1
vote
1answer
172 views

Digital Certificate Chain Verification

Does a certificate contain the complete chain of all certificates up to the trusted root certificate, or does the program that verifies certificates have to fetch each parent certificate individually ...
3
votes
3answers
241 views

Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?

Consider a communication channel that needs to be secure (Encryption can not use full "volume" encryption, since future messages are not known). Would it be better to only transmit encrypted ...
3
votes
1answer
744 views

AES CCM vs CCMP

Are the terms AES CCM and AES CCMP are equivalent, or is there any technical differences between the two?
1
vote
1answer
108 views

MD5 pre-fixing with an unkown postfix

Is the MD5 prefixing attack still valuable to an attacker if he doesn't know the postfix of the string? For instance, what if the following sanity check was being used: ...
10
votes
2answers
1k views

Is using a predictable IV with CFB mode safe or not?

While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine): "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
1
vote
2answers
173 views

homomorphic encryption special case of multi party computation?

I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ...
6
votes
1answer
337 views

Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
2
votes
3answers
979 views

What is the length of an RSA signature?

Is it the same as the bits of the key (So a 2048 bit system will yield a 2048 bit signature)? At most as the key? Or something else entirely?
4
votes
4answers
478 views

Which block cipher modes of operation allow a predictable IV?

Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique ...
3
votes
2answers
671 views

Why can't the IV be predictable when its said it doesn't need to be a secret?

I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should ...
4
votes
2answers
313 views

Cryptographic GUID?

I need a GUID. Really just any number that is likely to be unique. However I prefer not to leak time and other things as a GUID may leak. What should i use as a cryptographic replacement? I was ...
1
vote
1answer
56 views

Design question for a service that signs messages on behalf of a user

I'm working on a messaging service that lets users author messages and have them signed with an RSA key. The key is used for identity purposes only and can be revoked, so compromising the private key ...
5
votes
2answers
242 views

Do MD5's weaknesses affect Oplop?

Oplop is an algorithm that generates account-specific passwords from a master password and user-chosen nickname (typically username@domain). From the website: Concatenate the master password with ...
3
votes
4answers
3k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
0
votes
2answers
175 views

Is stretching hash several times basically the same as bcrypt?

As I understand it, the main advantage of bcrypt is stretching so it becomes slower to crack overtime. But, is using a "good enough" algorithm (e.g., SHA-2 family) then stretching until it's slow ...
3
votes
2answers
2k views

Secure private key storage

I'm developing application in Java that has to store RSA keys in software for foreseeable future (that is, at least 10 years). The two most common standards of storing private keys are PKCS12 and JKS ...
2
votes
5answers
631 views

Approach towards anonymous e-voting

I want to implement an internet-based e-voting system. Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy ...
-1
votes
1answer
150 views

Why is 2 the inverse of 10?

I have one question about the ECDSA signature scheme. When Bob wants to send a message to Alice that is to be signed she makes following things (with for example $A = (5,1)$, $d=7$, $q=19$). ...
6
votes
1answer
137 views

How to turn adversary against encryption of zeroes into adversary against random bits?

I recently read the article Nonce-Based Symmetric Encryption by Rogaway, where he presents two different notions of indistinguishability, which he calls ind$ and ind, respectively. Here's the ...
0
votes
1answer
84 views

inverse of 985 mod(φ60131)

Alright Ive been working on this one for a while I found φ(60131) to be 97294 ½(60131+60131(5)^.5) = 97294 then I worked through the GCD ...
4
votes
2answers
173 views

How long does it take to extract a key from a FIPS-140 Level 2 device?

How long does it take to extract a key from a FIPS-140 Level 2 device? What records are there of successful extraction? How much did the first extraction from a given device cost? How much would a ...
3
votes
3answers
264 views

Existing works on pre-computing ElGamal ephermal keys

I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
2
votes
1answer
144 views

How is the EAX-mode used in EAP-PSK (RFC 4764)?

According to the specification of RFC 4764, contents in EAP's third message and fourth message are required to be encrypted by AES-128 in EAX mode (also called protected channel). In RFC 4764, the ...
0
votes
1answer
250 views

Polynomial for secure communication

Can we use a polynomial $P(x)$ to securely communicate ? For example Alice & Bob agree on a degree of a polynomial. The value $x$ & the coeficients are generated from a seed using a hash ...
10
votes
2answers
323 views

Is RC4 a problem for password-based authentication?

This is a follow-up question to Does TLS use RC4-drop[n]?. As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that ...
1
vote
1answer
103 views

Random decomposition of symmetric key

Considering a symmetric cipher (i.e : AES in counter mode), is it possible for any given key to be randomly decomposed into other keys without knowing the message or the ciphertext, such as : ...
2
votes
2answers
265 views

Is it possible to match encrypted documents using user-defined search terms?

