All Questions
1
vote
1answer
78 views
How difficult is it to check if a group element is in a sub group?
I am just curious. We have a group $G$ and its subgroup $H$ with a generator element $h \in H$. How difficult is it to check for $x \in G$ that $x \in \langle h \rangle$? Is there a better way than ...
2
votes
3answers
129 views
Is there a way to use Shamir Secret Sharing with updatable data?
I want to divide a system that maintains these properties, based on Shamir's Secret Sharing:
A secret key is split up to N pieces, where T of them are enough to reconstruct the key.
The original key ...
6
votes
0answers
131 views
What changed in PKCS#1 v2.2, and why?
PKCS#1 is one of the most used (de-facto) standard for real-world use of RSA.
That's for good reasons: PKCS#1 is well thought, versatile, understandable, has been relatively stable for over two ...
5
votes
2answers
127 views
Security of tokenization of plain text conversations - cryptanalysis
I came across a marketing video here. They claim to perform AES encryption and tokenization of sensitive data, at the corporate gateway, before it leaves the company firewall destined for the public ...
2
votes
1answer
245 views
Is a known plaintext, ciphertext, and public-key a viable attack on RSA?
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.
Alice and Bob each have their public- and private-key pairs ...
0
votes
0answers
54 views
Strength of Combining Hash functions [duplicate]
If I combine two hash functions, what will the impact on the strength of the resulting function.
If I combine in following way:
H1*H2 (multiply)
H1 + H2 (concat)
H1 Xor H2
H1 (H2)
EDIT:
Lets say H1 ...
2
votes
1answer
46 views
Equivalents to a physical hat+shaking?
I would like a multiparty protocol, secure in the honest-but-curious model at least, but hopefully other situations as well, that can do the following: every party among $\{P_1, P_2, \ldots P_n\}$ ...
4
votes
2answers
134 views
ChaCha cipher + Poly1305
The Poly1305-AES paper summarizes the MAC as
$$ Poly1305(m, AES_k(n)) = {H_r(m) + AES_k(n)} \mod 2^{128} $$
Can I presume that $+$ here is just meant as a form of 16-byte mixing $H_r(m)$ and ...
2
votes
1answer
193 views
XOR cipher for encrypting compiled C code
I'm exploring ways of encrypting Intel hex files we send to customers for flashing onto an embedded device. The embedded processor itself has a built-in mechanism that prevents anyone from reading the ...
0
votes
0answers
62 views
Use curve25519 for ElGamal crypto
DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that ...
0
votes
1answer
55 views
Exponentiation In PBC library
I need to compute a function $h^l$, where h is an element of G2 and l is a rational number. How can this be done using the PBC library?
I have converted the h to ...
6
votes
3answers
448 views
Is this encryption algorithm build from MD5 secure?
I'm being asked to use an encryption algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm ...
2
votes
1answer
54 views
How are Elliptic Curve Cryptography and Pairing Based Cryptography related?
I have been doing a project that uses the PBC library developed by Ben Lynn. But I am still not clear on how PBC is related to ECC.
I know that this is a site for complex crypto QA, but I did not know ...
1
vote
1answer
57 views
RC4-52 by hand / pen-and-paper?
I've played a lot with VIC and enjoy its complexity and effectiveness as a field cipher . However RC4 has caught my attention lately and I've read there is a RC4-52 variant that can be done by hand.
...
1
vote
0answers
79 views
One-time pad and perfect secrecy properties
I have a homework problem:
Explain how to find $m_{0}$ and $c$ such that $P[c=c': k \leftarrow K, c' \leftarrow E(k, m_{0})] > 0$
where P is probability and k is chosen uniformly.
I do not know ...
1
vote
2answers
184 views
What data is saved in RSA private key?
What data is saved in RSA private key in openssl? How to view it?
Wikpedia says these variables are saved.
2
votes
1answer
122 views
What should I be aware of when implementing algorithms myself?
I plan to build my own crypto library. The project will be primarily for me to learn (and if useful for no other purpose, that is fine). In the past I have implemented a few hashes, and AES quite a ...
3
votes
1answer
120 views
Should the secret key of Shamir's secret-sharing algorithm be interpreted byte by byte?
Should the secret message of Shamir's secret-sharing algorithm be interpreted and processed byte by byte?
Interpreting it byte by byte makes it easier to process, but in case one of the shareholders ...
0
votes
1answer
126 views
Possibility of factorisation of rsa modulus due to vulnerability in java implementation code
Below is my implementation of the RSA algorithm. Actually I'm choosing the private key (d) instead of public key (e) and computing the public key.It is working fine but
I want to know if this is a ...
0
votes
1answer
61 views
GPG vs PGP vs OpenSSH and management of them
What is the main difference of the three?
Can I use only one of them for everything (e.g. GPG for SSH authentication)
If I encrypt my private key with a pass-phrase, is it strong enough so that if ...
1
vote
2answers
182 views
is AES secure for java application licensing
I have to license a java application and want to code a quick implementation, the scheme I came up with is:
1) The Application calculates a string X which we assume to be the md5 sum of the ...
1
vote
1answer
68 views
Security relevance of random factor in Paillier
In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$.
The additive-homomorphic property of the system shows that
...
1
vote
2answers
135 views
Zero-Knowledge Challenge-Responce Protocol
Good day to everyone.
I am trying to implement an e voting system (just for reference -it is not important though-it is described at the Internet Voting Protocol Based on Improved Implicit Security ...
1
vote
1answer
66 views
How to secure a mental poker protocol?
I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
2
votes
0answers
77 views
Are there any secure commutative ciphers?
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.
