All Questions

534 views

Finding roots in $\mathbb{Z}_p$

Is there an efficient way (algorihtm) to compute the solutions of the congruence $x^n\equiv a \pmod p$? $n\in \mathbb{N}$ $a\in\mathbb{Z}_p$ $p$ is a large prime number Note that: By efficient I ...
559 views

CBC - a canonical mode, even though there are streaming modes

Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
731 views

RS Erasure Coding and Shamir's Secret Sharing

So I was trying to understand the basic difference between erasure coding and secret sharing, and I found this paper (that you can find here or here). For what I understand, it states that Shamir's ...
2k views

Is there a simple hash function that one can compute without a computer?

I am looking for a hash function that is computable by hand (in reasonable time). The function should be at least a little bit secure: There should be no trivial way to find a collision (by hand). For ...
1k views

Hashing or encrypting twice to increase security?

Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
431 views

What is the general justification for the hardness of finding preimages for cryptographic hash functions?

Since most cryptographic hash functions are simple, compact constructions does this simplicity impose a limit on the complexity and the size of a function that can generate preimages? That is, given a ...
908 views

What security do Cryptographic Sponges offer against generic quantum attacks?

In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...
338 views

Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?

I take the definition of safe prime as: a prime $p$ is safe when $(p-1)/2$ is prime. Safe primes of appropriate size are the standard choice for the modulus of cryptosystems related to the discrete ...
1k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
1k views

Technical details of attack on Android bitcoin usage of SecureRandom

Reports are surfacing that Android's Java SecureRandom class has issues and isn't totally secure. A specific example of how this issue translates to applications is bitcoin, where reports are stating ...
363 views

What exactly is the base for the KECCAK (SHA3) claim that a security strength of 256 bits is “post-quantum sufficient”?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → ...
766 views

Practical consequences of using functional encryption for software obfuscation

I came across this article, which describes a method, developed by UCLA CS professor Amit Sahai et al, for using functional encryption in order to achieve software obfuscation. The paper that the ...
616 views

I have a few questions about the random oracle model

1.) Proving the security of a scheme with the ROM takes two steps; first you prove that the sceme is secure in this idealized world where a random oracle exists and then you implement this scheme in ...
2k views

How can rainbow tables be used for a dictionary attack?

I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ...
1k views

“Weaknesses” in SHA-256d?

According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so: SHA-256d(x) = SHA-256(SHA-256(x)) Apparently, the motivation for ...
374 views

Hash function from narrower block cipher operated in CBC-encryption mode?

I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ ...
4k views

How does the index of coincidence work in the Kasiki test?

I'm starting to learn about cryptanalysis and I am having a bit of difficulty understanding the Kasiski test's index of coincidence. I have a book (Cryptography Theory And Practice by Douglas Stinson) ...
342 views

Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?

Like people always say: “Attacks only get worse…” — which is why I'm asking early. I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, ...
402 views

RSA leak bits to factor N

Suppose you randomly generate large primes p and q as in RSA, and then tell me N=pq but not p or q. Then, you would like to actually let me factor N, except you should tell me as few bits of ...
896 views

Should I salt an AES password at each encryption?

I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message. I don't understand ...
6k views

When to use RSA and when ElGamal asymmetric encryption

If i am not wrong in cryptography there are 2 basic cryptographic schemes for public key cryptography. RSA encryption whose security is based on the infeasibility of solving the factoring of big ...
542 views

What is a hard-core predicate?

I read this article on Wikipedia: Hard-core predicate. Still I don't understand what exactly is a hard-core predicate. Is it possible to put this in simple English terminology, and perhaps with a ...
357 views

When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position 2^254. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private key? ...
625 views

What stops the Multiply-With-Carry Random Number Generator from being a Cryptographically Secure Pseudo-Random Number Generator?

