4
votes
1answer
180 views

The difference between MAC algorithms and what to use

I've been looking into message authentication codes and found several ways to create integrity for a message. I know of the following algorithms: HMAC, this can use any cryptograhpic hash function ...
0
votes
1answer
52 views

How is the MAC or HMAC secret shared with the other party for verification?

I've seen people everywhere say to use a MAC or HMAC with block ciphers. I think I understand the basics, but I'm still not sure how the HMAC secret is distributed so the other party can verify that ...
0
votes
0answers
77 views

Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme. $k_1$: encryption key $k_2$: authentication ...
1
vote
1answer
46 views

Words in Index of coincidence using vignere

I am trying to interpret the formula for index of coincidence from here I am not understanding fi , How i can calculate fi in this context ? Is this the appearance of single word like (...
0
votes
1answer
61 views

Attribute-based encryption for cloud storage

I'm trying to understand attribute-based encryption schemes. Almost all articles describe that they are designed for cloud storage, but as I understand, almost all computing (encryption & ...
2
votes
1answer
80 views

Plaintext block chaining, bad idea why?

Ahead of the question, little warning. Question is not about what are the better options. Question is why it is bad idea? Ok, suppose we have plaintext $p$, which divided into blocks: ...
3
votes
1answer
96 views

Is it ever unsafe to compress an EC point?

I am working with a library that outputs EC points in uncompressed form. To save space, I'm considering modifying said library to use compressed EC points. Assuming that I keep track of the sign bit ...
0
votes
2answers
44 views

Length of prime number used in Pedersen Commitment

I am writing a program using a Pedersen commitment scheme and all I'm missing is an appropriate length for my prime $p$. I have heard that a length of $2^{80}$ is ok, is that correct?
2
votes
0answers
74 views

Proving that a plaintext is the Paillier decryption of a certain ciphertext

Assume that Alice received 100 ciphertexts encrypted with additive homomorphic encryption, say Paillier, using the same public key that belongs to Bob. Alice added all of them, and wants to know the ...
0
votes
1answer
44 views

Using HMAC SHA256 to protect payment files in local trusted network

in a project that I am working on we have been tasked with eliminating PGP while providing sufficient security to protect payment files only within the Company's trusted network. We arrived at HMAC ...
2
votes
1answer
45 views

Is MCrypt's 8-bit OFB mode secure?

I just stumbled across a Stack Overflow post which points out that the libmcrypt library (notably used in PHP) implements a somewhat unusual set of block cipher modes: it calls the usual CFB and OFB ...
2
votes
1answer
60 views

Retrieve value of private key after encryption with the public key

Is there a way to find an RSA private key after it is encrypted with the corresponding public key? Does there exist an algorithm to recover the private key in this special case?
5
votes
1answer
605 views

Why does applying 56-bit DES twice only give 57 bits of security? [duplicate]

Given two 56-bit keys, $k_1$ and $k_2$, why does $E_{k_1}(E_{k_2}(M))$ only give 57 bits of security? So basically I'm unsure why it only gives 57 bits of security; I understand that one key will ...
0
votes
1answer
28 views

Combining cascaded encryption keys into one key

Is there an encryption algorithm where it's possible to combine multiple encryption keys into one, so that: $E_{AB}(Data) = E_A(E_B(Data))$ KeyAB should be computable from KeyA and KeyB, but it must ...
0
votes
1answer
69 views

Knowing N and a relationship between the 2 prime numbers(p and q) find p and q generated with RSA

Let there be $p$ and $q$, 2 prime numbers for which the following relationship is true: $|p-q| < 2 \cdot N^{1/4}$. The algorithm first generates the prime number $p$, then it generates $q$ close ...
0
votes
2answers
57 views

Integrity compromised - HASH modified

As we are all aware that HASHing is user to verify integrity in cryptography. I have a query about hashing. Suppose a man in the middle attacker manipulates the data and creates new HASH (by running ...
0
votes
1answer
118 views

Multiple AES/ECB encryptions of different data with same key all end with same pattern

We have used "AES/ECB/PKCS5Padding" with a 256 bit key. We encrypt different streams of data (blockwise) with the same key. Each encrypted stream ends with same pattern. What is the reason for this?
1
vote
1answer
42 views

Is authentication length always a subset of encryption length?

