2
votes
1answer
975 views

How good is using AES CTR mode with initial counter as 0?

Is it advisable to use AES CTR mode with the counter initialized to 0? How good is it in security terms?
2
votes
1answer
477 views

LFSR using words

If I've got an LFSR, let's say a 16-bit Fibonacci LFSR as shown in the corresponding wikipedia article, which generates maximum length sequences, could I use it to create word sequences instead of bit ...
2
votes
1answer
112 views

How do these figures represent a boolean function?

In the Wikipedia article "Bent functions", there are some figures representing those Bent functions: How do these figures represent a boolean function ?
2
votes
3answers
217 views

Decryption possible only within a period of time

Time-locked encryption and time-released encryption seem to be security systems focused on making sure that the decryption of certain message cannot take place before a certain time has passed. ...
2
votes
3answers
218 views

How should I interpret this note on diffusion of the internal state of a PRNG?

This question is about Tyche, a non-cryptographic PRNG. While the PRNG is not cryptographic the analysis and this question surely is heavily involved with cryptography, so I think it's on-topic here. ...
2
votes
2answers
276 views

Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
2
votes
3answers
408 views

Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?

Could you choose the number of PBKDF2 iterations based upon the system time? I've heard a few people recommend that the number of iterations for PBKDF2 should be doubled every two years (starting ...
2
votes
1answer
107 views

Recasting randomly generated numbers to other widths

Suppose I have a list of randomly generated uint_8's, uniform over the whole range of uint_8. I write them into a file as raw ...
2
votes
1answer
95 views

Is it possible to generate a message using the mac and the key?

Say that you have the Key and the MAC value that was generated from the Key using CBC. Is it possible to generate a message with just the mac and the key? If so, how would you do it?
2
votes
1answer
147 views

Can stream ciphers (usually) be “run backwards”?

Is it possible to reconstruct the previous output bits of a stream cipher, e.g. RC4, when only the current state is known, or is that computationally hard, or even impossible (due to ambiguous ...
2
votes
1answer
176 views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
2
votes
1answer
150 views

Camellia cipher - is it a symmetric or asymmetric cipher?

I read a wiki page about Camellia cipher and know that it is a block cipher that can use 128-bit, 192-bit or 256-bit keys. But I cant find any information about if its a symmetric cipher (uses one key ...
2
votes
1answer
197 views

Public Keys on Social Media

Is there any problem with using social media (i.e. Facebook) as a directory of public keys? For example, couldn't Alice put a note containing $(g^a \bmod p, g, p)$ on her Facebook page so she could ...
2
votes
1answer
151 views

Can OTP still be broken if there are several messages being sent with only a slight variation in a password?

If an attacker were able to get a hold of 2 encrypted messages that were both encrypted in a one time pad with a password that were each similar but had one change in the first character, could it ...
2
votes
1answer
194 views

Why must we hash lot of times in rainbow tables?

I don't get the utility to chain and reduce in generating rainbow tables. Hash functions are made to not have collisions, or at least chain only 2 times so we don't return to the concept of the hash ...
2
votes
1answer
2k views

How is input message for SHA-2 padded?

I read about how is an input message prepared to be hashed by MD4,MD5 or SHA-1: Step1 Append padding bits The input message is "padded" (extended) so that its length (in bits) equals to 448 ...
2
votes
1answer
138 views

Can you explain what the AES paper means by “sharing active S-boxes”?

I am reading the "Biclique cryptanalysis of the full AES" paper. What do they mean by "sharing active S-boxes"? How can this concept can be advantageous to make a bicycle? If there is someone who ...
2
votes
2answers
2k views

How does SafeNet MobilePASS generate passwords?

We use MobilePASS at work but the latest version of the android client seems to be buggy so I wanted to have a go at implementing the algorithm myself. You can download the client to play with here: ...
2
votes
2answers
198 views

Pseudorandom functions

The usual case to distinguish a pseudorandom function from a random function is to assume that the adversary can choose the plaintext blocks. Is there another case (game) in which the adversary can ...
2
votes
1answer
229 views

Are SSL modes with forward secrecy vulnerable to the BEAST attack?

From the original BEAST paper, it seems to me that you need the same session key when encrypting data, so you can check if the original plaintext block is the same as your chosen plaintext (which is ...
2
votes
3answers
640 views

additive ElGamal encryption algorithm

I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts. The problem is that I need to ...
2
votes
2answers
520 views

Is rainbow table attack applicable to any hash?

Typically when rainbow tables are discussed MD5 hash is used as an example. It's not quite clear whether this attack is specific just to MD5 or to a certain subset of hashes or to just any hash ...
2
votes
3answers
5k views

OpenSSL AES 256-bit Key Management

I am using C and OpenSSL to encrypt files. After experimenting with the OpenSSL command line utility, it makes you enter a passphrase that can be any length, but uses that to create a 256-bit key. ...
2
votes
2answers
197 views

No IV for one off symmetric file encryption

My question is (hopefully, for somebody) a simple one; but my project is holding as I'm not sure. I read on SO that generating encryption keys without an IV is a bad idea, so is using a constant IV ...
2
votes
2answers
278 views

HMAC and assumptions on the cryptographic hash

According to Wikipedia, a cryptographic hash function has the following properties: Pre-image resistance: Given $h$, it's difficult to find any message $m$ such that $h = H(m)$. Second pre-image ...
2
votes
1answer
328 views

How insecure in practice?

