All Questions

1
vote
1answer
91 views

Distinguishing joint probability distributions

Assume that we have a probability distribution $P(X,Y)$ for the joint probability of random variables $X$ and $Y$. Let $P(Y, Z)$ be analogous distribution for $Z$ and $Y$. Based on these we can define ...
2
votes
2answers
478 views

Can I make a cipher (ex: Vigenère) harder to break?

The Vigenère cipher can relatively easy be broken when the key size is small compared to the size of the message. One first finds the length of the key, and then uses frequency analysis to actually ...
2
votes
1answer
460 views

Using Chi-Square for Vigenère Cipher

I am writing a program which will use Chi-Square to determine which is the correct keyword for a ciphertext via Vigenère cipher. I came across a website that describes the Chi-Square statistics in a ...
2
votes
2answers
261 views

What does the linear assumption over bilinear groups mean?

In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say: In both schemes we rely on the linear assumption over bilinear groups. What ...
2
votes
1answer
139 views

Why does Merkle's Puzzle requires Eve quadratic complexity of effort to break the system?

The way Applied cryptography 2ED explains the puzzle is as follows (I paraphrase it): Bob generates 2^20 messages of the form x,y where ...
0
votes
2answers
115 views

The weak link is the password?

Consider a secure modern block cipher like AES/Serpent/Twofish. I hear everyone say that the complexity is $2^{128}$ for a 128 block cipher. But isn't the weak link the actual hashed and salted ...
5
votes
4answers
11k views

Does the SHA hash function always generate a fixed length hash?

I'm using the SHA1/2 family of algorithms for a particular project. I was wondering if all the SHA algorithms return a fixed length hash regardless of the length of the data.
1
vote
2answers
202 views

Are there attacks that break collision resistance but not preimage resistance?

Are there any examples of attacks on hash functions which: break collision resistance and second preimage resistant, or break collision resistance and preimage resistant? I have looked at ...
3
votes
1answer
394 views

Subtracting a point in elliptic curve cryptography?

I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption: ...
2
votes
1answer
119 views

How does SSL secure the initial handshake?

I'm reading the SSL specs, and it seems that the initial handshake has no authenticity protection at all. What is to prevent, say, an attacker from overwriting the "available ciphers" list with one ...
2
votes
3answers
364 views

Some cryptography security questions

I recently had a discussion with a friend of mine about cryptography. As we are both no experts, I thought that I could better resolve are dispute here :-). My friend said that when he used public ...
2
votes
1answer
204 views

ID-based key exchange protocol with PFS

The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the ...
2
votes
1answer
301 views

Can I use SHA1 as license key?

I have recently started looking into creating secure, while not validating against an external server, software product keys. The idea I have had is to create a key consisting of two parts firstly a ...
2
votes
1answer
124 views

Can you explain what the AES paper means by “sharing active S-boxes”?

I am reading the "Biclique cryptanalysis of the full AES" paper. What do they mean by "sharing active S-boxes"? How can this concept can be advantageous to make a bicycle? If there is someone who ...
1
vote
1answer
341 views

What's the difference between the long term key and the session keys?

I'm currently studying secret key cryptography, and I've come across the terms "long-term key" and "session key". What's the difference between these two kinds of keys?
5
votes
1answer
916 views

How do I calculate CRC32 mathematically?

I want to calcuate the CRC32 algorithm using polynomials directly but I don't know how. I found the generating polynomial listed here https://en.wikipedia.org/wiki/Cyclic_redundancy_check. This ...
5
votes
2answers
322 views

Tunnels used in md5

I'm reading the paper "Message Freedom in MD4 and MD5 Collisions: Application to APOP" about finding collisions for the MD5 hash algorithm involving the concept of tunnels as described in "Tunnels in ...
18
votes
1answer
861 views

Selective format-compliant JPEG encryption?

I am working towards building a format-compliant encryption system for pictures. The aim of it is to be able to obscure specific areas of a picture (i.e. faces, car license numbers...) while keeping ...
2
votes
0answers
50 views

SHA-512 hash collisions [duplicate]

Possible Duplicate: Is SHA-512 bijective when hashing a single 512-bit block? Is there any guarantee that there are no collisions for all 512-bit input values for SHA-512 (every 512-bit ...
6
votes
2answers
4k views

Are there any known collisions for the SHA-2 family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512? By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
2
votes
1answer
605 views

If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
10
votes
3answers
4k views

What is pre-image resistance, and how can the lack thereof be exploited?

What is "preimage resistance", and how can the lack thereof be exploited? How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?
12
votes
2answers
4k views

Differences Between White-Box Cryptography and Code Obfuscation

I have been reading the question "What is a white-box implementation of a cryptographic algorithm?" and it led to this short article / Q&A which states in question 2: Q2: What is the ...
3
votes
2answers
686 views

Using an RSA private key simultanously as an AES encryption key to generate random numbers?

Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the successor X9.31- standard to implement my PRNG. X9.17 uses DES, but ...
12
votes
1answer
634 views

Does unbalancing a feistel cipher always improve security? Does it improve security at all?

So according to Wikipedia unbalanced feistel ciphers provide greater provable security. Specifically, they state: The Thorp shuffle is an extreme case of an unbalanced Feistel cipher in which one ...
6
votes
1answer
176 views

Are there security issues with discrete logarithm keys not being uniformly distributed?

