
Can ECDSA signatures be safely made “deterministic”?
Using the terminology of the ECDSA wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
6
votes
1answer
520 views
Secp256k1 test examples
Are there any available test cases for testing elliptic curves like secp256k1 (Korblitz curves from http://www.secg.org/collateral/sec2_final.pdf)? For curves like P192 there are for example those ...
6
votes
1answer
381 views
What causes first block of AES decryption to be garbled, even with correct IV?
I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server.
The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA
...
6
votes
2answers
246 views
Pairing-friendly curves in small characteristic fields
There are several well-known techniques to generate pairing-friendly curves of degrees 1 to 36 on prime fields GF(p): Cocks-Pinch, MNT, Brezing-Weng, and several others.
In extension fields GF(p^n), ...
6
votes
2answers
316 views
Are Stream Ciphers Less Secure?
This is by no means a scientific observation, but it seems to me that stream ciphers receive a lot less attention than block ciphers. Is there any reason for this? (Is it because block ciphers are ...
6
votes
2answers
539 views
How much can we compress RSA public keys?
I am wondering to what degree we can define an RSA variant, with a security argument that it is as safe as regular RSA with a given modulus size $m$ (e.g. $m=2048$), in which the public key has a ...
6
votes
1answer
124 views
Message space in security definitions
What is the message space in the following example and how does a message space relate to a security definition?
I mean, what difference does it make to such a definition if your message space is ...
6
votes
2answers
275 views
Deniable Encryption from simple primitives
Is there a deniable encryption scheme $M = E(p_1,k_1,p_2,k_2,...,p_n,k_n), p_j = D(M,k_j)$ of $n$ plaintexts $p_1,p_2,...,p_n$ and $n$ keys $k_1,k_2,...,k_n$, such that we can fix $D$ to be a known ...
6
votes
1answer
1k views
How do other, non-RSA algorithms, compare to the PKCS #1 standard?
Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means.
I'm considering the ...
6
votes
3answers
159 views
Number of intersections of two sets
Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
6
votes
2answers
132 views
Have I understood pedersen commitment correctly?
I want to do a one-sided integer commitment scheme. I.e. the whole process must be non-interactive where I at one point first publicly reveal some data and then at a later time reveal the committed ...
6
votes
1answer
104 views
Is SpookyHash vulnerable to HashDoS?
Aumasson, Bernstein and Bosslet did an excellent job demonstrating fatal weaknesses in MurmurHash and CityHash, but what about SpookyHash?
My first uneducated guess is that it would be much harder to ...
6
votes
1answer
193 views
Using SHA-256 with different initial hash value
FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value ...
6
votes
2answers
375 views
Hash decrypts key, key decrypts cipher… why?
I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
6
votes
3answers
358 views
Security equivalence proofs for breaking RSA
It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring.
In otherwords, ...
6
votes
1answer
280 views
Are there any authoritative definitions of “key stretching”?
This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
6
votes
1answer
580 views
AES and perfect ciphers
I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES.
Obviously AES isn't a perfect cipher, since the ...
6
votes
1answer
632 views
How does HOTP keep in sync?
My understanding of HOTP is that each password is unique and based on a counter.
$$PASSWORD = HOTP_1(K,C)$$
Where $C$ is an incremental counter.
What I wish to know, is how you keep the client ...
6
votes
1answer
156 views
How would one crack a weak but unknown encryption protocol?
I asked a question on security.stackexchange, but was told it would be a better fit here:
http://security.stackexchange.com/questions/32779/how-would-one-crack-a-weak-but-unknown-encryption-protocol
...
6
votes
1answer
135 views
When do ECC patents end?
As the topic says, since when can ECC cryptography be freely used?
Isn't it widely used because of patents? There is no alternative to it on embedded devices and smart cards.
Just to mention: i am ...
6
votes
2answers
282 views
Deriving Keys for Symmetric Encryption and Authentication
So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
6
votes
3answers
480 views
Is Porticor's “homomorphic” key encryption something that can really be done or is it just marketing hype?
Porticor has an interesting file encryption offering for encrypting and decrypting files in an MySQL database quickly.
They are an Amazon AWS (Amazon Web Service) Partner Network technology partner ...
6
votes
1answer
974 views
How does a birthday attack on a hashing algorithm work?