Do in all the use cases, if I have to encrypt and authenticate, encrypt-then-authenticate or authenticate-then-encrypt, like in IPSEC, SSL or SSH or others, if I were to do these operations to a ...
1
vote
1answer
78 views

Vigenère, auto-correlation vs Kasiski examination

What are the differences between 'Kasiski examination' and 'auto-correlation' ? In Cryptool site, they state that autocorrelation analysis is more efficient and clearer than the Friedman or Kasiski ...
3
votes
2answers
173 views

Key space vs Cardinality of 1024-bit RSA

I have been trying to figure out the encryption key space, and cardinality of 1024-bit RSA. From my understanding, the key generated from 1024-bit will be primes greater than $2^{1023}$ but less than ...
0
votes
1answer
44 views

Are keys generated by the user or block cipher algorithms themselves? [closed]

We know block cipher algorithms. In the block cipher algorithms, Key Scheduling is the one crucial part. I see that in some simulation programs of the AES,DES,TripleDES encryption algorithms. In ...
0
votes
1answer
66 views

Finding Vignere Cipher key [closed]

I am new to cryptography and I am just trying to find key for random text. Can please explain the easy way how we can find the key in small number of steps ? if we have text like Peit Wokm! Mhfa ...
0
votes
1answer
56 views

How do I control an access code safely?

Upon registration an user has to specify an access code of five digits. This access code is also used as a password for the encryption and decryption of certain strings. The user types in "12345" ...
3
votes
1answer
58 views

dh parameters someone else generated

Am am auditing some software that includes compiled in DH parameters (2048 bits). I can't be sure who generated the DH parameters or how they were generated. Question: Can DH parameters be weak ...
0
votes
0answers
21 views

Does it make sense to have multiple values of authentication and cipher offsets while encrypting a packet?

Consider a packet with N segments. cofsset(cipher offset - from where one must cipher) lies in arbitrary Segment "A". aoffset (authentication offset - from where one must authenticate) lies in ...
0
votes
1answer
58 views

RSA modulus (N) from public key and calculating N from p, q not equal [closed]

I have a RSA public key in the form of public exponent and modulus as follows: ...
0
votes
0answers
28 views

EC based password authenticated key exchange protocol

I would like to know: What is the currently best (efficiency and security wise) known EC based password authenticated key exchange protocol? (i.e. is there any EC based protocol may be similar to DH ...
1
vote
2answers
127 views

nonce of AES-GCM in SSL

It seems that the nonce of AES-GCM in SSL has 3 parts: salt, 4 bytes, generated in handshake, not changed in whole session nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL ...
0
votes
1answer
40 views

Why perfect secrecy can be ensured when a plain message and a cipher-text based on one-time pad are correlated?

First, some well-known results are as follows. For random variables $X$ and $Y$, we have $$H(X,Y) \leq H(X) + H(Y).$$ The equality is achieved when $X$ and $Y$ are independent. Second, in one-time ...
0
votes
2answers
58 views

Fortuna: why are source ID and data length added together with entropy data into the pools

Section 9.5.6 of Cryptography Engineering states that The concatenation [of source number, length of data, and data itself] is then appended to the pool. Why are we including source number and ...
0
votes
1answer
39 views

what is legend of h(r) in this protocol?

can you help me what is legend of h(r) in below protocol? ‎‎$A‎\leftarrow‎{B}\quad:{h(r)‎‎}{,B}{,P{_A(r,B)}}‎\\A‎\rightarrow‎{B}\quad:r$
7
votes
1answer
124 views

Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?

