2
votes
1answer
207 views

Bandwidth and block size for Paillier cryptosystem

Can someone clarify what is meant by the terms cryptosystem bandwidth and block size for public key cryptosystems; The context is the Paillier cryptosystem and its Damgard-Jurik generalisation. My ...
2
votes
3answers
606 views

Using Whirlpool hashing function to encrypt data

I've read that the Whirlpool hash function can produce footprints that could be used as a pseudorandom generator. Is it "OK" to use it to encrypt some data using something like the following? ...
1
vote
1answer
781 views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
3
votes
1answer
111 views

md5sum collision question

I've been reading the wikipedia page, trying to get a better understanding of how to produce a collision. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities The wikipedia page above states: ...
4
votes
2answers
599 views

With a true random number generator at hand, how to implement one-time pad?

I have a Raspberry Pi single-board computer that happened to have an hardware true random number generator, based on some quantum effects on the processor silicon, baked into its BCM2835 chip and I ...
2
votes
1answer
244 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
8
votes
2answers
4k views

Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
0
votes
1answer
58 views

What makes adaptive memory attack difficult for the adversary?

On page 11, definition 2 of "Simultaneous Hardcore Bits and Cryptography Against Memory Attacks", the paper outlines the following steps (PK,SK) public key and secret key are generated by defender ...
0
votes
1answer
259 views

Is my understanding of CPA indistinguishability experiment correct?

Following are steps to conduct Chosen Plaintext Attack (CPA) indistinguishibility experiment $PrivK_\mathcal{A,E}^{eav}(n)$. $\mathcal{A}$ is the adversary $\mathcal{E}$ is the encryption scheme ...
8
votes
2answers
1k views

Does Microsoft use Dual_EC_DRBG by default?

So, as we all know, Dual_EC_DRBG contains an NSA back door. At this point, there is no reason to call it a "potential" or even an "alleged" back door; the presence is obvious even to the NY Times. As ...
-3
votes
1answer
310 views

List of available symmetric & assymetric ciphers [closed]

I was looking all over the Internet list of ALL existing symmetric and asymmetric ciphers. I know that there's, for example, AES, DES, Blowfish, DSA. But how about more? Where to find such list?
3
votes
1answer
611 views

Proof that IND$-CPA implies IND-CPA?

I've read a few papers recently that used a notion of security called "indistinguishability from random bits/strings" under chosen plaintext attack, also called IND\$-CPA. See e.g. ...
2
votes
1answer
277 views

Is it safe to use GZIP to avoid padding related attacks

I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different ...
7
votes
2answers
589 views

Why is AES considered to be secure?

The security of RSA is based on the integer factorization problem, which is a very well defined and understood mathematical problem. This problem must be solved in order to fundamentally break RSA. ...
2
votes
1answer
315 views

Can I use SHA1 as license key?

I have recently started looking into creating secure, while not validating against an external server, software product keys. The idea I have had is to create a key consisting of two parts firstly a ...
-1
votes
1answer
106 views

Can someone explain how this unpadded RSA formula works?

Taken from http://en.wikipedia.org/wiki/Homomorphic_encryption, $\mathcal{E}(x_1) \cdot \mathcal{E}(x_2) = x_1^e x_2^e$ $\bmod\; m = (x_1x_2)^e \;$ $\bmod\; m = \mathcal{E}(x_1 \cdot x_2)$ What is ...
2
votes
2answers
82 views

How to get the same calculation result on an untrusted computer, while withholding some information?

Consider this command on a trusted computer: result = function(public data, secret data) or shorter: r = f(p,s). How could a ...
0
votes
1answer
68 views

blinding a hash vs. sending the hash directly

So with blind signatures you have two parties - A and B. A has a message that they want B to sign so A creates a hash of their message, blinds it, and then sends it to B to sign. That, as I understand ...
1
vote
1answer
162 views

Generating keys with HKDF from Diffie Hellman agreement

In order to generate multiple session keys from a Diffie Hellman key agreement protocol, I'm trying to use the HKDF to generate this session keys. The HKDF algorithm uses an Extraction-Expand ...
18
votes
5answers
3k views

What is the lowest level of mathematics required in order to understand how encryption algorithms work?

What mathematical fields of knowledge would be required in order to get a good understanding of encryption algorithms? Is it basic algebra, or is there a "higher education" mathematical field ...
8
votes
1answer
249 views

Is the inverse of a secure PRP, also a secure PRP?

If a block cipher is a secure PRP, is it's inverse a secure PRP as well? My intuition says yes but I'm not exactly sure. On a related note, if a block cipher is a secure sPRP, is it's inverse a ...
3
votes
1answer
203 views

How would I make a secret notation alphabet more secure?

Disclaimer: I was looking for a place to ask this question on SE and this site seems to be the most fitting. If this question doesn't belong here, feel free to redirect me. Just out of boredom and ...
2
votes
1answer
122 views

Is it possible to find a preimage for a reduced size hash?

Given a message $M$ and a 256 bit key $K$, perform HMAC($K$, $M$) with a 256 bit hash function resulting in: $a$ = ...
2
votes
1answer
203 views

Shamir's secret sharing with passwords

I'm trying to design an extension to Shamir's Secret Sharing that would allow the participant to specify a password instead of remembering/storing a large integer or binary data. So far, I have two ...
3
votes
1answer
143 views

What does it mean to be simultaneously hardcore?