A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits.
That means it takes about ...
6
votes
1answer
186 views
Proof of work for standard computers
I'm interested in a proof-of-work system that works well on standard computers without using the GPU.
Properties the system should have:
Seed based proof-of-work.
There is no distinguished ...
6
votes
2answers
2k views
What's the fundamental difference between Diffie-Hellman and RSA?
What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
6
votes
1answer
545 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
6
votes
1answer
119 views
Are there any tools for expressing the cipher operations as a system of equations?
The first step In Algebraic-attack is expressing the cipher operations as a system of equations. Is there an automated tool to do this?
6
votes
2answers
236 views
Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
Consider a common practically-collision-resistant Merkle–Damgård hash function $\mathcal{H}$ (e.g. SHA-1, RIPEMD-160, SHA-256, SHA-512). We define a Message Authentication Code $\mathcal{C}$
$$(k,m) ...
6
votes
1answer
205 views
A fair peer-based coin-flipping protocol?
I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight.
This is how my idea ...
6
votes
1answer
161 views
Useful pairings for cryptography
I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
6
votes
2answers
192 views
Unit testing a library RNG and its seeding for practical security
Suppose I have a cryptography library that provides me with a black-box random number generator that is supposed to be suitable for long-lived key generation. (Under the hood it may be assumed to use ...
6
votes
2answers
299 views
What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?
Given a binary shift register of $n$ bits, a primitive binary nonlinear feedback shift register will generate a sequence with a period of $2^n - 1$.
While I am unable to find a paper which directly ...
6
votes
1answer
186 views
What is the sign bit for in Feige-Fiat-Shamir?
The Feige-Fiat-Shamir identity scheme is based on a ZKP assuming that square roots are "hard" modulo an integer of unknown factorization. The "parallel version" of this protocol includes a "sign bit" ...
6
votes
1answer
129 views
Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$
Suppose, for some security parameter $n$ you choose a prime $p$ such that $p = 2^n+c$ for some relatively small $|c| < 2^m << 2^n$. I have seen such primes being called Pseudo-Mersenne Primes ...
6
votes
1answer
276 views
Hash function from narrower block cipher operated in CBC-encryption mode?
I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ ...
6
votes
1answer
197 views
Why does Skein use an output transform, but other similar hashes don't?
Skein uses an additional compression function call to finalize the output, even when the output isn't larger than the native output size.
The Skein paper says:
Due to Skein’s output ...
6
votes
1answer
108 views
Why does it matter for a signature scheme to be without random oracles?
There is a profusion of articles proposing signature schemes without random oracles (see for yourself). What does that mean, and why does it matter?
6
votes
1answer
94 views
Abstracting primitives and modes of operation
I am developing a symmetric crypto library and have reached a roadblock. Looking at block ciphers, it is quite obvious that all block ciphers are trivially abstractable as a simple primitive ...
6
votes
1answer
368 views
How to deduce enigma settings given a partial plaintext?
Assuming some large block of text is encrypted with an enigma machine and I only know a small subset of letters before and after encryption, how do I go about figuring out the enigma settings from ...
6
votes
1answer
439 views
Implementation of Tao Xie and Denguo Feng's MD5 attack
It is well known that MD5 is completely broken today - however, to understand the theory behind the attacks I am looking for an implementation of the collision attacks described in the 2009 paper A ...
5
votes
4answers
478 views
What is the signature scheme with the fastest batch verification protocol for multiple signers?
I'm looking for a scheme where signing may be costly (slow) but batch verification with different signers is the fastest possible.
Modified ECDSA allows batch verification for different signers with ...
5
votes
5answers
450 views
Applications of Group Ciphers
I've been reading a paper [1], and I've ran across something called a "Group Cipher", which is similar to homomorphic encryption, with an important difference.
In homomorphic encryption we have an ...
5
votes
3answers
427 views
Is RSA padding needed for single recipient, one-time, unique random message?
I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ...
5
votes
3answers
570 views
What is the recommended replacement for MD5?
Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?
5
votes
3answers
190 views
How to best obtain bit sequences from throwing normal dice?
Throwing normal dice, one can get sequences of digits in [0,5]. Which is the best procedure
in practice to transform such sequences into bit sequences desired?