I am in attempt to understand relative insecurity of certain encryption schemes. Particularly of interest is DES and RC2. I know AES is better and should be used to encrypt. But practically, if ...
2
votes
2answers
1k views

How to test if a number is a primitive root?

How to test if a number is a primitive root, assuming the modulus is a prime? And if not? Is it not enough if the number is relatively prime to the modulus or prime?
2
votes
1answer
152 views

Is this algorithm secure?

I recently found this site, proposing a hashing algorithm for passwords. They describe the following: pad the password on both sides with SHA1(email) to ...
2
votes
2answers
1k views

Is Base64(SHA1(GUID)) still unique like the original GUID?

Basically what the title is; GUIDs are unique by design. If you run the GUID through SHA1 and then Base64 the hash, will the resulting string have the same guaranteed uniqueness as the GUID, or not?
2
votes
1answer
608 views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...
2
votes
2answers
275 views

Many consecutive hashes to slow down brute force attack?

I've heard that hash algorithms like bcrypt are more secure because they take longer to complete, and therefore take much longer to prute force, without a noticable ...
2
votes
2answers
776 views

risk of attacker decrypting RSA ciphertext without public or private key

As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
2
votes
2answers
336 views

Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies­-Meyer or Miyaguchi-Preneel are ...
2
votes
1answer
559 views

Attack on DSA with signatures made with k, k+1, k+2

For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages ...
2
votes
1answer
302 views

Proof of the standard pseudorandom generator + XOR encryption scheme in Goldreich

Reading Goldreich's Foundations of Cryptography II, I found this proof for the security of the common pseudorandom generator + XOR encryption scheme (Proposition 5.2.12 in the book): Assume you ...
2
votes
1answer
98 views

How difficult is it to check if a group element is in a sub group?

I am just curious. We have a group $G$ and its subgroup $H$ with a generator element $h \in H$. How difficult is it to check for $x \in G$ that $x \in \langle h \rangle$? Is there a better way than ...
2
votes
1answer
133 views

Padding always the same, problem or not?

I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm. My problem is that I split the message into ...
2
votes
2answers
515 views

Is there a length-preserving encryption scheme?

Is there a length-preserving encryption scheme, that preserves the lengths of input sizes such that the length of the input plain text is same as length of the output cipher text ?
2
votes
2answers
912 views

Do known-plaintext attacks exist for public key encryption?

In asymmetric ciphers we publish the public key for anyone, which means an attacker can encrypt any message they want and compare the ciphertext and plaintext without communicating with the owner of ...
2
votes
2answers
1k views

Can a shift cipher attain perfect secrecy?

On a practice question for my intro cryptography exam, it asks the following: Assuming that keys are chosen with equal likelihood, the shift cipher provides:    A) computational security ...
2
votes
3answers
2k views

Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
2
votes
1answer
1k views

How can I use eulers totient and the chinese remainder theorem for modular exponentiation?

I'm trying to implement modular exponentiation in Java using Lagrange and the Chinese remainder theorem. The example we've been given is: Let $N = 55 = 5 · 11$ and suppose we want to compute ...
2
votes
4answers
723 views

One time pad key exchange

If two parties want to communicate with securely using OTP , how is the key ( that is lengthy as plain text) shared with other party for decryption ?
2
votes
2answers
118 views

When is each key used when encrypting an email using OpenPGP?

When you send an email using PGP to encrypt emails, is the recipients public key used to encrypt the email, or is your private key used? Are they both used? At what points do each of the four keys ...
2
votes
1answer
451 views

What is the strength of unpadded RSA?

I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling. How many bits of security does unpadded RSA have, in relation to its key ...
2
votes
1answer
1k views

Simulation-based security?

I've been reading Introduction to Modern Cryptography by Katz and Lindell as an introduction to cryptography. The book seems to use the term 'simulator' when it talks about a game like, for instance, ...
2
votes
1answer
491 views

Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm?

For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to increase security? Note: I just want more secure output and CPU cycles does not ...
2
votes
1answer
244 views

Aes encryption -The relevance of static matrix in mixcolumns operation

Can someone explain to me the relevance of the static matrix used for the mixcolumns operation in aes encryption.i.e the relevance of why the byte is multiplied by 2 + next byte multiplied by 3 + next ...
2
votes
1answer
181 views

What are the dangers of predictable (repeated) plaintext structures?

When using a "good", modern cipher (specifically one that provides ciphertext indistinguishability), is it a problem at all if there is some well-known structure in all plaintexts? For example, ...
2
votes
3answers
150 views

Is it possible to ensure security with zero pre-shared information?

Is it possible to secure a communications channel against both passive (sniffing) and active (injecting / MitM) attackers without either legitimate party knowing any pre-shared information? I know ...

15 30 50 per page