1
vote
2answers
175 views

Pseudorandom generator and AE-secure encryption

How would you answer the following question (I have to translate it from German): The existence of a pseudorandom generator implies the existence of a AE-Secure encryption scheme (AE = ...
7
votes
4answers
530 views

Cracking WWII-era codes - code found on a pigeon's leg in Surrey

A recent BBC article entitled WWII code 'may never be cracked' posted a code: AOAKN HVPKD FNFJW YIDDC RQXSR DJHFP GOVFN MIAPX PABUZ WYYNP CMPNW HJRZH NLXKG MEMKK ONOIB AKEEQ WAOTA RBQRH DJOFM TPZEH ...
-2
votes
1answer
330 views

Encrypting with private key in Public Key InfraStructure [closed]

In Public key infrastructure, the MD5 of a piece of data is encrypted with the private key of a sender and this encrypted MD5 – along with the data – is again encrypted using an algorithm like AES or ...
12
votes
3answers
5k views

Should we sign-then-encrypt, or encrypt-then-sign?

We often want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
3
votes
2answers
1k views

Cracking the Beaufort cipher

Is there any easy way to crack a Beaufort cipher? We have a Vigenère table, and are trying to guess the keyword. Any easier way?
5
votes
2answers
604 views

Does a trace of SSL packets provide a proof of data authenticity?

I'm wondering if it would make sense to record a whole HTTPS session, publish its encryption keys and present it to third parties as a proof that this particular data was sent by a given server ...
3
votes
0answers
164 views

Does Keccak have an eTCR mode?

On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3): ...
4
votes
1answer
229 views

Questions about William's p+1

First off, if you're doing William's p+1 test, then also doing Pollard's p-1 is redundant, since the p+1 test covers both cases, right? Second, why is the recurrence $V_{n+1} = aV_n - V_{n-1}$ used? ...
10
votes
3answers
410 views

How to construct a good PRF from a block cipher?

We want to explicitly construct a good (as tentatively defined below) Pseudo-Random Function $F$ with $b$-bit input and output, from (preferably just) one Pseudo-Random Permutation $E$ of $b$-bit, as ...
4
votes
2answers
247 views

Is storing the hash of a key together with ciphertext encrypted with that key secure?

Is it secure to store the hash of a symmetric cipher key along with data encrypted with that key? Are there any circumstances or algorithms in which this combination could lead to potential weaknesses ...
4
votes
1answer
408 views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
1
vote
2answers
104 views

What can a master password also be called?

When having a company computer that is full disk encrypted, it is common that the boss have a master password / backdoor, so the data always can be decrypted. I have heard some call this for "scrow" ...
0
votes
0answers
42 views

NIST Standard for Advanced Encryption Standard Algorithm [duplicate]

Possible Duplicate: Advantage of AES(Rijndael) over Twofish and Serpent What is the reason of NIST why Rijndael choose as the Advanced Encryption Standard
0
votes
1answer
389 views

detecting ROT13/base64 encryption

Is there anyway to detect that a cipher is encrypted with ROT13 Or Base64 without decrypting it using the algorithm and check that the result means (works)? I mean does an algorithm exists that test ...
2
votes
0answers
91 views

Is this a valid real-time authentication scheme?

The scenario in Alice/Bob/Cindy terms: Alice approaches someone she doesn't know, but thinks is Bob, and asks for some secret information. Bob doesn't know and doesn't trust Alice, but Alice says she ...
1
vote
1answer
135 views

Does a break in a collision resistance property of a hash function by definition implies an attack at the first pre-image attack?

Is there a formal security proof in the shape of reduction that states that if an attacker manages to break the collision resistance property of a cryptographic hash function (a random oracle) he will ...
7
votes
2answers
207 views

Will varying plaintext compensate for a fixed initialisation vector?

This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest. I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
10
votes
5answers
1k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
4
votes
6answers
469 views

Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?

With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
4
votes
2answers
957 views

Are there any standards of multi-prime RSA key generation?

FIPS 186-3 specifies a method to generate DSA parameters. Is there anything similar (official standard or widely-accepted recommendation) that shows how to generate the primes for multi-prime RSA?
0
votes
2answers
160 views

Is this how padding can work?

So for block ciphers you need a fixed size block. If the plaintext length is not a multiple of the block length then you need to pad it. One way you could do this is that for the last block you just ...
1
vote
2answers
4k views

Decrypt digital signature using RSA public key with openssl

I have a digital signature that was created using the following algorithm: a SHA-256 hash of the body of the message is calculated. It is then signed using an RSA private key and the result is ...
6
votes
3answers
1k views

Relative merits of AES ECB and CBC modes for securing data at rest

I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data. I assume the ...
3
votes
2answers
186 views

Proof that a function constructed from a PRP is, or is not a PRF?

Let $E$ be a family of Pseudo-Random Permutations of $b$ bits, with $E_K$ indistinguishable from random permutation with effort less than $O(2^b)$, easily computable as well as the inverse ...
1
vote
1answer
61 views

Secure MAC implies that probability of same tags on different messages is negligible

So let any secure MAC (message authentication code) be given. Intuitively, I think it is clear that the probability of getting the same tag on two different messages is very small, i.e. negligible. I ...
3
votes
2answers
131 views

iterated discrete log problem

Consider the following problem: given $g_1 \ldots g_i,h_1 \ldots h_i \in G$, $\forall i$ find $x_i$ such that $g_i^{x_i}=h_i$ For $i=1$ this is the discrete log problem and is assumed to to have ...
3
votes
2answers
590 views

Implementing AES in C++: 4x4 Array of unint8_t, or 4x1 array of uint32_t?

