4
votes
0answers
66 views

Additive homomorphic encryption scheme without change in operator

I'm looking for an additive homomorphic encryption that the addition operator (+) in its plaintext space be the same as addition operator in its ciphertext space. (Schemes like Paillier do addition in ...
3
votes
1answer
318 views

A fast non-cryptographic hash function that is “strong enough”?

I'm designing a simple one-time-password mechanism for authentication against a possibly-insecure server - i.e. I don't want to use symmetric shared secrets. The first idea that came into mind was ...
3
votes
2answers
1k views

Generate a unique 64 bit numeric database key without collisions at $2^{32}$ birthday threshold?

What is the best way to generate a unique 64 bit numeric database key from a string? For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...
2
votes
1answer
94 views

Does SipHash have 64 bit (second) preimage security?

I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere. I think it should be 64 bits, but I'd feel safer if somebody who has ...
8
votes
1answer
2k views

Knowing pre-encryption data, can we find the private key CryptoLocker used?

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files. If we know ...
1
vote
1answer
87 views

How can I handle the situation if key size is less than 64 bits in DES?

If the data is not a multiple of 64 bits, then I can use padding. I know that it is not secure. But if the key is less than or more than 64 bits, should I ask the user to enter the key again, or ...
2
votes
3answers
73 views

Digital signature algorithms within the European Union

I've just noticed that US NIST has accepted DSA as a digital signature standard. Does the European Union have a similar standard, specifying an algorithm to use when digitally signing messages? I ...
0
votes
1answer
50 views
0
votes
0answers
96 views

Envelope Encryption with asymmetric keys vs KMS

In Envelope encryption a symmetric secret key is used to sign the data and then another key is used to encrypt the secret to produce an encrypted secret key. The encrypted messages is packaged with ...
2
votes
1answer
89 views

How to encrypt/decrypt data in an SPI BIOS FLASH

I need some info/suggestions about the cryptographic algorithm that make me sure that the executed bios by the CPU is an authenticated bios. The check has to be performed by a FPGA. I have SPI Flash ...
2
votes
2answers
1k views
0
votes
0answers
37 views

Is double encryption using AES using different key lengths (128 bit and then 256 bit) vulnerable? [duplicate]

I know that AES 256 bit is far more than enough to secure a file. I just want to know if there are any vulnerabilities or known attacks which can make such this combination less secure "double ...
0
votes
2answers
67 views

OTP same message encrypted twice (with different keys)

Lets say we have a message $m$ that we encrypt with two keys $k_1, k_2$ such that $k_1 \ne k_2$. This will produce two ciphertexts $c_1, c_2$ such that $c_1 = m \oplus k_1, c_2 = m \oplus k_2$. The ...
6
votes
1answer
1k views

CKM_RSA_PKCS vs CKM_RSA_X_509 mechanisms in PKCS#11

What is the exact difference between the CKM_RSA_PKCS and CKM_RSA_X_509 mechanisms in the PKCS#11 v2.20 specification (Please ...
5
votes
4answers
5k views

Diffie-Hellman and man-in-the-middle attacks

See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman? How do we combat this? I have two questions: Is one solution for both Alice and Bob ...
1
vote
1answer
57 views

Why an upside down path on the evaluation of branching program on encrypted data?

Suggested by Ricky Demer in this post, I am reading the paper "Evaluating Branching Programs on Encrypted Data"(TCC 2007), which uses one-round strong OT protocol to implement homomorphic evaluation ...
3
votes
1answer
543 views

Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...
2
votes
1answer
236 views

Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
0
votes
1answer
45 views

Are there any encryption schemes that enable to permute homomorphically?

According to the Barrington's theorem, any circuit in NC1 can be converted to a branching program, whose main operation is the composition of permutations (along with the choosing of permutations ...
2
votes
1answer
156 views

Why the $IV$ used in Merkle-Damgard has to be fixed to a specific value?

I just can't figure out why on earth the $IV$ in Merkle-Damgard has to be fixed (that's what the Katz-Lindell book says)? Because even if you choose it randomly from say $\{{0,1}\}^n$ then the ...
15
votes
3answers
2k views

Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?

I understand the need for padding in MD5. But why do we append the message length to the padding? I heard it strengthens the hash but how? Please provide an example if possible and how it applies to ...
4
votes
2answers
74 views

Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?

I recentely asked "IND-CCA1 RSA padding?" about whether there is a IND-CCA1 secure variant of RSA. The original version of the question also allowed usage of ECC which would allow usage of ElGamal, ...
0
votes
1answer
41 views

Request for review: known plaintext mitigation by rotation and xor encoding

When using structured data inside a plaintext (such as gzip headers, xml, etc.) they generate known plaintext which may be useful in cracking the ciphertext. So I had these two ideas on how to make ...
1
vote
1answer
139 views

Modular reduction for NIST prime P256— understanding the data

I am working on a project where I need to implement elliptic curve cryptography, I am struggling from a long time in order to understand the working and the process. Modular finite field arithmetic, ...
29
votes
6answers
5k views

Is there a secure cryptosystem that can be performed mentally?

I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
3
votes
1answer
84 views

How to prove the hardness of Rabin's function?