Despite the fact that Marsaglia's MWC PRNG (multiply-with-carry random number generator) is considered to be "the mother of all RNGs", it does not seem to be considered to be a CSPRNG ...
257 views

Automated security protocol verification tool for eCK model

I want a tool that (runs on Win7 and) can perform automated verification of a protocol in the eCK security model as described in Microsoft Research's paper "Stronger Security of Authenticated Key ...
280 views

Can one have an authentic, but repudiable, message without a previously shared secret?

Bob wants to send a message to Alice, such that Alice can be sure that the message came from Bob, but can't prove it to anyone else. If I understand right, this means that the same message could have ...
357 views

How to best obtain bit sequences from throwing normal dice?

Throwing normal dice, one can get sequences of digits in [0,5]. Which is the best procedure in practice to transform such sequences into bit sequences desired?
1k views

What alphanumeric string length can be used to guarantee no hash collisions from CRC-64?

If I'm hashing alphanumeric strings (chars in the set 0-9, a-...
197 views

Pen-and-paper one-way function for externally-anonymous survey

When conducting surveys, an Administrator might send an Enumerator to survey a Respondent. For "sensitive" questions (e.g. about embarrassing behavior), the Respondent may be fine with the truth being ...
416 views

Is there a practical zero-knowledge proof for this special discrete log equation?

We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal. Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$. There are two parties, Alice and Bob: Alice knows: ...
755 views

Why is CBC with predictable IV considered insecure against CPA

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that is uses, the attacker can ...
439 views

Proof that lottery does not know outcome of draw

Could a variable participant lottery system cryptographically prove that they have zero knowledge of the outcome of a draw? Participants do not choose numbers in this lottery and winning numbers are ...
553 views

Encryption algorithm that produces dummy output on incorrect passwords

Background: I've been thinking about using encryption in the context of backing up files to untrusted locations (to the point of making the file publicly and widely distributed for practically ...
292 views

Convert old and busted password encryption to something sensible

Given a TOTALLY HYPOTHETICAL scenario in which passwords for over a million accounts in over 200 databases have been stored using 3DES, a key derived from a (single) MD5 hash of a customer-controlled ...
172 views

Can I jettison MAC if I already have SHA1(M)?

I'm currently using SSL with AES-CBC and HMAC for a file transfer containing string M. Now suppose Alice already knows SHA1(M) (and the adversary does not), and she downloads M from Bob using only ...
1k views

Do I have to recompute all hashes if I change the work factor in bcrypt?

The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number ...
2k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and seen code ...
2k views

How can I convert a DER ECDSA signature to ASN.1? [closed]

I having trouble verifying an ECDSA signature signed using client side javascript with Java/BouncyCastle. The javascript signing function source ...
759 views

What is Identity-Based Encryption (IBE) and why is it “better”?

Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
144 views

How to calculate entropy of a combined key

I know how to calculate the entropy of a key that relates to its selection process. For example if the key space is $1000$, entropy of a randomly chosen key is $1000$. Suppose now you have two keys ...
322 views

Hide a weakness in ECC by choosing the prime or one of the curve coefficients

Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve $$E: y^2 \equiv x^3 -3x + b \pmod p$$ is cryptographically weak? You need to choose ...
222 views

Why not encrypt salt?

Assuming I had to distribute salt+ciphertext together over an insecure channel, isn't it better to store the salt encrypted? By encrypted I mean with a block cipher and with key and IV derived from ...
3k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
3k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
236 views

Attack on DSA with signatures made with k, k+1, k+2

For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages ...
346 views

Tools for modelling and analysis of cryptographic protocols

I am designing some cryptographic protocols and I am new to it. Are there any well-known tools that can be used to model and design these protocols? And also verify or analyze their validity? If not ...
523 views

Simulation-based security?

I've been reading Introduction to Modern Cryptography by Katz and Lindell as an introduction to cryptography. The book seems to use the term 'simulator' when it talks about a game like, for instance, ...
229 views

One-way function and factoring

I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...