Suppose I am storing a number of encrypted documents in a database. I would like to make it possible to identify the subset of documents whose contents match user-specified search terms without a) ...
14
votes
2answers
1k views

Blum Blum Shub vs. AES-CTR or other CSPRNGs

Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
2
votes
1answer
181 views

Aes encryption -The relevance of static matrix in mixcolumns operation

Can someone explain to me the relevance of the static matrix used for the mixcolumns operation in aes encryption.i.e the relevance of why the byte is multiplied by 2 + next byte multiplied by 3 + next ...
7
votes
1answer
809 views

Is a second preimage attack on MD5 feasible?

What's the practical status of MD5 w.r.t. second-preimage? Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
1
vote
3answers
103 views

MISTY1 Implementation error

I am trying to implement MISTY1. It's RFC, RFC2994, contains psuedocode that I basically copy and pasted into Code::Blocks. However, I managed to mess that up somehow. After 2 days, I still have not ...
1
vote
1answer
496 views

How to jusify {e,n} is a valid RSA public key?

I have a two set of key {36,77} and {50,117}, How can validate if it is a valid RSA public keys? Is there any simple method?
2
votes
1answer
152 views

What are the dangers of predictable (repeated) plaintext structures?

When using a "good", modern cipher (specifically one that provides ciphertext indistinguishability), is it a problem at all if there is some well-known structure in all plaintexts? For example, ...
5
votes
2answers
323 views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
2
votes
2answers
179 views

Stream cipher malleability

Considering a stream cipher that produces a ciphertext $c$ from a message $m$ and a key $k$ is it possible to apply operations (multiplication and/or addition) directly to $c$ without knowing the key ...
2
votes
0answers
56 views

Are there any systems like SDSI / SPKI that are currently being developed?

SPKI / SDSI look interesting but appear to have fizzled out and died. Are there any modern competitors?
5
votes
3answers
781 views

Relative security of a Vigenère cipher

Within a closed computer network, I am ciphering some plaintext data as an added security measure. This is below several other layers of protection. For various technical reasons, I am restricted to ...
5
votes
1answer
316 views

Does TLS use RC4-drop[n]?

According to many sources, the first few (n) bytes of the RC4 keystream are strongly biased, and therefore should be discarded before using the keystream to encrypt anything; this precaution is ...
1
vote
2answers
122 views

Practical implementations of Multiparty computations [closed]

Are there any practical implementations and or software platforms to prototype applications based on MPC ?
2
votes
1answer
173 views
6
votes
1answer
299 views

Why x00 is usually avoided in salt?

In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, ...
2
votes
1answer
158 views

How many different keystreams can I produce with AES in Counter Mode?

I'm using a 64-bit nonce (incremented between the streams) and a 64-bit counter (incremented within a stream) for AES in CTR mode. How many different key streams can I produce with this setup?
3
votes
1answer
156 views

Encrypt array of int for individual retrieval

I have limited exposure to cryptographic terminology, so please bear with me. My end goal is to encrypt integer IDs, before transmitting them to a web client in a list of search results, in a way ...
0
votes
1answer
363 views

SSTP MSCHAP-V2 Authentication before SSL or after SSL Session

So with the recent news that there's a lovely new tool to crack MSChapV2 packets. So the question I have is on a SSTP Connection is the MSChapv2 handshake encrypted pre SSL setup or post. Obviously ...
3
votes
1answer
118 views

Why do we need extra hashing if we could use simpler scheme?

Lets say that we use init vector IV, key K and HMAC key H. Message is M. Mode of operation is CBC !!! We usually encrypt as this ...
3
votes
1answer
222 views

What is the name of this kind of protocol

There is a communication protocol that I believe creates the equivalent of a one time pad, with the downside that the secret message must be transferred multiple times. The protocol is so simple that ...
1
vote
1answer
231 views

Are there any multiparty homomorphic encryption schemes?

Are there any multiparty homomorphic encryption schemes ? Most of the literature is about two party schemes . Is there any generalization made for n party ?
1
vote
1answer
503 views

What would be the most effective way to brute force a 16 char AES key?

I have a file that is encrypted in AES using a 16 char string. The string is (a-zA-Z0-9) and .,?!. Also, it only contains words ...
5
votes
1answer
700 views

How do I calculate CRC32 mathematically?

I want to calcuate the CRC32 algorithm using polynomials directly but I don't know how. I found the generating polynomial listed here https://en.wikipedia.org/wiki/Cyclic_redundancy_check. This ...
2
votes
6answers
838 views

Why does ROT13 provide no cryptographic security?

I can understand that ROT13 is not secure for obvious reasons, but I'm looking for the theoretical answer. Wikipedia says "The algorithm provides no cryptographic security.." What does it mean to ...

15 30 50 per page