7
votes
2answers
165 views

Encrypting or HMACing password digests

Assuming I'm using bcrypt to digest passwords, is any additional security gained by either encrypting or HMACing the resulting digests? By requiring a key to compare password hashes, I would expect ...
3
votes
2answers
118 views

Asymmetric key derivation – Who derives the new pub key can't know the new private key

I'm looking for a peer reviewed protocol or algorithm that can do this, preferentially I need something based on elliptic-curves cryptography. Alice know the main public key of Bob (B-PUB-1). Alice ...
2
votes
2answers
128 views

Why have Nonce and why encrypt everything in step 2 for Needham-Schroeder?

Here is the protocol outline I am looking at (source: Foundations of Computer Security, Lecture 60: The Needham-Schroeder Protocol) $$ \begin{array}{ccl} 1.& A \to S \colon& A,B,N_a \\ ...
5
votes
1answer
193 views

Relation between key size and PRNG state size

Some (supposedly) cryptographically secure PRNGs have an internal state of only 160 bits or less. When the algorithm is otherwise properly designed, that seems like enough to generate a 128 bit key ...
4
votes
1answer
153 views

How secure is this use of Ziv-Lempel encoding?

I'm reading patent application US 20120278897 A1 — “System and method of sort-order preserving tokenization”. Near the bottom they describe their token generation algorithm, which basically involves ...
4
votes
1answer
388 views

Attacks on the RSA Cryptosystem

I was reading some articles about attacks on RSA system and I wonder about some generalization of the following theorem. Theorem (Coppersmith). Let $N=pq$ be an $n$-bit RSA modulus, where ...
3
votes
1answer
323 views

How do institutions like banks do RSA with big primes?

When encrypting with RSA it is often infeasible to decrypt by just doing c^d mod n, because for example when using the primes $(p,q)=(12553,1233)$, which are small ...
3
votes
1answer
186 views

Calculating amount of time for brute forcing ciphertext depending on the size of the key

I am a graphic design student and for my information graphic project I have chosen the topic of the history of encryption and how the security level developed over the centuries. It’s basically an ...
3
votes
1answer
176 views

AES-CTR with ephemeral keys vs IV

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several ...
2
votes
1answer
52 views

Encryption mode with chained algorithms

Suppose that I want to encrypt some data using two different algorithm chained (e.g. AES and Serpent) and harnessing the benefits of CBC. I can do: ...
2
votes
1answer
111 views

Is it necessary to use single hash function for signature generation and HMAC?

I am trying to figure out if we need to use single hash function across all the places in a ssh session. i.e – signature generation/verification and HMAC calculation/validation. Is it possible to use ...
2
votes
1answer
147 views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...
1
vote
1answer
25 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
1
vote
1answer
45 views

In Pedersen Key Distribution, can the public key be persistent?

I am implementing a key distribution protocol described by Torben Pedersen in A Threshold Cryptosystem without a Trusted Party (EUROCRYPT'91). In the protocol, the $n$ parties distribute a public key ...
1
vote
1answer
75 views

Sequence of Encrypting RSA like Chaum Blinding scheme

I'd be a noob in cryptography but reading up a little on RSA, I do get some understanding and I want to specifically resolve this issue. UPDATED Lets say we have the following values in place: ...
1
vote
1answer
121 views

Leak-proof protocol: is such a thing possible?

Is it possible to design a protocol that by itself guarantees that a malicious implementation cannot leak secret data without breaking the protocol? Setting: Alice and Bob have a pre-shared secret ...
1
vote
1answer
95 views

Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?

I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys ...
1
vote
1answer
95 views

What is the best way to share a shared secret key over HTTPS to be used for HMAC authentication?

I am writing an application in Java that will be using SHA-1 HMAC message authentication. From what I understand, a connection over HTTPS is considered secure enough to share a secret key in plain ...
1
vote
1answer
85 views

Why should a signature use PSS padding in RSA?

Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and ...
1
vote
1answer
61 views

Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?

Let R1 and R2 be (32 byte) random values, and let a H = Hash (R1, R2, Message) be of the same length as each R value. Provided E (R2, R1, Message) is operating in some chaining mode, are there any ...
1
vote
1answer
66 views

Is there a method to combine encryption and ring signing?

There's the well-known question on whether to sign or encrypt first. However, if instead a message is to be ring-signed such that either recipient could be the actual signer, is there any scheme that ...
1
vote
1answer
154 views

Insecurity in Needham and Schroeder protocol?

I've been studying specifically the authentication algorithm Needham and Shroeder, and understand the idea in general of the message exchange. But, researching on the subject, I found a question that ...
1
vote
1answer
94 views

Reusing PGP key when generating SSL Certificate Authority?

Does it make sense to reuse some of the keys from my PGP (gnupg, gpg) keyblock when generating my own SSL Certificate Authority (a toy one for myself and a few web services of mine)? In an ideal ...
0
votes
1answer
143 views

How can I convert numbers into prime numbers?

I'm working with one-way accumulators, but I'm not knowledgable in cryptography. Is there an easy peasy way to hash numbers (or whatever) into prime numbers? Obviously I'd like it to be collision ...
0
votes
1answer
86 views

Questions about hash functions

Let $H$ be a secure hash function (e.g. SHA256), is it possibile to find $H(M1)$ given $H(M1||M2)$ if the length of $M1$ and/or $M2$ is exact the block size of the hash (that is, 64 bytes for SHA ...
0
votes
1answer
61 views

how to use salt to sign a message and how is it effective?

