3
votes
2answers
153 views

Reductionist proofs of decisional problems to computational

Are they any reductionist proofs where an attacker $\mathcal{I}$ for a well established computationally "hard" problem $\mathsf{Π}$ is employing an attacker $\mathcal{A}$ who we assume is able to ...
2
votes
0answers
46 views

Common pitfalls of session key activation?

Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly ...
18
votes
4answers
2k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
3
votes
1answer
104 views

Need to generate new DH keys for every message in OTR

Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it ...
3
votes
1answer
144 views

How to handle the GCD(V,P) != 1 case when doing point addition or point doubling in elliptic curve cryptography

The equation for a finite field Elliptic Curve is of this form: $$y^2 \equiv x^3 + a * x + b \pmod{P}$$ When we do common EC operations like point doubling or point addition we need to calculate the ...
0
votes
0answers
61 views

AES/CBC fixed Initial vector use-case [duplicate]

I am using AES/CBC to encrypt my http cookie. I never encrypt the same cookie value twice so my understanding is I don't need to use a random initial vector - using a fixed initial vector is fine for ...
1
vote
0answers
58 views

For enciphering messages with AES in CTR mode, do I need a different key for each message?

I have written a program to run AES in CTR mode with keys of 128,192 or 256 bits and checked it gives correct results with the data given in section F.5 at ...
3
votes
3answers
242 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
2
votes
1answer
502 views

Some questions about encrypting (AES) a file with password

I'm relatively new to encrypting, and I have some questions. I intend to write a standalone C# program that will write and read an encrypted file with sensitive data using a password entered by the ...
6
votes
2answers
320 views

Does data authenticity always, implicitly, provide data integrity?

Does a scheme which provides data authenticity (e.g. HMAC or RSA signature) always implicitly provide integrity? It seems, to me at least, that it must by necessity. However, I have seen ...
1
vote
0answers
90 views

(n,n) Shamir secret sharing [duplicate]

In (n,n) Shamir secret sharing if n shareholders do not have the public values (X values) can they still obtain the secret with only Y values?
4
votes
2answers
845 views

Is RSA key size the size of private key exponent in public key encryption?

I have implemented a key pair generation scheme for RSA algorithm. I have taken the length of private key exponent as RSA key size, but then I've got to know that RSA key size is the size of the ...
1
vote
0answers
69 views

Want to use ECC but am clueless [closed]

First off, I'm not an experienced cryptography or computer person, please bear with me. I have some basic experiences with PGP software though (not much of a redemption huh?). I have some data that ...
-2
votes
1answer
56 views

How to write the encrypted message after using RSA

I have created a RSA encryption/decryption program but how do i write out the results after doing a encryption? Right now I have it so that it will just print out the decimal value of one character ...
4
votes
2answers
479 views

Quantum key distribution simulation

I'm looking for a simulation of the Quantum Key Distribution protocol. Does anyone here have one that they could recommend?
-1
votes
1answer
73 views

Error propogation in CBC mode

Going through the wiki for modes of operation I see that the section error propogation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
2
votes
1answer
147 views

Chosen Ciphertext Attack with a theoretical decryption machine

Say we have an encryption algorithm that encrypts data blocks of 128 bits size, and makes them cipher blocks $C = E(P)$ without chaining. Also assume there is a linearity rule for XOR: For every pair ...
2
votes
1answer
214 views

Illustrate NTRU using lattices

I studied some papers related to NTRU. All these papers describe NTRU as a lattice based cryptosystem but I could not find any paper which illustrates NTRU algorithm from lattice point of view. It ...
2
votes
1answer
76 views

Pairing Field size as security parameter

I have read Pairings for cryptographers: It states that the groups $G_1$ and $G_2$ are groups of points on the curve and the group GT is a subgroup of the multiplicative group of a related finite ...
3
votes
1answer
199 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
2
votes
1answer
88 views

Why would splitting a password output be better than separate HMACs for encryption/authentication key derivation?

In a recent question I asked here on crypto.se, an answer was given that surprised me a bit. As mentioned in the referenced question, I'm looking to derive encryption and authentication keys from ...
4
votes
2answers
308 views

Is there a public-key cryptography method that enables public keys to be much smaller than private keys?

Does a public key cryptography method that enables the public key to be orders of magnitude smaller than the private key exist?
-1
votes
2answers
114 views

Journals to read in order to keep up to date with interesting research [closed]

I'd love suggestions from crypto.stack as to academic journals to read. They can range from introductory to advanced, as long as it's free (requires no access fees). Feel free to edit this question ...
7
votes
2answers
986 views

Generating Encryption Keys from Biometric Fingerprint Templates

How would one go about generating Encryption Keys from Biometric Fingerprint Templates extracted from a fingerprint using either Griaule SDK or DigitalPersona SDK or any other SDK that will return the ...
2
votes
1answer
97 views

Efficiency of chaining AES “groups” of blocks

From ISO/IEC 23001-7:2012/Amd 1:2012 10.2.2 Creation of Initialization Vector (Informative) Decryption efficiency may be improved if subsequent initialization vectors use the value of the last ...
1
vote
1answer
81 views

order of elliptic curve divisible by prime

Why order "u" of an elliptic curve "E" defined over a finite field "GF (q)" (u = | E / GF (q) |) must be divisible by a large prime number r to be appropriate for cryptographic purposes?
2
votes
1answer
118 views

How does CBC work with read-write volumes?

