2
votes
1answer
212 views

Why is verification using DSA slower than verification with RSA?

We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this? DSA parameter generation: choose prime number $p$ choose prime number $q$ such ...
2
votes
2answers
502 views

Why RSA uses {d,n} as private key instead of {e,n}?

While studying the RSA algorithm I referred to some books and some sites such as RSA (wikipedia) and all of them chose {d,n} as the secret (private) key and release {e,n} as the public key but as d ...
1
vote
1answer
153 views

Which keys are necessary to decrypt Application data in a SSL connection?

I'm debugging an application which communicates between client and server using a SSL/TLS connection, and want to capture and analyze the sent data. Are the client write keys and server write keys ...
0
votes
1answer
115 views

what actually the function for e(g,g)^xy

I doing a project using ABE "Attribute-Based-Encryption" but i didn't understand what actually the function for $e(g,g)^xy$. Just tell what's the calculation need to perform here. I gone through no of ...
7
votes
2answers
232 views

Linkable ring signature scheme

I need an implementation of linkable ring signature, a ring signature which allows identifying whether two signatures belong to the same signer. It has important privacy-related applications, like ...
1
vote
1answer
248 views

Key sizes for discrete logarithm based methods

I have a question regarding the key generation process of methods that are based on the discrete logarithm problem. This site gives some good insights, but I don't fully grasp it I think: ...
24
votes
2answers
916 views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows ...
3
votes
3answers
621 views

Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
14
votes
4answers
7k views

Recommended skills for a job in cryptology [closed]

First let me apologize if this is an ill posed question. Let me also note that I do not in any way seek a comprehensive answer, simply your thoughts on what makes for a valuable asset to a company ...
2
votes
2answers
207 views

What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?

I'm working with the affine representations of points of the Secp256k1 elliptic curve (from Bitcoin). I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed ...
2
votes
1answer
182 views

How does the birthday attack work in AUTH and UF-CMA games?

In the AUTH and UF-CMA games, an adversary is required to forge a ciphertext or message/tag pair to win the game. Given an encryption scheme $E$ and a PRF $F$, let $\hat{E} = C || F_k(C)$ and $C = ...
3
votes
1answer
383 views

How much data can I encrypt with AES before I need to change the key in CBC mode?

In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted. It seems that ...
1
vote
1answer
139 views

Do I need to keep a 64-bit version number secret?

Assume the following structure: version | iv | ciphertext | HMAC(version | iv | ciphertext | ..., key) The version starts out ...
11
votes
1answer
647 views

Is Wikipedia's table about SHA-2 collisions correct?

I was looking a Wikipedia article on SHA-2, and the "Comparison of SHA functions" table seems to indicate that SHA-2 is less secure than SHA-1. Is this true, or is the table wrong / misleading? ...
0
votes
1answer
136 views

What key length is required to keep simple keyed “hash” secure?

In a previous question, I described a particular keyed "hash" that mapped a 5-digit input code into a 5-digit output code. It used a 8-bit key which is very insecure - more than 99% of the time, you ...
10
votes
1answer
478 views

How random are commercial TRNGS

I'm thinking about buying a USB TRNG. How do I evaluate its randomness? I'm sure some are better than others but which is which? Are thermal-noise better than radio-noise TRNGs?
-1
votes
2answers
226 views

Perfect Secrecy, two Definitions

I'm reading the proof of the implication "Def 2.1 $\Rightarrow$ Def 2.4" in these slides about Adversarial Indistinguishability and Perfectly-Secret Encryption. I have a doubt in the slide 10. Here it ...
2
votes
1answer
147 views

Is this algorithm secure?

I recently found this site, proposing a hashing algorithm for passwords. They describe the following: pad the password on both sides with SHA1(email) to ...
0
votes
2answers
145 views

Physical Level Encryption

What types of algorithms that are capable of signing a message are out there that run on a physical level, e.g. lacking the infrastructure of a standard PC, no memory, processor or motherboard in the ...
1
vote
2answers
310 views

Are there any hand ciphers not obsoleted by computer cryptanalysis? [duplicate]

Computerized cryptanalysis has obviously made formerly "secure" hand ciphers like Playfair, Four Square, and the Hill Cipher obsolete because they can be defeated in seconds. But is there a hand ...
-2
votes
1answer
445 views

How to calculate cycles per byte [closed]

Sometimes, websites and scientific papers that introduce and/or handle cryptographic algorithms also provide speed-analysis and tables comparing the individual performance of cryptographic ...
-1
votes
2answers
339 views

Why this k parameter is in unary in adversary PPT algorithm? [duplicate]

While reading some text on cryptography, I found that algorithm $A$, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message ($y$) and ...
3
votes
1answer
300 views

Alternatives to HMAC + CBC?

I'm looking at using HMAC + CBC. The combination looks like this: ciphertext = AES256(text, k1) data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext Where: ...
2
votes
2answers
835 views

Is Base64(SHA1(GUID)) still unique like the original GUID?

Basically what the title is; GUIDs are unique by design. If you run the GUID through SHA1 and then Base64 the hash, will the resulting string have the same guaranteed uniqueness as the GUID, or not?
2
votes
2answers
445 views

What are the potential security impacts of using CRAM-MD5 for Emails, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. But ...
3
votes
1answer
139 views

When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?

