3
votes
2answers
138 views

Is this a plausible PBKDF?

Background: Hello, I'm working on a hobby project in which I might want to implement a key derivation function within a somewhat resource limited embedded system. For standard crypto functions, I ...
3
votes
2answers
2k views

Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
3
votes
2answers
595 views

Does CCA security imply authenticated encryption?

Does CCA security imply authenticated encryption?
3
votes
2answers
127 views

Ballot box with multiple parties. All can read it, or none can read it

I am trying to create a decentralized moderation system for the game Diplomacy, a game for seven players. In each round of a face-to-face game, each player writes their moves on paper then puts it in ...
3
votes
2answers
177 views

How do I construct variable length input (VIL) in a block cipher mode?

I've just been skimming NIST's "Five Confidentiality Modes". I understand those block cipher modes are used to securely encrypt input longer that the block cipher length. However, the common block ...
3
votes
1answer
272 views

ECDSA: How to retrieve a non-random k

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
3
votes
1answer
217 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
3
votes
1answer
149 views

Can I decrypt the message having it encrypted with different keys?

I have some encrypted binary data I want to decrypt. I know nothing about it, but I can get it encrypted with as many different (random, unknown) symmetric keys as I want. The keys are long enough to ...
3
votes
1answer
223 views

When is it safe to not use authenticated encryption?

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ...
3
votes
1answer
204 views

Performance for Subbytes in AES

I´m implementing the AES-encrypt algorithm for the SSE2 instruction set. For the Subbyte function i use movzx, having loaded ...
3
votes
1answer
460 views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
3
votes
1answer
203 views

Encrypting a short phrase into two keys. both with length of 32letters

It doesn't need to be crazy secure. I wanted to figure out if there's a popular practice when encrypting a short phrase (less than 32 letter long) into two keys (two strings 32 length). Doesn't need ...
3
votes
1answer
233 views

Using Stream Cipher as CSPRNG

Are there any guidelines or justification for converting a stream cipher algorithm for use as a CSPRNG? For instance, lets say I wanted to convert one of the eStream portfolio Profile 1 (software) ...
3
votes
1answer
223 views

derangements and permutations in cryptography

Given a partial key for a mono-alphabetic substitution cipher (missing 11 letters), calculate the number $N$ of possible keys, given that no plaintext letter can be mapped to itself. Ordinarily, ...
3
votes
2answers
3k views

How to calculate the maximum output size for data encrypted with a RSA Private Key?

I have an an encryption algorithm I am working with that looks like this: prv_key_enc(sha1_hash(data)) Where, the RSA parameters are: RSA/ECB/PKCS1Padding 1024 ...
3
votes
1answer
345 views

RFC 3526 - What does pi mean?

In RFC 3526 there are a series of primes listed as standard parameters used for Diffie-Helman. The primes are list in two formats. One is the long format, where the number is given in hex. For example:...
3
votes
2answers
610 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
3
votes
1answer
2k views

Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
3
votes
1answer
122 views

Does re-iterate AES128 with different keys gives any benefict?

I'm not cryptography expert (well, I'm here after all!) but I have this doubt… Suppose I have 2 different keys: secretkey1 secretkey2 And a plain text: myReallySecretPlainText If I use AES128 ...
3
votes
2answers
193 views

ElGamal in private set intersection: how to handle negative numbers?

I am trying to implement the Efficient Robust Private Set Intersection using Additive ElGamal. For this, from the client side, my inputs are $C = \{1, 2\}$. So, the polynomial is $(x-1)(x-2)$ which ...
3
votes
1answer
334 views

Which is better ECDHE with TLS 1.0

I have a webserver which only supports TLS 1.0 and I am not sure about something: Which is the better cipher in this group when aiming for the best security? ...
3
votes
2answers
397 views

Why have Nonce and why encrypt everything in step 2 for Needham-Schroeder?

Here is the protocol outline I am looking at (source: Foundations of Computer Security, Lecture 60: The Needham-Schroeder Protocol) $$ \begin{array}{ccl} 1.& A \to S \colon& A,B,N_a \\ ...
3
votes
2answers
399 views

How is the AEScrypt password related to the underlying AES key

AES uses a key that is at most 256 bit. I assume AESCrypt uses AES. When a file is encrypted with AEScrypt, there is no limit to the length of the password. What is the relation between the ...
3
votes
1answer
331 views

Can $r$ and $s$ from an ECDSA signature be negative numbers?

I have an ECDSA implementation in Mathematica over secp256k1 and $r$ and $s$ are always positive numbers. But if you encode them as bytes, the most significant byte can be over ...
3
votes
1answer
142 views

Calculate entropy of key derived from PBKF2 function

I am using PBKF2 to derive a encryption key from a password. suppose entropy of my password is y and my PBKF2 function has x number of iterations. So how to calculate the entropy of finale key derived ...
3
votes
1answer
6k views

Calculation of time to crack SHA-256 hash

A problem is given: 1 million users are authenticated with 9-digit PIN codes (e.g. 343534643). The PIN values are stored as hash values in a database. The hash is SHA-256, and is computed as: ...
3
votes
2answers
1k views

Advantages of bilinear map

Consider the pairing $e: G_1*G_2 \to G_t$. Why we are mapping element from group $G_1$ and group $G_2$ to an element in $G_t$. How are they used in cryptography? What advantages do they provide?
3
votes
1answer
118 views

Diffie-Hellman for Encryption

In learning how DH works for cryptography applications, I'm coming across some confusing language. For starters, most of the time DH is discussed in the context of "generating" their shared secret. ...
3
votes
3answers
776 views

What are the pros/cons of using symmetric crypto vs. hash in a commitment scheme?

