3
votes
1answer
69 views

Reversing a hash of known hashing algorithm

I am sure this is a very easy thing to do but I am not sure how to go about solving a problem like this, So there is this hash function which operates on a message which is in the form of a byte array ...
3
votes
1answer
52 views

I am trying to generate a permutation of polynomial with order m

Suppose m = 5 and N = 64. How do I choose the coefficients such that the polynomial is a permutation of nos from 0 to 63.?
3
votes
1answer
72 views

Combining public key signature schemes and private key encryption

I'm working on my bachelor thesis and I have some questions. I want to combine a CPA-secure private key encryption scheme and some unforgeable public key signature scheme (in my case some sanitizable ...
3
votes
1answer
67 views

How can I formally verify fuzzy commitment scheme based security protocol?

I am currently working on designing a security protocol which involves usage of fuzzy commitment schemes, for. eg Reed-Solomon codes which allows us to tolerate a certain level of error. I was ...
3
votes
2answers
53 views

Non primitive lfsr sequence

Given a non-primitive LFSR sequence (i.e number of states is less than $2^n - 1$); how do we find out the the characteristic polynomial? Will Berlekamp-Massey algorithm work in this case? for ...
3
votes
1answer
57 views

Is a random circuit likely to compute a one-way function?

I remember reading somewhere that (under certain reasonable assumptions) a Boolean circuit with many inputs and outputs (assume equal number for now) chosen at random will be a one-way function with ...
3
votes
1answer
41 views

ARC4random – ChaCha-based LibreSSL PRG

Here is arc4random.c from the LibreSSL pseudorandom generator as used in OpenBSD. It works as follows: Take 40 "truly random" bytes from OS (PRG seed); Use the seed as key and IV to generate 1024 ...
3
votes
1answer
80 views

Do 2DES and 3DES2 have the same effective key length?

I am following the notes "Introduction to Modern Cryptography" by Bellare and Rogaway, and on the chapter about blockciphers there is the following claim (page 11 of ...
3
votes
2answers
364 views

Is authenticated encryption unnecessary if the message is digitally signed?

Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?
3
votes
2answers
109 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
3
votes
1answer
76 views

Question about HMAC with SHA1

I would like to make sure I understood HMAC. Wikipedia declares it like: $$\operatorname{HMAC}(K,m)=H((K\oplus\text{opad})||H((K\oplus\text{ipad})||m))$$ If I want to use HMAC-SHA1, am I correct to ...
3
votes
3answers
112 views

Is an android encrypted SDcard readable/decryptable easily by a desktop machine?

If I encrypt my SDCard on my android phone using the built-in encryption software, and my phone dies for whatever reason, would I be able to easily by just using the pin/password to access that data ...
3
votes
2answers
67 views

How to generate a random number so server cannot cheat?

Here is the protocol: Bunch of players connected to server. Server creates nonce and hashes it - send hash to clients as bit commitment. Clients make nonces and send hashes to server as their bit ...
3
votes
2answers
108 views

Classification of a stream cipher

How would one classify a stream cipher that is neither synchronous, nor self synchronizing? I would have thought asynchronous, but from all the sources I can find, asynchronous is synonymous with ...
3
votes
1answer
83 views

Help with AES decryption with AES-NI Instructions

I am in process of implementing a AES 128 encryption in AVX2 assembly (using AES NI), and am having some problems with decryption logic. I have implemented the encryption sequence without any trouble. ...
3
votes
2answers
91 views

Long passwords and Bcrypt

I need to store passwords for a web application, and was looking at Bcrypt for a possible solution. After some research, it appears only the first 72 bytes influence the final hash output. While it is ...
3
votes
1answer
73 views

How exactly does certificate based authentication work?

I know the concept of key generation, as well as encryption and decryption using public and private keys. When it comes to authenticating a user by a server, in general there are three types: ...
3
votes
2answers
67 views

Are low security curves for ECDSA not supported?