I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w ...
1
vote
1answer
279 views

Polynomial multiplication and division in2^128

I want to multiply and divide polynomials, and implement the extended Euclidean algorithm for polynomial greatest common divisors, over a Galois Field of size $2^{128}$. Moreover, I want to use the ...
2
votes
1answer
437 views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...
1
vote
1answer
148 views

Is this a sensible cryptographic protocol intending to reduce the impact of compromised security?

I'm in the process of designing a cryptographic protocol which will reduce the impact an attacker will have if they gained root access to a server storing data. The basic crux of it is that keys ...
1
vote
2answers
696 views

Generate fixed length cipher text from arbitrary length plaintext

Using an encryption algorithm like AES, is it possible to generate a fixed length cipher text no matter how long the plain text becomes?
4
votes
1answer
489 views

Hill-cipher, disordered alphabet

I am going to apply a simple substitution cipher to my input, then encrypt the result with a Hill cipher. How can this be broken, in a chosen-plaintext threat model? In other words, instead of the ...
1
vote
2answers
289 views

Help me describe/identify this challenge-response protocol/algorithm?

My area of expertise is reverse engineering, specifically embedded systems. I do attack cryptographic systems, but this largely involves key recovery or exploiting the implementation. I was asked to ...
2
votes
2answers
179 views

Is Functional Encryption about Access Control over encrypted data alone?

Informally, In functional encryption system , a decryption key allows a user to learn a function of the encrypted data. But all i see is that the function acts as an access control over the data. ...
1
vote
0answers
42 views

calculating beta for elgamal elliptic curves [duplicate]

Suppose we use elgamal elliptic curves for secure communication. Bob selects a prime $p$, an elliptic curve $E$, a point $\alpha$ on $E \pmod p$, and a secret integer $f$. Suppose that Bob has ...
2
votes
2answers
373 views

SHA-1:Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output?

Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output? What is the probability that a 160-bit SHA-1 hash output contains at least 128 1's?
2
votes
2answers
975 views

True random numbers generated by sensors

Is using sensor raw data a good way of generating true random numbers? I mean using an IPhone's gyro/accelerometer raw output as a base for generating an array of true random numbers.
2
votes
2answers
314 views

Generating IV in TLS 1.2

I'm writing a TLS 1.2 implementation (in C#) using a custom protocol. My question is how to generate the IV attached to each message, I don't want to use RandonNumberGenerator because I've heard it ...
0
votes
1answer
65 views

PKCS#11: Which CKK_types are supported by CKM_PKCS5_PBKD2?

On Solaris there's a function pkcs11_PasswdToKey() which is a wrapper of C_GenerateKey(). I made a simple test and it turned out ...
2
votes
1answer
301 views

What is a fair exchange scheme?

The Wikipedia entry Fair exchange has only two lines, and the only paper I can find describing such a protocol is extremely complicated. Is this a new field in cryptology or can someone give an ...
0
votes
1answer
78 views

Encrypting a broadcast channel

We're building a data service that is expected to go out through a single "fat pipe" channel. The design requirement says that the data in the channel must be protected by authentication and ...
6
votes
1answer
851 views

Using an MD5 hash as a password

Suppose Alice is using a password prompt that only accepts up to 32 characters for any particular password. Memorization of long strings of random characters is not one of Alice's strengths, so she ...
2
votes
2answers
337 views

CSPRNG in JavaScript using Audio and Video

I ported GnuPG to Javascript using Emscripten (not released yet). Now I need a good replacement for /dev/random//dev/urandom. ...
3
votes
1answer
271 views

Why is the discrete log problem easy when the exponent comes from a binomial distribution?

I read in http://epubs.surrey.ac.uk/7219/2/esorics06.pdf that in exponential El Gamal the discrete log problem for recovering $m$ from $g^m$ can be made tractable when $m$ is drawn from a binomial ...
1
vote
2answers
291 views

Why is the following RSA PRNG cryptographically secure?

One requirement states that the generator has to withstand the next-bit test. Consider the following PRNG, where we calculate next output $x_i$ via the formula $x_i = x_{i-1}^ e\mod n$. I can see ...
3
votes
2answers
371 views

Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
1
vote
1answer
270 views

Designing a security system from scratch with a custom protocol, suggestions needed

For the reasons I cannot go into details, I need to design my own protocol and overall security system which will be used to establish secure data exchange between various devices (most notably ...
2
votes
2answers
460 views

Combining LFSRs for Stream Ciphers: Why do we need high non-linearity?

Linear Feedback Shift Registers (LFSRs) can be excellent (efficient, fast, and with good statistial properties) pseudo-random generators. Many stream ciphers are based on LFSRs and one of the possible ...
7
votes
2answers
287 views

How to do a literature search

How do I do a literature search of the research literature on cryptography? Assume there's some topic in cryptography I'd like to learn more about; how do I search the cryptographic research ...
2
votes
1answer
203 views

Does SRP reduce to DH key echange when shared password is not secret?

I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later. I ...
2
votes
4answers
689 views

random number generator 10-side dice alternative

A lot of sites (e.g. Dirk Rijmenants') refer to 10-side dice to generate random number for one-time-pad. I was thinking about new ways to generate random numbers, letters and passwords. here what I ...

15 30 50 per page