2
votes
2answers
355 views

How can I add more rounds to AES?

I'd like to understand a bit more about the AES key schedule if anyone would mind explaining that. For instance, why is the way the schedule generated (with recursive xors and occasional ...
5
votes
1answer
717 views

Get RSA PlainText without Knowing Private Key

If I have an algorithm,RSA-Crack(), that, for a given RSA public key (n,e), is able to decrypt 1% of the messages encrypted with that key (without knowledge of the corresponding private key).Can there ...
1
vote
2answers
226 views

Non-Interactive Zero-Knowledge-Proof for discret Logarithm?

In a Non-Interactive $Zero-Knowledge-Proof$, the challenge is chosen by the Prover. I am trying to find a Non-Interactive Zero-Knowledge-Proof based on the following problem: DISCRETE LOGARITHM ...
1
vote
1answer
302 views

AES Secure key generation and storage

I have a client-server application, which is transferring data between its components in a secure way. I currently use AES algorithm with CBC mode to transfer data and file. This is the scenario: ...
1
vote
1answer
145 views

Comparing plaintext to contents of ciphertext

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer? Encrypt the plaintext and compare ...
5
votes
4answers
285 views

How is it possible to parallelize a hashing function to crack an iteratively hashed password?

Suppose I have an algorithm that relies on multiple iterations of a hash function like SHA1 to slow down an attacker trying to bruteforce a hash. ...
1
vote
2answers
465 views

AES key padding

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes? Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
4
votes
1answer
416 views

In RSA encryption, does the value of e need to be random?

I am a novice programmer and am just finishing up an RSA encryption program that I am writing for practice. Currently I have the program generate a relatively small random value for the public key e. ...
4
votes
2answers
241 views

AES encrypting multiple files

So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should ...
0
votes
0answers
135 views

Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
6
votes
1answer
605 views

RSA-OAEP Input Parameters

When creating padding for RSA using OAEP, a message is prepared as follows: Hash(Input Parameter) || Zeros || 1 || Message My question is, what should the Input ...
5
votes
2answers
190 views

Is there any research on the problem of making a number more memorable to humans?

Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that ...
1
vote
1answer
472 views

Weakness in using only one RSA key pair for two-way communication?

In Alice/Bob/Cindy terms (EDIT: and with a little more detail): Alice and Bob have each securely obtained one key of an RSA keypair from a trusted third party. Alice has one key ($e$ and $n$), Bob ...
0
votes
2answers
136 views

Bent Combining Functions

Bent functions are boolean functions with maximum nonlinearity and are widely studied for their potential applications in cryptography. Lets say you wanted to use a simple two input AND gate as a ...
1
vote
1answer
91 views

Ensuring integrity of a client side script

I want a script that is running on the client to compute a collision resistant hash and send it to a server. I need to ensure that the script which performs this hash is not altered in any malicious ...
1
vote
3answers
321 views

Can we construct fully homomorphic encryption scheme based on non-circuit approach?

At present, all FHE scheme are be constructed based on circuit approach. Can we construct fully homomorphic encryption scheme based on non-circuit approach? Is Polly cracker non-circuit approach ?
2
votes
1answer
256 views

What's a good P to use in ElGamal key generation?

I need to generate a 1024 bit ElGamal key on Android, and key generation takes forever (~10 minutes on a Galaxy Nexus), I suspect because it take so long to generate a safe prime. Is it dangerous for ...
3
votes
1answer
147 views

SSL Key Exchange

I read briefly over the TSL/SSL key exchange protocol. I have to wonder about the whole pre-master-key procedure. Wouldn't it be sufficient if the client or server encrypted a generated session key ...
4
votes
4answers
860 views

How can I validate a hashed password if all I have is another hash?

The Scenario I have a client-side web application that bounces requests against a server-side API. For the sake of simplicity, every request must pass a username and password. This is similar to ...
4
votes
1answer
102 views

Security implications of using constant string to verify AES key?

I know that you can use for example CBC-MAC to verify data integrity and thus the password upon decryption. But would there be security implications of just adding a constant string to the plaintext ...
2
votes
2answers
339 views

Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?

I read the paper Cache-timing attacks on AES (by Daniel J. Bernstein), but I don't seem to understand everything. The author dedicates a long section on how to prevent the OS to interrupt an AES ...
4
votes
1answer
549 views

AES timing attacks

I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ...
4
votes
1answer
332 views

Exhausting the entropy of a hash function

In the case of password storage, consider the following: I have an idea that one can exhaust the entropy of input to the MD5 function by using a 128 bit random value as the password (indeed, any hash ...
5
votes
3answers
1k views

Why is the IV passed in the clear when it can be easily encrypted?

The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ...
2
votes
3answers
207 views

Message authentication codes construction

I was reading the paper $[1]$ and came across the scheme that I show below. While I understand the scheme well, I don't understand why they prepend a 0 to the block containing $r$ and a 1 to all other ...
2
votes
3answers
264 views

Safety of DSA key parameters sharing

I'm looking for a solution to use in a context where I need to be able to generate new asymmetric key pairs quickly (using a widely recognized algorithm, and EC-DSA is not applicable). It sounds like ...
3
votes
1answer
1k views

Constructing RSA private key, given public key

As part of a puzzle I was given an RSA 256-bit public key and an encrypted message. The key itself is very weak, having exponent e = 65537 and modulus N = ...
1
vote
2answers
181 views

What cipher mode is suitable for independantly decryptable short messages?