In this paper the term "simultaneously hardcore" is defined as: "We say that a block of bits of $x$ are simultaneously hard-core for a one-way function $f(x)$, if given $f(x)$ they cannot be ...
3
votes
0answers
123 views

Which encryption method supports random reads?

I have a file containing 16-bit samples and I want to encrypt it, but the problem is that I need to be able to read any random 16-bit value from the file, and be to able to decrypt it, without reading ...
16
votes
9answers
2k views

Why not the one-time pad with pseudo-number generator

I am very new to cryptography (so be kind), but I have a question that may seem silly. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one ...
2
votes
4answers
188 views

Which encryption method supports random reads?

I have a file containing 16-bit samples and I want to encrypt it, but the problem is that I need to be able to read any random 16-bit value from the file, and be to able to decrypt it, without reading ...
4
votes
3answers
359 views

Can we design a public-key infrastructure without certificate authorities?

In a recent essay, Bruce Schneier tasks the engineering community with redesigning and rebuilding the vulnerable parts of the Internet's backbone. We need to figure out how to re-engineer the ...
2
votes
2answers
325 views

Can I construct a feasible stream cipher out of HMAC and a secure hash algorithm?

I have constructed a stream cipher from a secure hash algorithm and a HMAC. Here is a brief description of the algorithm: Let: (Actually Objective-C styled pseudo code) ...
29
votes
1answer
25k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
4
votes
1answer
302 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
7
votes
2answers
466 views

Encrypting 8 times with 8-bit key beneficial?

I was trying to understand cryptography from the book Information Security by Mark Stamp and I am confused by something. Suppose that Alice has a secure block cipher, but the cipher only uses an ...
0
votes
1answer
157 views

PKCS1 and blind RSA signatures

Wikipedia's article on RSA blind signatures says that you need to raise the message $m$ to the secret exponent $d$ modulo the public modulus $N$. Implicit within that, it seems to me, is that m needs ...
2
votes
2answers
733 views

Estimating bits of entropy

Best ways to estimate average bits of entropy in a byte stream. I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What ...
4
votes
1answer
469 views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
0
votes
1answer
469 views

probability of N hash digits colliding

What is the probability of the first N hash digits colliding? for example i made a script that appends the first 5 digits of the file's sha1 hash to the name of the file. So will the probability of ...
1
vote
1answer
474 views

Proper way of doing encryption and authentication (PBKDF2 + AES)

I'm currently in the planning phase of an authentication and storage-ish service. The client needs a file ("ENCFILE") which he will work with. This file will be encrypted with AES256, and stored on ...
5
votes
2answers
163 views

Fast post-processing for broken RDRAND

Let's assume that the Intel RDRAND instruction does not return fully random numbers, e.g. because it has been engineered with a backdoor for the NSA. If the Intel RDRAND instruction is used directly ...
1
vote
1answer
70 views

what is PFS game?

when i reading about this paper, in the Setup of SIM section 5.2, it says that "According to the definition of PFS game", i wonder what the definition of PFS game ...
5
votes
1answer
1k views

DSA vs. ElGamal vs. Schnorr

It has been well known for a long time that NSA played a primary role in the development of the Digital Signature Algorithm (DSA). DSA is a sort of hybrid of the ElGamal and Schnorr signature ...
3
votes
1answer
2k views

Who uses the RSA BSAFE library?

Who uses RSA's BSAFE library? Does anyone know what products use it, or have any statistics on how many end users use something that is built on BSAFE? Background: BSAFE is one of the oldest ...
4
votes
2answers
340 views

Using SHA3 as an entropy pool

Has any work been done on analyzing the SHA3 sponge construction for use as an entropy pool (e.g. /dev/random)? All the use cases I've heard of consts of a ...
1
vote
1answer
411 views

How to protect from Silver–Pohlig–Hellman algorithm

I read that Silver–Pohlig–Hellman algorithm solves the discrete logarithm with prime module $p$ in $O(\log^2(p))$ if $p-1$ is a smooth number. This seems pretty fatal for cryptography, since it is a ...
1
vote
0answers
43 views

one-time key, zero IV in stream cipher (e.g. AES-CTR) [duplicate]

Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to ...
2
votes
0answers
138 views

Precise meaning of various terms related to universal hash functions

I've been reading about universal hashing, but I'm confused by all these different terms and notations. Could someone help me understand the precise meaning or relation between the following terms: ...
7
votes
1answer
380 views

Is SSH public key authentication weakened by 'none' cipher?

As far as I know, SSH2 first does a key exchange based on the server host key and brings up transport authentication and encryption derived from this kex. The real authentication (password or public ...
3
votes
2answers
1k views

How is the key shared in symmetric key cryptography?

Symmetric key cryptography is an encryption system in which the sender and receiver of a message share a single, common key that is used to encrypt and decrypt the message. Is the key public or it is ...
2
votes
0answers
142 views

Integer factorization based password authentication

After looking at this security issue at DjangoProject, I started to think in a password-based authentication that places the burden of PBKDF2 (or whatever is the hashing function) on the client. So I ...
2
votes
1answer
1k views

Inverting the encryption equation of a symmetric cipher

I've just started a cryptography course. I am beginning to understand the concepts (I'm only in week 2) but I just can't get my head around the theories and principles when written as equations. I've ...

15 30 50 per page