I'm implementing AES in C++, and, inspired by the way words are handled in SHA, I decided this time to handle the state as a one dimensional array of 4byte unsigned integers as opposed to a two ...
1
vote
2answers
511 views

AES key padding

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes? Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
4
votes
0answers
152 views

Ring Signature - paper/code difference in trying to solve inverse trap door function?

there is a paper on ring signatures and a python implementation of it here. The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
5
votes
2answers
203 views

Why does OAEP have 2 rounds with 2 random oracles?

I strive into understanding why OAEP has two rounds of computations and not just one. I.e: Wouldn't it be safe to hash the random number r and XOR it with the original message?What security risks if ...
2
votes
3answers
1k views

Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
6
votes
3answers
278 views

Word-based stream ciphers vs “regular” stream ciphers?

Could somebody explain what is the difference between "word-based" stream ciphers and the regular ones? Those last ones use pseudo-random sequences XOR'd bit by bit with the message, as far as I know. ...
3
votes
1answer
1k views

How to prove that the concatenation of two secure PRG is secure?

Given $G:\{0,1\}^s \rightarrow \{0, 1\}^n$ a secure PRG, how can one prove that $G'(k_1, k_2) = G(k_1) \cdot G(k_2)$ is secure ($\cdot$ means concatenation)? In other words, I'd like to show that if ...
4
votes
1answer
531 views

What does Maj and Ch mean in SHA-256 algorithm?

I'm guessing they're some kind of standard function but what do they do and what do the names mean? A little explaination or link me to an article would be great.
-2
votes
0answers
458 views

Fiat-Shamir signature [closed]

I have a question about Fiat-Shamir signature: A hash function is h(w)=w mod 2011 and w1=2623, w2=3269, w3=1938. What is h=? and how to determine k.t bits?
3
votes
1answer
330 views

Efficient set up for a Montgomery multiplication

Montgomery described an efficient method to compute a modular multiplication. This works by using a special constant $R$ and assumes the inputs $a$ and $b$ have been made into a special representation ...
6
votes
2answers
352 views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST ...
0
votes
1answer
809 views

What is a trapdoor permutation?

Can anyone explain to me what a trapdoor one-way permutation is? Is RSA a trapdoor one-way permutation? Context: I was reading about ring signatures. On page 560, it describes steps to ...
1
vote
0answers
120 views

Quadratic Sieve Bottleneck, Multiple Polynomials an option?

After my failed attempt at trying to implement the ECM, I started working on the quadratic sieve. It works, but the bottleneck is finding smooth values over the factor base. The way I implemented it ...
1
vote
2answers
182 views

Breaking RSA, given a special kind of oracle that decrypts related ciphertexts for us

Let $c=E^{RSA}_{e}(w)$ be the ciphertext belonging to the plaintext $w$ if an $RSA$ system is used. Assume that the public exponent $e$ satisfies $e \le 10$. Furthermore, assume there is an oracle ...
1
vote
1answer
241 views

Montgomery Exponentiation - selecting input value R for a given BigInteger

I have Montgomery exponentiation working, but it's working quite slow. I suspect there are two reasons for this - I implemented it bit size instead of word size (I didn't realize at the time that ...
1
vote
1answer
285 views

How do unkeyed hash functions (for MDCs) provide security?

Unkeyed hash functions are, by definition, hash functions computed without a key. SHA-1 is an example. MDCs (message digest codes) are a subclass of unkeyed hash functions. How are unkeyed hash ...
1
vote
1answer
386 views

Why are these specific values used to initialise the hash buffer in SHA-512?

I'm reading the book Network Security Essentials written by William Stallings. To create a message digest with SHA-512, we have to go through some steps: append padding bits. append length ...
1
vote
0answers
78 views

Why do we always append padding bits in SHA-512? [duplicate]

Possible Duplicate: In the SHA hash algorithm, why is the message always padded? I'm reading the book Network Security Essentials written by William Stallings. To create a message digest ...
7
votes
3answers
11k views

Difference between stream cipher and block cipher

A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. A block cipher ...
1
vote
1answer
806 views

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that me is me, they create a certificate (for me) which contains the digital signature and public ...
4
votes
2answers
297 views

Why do we need Hash by key?

(i'm just trying to find what am I missing...) Assuming John have a clear text message , he can create a regular hash ( like md5 , or sha256) and then encrypt the ...
1
vote
1answer
143 views

On the fly key generation for cloud storage objects

Cryptographic key management involves storing and managing encryption decryption keys , certificates , signatures etc . If the requirement is just to store and manage object specific keys ( say ...
-1
votes
1answer
651 views

Is it possible to crack a blowfish 256 bits encrypted file? [closed]

I have a file of my own that I have encrypted using Coder-Abi. Now, I can just remember part of this password. So, would it be possible (much easier) for me to crack it knowing only part of it? I can ...
2
votes
1answer
966 views

How can I use eulers totient and the chinese remainder theorem for modular exponentiation?

I'm trying to implement modular exponentiation in Java using Lagrange and the Chinese remainder theorem. The example we've been given is: Let $N = 55 = 5 · 11$ and suppose we want to compute ...

15 30 50 per page