My question is, here there any commutative ciphers out there that are secure ...
3
votes
2answers
111 views
Simple RC4 key generation scheme
I would like to ask you about your opinion on the following scheme of combining a master key and a nonce and stretching the result to the full 256-bytes RC4 key.
Master key $K_m$ is a pre-shared ...
1
vote
1answer
78 views
Why is Bcrypt called a Key Derivation Function?
I am trying to understand why is bcrypt called a Key Derivation Function?
I looked up the details of Ekfblowfish on Usenix article here:
...
1
vote
3answers
146 views
What goals is homomorphic encryption aiming to solve?
As I understand from this article about homomorphic encryption, it
mainly aims to enhance the security of cloud computing. We should be able to encrypt data and send it to the cloud. After it is send, ...
2
votes
1answer
88 views
Security of Pohlig-Hellman exponentation cipher?
I am looking into implementing Pohlig-Hellman exponentation cipher and I would like to know how secure that algorithm is? I am guessing it's security relates greatly to the prime number used in it. ...
0
votes
1answer
38 views
What information to include is the 'info' input for HKDF?
The RFC states the following:
3.2. The 'info' Input to HKDF
While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main ...
4
votes
1answer
85 views
In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?
See this question. The comment by Brett Hale stated:
On the other hand, ensuring $(p - 1)$ has a large prime factor requires very little extra effort.
What's actually the 'little extra effort'?
0
votes
2answers
77 views
Is solving a modular linear equation a hard problem when the coefficient is not an invertible element?
Assume that we have a linear equation like this:
$$ax=b \pmod n$$
when $x$ is the unknown, and $a$ is not an invertible element in $n$.
is finding $x$ a hard problem?
(by solving I mean finding an ...
1
vote
2answers
60 views
Is it safe for the ChaCha8 nonce to be deterministic?
ChaCha8 takes a 8 byte nonce (or IV) that should not be the same twice for the same key. Generating this nonce randomly makes me very very nervous for collisions.
Is it safe to generate this nonce ...
2
votes
2answers
112 views
Timing attack on modular exponentiation
It is known that computing $a^x \bmod N$ takes $O(|x| + \mathrm{pop}(x))$ multiplications modulo $N$, where $|x|$ is the number of bits of $x$ and $\mathrm{pop}(x)$ is the number of $1$ bits (Hamming ...
0
votes
1answer
104 views
How to solve the reverse of an equation that uses MOD?
I've been tasked with reverse engineering an unknown crypto function. The function uses the following constants:
$a=380951$:
I noticed that this is a prime number
$b=3182$:
I noted that this is a ...
0
votes
1answer
45 views
Is it possible to create a Bilinear Function with Already Assigned “Multiplicative” Input Groups?
Assume that we have an already assigned Multiplicative Cyclic Group $\mathbb Z_p^*$ with order $q=p-1$, and $p$ is a prime number, is it possible to create a bilinear function $\hat{e}: \mathbb Z_p^* ...
2
votes
0answers
37 views
Unique GCM/CCM initial counters without recipient side message counters
I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
3
votes
2answers
83 views
Can I combine two PRNGs to make use of more seed data?
I have 320 bits of seed data (actually 512 bits of data with 320 bits of entropy, derived from a Diffie-Hellman shared secret and nonces). The PRNG I am using at the moment is the android version of ...
5
votes
1answer
488 views
Why is CAMELLIA suddenly so widely used?
When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available.
Is that not ...
3
votes
4answers
177 views
Is there a practical security difference between XXX-bit encryption?
I know I'm treading in dangerous waters asking this - my comprehension of cryptography math is sorely lacking. On the flip side it gives me massive admiration for what many of you are able to do.
...
1
vote
1answer
138 views
Simple example for CP-ABE (Ciphertext policy attribute-based encryption)
I'm currently working on Ciphertext Policy Attribute-Based Encryption (CP-ABE). So far I'm only using it with a basic understanding how it actually works. Now I want to understand it a bit better, but ...
2
votes
2answers
269 views
What is the difference between MAC and HMAC?
In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
4
votes
1answer
162 views
Can SRP be used with Elliptic Curves?
I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.
Edit: ok, can it be at least ...
5
votes
3answers
214 views
Finding roots in $\mathbb{Z}_p$
Is there an efficient way (algorihtm) to compute the solutions of the congruence $x^n\equiv a \pmod p$?
$n\in \mathbb{N}$
$a\in\mathbb{Z}_p$
$p$ is a large prime number
Note that:
By efficient I ...
1
vote
0answers
69 views
Is SHA-1 collision free on data up to 20 bytes long? [duplicate]
Is SHA-1 collision free on data up to 20 bytes long (lenght of hash / internal state)? That means that every input produce unique output, but you surely know that, i just write it in order my question ...
2
votes
1answer
101 views
Are RSA signatures deterministic?
If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, do I always will have the same signature?
A Java example always return ...
1
vote
2answers
90 views
While generating a random Elliptic curve what are the conditions i have to considerd?
I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy?
For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a ...
4
votes
1answer
135 views
Question about why RSA is hard to attack
I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do.
Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ...
4
votes
2answers
159 views
Is SHA-1 still practical secure under specific scenarios?
It is conjectured that SHA-1 has been broken from the "research" perspective but no in real world. That is that there is an algebraic attack that explores weaknesses on its algrebraic construction. ...
2
votes
2answers
156 views
How to efficiently generate a stream of independent, but biased random bits?
Usually, in cryptography, one is interested in debiasing a stream of independent (true) random bits, and several algorithms exist to do this. What about the converse? Let's assume I have a stream of ...