I am working in a very bandwidth restricted environment, and we are looking to implement ECDSA digital signatures. Although they are no longer recommended, we might be looking to use curves that are ...
3
votes
1answer
59 views

Does a “commutative” asymmetric system exist?

Completely crypto noob here. I'm looking for a cryptosystem made of a func f + key1 + key2 such that they satisfy: g(f(msg, key1),key2)=msg g(f(msg, key2),key1)=msg key1 != key2 Does such a ...
3
votes
1answer
102 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...
3
votes
1answer
72 views

Security of this scheme

I am developing a software and I am not sure if it is completely secure. I have 22 Mb of data to encrypt used multiple times, random IV (generated using RAND_bytes from OpenSSL lib) and password ...
3
votes
1answer
187 views

Why multiple homomorphic operations on a ciphertext leaks no information about the plaintext?

Scenario: Assume I encrypt message $m$ using Paillier encryption, so I would get $c=E(m)$. I give the identical $c$ to two different parties, parties $D$ and $E$. Party $D$ computes: $c_{D}= ...
3
votes
2answers
136 views

Why does GPG ciphertext length differ with fixed plaintext length?

Thank you for your reply. Based on your inputs. I was investigated further, find details below Step 1) Input string for encryption is UUID format Input data = c0c6f311-a793-4d65-9374-1c0e45f5382c ...
3
votes
2answers
102 views

Are all encryption tools made equal?

I'd like to encrypt work-related data backups stored on an external drive. The backups contain proprietary company information and trade secrets. My current backup program, Comodo Backup, allows me ...
3
votes
1answer
73 views

gpg --gen-random quality level: is higher “better”?

The GNU Privacy Guard manual pages have this to say about using the gpg --gen-random 0|1|2 count command: Emit count random bytes of the given quality level 0, ...
3
votes
1answer
43 views

How many bits of an exponent are leaked when doing a powmod?

How many bits of the exponent $x$ are leaked when you calculate and reveal $g^x \pmod p$ for some generator $g$ of $\mathbb Z^∗_p$? The low bit of $x$ is obviously leaked: the low bit equals ...
3
votes
1answer
202 views

How to build a difference distribution table?

i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in ...
3
votes
1answer
63 views

What about using only XOR gates in homomorphic encryption?

What if we were substitute the ANDs with XORs in some homomorphic encryption scheme like BGV(https://eprint.iacr.org/2011/277.pdf), LTV ( https://eprint.iacr.org/2013/094.pdf) ? It may be more ...
3
votes
1answer
98 views

Can a billion elliptic curve keys be generated on a laptop in less than an hour?

I want my application to generate an EC key pair. The first four bytes of the sha256 hash of the public key should contain a known IP address. As hashes are one-way functions, I need to brute force ...
3
votes
1answer
89 views

Is there any benefit of changing the AES-CCM encryption key periodically even if the Nonce space is not exhausted yet?

I would like an answer that could be sustained by a mathematical proof. Let's say I'm using AES-CCM to encrypt a lot of messages, and I always use a different nonce. I know that when the nonce space ...
3
votes
1answer
123 views

Can homomorphic decryption of DES be practical?

I was reading this paper Homomorphic evaluation of the AES Circuit by Gentry et al. when I thought if something similar can be done with DES or 3DES, e.g. it is plausible to decrypt DES ...
3
votes
1answer
76 views

Are HTTPS web sessions non-repudiable?

(This is probably a basic question, and may be a duplicate; if so, just let me know.) Suppose there are two clients A and B, ...
3
votes
1answer
44 views

X509 certificates: Two Algorithm Identifiers?

I'm wondering why there are two Algorithm Identifiers in a X509 certificate. One is in the "to be signed" part and the other one is at the end right before the actual signature. Are they used for the ...
3
votes
1answer
207 views

Why not use OAEP for signatures?

There seems to be a distinct lack of implementations of RSA signatures using OAEP to pad the digest. Other than the old, funky, padding schemes, it's PSS all the way. PSS seems to have the whiff of ...
3
votes
1answer
88 views

How do I tack on “additional data” to libsodium's public-key authenticated encryption?

