3
votes
2answers
463 views

Zero-knowledge proof using quadratic residue: why two options?

In the zero knowledge proof using QR, why do we even bother with the server sending us $b = 0$ back? As I understand it, the server selects $b = 0$ or $b = 1$. If $b = 0$, then the client (Alice) ...
3
votes
3answers
360 views

How does an oblivious test of plaintext equality work?

Assume an ElGamal Cryptosystem. Assume a set of three players, $P_1$, $P_2$ and $P_3$. The private key $x$ is shared among the players. The player $P_1$ has a piece of the private key $x_1$, $P_2$ has ...
3
votes
1answer
4k views

How is input message for SHA-2 padded?

I read about how is an input message prepared to be hashed by MD4,MD5 or SHA-1: Step1 Append padding bits The input message is "padded" (extended) so that its length (in bits) equals to 448 ...
3
votes
2answers
929 views

If we can find prime numbers larger than 17 milion digits, why can't we find all 1024bit primes? [duplicate]

"Largest Known Prime Number Discovered; Has 17,425,170 Digits" http://www.sciencedaily.com/releases/2013/02/130213225424.htm If we can find prime numbers larger than 17 milion digits, why can't we ...
3
votes
2answers
294 views

No IV for one off symmetric file encryption

My question is (hopefully, for somebody) a simple one; but my project is holding as I'm not sure. I read on SO that generating encryption keys without an IV is a bad idea, so is using a constant IV ...
3
votes
3answers
1k views

If RSA is limited to 117-200 bytes or so, is that a very limited use case?

Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size? I have read that you can only encrypt a message of around 117 to 200 ...
3
votes
3answers
1k views

Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
3
votes
1answer
585 views

Why is the discrete log problem easy when the exponent comes from a binomial distribution?

I read in http://epubs.surrey.ac.uk/7219/2/esorics06.pdf that in exponential El Gamal the discrete log problem for recovering $m$ from $g^m$ can be made tractable when $m$ is drawn from a binomial ...
3
votes
1answer
221 views

Are digital signatures secure for signing lots of small messages?

I need to sign the numbers from 1 to 1 billion (literally this, it's not an analogy) using a digital signature and then send these numbers in a particular order to someone. The message is not private ...
3
votes
1answer
150 views

What does “adaptively secure” mean?

In a paper it says "In the generic group model, the PRF is adaptively secure for inputs of $\mathbb{Z}_q^n$". Maybe a stupid question, but what does "adaptively secure" mean exactly?
3
votes
1answer
1k views

Question about the definition of a secure PRF

I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF. I understand the test goes as follows: A challenger picks a function $f$ such that $f \leftarrow \...
3
votes
2answers
996 views

Can two rc4 encoded messages be XORed and decrypted if encrypted with the same key?

If I have the following: E1 = RC4(M1, K); E2 = RC4(M2, K); If two different messages M1 and M2 are encrypted with the same key, K, can the key be recovered by ...
3
votes
3answers
423 views

Why do we assume un-security of communication channel on every cryptography system

While reading about a few cryptographic systems, I noticed that we always assume the communication channel is not secured. Why is this assumption made? And, why the effort is being put into designing ...
3
votes
1answer
286 views

Crypto puzzle as proof of randomness?

I need an untrusted client to generate a random public/private keypair (in particular, an Ed25519 keypair, which can be generated really fast), but I'm only allowed to see the public key. The ...
3
votes
2answers
1k views

Do known-plaintext attacks exist for public key encryption?

In asymmetric ciphers we publish the public key for anyone, which means an attacker can encrypt any message they want and compare the ciphertext and plaintext without communicating with the owner of ...
3
votes
2answers
191 views

iterated discrete log problem

Consider the following problem: given $g_1 \ldots g_i,h_1 \ldots h_i \in G$, $\forall i$ find $x_i$ such that $g_i^{x_i}=h_i$ For $i=1$ this is the discrete log problem and is assumed to to have ...
3
votes
2answers
881 views

Implementing AES in C++: 4x4 Array of unint8_t, or 4x1 array of uint32_t?