In a commitment scheme, are there any differences on using a symmetric cipher versus using a hash? If at the "opening", I have to reveal $r$ (a random number concatenated with the messaged at the ...
3
votes
2answers
212 views

Why doesn't this dummy mutual authentication protocol provide mutual authentication?

I am a student taking a cryptography course so forgive me if this comes off as a silly question. This is an assignment question: $Alice \rightarrow R \rightarrow Bob$ $Alice \leftarrow [R]B \...
3
votes
2answers
419 views

Any real world implementation using message recovery?

During my master thesis I came across RSA-PSS-R which is in my opinion a quite elegant way of saving bandwidth and space using digital signature. But I didn't find any information about any real world ...
3
votes
1answer
1k views

Non-linearity of a boolean function

What's the definition of non-linearity of a boolean function? Roughly saying it is minimum number of times it equals any affine function. But I don't get it mathematically. For example, if $f = ...
3
votes
1answer
311 views

Can we decrypt in this order when the message is encrypted twice?

If we encrypt a message twice with symmetric key $k_1$ first and then $k_2$ like $E_{k2}\{E_{k1}\{m\}\}$ , ideally we should decrypt with $k_2$ first and then $k_1$ but is it possible to decrypt with $...
3
votes
1answer
12k views

Decrypting the password from SHA-512 hash value

I am currently studying AES algorithm and writing a Code using Python. I am trying to add 'Salt' into the user input password, Here is what I am doing, ...
3
votes
2answers
663 views

AES block cipher modes of operation

have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ...
3
votes
1answer
102 views

Hashing a message with a length that isn't a multiple of 8 bits

NIST FIPS 180-4. “5.1. Padding the Message.” Suppose that the length of the message, $M$, is $l$ bits. Is there any library that can receive a message of length (in bits) which is not a multiple ...
3
votes
2answers
665 views

RSA encryption exponent

In RSA public-key material (e, N), why must the encryption exponent e be relatively prime to $\phi(N)$? Why must any public key encryption algorithm resist CPA?
3
votes
2answers
403 views

Calculating ciphersize of Paillier, SSE and OPE

If I have to encrypt a 32 bit plaintext in each of Paillier, SSE and OPE, how can I make an estimate of the ciphertext sizes respectively in order to reserve the amount of space in a database?
3
votes
1answer
346 views

How would I make a secret notation alphabet more secure?

Disclaimer: I was looking for a place to ask this question on SE and this site seems to be the most fitting. If this question doesn't belong here, feel free to redirect me. Just out of boredom and ...
3
votes
1answer
763 views

Why does openssl BN_generate_prime return only a fraction of the safe primes within the given bit range?

I went into prime generation issues the last week and eventually calculated 10^7 primes using erik tews safeprimegen python wrapper for openssl. (https://github.com/eriktews/gensafeprime) (System: ...
3
votes
1answer
482 views

Which PRNG security requirements do I need for key generation

Do I need to worry about "predictability" an an allegedly secure CSPRNG if I am just using it to generate key material from time to time? Suppose that for some odd reason, I am less trustful today ...
3
votes
2answers
171 views

Finite fields in elliptic curve

I have an elliptic curve defined over finite field where $S_1=aP$ . Is it valid to say that $S_1P$ can also be computed. $P$ is the generator of the group. What my real question is that. Should '$a$' ...
3
votes
1answer
2k views

SIMON implementation, decryption issues

I've been trying to implement the new SIMON block cipher in Ruby as a personal challenge. The spec didn't include a pseudocode version of the decryption but I thought I had it figured out. The code I ...
3
votes
1answer
716 views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
3
votes
1answer
215 views

Are there any good examples of Contemporary Mechanical Cryptography?

Are there secure mechanical cryptosystems in use today? Not necessarily alphabetic either, ie digital but mechanical?
3
votes
3answers
354 views

Stream cipher with Diffie-Hellman and Cryptographic Hash Function? [duplicate]

I know: Never do your own crypto. But this question is just theoretical. Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash ...
3
votes
1answer
115 views

Signing an integer, which may be increased

I have a 64 bit integer. It has some sort of signature so that one can be sure it is valid. Anyone may increase the integer, update the signature, and remove all trace of the old signature. But it is ...
3
votes
1answer
2k views

What is U2FsdGVkX1?

Using CryptoJS 3.1 I noticed that using 3Des, the encrypted message always start with U2FsdGVkX1 Why is the first part of the encryption always the same? What information does this hold and ...
3
votes
1answer
118 views

Can substrings of a long string be efficiently authenticated?

Suppose one has a (strong) shared secret key and wishes to authenticate a very long string in a way that will allow the verifier to verify small substrings without reading much of the stored data and ...
3
votes
2answers
288 views

differential and linear cryptanalysis

I have been reading about differential and linear cryptanalysis. They were mainly introduced by Adi Shamir and Biham to show weakness of DES. However, many of articles state that they have been ...

15 30 50 per page