It is given two RSA moduli $N_1$ and $N_2$, known to be of the form $N_i=p_i\cdot q_i$, with $p_i$ and $q_i$ unknown primes, and such that $p_2=p_1+2$. Can we make use of that relation to factor the ...
0
votes
0answers
57 views

Popularity of ECMQV authenticated key agreement protocol

I've got a few ECMQV related questions: Why is ECMQV a more efficient EC-based authenticated key agreement protocol? Why is ECMQV so popular? Is it because no other protocol of its strength exists? ...
-1
votes
1answer
37 views

What does L_n is the bit length of the group order n states need for my calculation in ECDSA algorithm?

I am doing the program of implementing ECDSA for which I am trying to solve the equation scenario. In ECDSA that signature generation algorithm which states as hash value from the SHA-1 and where $l$ ...
0
votes
2answers
123 views

Asymmetric encryption that is secure for (almost) any foreseeable future

Recently, I've been reading a couple of papers about building cryptosystems that are secure for up to 30 years. But for some applications, this seems a bit low to me. So I am wondering if considering ...
1
vote
0answers
130 views

Is chaotic encryption secure?

I know this sounds too broad. But I noticed that there was a chapter on chaotic crypto in the recent Handbook of Information and Communication Security Editors: Stavroulakis, Peter, Stamp, Mark (Eds.) ...
5
votes
3answers
132 views

Is there a way to use bcrypt with passwords longer than 72 bytes securely?

From my understanding BCrypt truncates the password to 72 bytes. If a password is longer than 72 bytes, what is a way to store that password using bcrypt securely without compromising it? Or is this ...
1
vote
1answer
106 views

Inserting a backdoor into a cryptographic hash function

I'm curious as to how a backdoor can be built into a hash function. What might it take the form of? What's probability of getting one that can be backdoored in a way that can actually undermine its ...
5
votes
2answers
99 views

What is a Key Derivation Function?

From Wikipedia: In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or ...
2
votes
0answers
33 views

Encrypt-Mix-Encrypt: Full Diffusion?

I've read this paper about the encrypt-mix-encrypt mode for ciphers and was asking myself if this mode provides "full" diffusion. So if an attacker alters one bit of the ciphertext, how many bits ...
0
votes
0answers
41 views

why are both ipad and opad required for HMAC? [duplicate]

I was reading about HMAC and why it is crucial to avoid security issues with normal prepending / appending the secret k to a message (issues due to merkel damagard construction). I am not familiar ...
1
vote
1answer
41 views

Are there equivalent IVs in DES/CBC?

I'm playing around with the CryptoPP library with DES/CBC and I've noticed that for some sets of data, if I decrypt the ciphertext with Key1, IV1, I get a good cleartext result -- but if I decrypt the ...
0
votes
1answer
64 views

Choosing finite field size in Shamir's Secret Sharing Scheme

The Wikipedia article on Shamir's Secret Sharing says to that to have information theoretical security the splitting algorithm should be evaluated using finite field arithmetic on the field ...
3
votes
1answer
276 views

Weaker alternative to Ed25519?

For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast. However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
0
votes
1answer
48 views

Value of S and r in Fiat-Shamir Protocol

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
2
votes
1answer
80 views

RFID Protocol Cryptanalysis

Assume we have the following scheme for RFID: TAG & READER both have initially k keys. Every session the TAG computes $k_i$=F($k_{i-1})$ where F is a function which computes XOR of previous key ...
1
vote
1answer
40 views

Errata for NIST SP 800-63

I'm looking through the latest version of NIST SP 800-63, and there is a table (Table A.1) in the Appendix that supposed give the "entropy" of a password for a 94 character alphabet for various ...
1
vote
1answer
78 views

Benefit of using random key in Shamir's Secret Sharing

I am implementing Shamir's Secret Sharing, and I find that in (t,n)-threshold scheme, the shares are just using 1,2,3...,n as the key to form the shares ...
0
votes
1answer
87 views

SSL / TLS digital signature exchange

If server is sending its digital signature, in which message / where does the digitally signature is provided to the client. Is it after the server_hello message because there the public key of the ...
1
vote
1answer
45 views

Meaning of Signature hash algorithm field in certificate

I'd like to understand what is the meaning of this field, especially considering that when calling a crypto library to sign data the digest method is specified by the caller. For example, this simple ...

15 30 50 per page