I'm implementing AES in C++, and, inspired by the way words are handled in SHA, I decided this time to handle the state as a one dimensional array of 4byte unsigned integers as opposed to a two ...
3
votes
1answer
918 views

Proving that a scheme is not IND-CPA-secure

Suppose I want to prove that a given symmetric encryption scheme is not IND-CPA secure. The first thing I do is to define a specific adversary that attacks the scheme. How can I proof neatly, (using ...
3
votes
1answer
1k views

Why do we need in RSA the modulus to be product of 2 primes?

I think I roughly understand how the RSA alorithm is working. However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$. I vaguely know it ...
3
votes
1answer
639 views

Are there secure stream ciphers that cannot be parallelized?

Are there any stream ciphers (or a deterministic random number generators, that should work as well I guess?) that cannot be parallelized? So for example if I seed it with a specific value, and then "...
3
votes
1answer
730 views

Is there another resource for Carter-Wegman-style message authentication?

I'm wondering if there are other resources that cover Carter-Wegman style message authentication, besides the sources themselves. Is there an online text or a book that covers their ideas? I'd ...
3
votes
2answers
312 views

Is just a bit of random, “fully random”?

I understand that hashing a datetime is a pseudo-random number, and not good in a security context. But what about hashing a datetime plus a truly-random but constant string (just a string that an "...
3
votes
2answers
146 views

KDF with low-entropy salts

I need to derive a key from a username and a password. These are the only two things I have access to. What I thought is using PBKDF2 with username as the salt and password as the master password. ...
3
votes
2answers
1k views

How to decrypt this RSA-like cipher

Suppose we have a RSA-type Modulus $n = pq$ with $p,q$ prime. We also pick a random public exponent $e$ with $\gcd(e,\varphi(n)) = 1$ and compute the private exponent $d$ with $de \equiv 1 \pmod{\...
3
votes
3answers
573 views

Multiple Hash Functions that work in either nesting

Are there any hashing functions that, if two are used in conjunction (with the same salts) will return the same response regardless of ordering? I.e. are there hash-functions $H_1$, $H_2$ such that ...
3
votes
2answers
610 views

How does the cyclic attack on RSA work?

I am trying to get the idea of cyclic attacks againts assymetric RSA encryption. Taken from Handbook of applied cryptography . Let $k$ be a positive integer such that $$c^{(e^{k})} = c\mod n \tag{1}....
3
votes
2answers
564 views

Are there standards for transport layer security using only symmetric keys?

I have an embedded system with AES-128 implemented in hardware. There is very little flash/RAM and the (8-bit) CPU runs relatively slowly. Public key crypto isn't a viable option. This system is ...
3
votes
2answers
394 views

Simple xor cipher extension

Probably the simplest cipher is the xor cipher with a single integer. One can extend this to use more than one integer by several means. I'm wondering if there is any benefit to doing more than this: ...
3
votes
3answers
469 views

What is the best way to send two floating point numbers to a server on the internet from a small device such as an arduino?

I was thinking about sending some sensitive data (temperature) from an arduino (AVR 8-bit processor) to a server on the internet. But I would like to make sure that it would not be possible for Eve ...
3
votes
1answer
47 views

Is the following 4 digits code generator secure and non-deterministic?

In a C# WCF service, I need to send a 4 digits code by SMS to validate a user account/password. For security reasons, the code has to be non-deterministic (so that a malicious user/hacker should not ...
3
votes
1answer
74 views

How are boolean functions used in cryptography?

I recently started becoming interested in Boolean functions. Because they are defined as $f: \{0, 1\}^n \rightarrow \{0, 1\}$, or in other words only over $\{0, 1\}$, I guessed they can somehow be ...
3
votes
1answer
84 views

Why is 128-bit considered “medium term” security?

Why is 128-bit encryption considered good enough for medium term security only? How is expected to be eventually broken? Quantum computing or brute force attack?
3
votes
1answer
62 views

Have I made any glaring mistakes in my use of Yao's garbled circuits?

I would like to use garbled circuits to provide a service that allows people to vote where they do not need to reveal their votes to my server or to anyone else. Let's assume that I have secure ways ...
3
votes
2answers
158 views

Why do we need Euler's totient function $\varphi(N)$ in RSA?