I have read an article about an attack on LUKS in CBC mode and had a look at the WP article about CBC and now I am confused. If I have understood that correctly then changing the plaintext of a block ...
7
votes
1answer
184 views

What is the “artificial abort” technique?

In the security proof of Brent Waters's paper Efficient Identity-Based Encryption Without Random Oracles, he uses a novel “artificial abort” step on page 6. At this point the simulator is still ...
-1
votes
1answer
348 views

Reverse engineering a single checksum byte [closed]

I am working to understand a system which saves a few bytes of data together with what appears to be a single checksum byte that provides a very naive guarantee that the data has not been tampered ...
2
votes
2answers
191 views

How can I perform matching on an “encrypted- fingerprint feature matrix” using Fully Homomorphic Encryption?

I am doing a finger-print authentication process. The feature-extraction using minutiae has been done and I get an N x 6 matrix, where the 6 columns are {$x_i$ ...
1
vote
2answers
151 views

What are the major flaws and limitations of this hash-based stream cipher design?

K is a 224-bit key. C is a 32-bit counter; it is publicly known. the same value is never used twice. ...
0
votes
1answer
317 views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
1
vote
1answer
111 views

How does this SSL-related flaw work?

I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked. First how HTTPS works… to be sure I’m on the same page: Server ...
1
vote
1answer
68 views

Problem with anonymously merging information from distributed sources

Some Background: There is an entity with an identifier and some information. The identifier of this entity is a string with a known scheme/pattern(Which means the total number of such possible ...
2
votes
1answer
325 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...
1
vote
2answers
202 views

weaknesses in ElGamal with public key of small order

Suppose $p=29$, $\alpha = 2 \in F_p^*$ is a generator of $F_p^*$. Bob picks $d \in \{2,...,27\}$ such that $\beta = \alpha ^d=28 \pmod{29}$. He then sends his $(p,\alpha ,\beta)$ to Alice who herself ...
1
vote
2answers
138 views

Understanding math behind RSA key derivation [duplicate]

I was reading through the key derivation for RSA. Here are the steps per wiki - Select strong primes $p$ and $q$ such that $pq = n$ $\phi(n)$ = $(p-1)(q-1)$ select $e$ such that $e$ and $\phi(n)$ ...
2
votes
1answer
182 views

How do P2P clients like uTorrent maintain authenticity of files?

I am very new to concepts of cryptography so bear with me and feel free to fill in any information that may seem obvious but something you think someone may not know. At first I was under impression ...
0
votes
0answers
73 views

Can you determine an unknown value when it is combined with a known value and you are given the resulting hash?

Say I have a string that I want to keep hidden. You can then enter a known string which is added to the end of the hidden string and you are given the sha256 hash of the combined string. If you were ...
3
votes
1answer
115 views

Cryptographic pseudo-random generation of address subsets

Suppose I have devices which broadcast, on an insecure channel, 32-bit addresses. I want to make these devices untraceable - one way to do so is to allocate for each device a distinct subset of ...
1
vote
1answer
801 views

Complement property of DES

I'm supposed to show the complement property of DES ($c=DES(p,k) => \bar c = DES(\bar p, \bar k)$). My idea was to just start the algorithm with $\bar p$ and see what happens (ignoring the initial ...
-2
votes
0answers
116 views

Symmetric-Key Based authentication [closed]

So i've managed to answer all the other cryptography questions, but I have not come across this exam style question before, and need help.
2
votes
1answer
224 views

Simple way to extend AES to 256-bit block size

What is the best way to use standard AES with a 128-bit block size to act as a 256-bit block cipher? I am aware of CMC and EME which seem to serve this purpose, but they seem to be more complicated ...
2
votes
1answer
269 views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
-1
votes
2answers
366 views

Shamir Secret sharing - Can share generator keep x values secret?

I'm wondering, in Shamir secret sharing, can generator of the shares, keep the x values which are used in evaluating the polynomial to obtain y values (i.e., the shares) secret, and whenever the ...
0
votes
1answer
452 views

One-time pad, zero key and Shannon

I'm supposed to prove that OTP without the zero key $k=0^n$ is not perfectly secret anymore. I understand that it's not because an attacker learns something by looking at the plaintext and ciphertext. ...
3
votes
2answers
200 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
2
votes
1answer
207 views

Is AES-256 over AES-128 weakening the original encryption?

When transfering data using TLS the browser and server agree the cipher suite to be used - so for example this could be chosen as AES-128 and is (probably) outside of my control. If I separately ...
1
vote
1answer
74 views

Security assessment between $g^{a_ix_i+r_i}$ and $g^{x_i+r_i}$ [closed]

Imagine a tagging system whose security requirements imply to learn nothing from the tag about the encoded value. We consider a plaintext space $X \in \mathbb{Z}_p$ and a group $\mathbb{G}$ where ...
3
votes
4answers
700 views

Which tamper-protection algorithm provides the shortest output?

Background When making web applications you sometimes need to pass data along with the form which isn't visible to the user. Database IDs are the most common, but texts and IDs are sometimes ...

15 30 50 per page