6
votes
3answers
492 views

How useful is NIST's Randomness Beacon for cryptographic use?

NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
3
votes
1answer
603 views

LFSR get output from characteristic polynomial?

Say you have a characteristic polynomial of an LFSR: $$f(X) = X^4 + X^3 + 1$$ How can I use this function f to get the output of the LFSR, given some initial state? Obviously I can create the LFSR ...
4
votes
1answer
153 views

Cryptanalysis of AES on SSD with TRIM enabled

Attack scenario: SSD physically retrieved from a computer that is turned off. The entire disk is encrypted with AES 256-bit (GNU/Linux, LUKS). The SSD has had TRIM enabled for several years and the ...
0
votes
1answer
217 views

AES CBC MAC splicing attack

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is: given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, ...
2
votes
1answer
203 views

Is there a time-space tradeoff attack for breaking symmetrical cryptos?

Is there any known techniques for using time-space tradeoff for speeding up symmetrical crypto breaking? Kind of like rainbow tables speed up breaking hashes by using huge precomputed tables. Is ...
4
votes
4answers
454 views

Efficient Symmetric Mutual Entity Authentication Protocol

I am looking for an Authentication protocol for access control. Let's say both the client and server would share a symmetric secret (256 bit key) and the client wants to access the server. Access ...
3
votes
2answers
309 views

Can a “pattern” in a series of passwords be detected from their hashes (and maybe a single raw password)?

Let's say I'm a lazy user of a system with annoyingly frequent password change policies. I may have a "good" password I used initially that is only used for this system but since I have to change it ...
4
votes
2answers
1k views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is ...
-2
votes
1answer
571 views

How to calculate cycles per byte [closed]

Sometimes, websites and scientific papers that introduce and/or handle cryptographic algorithms also provide speed-analysis and tables comparing the individual performance of cryptographic ...
1
vote
0answers
125 views

Challenge–response authentication which can be done in head?

Say we have door where you have to say a password to pass. If theres someone standing nearby he would hear the password and could also use it. So therefore the doorman gives you a different number ...
8
votes
1answer
2k views

What is a tweakable block cipher?

Pretty simple question - but I can't seem to find much information about it. What exactly is a tweakable block cipher? How do they differ from traditional block ciphers? What is the 'tweak'? Is it ...
1
vote
1answer
199 views

Hash function and outputs of arbitrary length

I know that Skein can output a digest of arbitrary size, with a kind of counter mode. Blocks of the resulting digest can be computed in parallel. What about Keccak ? I know that a sponge function can ...
4
votes
2answers
643 views

How secure is the AES master key if Round Keys are found

If an attacker finds some round key of AES256, is it possible to find the master key? How safe is the master key if an attackers finds multiple round keys?
3
votes
1answer
225 views

Proofs by reduction and times of adversaries

I have some difficulties to understand, when we construct a reduction, how we determine the time for the constructed adversary to break a target security property. In general these details are not ...
2
votes
2answers
190 views

Pseudorandom functions

The usual case to distinguish a pseudorandom function from a random function is to assume that the adversary can choose the plaintext blocks. Is there another case (game) in which the adversary can ...
3
votes
2answers
260 views

Is prime regeneration necessary for every new session using a Diffie-Hellman key exchange?

As I understand it, bruteforcing a Diffie-Hellman generated secret key takes $P-1$ attempts to crack the shared secret, where $P$ is a very large prime used for modulus. If your $P$ is quite large, ...
4
votes
1answer
158 views

How can I tell how many bits of security a secure hash function has?

How can I tell how many bits of security a secure hash function has? For example, how would I calculate or tell how many bits of security a secure hash function with 160 bits output would have? ...
3
votes
1answer
109 views

Does re-iterate AES128 with different keys gives any benefict?

I'm not cryptography expert (well, I'm here after all!) but I have this doubt… Suppose I have 2 different keys: secretkey1 secretkey2 And a plain text: myReallySecretPlainText If I use AES128 ...
5
votes
1answer
319 views

I need a 64-bit cryptographic hash for 96 bits of data

I have a situation in which I need to combine a 32-bit datum, G, and a 64-bit datum, I, to produce a 64-bit datum. No two ...
-1
votes
1answer
107 views

Why is it said that if we know few bits of pseudo random sequence we can predict the whole of it?

I am new to this cryptography and in the source from which i study it is said that if we know the first few bits of a pseudo random sequence we can predict the whole of it.How is it possible? The ...
3
votes
2answers
416 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
1
vote
0answers
39 views

Distributed authentication in low trust environment

I would like to inquire if there is any Method to achieve the following: There is a list $L$ of $n$ entities that are allowed to perform a certain action. $L$ is cryptographically signed by some ...
3
votes
2answers
211 views

Is a random oracle controled by the challenger?

When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger? What if the Hash is only used by the adversary?
10
votes
4answers
10k views

What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not. Can anyone explain to me how ...
2
votes
1answer
585 views

Is it true that for RSA with no padding, the length of data must be equal to the length of key?

The question pertains not in terms of security but computing operational functionality, as it how the computation is done. Is it true that for RSA with no padding, the length of data must be equal to ...
3
votes
1answer
193 views

counting points on elliptic curve

Given an elliptic curve with equation $y^2=x^3+ax+b$, and i want to find the number of points $(a,b)\in E(\mathbb{F}_p)$ where the polynomial has repeated roots, how do i do it? I have an intuition it ...
4
votes
1answer
246 views

Can the AES encryption and decryption algorithms be described as a polynomial for a specific key?