After we calculated $N = p * q$, we calculate $\varphi(N)$ and use it later to determine $e$ (PR) and $d$ (PU). But why? For decryption and encryption we only use $N$ and don't need $\varphi(N)$. So ...
3
votes
1answer
92 views

Why do the subexponential algoriths for the DLP not work for the ECDLP?

Elliptic curve cryptography is much more secure for the same parameters because attacks that work on the DLP do not work on the ECDLP. Why do the attacks fail in the latter case?
3
votes
2answers
241 views

Why are recomended RSA key lengths so high? [duplicate]

I was checking for authoritative sources to back up my recommendation of a minimum RSA key length of 1024 and was shocked to find that NIST 800-56Br1 and FIPS 186-4 both recommend at least 2048 bits ...
3
votes
2answers
292 views

How to calculate key size of a security algorithm?

There are lots of security algorithms. One of the way to measure security of a cryptography algorithm is to find out its key size. There are many key size of a single algorithm. ECC (Elliptic ...
3
votes
1answer
170 views

RSA private key finding method

Bob uses RSA with $p=83$ and $q=103$. His public key is $e=445$. Alice claims that she can calculate Bob's private key without using the definition $d=e^{−1}\bmod φ(n)$? But how?
3
votes
1answer
735 views

Is this DIY remote lock protocol secure?

I need your advice on following scheme of exchange protocol between remote lock and key. I'm planning to use following algorithm: Key generates unique value that never repeats (in reality it's just ...
3
votes
1answer
194 views

Difference between Pseudo Mersenne primes and Generalized Mersenne primes

The field prime numbers $p$ proposed by the NIST standards are referred to as Generalized Mersenne prime numbers [1] and as Pseudo Mersenne prime numbers [2]. Is there a difference between Pseudo ...
3
votes
1answer
70 views

Faster alternative to HKDF

HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ...
3
votes
2answers
65 views

(Non-) Perfect Secrecy of Vernam Cipher Using $E(m) = m \oplus k \oplus \operatorname{rev}(k)$

Given the cipher $$E(k, m) = m \oplus k \oplus \operatorname{rev}(k)$$ where $\operatorname{rev}(k)$ is the reversed binary of $k$, how would one prove that the cipher is not perfectly secret. I ...
3
votes
1answer
70 views

Is it secure to use hexadecimal data for IV instead of raw binary?

Is it safe and secure to use a function like bin2hex (which converts binary data to hexadecimal) on the binary output of functions like ...
3
votes
1answer
170 views

Checking the integrity of RSA public key

Let's say I need to verify a digital signature and the public key is stored in untrusted storage which I need to fetch before I verify the digital signature. However, I can store the cryptographic ...
3
votes
1answer
412 views

ECC keys vulnerable to brute force attack?

I have started learning about Elliptic curve cryptography. Since the key size required in ECC is relatively lesser than the key size in RSA to provide the same amount of strong encryptions, I wonder ...
3
votes
1answer
134 views

Relationship between exponent and modulus in RSA (as RSA properties as listed in X.509)

In one of my assignments, I had the following question (Please read on. Not a homework assignment :) ): X.509 (1998 version) lists properties that RSA keys must satisfy to be secure. One such ...
3
votes
1answer
215 views

HMAC-SHA256 on large data files

I currently need to encrypt large files (video, over 6 Gbytes) for our customers. To ensure authenticity and integrity, we chose HMAC-256 as we already use it in our internal messaging system. But ...
3
votes
1answer
99 views

Define “cryptographer”

I often encounter the phrase "I am not a cryptographer". Is there a generally accepted definition for who is a cryptographer? What qualifications would be expected? For instance, should that person ...
3
votes
1answer
87 views

Implementing 5 modes of operation with a hash function

Is it possible to implement any of the 5 modes of operation (ECB, CBC, OFB, CFB, CTR) with a hash function?
3
votes
2answers
330 views

Definition of authenticity

I came across various definitions of what authenticity means in cryptography. I would like to know which one is correct. The first definition - the one I always used - is the following: Data ...

15 30 50 per page