1
vote
1answer
233 views

Rock-paper-scissors over network, how to protect from cheating server?

I'm trying to design cryptographic protocol to play Rock-Paper-Scissors with two parties, neither trusting each other, nor trusting server they use for communication, so game is 'provably fair'. So ...
0
votes
1answer
129 views

No of keys used in Triple DES Algorithm

I am studying Triple DES. I have got two basic questions. One, why are we following a sequence like encrypt(decrypt(encrypt)); what is the problem using a sequence encrypt(encrypt(encrypt))? ...
2
votes
1answer
141 views

Explanations for the complexity values for second preimage attack on GOST?

I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities ...
8
votes
3answers
1k views

SHA-224 Purpose

One of the new features of Java 8 is the SHA-224 message digest. What is the use case for having a 224-bit-length hash?
0
votes
1answer
133 views

Why is DDH not hard over $\mathbb{Z}^*_p$?

Why is Diffie-Hellman key exchange not hard over $\mathbb{Z}^{*}_p$?
1
vote
1answer
159 views

What is difference among eavesdropper attack, multiple message attack and CPA attack?

What is/are difference(s) among eavesdropper attack, multiple message attack and CPA attack in context of symmetric key encryption? I only know that in eavesdropper attack there is an adversary ...
3
votes
1answer
209 views

Difference between lightweight, online and low memory Authenticated Encryption schemes

What is the basic difference between the following types of Authenticated Encryption (AE) schemes? Lightweight Authenticated encryption Online Authenticated Encryption Authenticated Encryption for ...
0
votes
1answer
53 views

Ensuring that an operation takes a relatively specific amount of time, but easily verify the result

I want an algorithm of some sort that can ensure that an operation takes a fairly specific amount of time, but proof that this operation was done can be completed relatively inexpensively. For ...
2
votes
2answers
267 views

How does compression before encryption leak info about the input?

Apparently current best practices recommend that you do not compress before you encrypt. For example in this blog entry (*): http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ It ...
2
votes
2answers
99 views

Proving a decision was randomly made [duplicate]

Alice and Bob want to agree on a bit $0$ or $1$. Both know it would be fair to pick that at random, but there's no way they could meet to throw a dice and no third party they could trust. Are there ...
5
votes
1answer
123 views

How can I find the order of the group that an elliptic curve is defined over?

I have a Weierstrass elliptic curve ($y^2=x^3+a \times x+b \mod p $) How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] ...
5
votes
2answers
196 views

How is HMAC(message,key) more secure than Hash(key1+message+key2)

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is ...
1
vote
0answers
103 views

RSA timing attack

Given an RSA implementation that uses Montgomery multiplications and CIOS exp algo, but NOT CRT. Given a decryption1 oracle that takes chosen cipher text and responds the plain text and the time it ...
0
votes
1answer
103 views

Hash Function to get same value for different messages [duplicate]

I am studying a function where I found the some hash properties. Hash functions: Given a code c is computationally infeasible to find m such that ...
3
votes
2answers
215 views

secure integer comparison

I have been going through a huge amount of papers to find a simple and a practical method to compare integer numbers without revealing their original values. I know that this falls within the area of ...
-1
votes
2answers
1k views

Decrypting Triple-DES using 2 keys in crypto tools

I'm currently working on crypto tools to encrypt/decrypt 4 blocks of messages using Triple-DES with 2 keys. So, I've reached the final cipher text, but now I have to do the reverse and get the ...
1
vote
1answer
103 views

how to use salt to sign a message and how is it effective? [duplicate]

I've had an assignment to sign a file using hash and salt, so I read about salt and I got why it's important when it comes to password, but not to sign messages. How do I sign something using salt? ...
2
votes
2answers
116 views

Soundness idea of basic zero knowledge prood

I am having a hard time figuring out the soundness proof of the bellow zero knowledge protocol. As it is a typical proof, I would love to deeply understand it. zero knowledge argument that $h \in ...
1
vote
1answer
179 views

How to solve custom made ciphers? [closed]

How would you go about solving basic custom made ciphers - e.g. one generated from this website http://www.wikihow.com/Write-a-Custom-Cipher-Carefully? This is solving it without knowing the method ...
-1
votes
1answer
40 views

In Needham Schroeder key distribution what happens if responder's part is not encrypted in step 2 with Kbs but encrypted instead by Kab in step 3

The Needham-Schroeder protocol is: 1 A→S:A,B,Na 2 S→A:{Na,B,Kab,{Kab,A}Kbs}Kas 3 A→B:{Kab,A}Kbs 4 B→A:{Nb}Kab 5 A→B:{Nb−1}Kab Here Na and Nb are nonces. Kab is the key between a and b Kas is ...
1
vote
1answer
2k views

CryptoJS.AES result always has same first few bytes?

When using this very minimal CryptoJS AES example: ...
1
vote
1answer
98 views

What is the idea behind hashing the QueryString in OAuth?