AES is a block cipher that consists of non-linear and linear parts to provide the Shannon requirements of confusion and diffusion respectively. The linear parts can for sure be described as a ...
2
votes
1answer
108 views

Cryptographic Arithmetic Toolbox/Software [closed]

This term I have many cryptography courses treating finite fields. I was wondering if there is any good software that could help doing basic operations in galois fields etc. I already googled but ...
3
votes
2answers
167 views

One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on ...
3
votes
2answers
136 views

Choice of reduction polynomial in Whirlpool's internal cipher

Whirlpool is an interesting little hash function in the Miyaguchi-Preneel family. In my mind, it's most interesting feature is the design of internal cipher W, where the distinction between key and ...
10
votes
1answer
1k views

SHA-256: (Probabilistic?) partial preimage possible?

Currently busying myself with the Bitcoin "mining" algorithm, I am wondering if the process really cannot be simplified. For reference, the algorithm is basically SHA-256d: $success := SHA256( ...
1
vote
1answer
58 views

How to invalidate decryption key in multi user model?

I want to develop an application that will allow a user to create a public/private key pair, and encrypt it symmetrically with a key such that once they enter their password, they will be able to ...
1
vote
1answer
86 views

What is the idea behind hashing the QueryString in OAuth?

In OAuth 1.0a and 2.0 using MAC Authorization, I need to generate a hash of all the QueryString Parameters, which requires normalization (alphabetical ordering) of them. I'm trying to understand what ...
7
votes
1answer
2k views

Generating Random Primes

Although this has been extensively discussed around here, I'm curious whether my approach makes sense, or I should just stick to "the standard version". I'm implementing some homomorphic encryption ...
5
votes
1answer
316 views

How are trapdoor functions developed/found and where can I find existing ones?

Trapdoor functions are a fundamental part of public key cryptography. An example of the most common trapdoor is Prime Factorization, used in cryptosystems such as RSA How are these trapdoor ...
1
vote
0answers
54 views

1-1 trapdoor function mapping the set of $n$-bit numbers to themselves

I am looking for a trapdoor one-to-one function $f : \{0,1\}^n \rightarrow \{0,1\}^n$ (that is, mapping the set of $n$ bit numbers 1-1 onto itself [any $n$ is OK]). I was considering the use of ...
4
votes
1answer
585 views

Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?

The PKCS #1 v1.5 padding scheme for RSA has been proven to have some weakness when used with TLS for example. My question is: is it still secure under the following conditions? Alice sends a ...
1
vote
0answers
52 views

Client puzzle using hash

When a server is under attack, it send the client the following data: Nonce - a byte array of Y length Hash - the hash digest of the puzzle solution The client has to find X such as ...
2
votes
1answer
158 views

Do any one-key-of-many cryptographic schemes exist?

I'm pretty sure I understand how public/private key cryptography works. Anybody can encrypt a message using a well-known public key, but only the person who holds the private key can decrypt it. My ...
0
votes
1answer
125 views

Why is DDH not hard over $\mathbb{Z}^*_p$?

Why is Diffie-Hellman key exchange not hard over $\mathbb{Z}^{*}_p$?
1
vote
1answer
101 views

Prove that two MACs with incremendal PRF application are not secure

How do I prove the following MACs are insecure?                                                        1                                                                                   2
1
vote
0answers
78 views

Parallel-resistant proof-of-work scheme without hidden knowledge

Follow-up to: Parallel-resistant proof-of-work scheme? Is there a proof-of-work scheme that: can only be solved serially; given the solution, can be verified in minimal time; deterministically ...
2
votes
1answer
485 views

Question regarding multiple SHA-256 rounds on a Bitcoin Brain Wallet passphrase…

I am attempting to come up with a way of memorizing a seed that could lead to any number of brain wallets for bitcoin. I need multiple wallets because a) I don't want all my eggs in one basket, and ...
1
vote
4answers
689 views

Messages exchanged between Bob Alice are encrypted safe?

Can you help me understand the following reasoning? If Alice sends Bob a message and that message is encrypted with two keys simultaneously: a symmetric key (Ks) and Bob's public key. The symmetric ...
8
votes
3answers
1k views

SHA-224 Purpose

One of the new features of Java 8 is the SHA-224 message digest. What is the use case for having a 224-bit-length hash?
1
vote
2answers
182 views

hill cipher encryption way 1x3 plaintext matrix

Can someone help me with a Hill cipher? When do I have to use: 1x3 plain text matrix (p1, p2, p3) * 3x3 key matrix 3x3 key matrix * 3x1 plain text matrix Or they are both correct? I tried to ...
1
vote
1answer
142 views

What is difference among eavesdropper attack, multiple message attack and CPA attack?

What is/are difference(s) among eavesdropper attack, multiple message attack and CPA attack in context of symmetric key encryption? I only know that in eavesdropper attack there is an adversary ...
0
votes
1answer
102 views

Hash Function to get same value for different messages [duplicate]

I am studying a function where I found the some hash properties. Hash functions: Given a code c is computationally infeasible to find m such that ...
17
votes
3answers
1k views

How secure is the Bitcoin protocol?

Are there any evidence (other than not being cracked so far) that the Bitcoin protocol is secure? "How secure" is it? (I realize that this might not qualify as a meaningful question - feel free to ...
8
votes
2answers
6k views

How does a padding oracle attack work?

I am unsure of how a padding oracle attack works. What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines. Can anyone explain this?

15 30 50 per page