6
votes
1answer
364 views

Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
2
votes
3answers
1k views

What is the length of an RSA signature?

Is it the same as the bits of the key (So a 2048 bit system will yield a 2048 bit signature)? At most as the key? Or something else entirely?
4
votes
4answers
511 views

Which block cipher modes of operation allow a predictable IV?

Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique ...
3
votes
2answers
747 views

Why can't the IV be predictable when its said it doesn't need to be a secret?

I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should ...
4
votes
2answers
367 views

Cryptographic GUID?

I need a GUID. Really just any number that is likely to be unique. However I prefer not to leak time and other things as a GUID may leak. What should i use as a cryptographic replacement? I was ...
1
vote
1answer
57 views

Design question for a service that signs messages on behalf of a user

I'm working on a messaging service that lets users author messages and have them signed with an RSA key. The key is used for identity purposes only and can be revoked, so compromising the private key ...
5
votes
2answers
250 views

Do MD5's weaknesses affect Oplop?

Oplop is an algorithm that generates account-specific passwords from a master password and user-chosen nickname (typically username@domain). From the website: Concatenate the master password with ...
6
votes
4answers
4k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
1
vote
2answers
184 views

Is stretching hash several times basically the same as bcrypt?

As I understand it, the main advantage of bcrypt is stretching so it becomes slower to crack overtime. But, is using a "good enough" algorithm (e.g., SHA-2 family) then stretching until it's slow ...
3
votes
2answers
2k views

Secure private key storage

I'm developing application in Java that has to store RSA keys in software for foreseeable future (that is, at least 10 years). The two most common standards of storing private keys are PKCS12 and JKS ...
2
votes
5answers
752 views

Approach towards anonymous e-voting

I want to implement an internet-based e-voting system. Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy ...
-2
votes
1answer
153 views

Why is 2 the inverse of 10?

I have one question about the ECDSA signature scheme. When Bob wants to send a message to Alice that is to be signed she makes following things (with for example $A = (5,1)$, $d=7$, $q=19$). ...
6
votes
1answer
137 views

How to turn adversary against encryption of zeroes into adversary against random bits?

I recently read the article Nonce-Based Symmetric Encryption by Rogaway, where he presents two different notions of indistinguishability, which he calls ind$ and ind, respectively. Here's the ...
0
votes
1answer
85 views

inverse of 985 mod(φ60131)

Alright Ive been working on this one for a while I found φ(60131) to be 97294 ½(60131+60131(5)^.5) = 97294 then I worked through the GCD ...
4
votes
2answers
181 views

How long does it take to extract a key from a FIPS-140 Level 2 device?

How long does it take to extract a key from a FIPS-140 Level 2 device? What records are there of successful extraction? How much did the first extraction from a given device cost? How much would a ...
3
votes
3answers
270 views

Existing works on pre-computing ElGamal ephermal keys

I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
2
votes
1answer
149 views

How is the EAX-mode used in EAP-PSK (RFC 4764)?

According to the specification of RFC 4764, contents in EAP's third message and fourth message are required to be encrypted by AES-128 in EAX mode (also called protected channel). In RFC 4764, the ...
0
votes
1answer
259 views

Polynomial for secure communication

Can we use a polynomial $P(x)$ to securely communicate ? For example Alice & Bob agree on a degree of a polynomial. The value $x$ & the coeficients are generated from a seed using a hash ...
10
votes
2answers
336 views

Is RC4 a problem for password-based authentication?

This is a follow-up question to Does TLS use RC4-drop[n]?. As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that ...
1
vote
1answer
105 views

Random decomposition of symmetric key

Considering a symmetric cipher (i.e : AES in counter mode), is it possible for any given key to be randomly decomposed into other keys without knowing the message or the ciphertext, such as : ...
3
votes
2answers
278 views

Is it possible to match encrypted documents using user-defined search terms?

Suppose I am storing a number of encrypted documents in a database. I would like to make it possible to identify the subset of documents whose contents match user-specified search terms without a) ...
14
votes
2answers
1k views

Blum Blum Shub vs. AES-CTR or other CSPRNGs

Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
2
votes
1answer
190 views

Aes encryption -The relevance of static matrix in mixcolumns operation

Can someone explain to me the relevance of the static matrix used for the mixcolumns operation in aes encryption.i.e the relevance of why the byte is multiplied by 2 + next byte multiplied by 3 + next ...
8
votes
1answer
930 views

Is a second preimage attack on MD5 feasible?

What's the practical status of MD5 w.r.t. second-preimage? Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
1
vote
3answers
107 views

MISTY1 Implementation error

I am trying to implement MISTY1. It's RFC, RFC2994, contains psuedocode that I basically copy and pasted into Code::Blocks. However, I managed to mess that up somehow. After 2 days, I still have not ...
1
vote
1answer
528 views

How to jusify {e,n} is a valid RSA public key?

I have a two set of key {36,77} and {50,117}, How can validate if it is a valid RSA public keys? Is there any simple method?
2
votes
1answer
161 views

What are the dangers of predictable (repeated) plaintext structures?