I'm building a small VoIP client which transmits encrypted audio data via UDP, and some packet loss is expected, so each packet will need to be decrypted separately even if others in the stream don't ...
3
votes
2answers
147 views

Is there an advantage to storing keys split between several hashes?

I have a question about the way to store a key or password that was used for encryption, so that the application can check if the user put in the right key for decryption. If I make a mistake, please ...
10
votes
2answers
381 views

How should one implement a delegated shared trust protocol?

Consider the following (probably naive) scenario. Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
5
votes
2answers
510 views

Does a trace of SSL packets provide a proof of data authenticity?

I'm wondering if it would make sense to record a whole HTTPS session, publish its encryption keys and present it to third parties as a proof that this particular data was sent by a given server ...
3
votes
1answer
162 views

Why does Schnorr's Digital Signature scheme necessitate two prime numbers?

One of the necessary components to the Schnorr Digital Signature scheme is a pair of prime numbers p and q such that q divides p-1. However, there is never a modular inverse taken of q so why is there ...
2
votes
0answers
158 views

Does Keccak have an eTCR mode?

On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3): ...
0
votes
1answer
383 views

Learning cryptography using a FPGA

I have a FPGA and am curious what cryptographic applications I can use with it. I'm just a hobbyist / security researcher and not a professional cryptographer. Since I'm creating my own curriculum, ...
0
votes
2answers
284 views

Is the AES encryption scheme CPA secure?

Give a 256 bit key space and 128 message space would AES block cipher as the encryption scheme be CPA secure?
2
votes
1answer
1k views

Brute force attack on DES + property of DES

In a brute force attack on DES, it seems to me that one plaintext-ciphertext pair suffices to launch the attack. (I.e. suppose we are given a message $x$ and a ciphertext $c$ such that $DES_k ( x ) = ...
3
votes
2answers
288 views

Looking for examples for “proof by reduction”

Im looking for examples for a proof by reduction. For example: Let $A=(Gen, H)$ be a hash function. We define a new Hash function $A'=(Gen',H')$ with Gen=Gen' $H'_s(x)=H_s(H_s(x))$ It should be ...
4
votes
2answers
231 views

Is storing the hash of a key together with ciphertext encrypted with that key secure?

Is it secure to store the hash of a symmetric cipher key along with data encrypted with that key? Are there any circumstances or algorithms in which this combination could lead to potential weaknesses ...
4
votes
1answer
219 views

Questions about William's p+1

First off, if you're doing William's p+1 test, then also doing Pollard's p-1 is redundant, since the p+1 test covers both cases, right? Second, why is the recurrence $V_{n+1} = aV_n - V_{n-1}$ used? ...
4
votes
2answers
320 views

Can I use guids / uuids as counters for key derivation?

I have a 512 bit master key, and 128 bit unique identifiers. I'm going to derive 256 bit keys to for use with deterministic and block ciphers. For reference, The KDF I'm going to use is Hash( C | ...
1
vote
2answers
102 views

What can a master password also be called?

When having a company computer that is full disk encrypted, it is common that the boss have a master password / backdoor, so the data always can be decrypted. I have heard some call this for "scrow" ...
1
vote
2answers
149 views

Pseudorandom generator and AE-secure encryption

How would you answer the following question (i have to translate it from german): The existence of a pseudorandom generator implies the existence of a AE-Secure encryption scheme (AE = authenticated ...
13
votes
3answers
4k views

Should we sign-then-encrypt, or encrypt-then-sign?

We often want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
10
votes
3answers
373 views

How to construct a good PRF from a block cipher?

We want to explicitly construct a good (as tentatively defined below) Pseudo-Random Function $F$ with $b$-bit input and output, from (preferably just) one Pseudo-Random Permutation $E$ of $b$-bit, as ...
-3
votes
3answers
255 views

Why shouldn't one build a MAC by XORing multiple message blocks?

I found this simple proposal for a MAC algorithm: Let the MAC of message M (which consists of message blocks $M_1$,$M_2$, ..., $M_n$) be the AES encryption with key K of the XOR of all the ...
3
votes
2answers
179 views

Proof that a function constructed from a PRP is, or is not a PRF?

Let $E$ be a family of Pseudo-Random Permutations of $b$ bits, with $E_K$ indistinguishable from random permutation with effort less than $O(2^b)$, easily computable as well as the inverse ...
6
votes
2answers
189 views

Will varying plaintext compensate for a fixed initialisation vector?

This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest. I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
4
votes
1answer
354 views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
0
votes
0answers
42 views

NIST Standard for Advanced Encryption Standard Algorithm [duplicate]

Possible Duplicate: Advantage of AES(Rijndael) over Twofish and Serpent What is the reason of NIST why Rijndael choose as the Advanced Encryption Standard
0
votes
1answer
336 views

detecting ROT13/base64 encryption

Is there anyway to detect that a cipher is encrypted with ROT13 Or Base64 without decrypting it using the algorithm and check that the result means (works)? I mean does an algorithm exists that test ...

15 30 50 per page