Generally, algorithms based on discrete logarithm specify that private keys are chosen as scalars between 1 and the order of the group (denoted $q$ here). For instance IEEE P1363 and FIPS 186-3 both ...
18
votes
2answers
3k views

What is entropy?

We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
8
votes
1answer
805 views

Change in probability of collision when removing digits from MD5 hexadecimal hash values

I am aware that MD5 has a known collision vulnerability and should not be relied upon when uniqueness is required, but in the environment I am working on I only have access to MD5 hash function. ...
4
votes
2answers
325 views

Which crypto libraries/programs do we have the most confidence in? [closed]

I have recently begun studying crypto. If it's one thing I have learned it's that we should not implement our own crypto. Therefore we should look to using existing software and libraries. When I ...
1
vote
2answers
864 views

Custom crypto library in C

I will be making (in the near future) an app that will contain some pretty heavy crypto. As it is possible that my app will be ported to different devices (initially it will be iOs only, but Mac, ...
1
vote
1answer
176 views

With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
6
votes
1answer
129 views

Cryptography used for login and signing transactions

My bank uses a smartcard reader (separate module not connected to the computer) as depicted below: When I need to log into my account it provides me with a challenge and I need to provide some ...
3
votes
3answers
416 views

Timing Attacks on ECDSA, ECDHE, AES and SHA2

Are there any known timing attacks (both practical and theoretical) on any implementations of the following? ECDSA (I'm aware of this one - are there any applicable to prime fields?), ECDHE (again, ...
2
votes
1answer
71 views

How do I know if a given curve requires a FpCurve F2mCurve or ECCCurve?

I'm trying to read a public key into Bouncy Castle (secp256k1) and need to choose from the following objects FpPoint; FpCurve; or ...
1
vote
1answer
2k views

HMAC SHA256 vs RSA SHA256 - which one to use

Salesforce recently announced they are moving away from HMAC SHA256 to RSA SHA256. Why did they make that move?. Any technical factors? Is HMAC really easy to break? ...
3
votes
2answers
216 views

Is there a companion algorithm for OTP to ensure integrity and/or authentication?

One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved: Fast generation of independent and identically distributed random variables Perfect key ...
2
votes
2answers
193 views

Hypothetical unknown cipher - security in obscurity?

I'm curious what would happen in the following scenario: Suppose an attacker gets a hold of a cipher-text of sufficiently large length. And suppose he has the means to verify a successful decryption. ...
1
vote
1answer
85 views

How do you use the Tiger hash function with GPG?

I've searched Google and the GnuPG documentation and I haven't been able to find an answer. Some pointers in the right direction would be greatly appreciated.
16
votes
1answer
8k views

What are the differences between a digital signature, a MAC and a hash?

A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind. Which assurances does each primitive provide to the recipient? What kind of keys are needed?
1
vote
0answers
129 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES ...
3
votes
2answers
677 views

Why is sharing the seed and using SecureRandom “deterministically” so bad?

I've recently been reading an article about "using cryptography to store credentials", and I would love it someone explained this in more detail… Up until Android 4.1, Android used a SecureRandom ...
28
votes
6answers
3k views

Is there a secure cryptosystem that can be performed mentally?

I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
1
vote
2answers
104 views

Is it possible to decide the base of a discrete logarithm?

Given $R$, a prime $p$ and two bases $g_1$ and $g_2$, is it possible to decide if $R = g_1^r$ mod $p$ or $R = g_2^r$ mod $p$ without knowing $r$?
2
votes
1answer
127 views

How do I prove that this PRNG is easily distinguished from a random sequence of numbers (modulo m)?

I was studying Crypto, and this question came up. Using a PRG like the multiplicative congruence generator: $b_{i+1} = a \cdot b_i \mod m$ How do I prove that the output of this PRG, or any PRG's ...
1
vote
1answer
2k views

Can AES use PKCS#5 padding

From What is the difference between PKCS#5 padding and PKCS#7 padding, I understand that PKCS#5 is defined for 8 byte block sizes. Does this rule it out as a padding option for AES since AES has a ...
2
votes
0answers
120 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
3
votes
2answers
176 views

Isn't the deterministic property of (EC)DSA a security problem?

From what I read in Wikipedia's article "Elliptic Curve DSA ~ Security", the "deterministic" generation of $k$ can help prevent certain type of attacks (such as the one happened to Sony). However, ...
2
votes
1answer
145 views

Good Encryption Exponent

I have placed a bet that I can create a public key such that my adversary will not be able to crack (decrypt) it for at least one week. For my primes $p$ and $q$, I chose very large numbers that are ...
6
votes
1answer
154 views

What's the state of the attack to get the first pre-image on MD4?

What's the state of the attack to get the first pre-image on MD4? Is it still $2^{102}$ as described by Gaëtan Leurent in "MD4 is Not One-Way" ?
2
votes
1answer
223 views

Can you help me understand how RC4-52 is done using pen-and-paper?

I've played a lot with VIC and enjoy its complexity and effectiveness as a field cipher. However, RC4 has caught my attention lately and I've read there is a RC4-52 variant that can be done by hand. ...

15 30 50 per page