When using a "good", modern cipher (specifically one that provides ciphertext indistinguishability), is it a problem at all if there is some well-known structure in all plaintexts? For example, ...
6
votes
2answers
377 views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
2
votes
2answers
187 views

Stream cipher malleability

Considering a stream cipher that produces a ciphertext $c$ from a message $m$ and a key $k$ is it possible to apply operations (multiplication and/or addition) directly to $c$ without knowing the key ...
2
votes
0answers
57 views

Are there any systems like SDSI / SPKI that are currently being developed?

SPKI / SDSI look interesting but appear to have fizzled out and died. Are there any modern competitors?
6
votes
4answers
907 views

Relative security of a Vigenère cipher

Within a closed computer network, I am ciphering some plaintext data as an added security measure. This is below several other layers of protection. For various technical reasons, I am restricted to ...
5
votes
1answer
336 views

Does TLS use RC4-drop[n]?

According to many sources, the first few (n) bytes of the RC4 keystream are strongly biased, and therefore should be discarded before using the keystream to encrypt anything; this precaution is ...
1
vote
2answers
131 views

Practical implementations of Multiparty computations [closed]

Are there any practical implementations and or software platforms to prototype applications based on MPC ?
2
votes
1answer
185 views
7
votes
1answer
326 views

Why x00 is usually avoided in salt?

In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, ...
2
votes
1answer
172 views

How many different keystreams can I produce with AES in Counter Mode?

I'm using a 64-bit nonce (incremented between the streams) and a 64-bit counter (incremented within a stream) for AES in CTR mode. How many different key streams can I produce with this setup?
3
votes
1answer
163 views

Encrypt array of int for individual retrieval

I have limited exposure to cryptographic terminology, so please bear with me. My end goal is to encrypt integer IDs, before transmitting them to a web client in a list of search results, in a way ...
0
votes
1answer
414 views

SSTP MSCHAP-V2 Authentication before SSL or after SSL Session

So with the recent news that there's a lovely new tool to crack MSChapV2 packets. So the question I have is on a SSTP Connection is the MSChapv2 handshake encrypted pre SSL setup or post. Obviously ...
2
votes
1answer
154 views

Why do we need extra hashing if we could use simpler scheme?

Lets say that we use init vector IV, key K and HMAC key H. Message is M. Mode of operation is CBC !!! We usually encrypt this way: ...
3
votes
1answer
235 views

What is the name of this kind of protocol

There is a communication protocol that I believe creates the equivalent of a one time pad, with the downside that the secret message must be transferred multiple times. The protocol is so simple that ...
1
vote
1answer
243 views

Are there any multiparty homomorphic encryption schemes?

Are there any multiparty homomorphic encryption schemes ? Most of the literature is about two party schemes . Is there any generalization made for n party ?
1
vote
1answer
513 views

What would be the most effective way to brute force a 16 char AES key?

I have a file that is encrypted in AES using a 16 char string. The string is (a-zA-Z0-9) and .,?!. Also, it only contains words ...
5
votes
1answer
759 views

How do I calculate CRC32 mathematically?

I want to calcuate the CRC32 algorithm using polynomials directly but I don't know how. I found the generating polynomial listed here https://en.wikipedia.org/wiki/Cyclic_redundancy_check. This ...
3
votes
6answers
923 views

Why does ROT13 provide no cryptographic security?

I can understand that ROT13 is not secure for obvious reasons, but I'm looking for the theoretical answer. Wikipedia says "The algorithm provides no cryptographic security.." What does it mean to ...
0
votes
3answers
248 views

Should I use md5 for my new application?

MD5 is a very fast hash and its output is short and easy to store. Should I use it for my non-security-sensitive application? I don't think so, but I can't seem to convince anyone else that this is ...
1
vote
1answer
710 views

AES GCM symmetric encryption of data at rest in c#, ciphertext much longer than plaintext

I've written encryption/decryption routines using AES GCM. Code can be found here. I recently realized that the cipher text is longer than I believe it should be. It should add the tag and IV onto ...
3
votes
2answers
243 views

Is just a bit of random, “fully random”?

I understand that hashing a datetime is a pseudo-random number, and not good in a security context. But what about hashing a datetime plus a truly-random but constant string (just a string that an ...
3
votes
2answers
386 views

Adaptive Hash Functions: How to tell how many iterations were used?

If an adaptive hash function like bcrypt or PBKDF2 is used in hashing passwords, the number of iterations used in the hashing process can be configured. For a penetration tester or a malicious ...
17
votes
3answers
544 views

Purpose of outer key in HMAC

From what I know, the HMAC constructions has two strength: It's resistant to length extensions Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
0
votes
2answers
707 views

Are mouse movement coordinates useful as a seed for a RNG?

Is it good to use a mouse movement as a 64-bit random seed for a Pseudorandom Generator like AES in Counter Mode? Should I only need to get the X and Y coordinates of the mouse movement?

15 30 50 per page