I am unable to prove the following theorem: If for a $1/(\log(n))$ fraction of the quadratic residues $q\pmod n$ one could find a square root of $q$, then one could factor $n$ in random polynomial ...
0
votes
1answer
50 views

Probability of $D_k(a*k+b) =p$ for a PRP

I'm wondering what the probability of a PRP having numerous keys (say 3 or more) with the same simple idempotent, or near identity, function. For example, does there exist values of $p, a, b, x_1,$ ...
3
votes
0answers
69 views

P-Complete hashes, hashing to a larger set

Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
0
votes
0answers
21 views

Enhanced Security Services / CAdES for PKCS7 - multiple signers for SignerInfo's?

In RFC5652, Cryptographic Message Syntax (CMS), section 5.3. SignerInfo Type, there's a sid field that maps to this: ...
2
votes
1answer
87 views

Possible to determine equivalence of hash codes from different hashing functions?

Let $H_{1}(x)$, $H_{2}(x)$, ..., $H_{n}(x)$ be a list of $n$ secure one-way hash functions such that for a given input $x$ each $H_{i}(x) \neq H_{j}(x)$ when $i \neq j$. Give one hash function to ...
1
vote
0answers
83 views

Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
0
votes
0answers
38 views

RC4 via nonlinear mixer — sound?

We implemented a rc4 (ARC4) variant for creating a cryptographic stream - question is: Is this sound? (I'll give an example for 32 bit variant, though 64 bit/larger is possible) Algorithm is as ...
3
votes
1answer
173 views

Safety of AES ECB when used with openssl_seal function

I'm trying to use PHP to encrypt files with a public key. I'm using the function openssl_seal that "encrypts data by using RC4 with a randomly generated secret key." RC4 is considered unsafe so the ...
0
votes
3answers
118 views

Let $G$ be a PRG. Are the following $G'$ constructions based on $G$ necessarily PRGs?

$G$ is a PRG where $|G(s)| > 2 \cdot |s|$. $G'(s) = G(s0^{|s|})$. $G'(s) = G(s_1...s_{n/2})$, where $s = s_1...s_n$. My question here is whether my own proposed solutions are correct and do ...
1
vote
2answers
192 views

How to formally prove that a given hash construction is collision resistant or not?

Is there a precise procedure or strategy to follow in order to prove in a formal way the (not) collision-resistance of a certain given hash construction? I.e. let $H_1$ and $H_2$ be two hash ...
1
vote
1answer
89 views

Is there a standard for public key encrypting and signing short messages?

Some systems, that operate over flaky bearers, need to send signed, encrypted messages that are entirely self contained - i.e. send a single 300 byte UDP rather than have a 10Kb, two-way, certificate ...
0
votes
0answers
58 views

Question about OR operation in fully homomorphic encryption

This page (which won't let me post a comment, sadly!) describes how the original FHE paper by Craig Gentry describes FHE. (Other references to this stuff can be found on this question.) It mentions ...
3
votes
2answers
137 views

Combine two sha512 hashes to a single hash

Assume I have two data fragments: $Frag_1$ and $Frag_2$. I can build sha512 hashes the usual way with $SHA512(Frag_1)$ and $SHA512(Frag_2)$ and then hash the two fragments appended to each other: ...
1
vote
1answer
27 views

Diffie-Hellman in the wild

Say we have a public network and lots of peers. Each may need to communicate with another peer. Would there be any huge security issue to each peer making the the public part of their key openly ...
0
votes
3answers
220 views

zendo data size restrictions

zendo is a new mobile phone app which encrypts messages using a one-time pad: http://techcrunch.com/2015/03/24/one-time-pads-ride-again/ users have to meet in person and exchange a key via a qr ...
2
votes
0answers
41 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
5
votes
2answers
736 views

KCV and compatibility with block cipher modes of operation

There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ...
2
votes
1answer
100 views

Is a 256 bit HMAC-SHA256 key compromised if the tail is used for identification?

Using a truncated hash of a key seems to be a safe way to identify the key (i.e. key fingerprint), but what about truncating a key itself in the case of HMAC-SHA256? Example: ...
4
votes
3answers
120 views

How does the birthday paradox apply to random keys?

I'm developing a web app where I wish to use pseudorandom keys for items, perhaps akin to Imgur. I was thinking about how many combinations I need to reduce the chance of someone guessing any random ...
1
vote
1answer
64 views

Determine if encryption is safe against CPA

The following encryption scheme encrypts each block of length $n$ of the plaintext separately: $c_i = k_1 \oplus F(k_2 \oplus p_i)$ Where $F$ is a strong pseudo-random permutation (i.e. it is easy ...
2
votes
2answers
114 views

Digital Signature Attack

In a typical digital signature scheme in which in order to sign we compute: hash of the message: $h(m)$ resulting hash signed with the private key $[h(m)](private key)$ If there were a collision ...
4
votes
3answers
629 views

Combining several symmetric ciphers using XOR

I have seen a talk by Rüdiger Weis, where he says that you can combine two symmetric ciphers using XOR. According to him, that has the effect that its sufficient if only one of the ciphers is secure. ...
3
votes
1answer
110 views

SHA512 vs HKDF key expansion

I'm working on a secure file storage server. This server allows users to upload and download files based on a "seed". This "seed" is a 128-bit value. From this 128-bit seed, we run SHA512 to derive a ...
2
votes
1answer
70 views

Using scrypt to generate key + IV/nonce together

Is there any security issue in using scrypt for Key + IV/nonce generation? In other words, can I safely use only a salt for scrypt and derive the nonce along with the key? For example: I have data I ...
4
votes
1answer
148 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...

15 30 50 per page