In OAuth 1.0a and 2.0 using MAC Authorization, I need to generate a hash of all the QueryString Parameters, which requires normalization (alphabetical ordering) of them. I'm trying to understand what ...
3
votes
1answer
131 views

McEliece information set decoding attack vulnerability

Wikipedia states that McEliece is open to "information set decoding attack". What is an "information set decoding attack" and how serious is the vulnerability? (is it just a matter of choosing proper ...
1
vote
2answers
141 views

McEliece key size

There's a lot of references about McEliece key size being the barrier for proper usage of the algorithm, exactly (or roughly) how large are the keys?
1
vote
1answer
82 views

Distinguishing Attack on CBC-MACs

I want to ask again about distinguishing attack on CBC MAC, based on the paper published by Ketting Jia, Xiaoyun Wang, Zheng Yuan, and Guangwu Xu: Distinguishing Attack and Second-Preimage Attack on ...
-2
votes
1answer
159 views

Zero Knowledge Proof for Correctness of the product of additive ElGamal Ciphers [duplicate]

Suppose we use Additive ElGamal defined as follows: Let $(K,E,D)$ be a triple. The key-generator $K$ outputs the description of a finite multiplicative group $G$ of prime order $q$, with three ...
-1
votes
1answer
123 views

How to create PSK key? [closed]

I'd like to create a PSK key to use with TLS-RSA-PSK-WITH-AES-256-CBC-SHA - what is the format of this key?
0
votes
2answers
383 views

Should an AES byte key generated with OpenSSL be converted to hex?

I am generating a key & iv with Ruby's OpenSSL wrapper for an AES CBC 256 setup: ...
1
vote
0answers
84 views

Public-key based on roots of polynomial

In general it's hard to calculate the roots of a given polynomial P(x). But the other way back calculating the coefficients is much easier (Vieta's formulas). If this is a one-way function, is it ...
3
votes
1answer
2k views

Why is Serpent faster than AES in this benchmark?

I have a laptop without the AES-NI CPU instructions but with SSE4.1. I'm using Linux and tried the (in-memory) cryptsetup benchmark to get the rough tendency which returned: ...
3
votes
1answer
129 views

Quadratic Sieve: what's the next step after it fails?

Factoring some 20-45 digit values n with a (simple) quadratic sieve, the quadratic sieve may end up with pairs of x and y s.t. $x^2 \equiv y^2 \pmod n$, but neither x+y nor x-y has a nontrivial gcd ...
1
vote
0answers
83 views

Does a dynamic accumulator exist yet? [closed]

I’m looking for a one-way accumulator which can safely add new members (deletion is not necessary) and does not rely on a trusted party in any way. I’ve been looking for one, I need it for this ...
3
votes
1answer
97 views

What is the importance of the $r$ and $c$ values for the Sponge Construction?

What is the importance of the $r$ and $c$ values? Keccak[r=1600,c=0] is stated on a calculator on the Keccak website to be a checksum. But I figured if c=0, then there's only one possible output? ...
1
vote
0answers
198 views

Is this a secure (and correct) sign-then-encrypt technique for transferring messages?

After reading some information on the way iMessage works I have been working on writing some code to try my hand at securely transferring messages in a similar manner and I wanted to confirm that the ...
2
votes
1answer
201 views

Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?

I have just started studying Elliptic Curve Cryptography, and I have this doubt. In ECC the group operation is addition (and not multiplication). So, why is ECDLP stated as a variation of the discrete ...
2
votes
1answer
200 views

Why concatenate the key a second time in HMAC? [duplicate]

On Wikipedia it is said that HMAC is basically (without taking into account padding): $H(key\ \Vert\ H(key\ \Vert\ message))$ where $\Vert$ denotes concatenation. I understand the need to hash ...
1
vote
2answers
85 views

Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$

Consider the accepted answer to the question: Why are elliptic curves better than cyclic groups? It seems to suggest there are subexponential algorithms (i.e., algorithms with running time $$ ...
5
votes
1answer
225 views

Entropy when iterating cryptographic hash functions

Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings: $$ \DeclareMathOperator{\H}{H} \DeclareMathOperator{\SHA}{SHA-256} \H(x) : \left\{0,1\right\}^{n} \mapsto ...
2
votes
1answer
360 views

How do the following new (2013) ECC curves compare in security or efficiency? [closed]

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
1
vote
0answers
111 views

Problem implementing MixBytes functionality in Groestl

Disclaimer: School work. I am trying to implement Groestl through Java, and have got stuck on the MixBytes section which can be found here section 3.4.5 page 11. As per the description of matrix ...
-1
votes
1answer
95 views

Meet in the middle attack - message and key

I clearly understand the story of Alice and Bob: Alice and Bob are going to use double DES. They know the keys K1 and K2. Alice sends to Bob the encrypted message c= EK1(EK2(m)). Bob decrypts the ...
4
votes
1answer
369 views

What prevents a padding standard to cause a data loss?

In here different byte padding standards are listed as ANSI X.923, ISO 101.26, PKCS7, ISO/IEC 7816-4 and zero padding. All of them seems to apply padding to the last byte blocks. Odds are rare but ...
-1
votes
1answer
218 views

Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate]

First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ...
-1
votes
1answer
173 views

Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate]

First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ...
4
votes
2answers
1k views

Randomness test question from FIPS 140-1 and comparison with 140-2

In FIPS 140-1 there are 4 statistical random number generator tests (The Monobit Test, The Poker Test, The Runs Test and The Long Runs Test. Then FIPS 140-2 came along and supposedly tightened the ...
3
votes
1answer
681 views

Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
4
votes
1answer
143 views

Should different key pairs be used for signing and encryption?

In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation: When a user turns ...
2
votes
1answer
123 views

Why do we apply the concept of circuit in homomorphic encryption schemes?

I am a beginner to the concept of homomorphic encryption. One thing that makes me very confused is why we use the circuit concept or approach to homomorphic encryption. Gentry's paper does not discuss ...
1
vote
1answer
765 views

Difference between known-plaintext attack and forward search attack

I am looking at the different attacks on RSA. I came across known-plaintext attack where the public key can be used to encrypt all possible messages until it finds a match on the sent encrypted ...
5
votes
1answer
314 views

Difference RSA keypair creation openSSL and openPGP?

Creating a 2048bits RSA keypair I figured that doing this using openssl takes as an input 32bytes of "randomness" from ...

15 30 50 per page