I note that libsodium provides AEAD when using symmetric cryptography. And yet, under section 8 (Public-key cryptography) there are no public-key methods described which allow for additional data ...
3
votes
1answer
90 views

How to understand RSA Proofs of correctness at Wikipedia

From Wikipedia(https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Proofs_of_correctness): $m^{ed}$ ≡ $m$ $\pmod{q}$ $m^{ed}$ ≡ $m$ $\pmod{p}$ then $m^{ed}$ ≡ $m$ $\pmod{pq}$ Question: if $m^{ed}$ ...
3
votes
2answers
182 views

Is simple XOR with secret key using DHE secure?

Client and server have given generator 3 and modulus which is 256 bit prime same all the time for all clients and server (simply hardcoded). They both generate a private exponent and send result to ...
3
votes
1answer
138 views
3
votes
1answer
125 views

What is tiger192,4 in PHP?

PHP supports hashing of the following Tiger algorithms: tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 Wikipedia's entry on Tiger says there's Tiger and Tiger2 and provides ...
3
votes
2answers
158 views

Whats the point of an IV if public? [duplicate]

What is the point of the initialization vector in cryptographic modes like AES-CBC when it is sent in the public? Cant any attacker just listen and reverse the IV? and as such defeating its purpose? ...
3
votes
1answer
78 views

Fixed-points in block ciphers; why don't they indicate a vulnerability?

I've seen a few questions here on fixed-points in ciphers, most asking about the possibility and existence. Most of the answers however pointed out that fixed points are not exactly a security threat. ...
3
votes
1answer
78 views

Use of the IV for the CBC Block Cipher in TLS1.2

I'm struggling to understand at what point a message is encrypted when looking at RFC 5246. The spec gives the generic block cipher in section 6.2.3.2 as: ...
3
votes
1answer
108 views

What is matrix branching program?

Recently I am reading something about order-revealing encryption (by Boneh at al. in EuroCrypt 2015) and encountered "matrix branching programming". It seems like it took me forever to understand ...
3
votes
3answers
174 views

Supersingular Isogeny Key Exchange broken?

Found this report detailing a quantum algorithm for computing isogenies between supersingular elliptic curves. http://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf with the quote ...
3
votes
1answer
105 views

SHA512 vs HKDF key expansion

I'm working on a secure file storage server. This server allows users to upload and download files based on a "seed". This "seed" is a 128-bit value. From this 128-bit seed, we run SHA512 to derive a ...
3
votes
1answer
55 views

Prove that H(s) = G(!s) is a CPRNG if G(s) is one

Given a cryptographic pseudo-random number generator $G$, prove that $H$ with $H(s) = G(!s)$ is also a cryptographic pseudo-random number generator. Here $s$ is a binary string; $!s$ is its ...
3
votes
1answer
131 views

Base point in Ed25519?

The paper "High-speed high-security signatures" by Bernstein et al. introduces the Edwards curve Ed25519. Concerning the base point $B$, it says that $B$ is the unique point $(x, 4/5)\in E$ for ...
3
votes
1answer
696 views

In SSL and TLS, why is there a separate Change Cipher Spec Protocol rather than including a change_cipher_spec message in the Handshake Protocol?

In SSL and TLS, why is there a separate Change Cipher Spec Protocol rather than including a change_cipher_spec message in the Handshake Protocol?
3
votes
1answer
92 views

What does “simulator” and “interactive” mean in a cryptographic credential system's definition of security?

Definition 1 on Page 7 of “An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation” by Camenisch and Lysyanskaya, uses the term “simulator” in defining the ...
3
votes
1answer
186 views

Hash functions to generate one time pad

Newbie question... may be... Stream cypher, will XOR message bits with one time pad bits Suppose I have a pseudo random number generator, like a Mersenne twister or sort of. I could use the ...

15 30 50 per page