I've had an assignment to sign a file using hash and salt, so I read about salt and I got why it's important when it comes to password, but not to sign messages. 1- how to sign using salt ? the only ...
-1
votes
1answer
69 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...
-1
votes
1answer
67 views

Advise key management protocol

Assume that sender and recipient both already have each others public keys(certificates). Sender needs to generate session key to encrypt some data and sends encrypted data to recipient. All offline - ...
-1
votes
1answer
75 views

Sematically Secure McEliece

I am read the Lemma 2 (pp13) in the paper "Kazukuni Kobara and Hideki Imai: Semantically Secure McEliece Public-Key Cryptosystems –Conversions for McEliece PKC– (PKC 2001)". Related to the question ...
0
votes
0answers
67 views

hybrid PKE scheme CCA2 insecurity

I'm reading a paper here say: As we know, in hybrid PKE schemes XOR alone cannot perfectly hide challenge bit to the CCA2 adversary The author does not define hybrid PKE schemes. What is ...
0
votes
0answers
81 views

About private keys of certificateless cryptography

While reading Identity Based Cryptography and Certificateless Cryptography , Can any one tell why should private key generator(PKG) or Key generation center (KGC) generate private keys for users..? ...
0
votes
0answers
84 views

How to Generate rsa keys using specific input numbers in openssl?

I am new to openssl so asking this question here for help. I selected 2 prime numbers p and q. Calculated public pair: (n,e) and private key: d. For ex. ...
0
votes
0answers
111 views

Certificateless Signature

Consider the following scenario: There are two users: A and B. Users A and B generate a pair of their own public and private keys PUBa, PRIa and PUBb, PRIb. There is one trusted center(TC) that ...
0
votes
0answers
34 views

What is the default type of salt for encryptions in Heimdal Kerberos?

I am trying to figure out what the salting mechanisms are for various kinds of encryptions in Heimdal Kerberos. In section "4.11 Encryption types and salting" of the Heimdal Kerberos documentation it ...
0
votes
0answers
62 views

Use of Different keys with PCBC

Currently I am having a doubt, while making a "DES PCBC" encryption on an image I observe a bit of the silhouette of the image (Probably because of the XOR between plaintext blocks and ciphertext ones ...
0
votes
0answers
101 views

How many messages needs to be send to server to get AES key in Cache-timing Attack

I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on ...
0
votes
0answers
129 views

How do multiple parties agree on a target block to hash for?

Bitcoin style blockchain… I have party(node) A, B, C and algorithm X. Algorithm X generates the first half of a target hash input - the "solution" to the problem. I want A, B and C to sign their ...
0
votes
0answers
140 views

High throughput and efficient data encryption/description? (other than AES)

What are some of the high throughput and efficient ciphers? I know AES has generally good performance, but is there anything more efficient that it now? I would like to perform small performance test ...
0
votes
0answers
358 views

How is the initial permutation of DES created?

I am creating a program in C language with DES (Data Encryption Standard) functionality, but don't know how to apply the initial permutation. Is it achieved by swapping the values? If "yes", then ...
0
votes
0answers
263 views

Keepass Twofish plugin security

Keepass is a well known open-source password manager program, with plugin support. One of the offered plugin is a twofish encryption mode of operation in lieu of the build-in AES algorithm ...
0
votes
0answers
48 views

Identifying a PKI cert uniquely

A Web Application wants the user to digitally sign a transaction using a PKI certificate. All users are pre-registered with the web-application. Pre-registeration includes uploading the Public part of ...
0
votes
0answers
146 views

How to safely sign a 6 characters String?

I have to decide, whether a document, which I am given, was correctly signed by a private key. my Ideas is to sign the document id using RSA with the private key and to print the following onto the ...
0
votes
0answers
50 views

Are there any bi-bidirectionally indistinguishable Asymmetric Encryption Algorithms

I have been using Asymmetric Encryption for a while, and I have come across an interesting concept, and it would be cool if it could be done. Are there any Asymmetric Encryption Algorithms where the ...
0
votes
0answers
77 views

can permutation matrix be found in parallel processing technique?

Let us say there exists a permutation matrix $n \times n$ for some large $n$. Then, there are $n!$ possible permutations. If one to use brute-force to find the secret permutation among $n!$ ...
0
votes
0answers
135 views

Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
-1
votes
0answers
27 views

HKDF as keystream generator

This is not my design, but used in the onepw protocol used for the new sync scheme in firefox by mozilla. https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol In this scheme a key is ...
-1
votes
0answers
38 views

What are the exact steps to decryption in International data Encryption Algorithm (IDEA)?

Can anyone tell me what are the exact steps for decryption in IDEA algorithm? I am doing that in this way: Taking multiplicative and additive inverse modulo of encryption keys. Creating decryption ...
-1
votes
0answers
21 views

Any good means to enhance the security of encryption processing with random prefix codes?

From a recent question of mine in this forum "Is substitution with random prefix codes secure?" I obtained a very valuable answer: "No. These codes are not secure. They are not secure against a ...
-1
votes
0answers
40 views

Does repeated hashing create a PRF?

Say you start with a seed value and hash it with a secure hashing algorithm, then hash the output of that and so on... Is this a PRF? Or does it have a certain computable period?
-1
votes
0answers
26 views

Winternitz checksum

I'm reading the One Time Signature Winternitz in this book [pag 38]. My question is Why is important the checksum? Is there any attack again Winternitz OTS if the checksum is hidden?

15 30 50 per page