3
votes
1answer
64 views

What is the right notion of security to use for file encryption?

It seems that several file encryption systems do NOT use authenticated encryption. (E.g. gpg --symmetric and boxcryptor as far as I can determine). I understand that this is generally considered ...
2
votes
0answers
104 views

Is there a mental poker algorithm that does not rely on commutative encryption?

The algorithm for mental poker that I saw on Wikipedia and everywhere else relies on an encryption algorithm such that $E_k(E_j(P)) = E_j(E_k(P))$, but I can't find a modern and secure algorithm for ...
1
vote
1answer
356 views

About Primitive roots mod n in Diffie-Hellman [duplicate]

I'm on the study of Diffie-Hellman and its related math (multiplicative group of integers $\mod n$). In some crypto papers and documents I've read that $g$ needs to be a primitive root mod $n$ ($g$ ...
1
vote
0answers
47 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute (...
2
votes
0answers
138 views

DPA Attack on HMAC SHA-256

I have read the paper Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written: The last ...
3
votes
3answers
408 views

Fast PKI for embedded device

We are creating a device with a small microcontroller (20 MHz CPU 16 KiB RAM). We need some way to securely send signed files to device (only signature, no encryption necessary). An external company ...
0
votes
2answers
322 views

How to decrypt a PGP message with only the two primes and the public exponent?

I'm trying to decrypt a PGP Message that is encrypted with an RSA key, but I only have this information: Public exponent: 65537 Prime 1: ...
0
votes
2answers
299 views

Operation modes of block ciphers how are used?

I am studying about different operation modes of block ciphers my question isn't something specific to that, but is how these operation modes are used in cryptography? I have this picture here (OFB-...
2
votes
1answer
138 views

poodle padding multiple blocks?

I'm quite new to the topic and read a bit about poodle and padding oracle. I quite understand the "regular" padding oracle attack, substituting the last byte of block(n-1) to determine the last byte ...
1
vote
0answers
69 views

Non-interactive zero-knowledge proof for discrete logarithm without random oracle

Is there any non-interactive zero-knowledge proof for discrete logarithm without random oracle over the group $\mathbb Z_p$?
1
vote
4answers
858 views

Why don’t all AES encryption tools produce the same key from the same password?

Alice and Bob meet regularly. They have agreed face-to-face a 128 bit password which they want use to encrypt/decrypt emails written between them. They decide to use 256-bit AES. Alice wrote her ...
1
vote
0answers
82 views

Does the encryption algorithm DES perform random permutations? If so how is information not lost?

Before round 1 begins, all 64 bits of an incoming message and all 56 bits of the secret key are separately permuted (shuffled) My question is this : Is the shuffling of the bits performed randomly? ...
1
vote
0answers
59 views

Why is public key cryptography not widely used in governments? [closed]

Are there any practical limitations? Govt driving license, passport, SSN could be digitally signed making it easy for anyone to validate. They can have a qr code in them which can be easily validated ...
7
votes
2answers
369 views

What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently ...
0
votes
4answers
183 views

One time pad in CBC mode?

I have been searching about if it is more secure to use CBC mode in OTP but I can't find anywhere where people have sad that it is more secure. Question: Is CBC mode in OTP more secure? Because I ...
1
vote
3answers
448 views

Sharing a secret key between many users

I would like to know if there is any security issue in sharing a secret key (of an asymmetric cryptography) between several users. I know that this secret key is no longer "secret", so it's no longer ...
0
votes
0answers
71 views

Bilinear pairing arithmetic - cryptographic accumulators

For calculating accumulated values for set of elements chosen randomly from say $ { e_1 ,e_2,...e_n}\varepsilon X $ we use the formula $acc= g^{f(e,s)}$ where $ f(e,s)= (e_1+s)(e_2+s).....(e_n+s)$ ...
0
votes
1answer
85 views

What is the difference between H(M) and H3(M, s, IDA)? [closed]

What is the difference between H(M) and H3(M, s, IDA)? I am aware of Hash function with a Message and a Key, but there are three parameters in: H3(M, s, IDA). Here M is the message, s is the key, ...
2
votes
2answers
88 views

Are covert and rational adversaries same?

Aumann and Lindell defined covert adversaries in 2009 which is informally adversaries which have a epsilon-deterrence to cheat. Some authors (for ex. John R. Wallrabenstein) have defined similar ...
1
vote
1answer
2k views

PGP public RSA key format

I have been trying to use Go (I could post the code, but I think I posted enough already...) to generate a PGP RSA key. However every time I try to encrypt something with it, something fails. However, ...
2
votes
0answers
59 views

Cryptographic enforcement schemes using Diffie-Hellman

If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ...
2
votes
1answer
149 views

Ring signatures in ECC

Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret ...
2
votes
1answer
426 views

How many bits of entropy can I expect from /dev/urandom in iOS?

Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and "...
0
votes
0answers
50 views

Discrete log in Galois Extension Field

I was reading 'Pinocchio Coin' paper by Danezis et al. where they have said, "If we use the efficient pairing groups of Pinocchio, computing discrete logarithms in the exponent field $\mathbb{F}_p$ ...
1
vote
1answer
222 views

Finding public exponent e

I'm trying to create an algorithm to find the public exponent e given a plain (non-CRT) private key that doesn't include the public exponent, i.e. I've only got $n$ and $d$. A question has already ...
1
vote
1answer
268 views

How to calculate RSA CRT parameters from public key and private exponent

Given the public key (n, e) and private exponent (d), how to calculate CRT parameters (p, q, dP, dQ, and qInv) of this RSA key pair?
3
votes
2answers
163 views

Is it practical to use a stream cipher in a block cipher mode?

My idea is to use a stream cipher encrypting 16 bytes at a time as a primative block cipher in a mode of operation such as CBC mode. Is this practical or useful in any way?
0
votes
0answers
71 views

Name of this attack?

I am studying Merkle tree signature. Let $\sigma=(s,Y_s,\sigma_{\text{OTS}},As)$ be a signature of certain document. Here $s$ is the index of leaf, $Y_s$ is the respectively OTS public key and $A_s$ ...
3
votes
2answers
2k views

Using ECB as RSA encryption mode, but encrypted messages are unique

As I understand, ECB should not be used as encryption mode unless you are encrypting single blocks of data which are always unique and only are encrypted once. I have a collection of ids represented ...
2
votes
1answer
102 views

Are pseudorandom permutation really permutation in mathematical sense?

In security, and specifically Block Cipher (AES, DES, etc), when we talk about pseudo random permutations, is the term "permutation" refer to the same meaning as in discrete mathematics. That is, the ...
2
votes
1answer
74 views

Compacting a substitution cipher key

In a substitution cipher, I recieve 3 bits and than I return another 3 bits. The key of this cipher could be a matrix represented as: ...
-3
votes
1answer
76 views

Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block? [closed]

The most promising of the 4 approaches described here (version 4) has been posted as a separate question. This post should be considered for archiving and historical purposes only. Disclaimer: the ...
0
votes
2answers
46 views

Would this method allow fast authenticated encryption using only a single encryption operation per block?

[This approach is flawed. A different speculative approach using an RNG instead of the cipher as a source of entropy was posted as a separate question] Assume $E$ is a block cipher, $C_0 = IV$ and $...
2
votes
2answers
394 views

Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?

Encrypt-then-Authenticate (EtA) seems to generally be considered the better option, compared to Authenticate-then-Encrypt (AtE) (see this Crypto.SE question, for example). The people writing the RFC ...
5
votes
1answer
94 views

Why do we truncate the hash when using DSA?

All the articles I read on the web about DSA keep telling me that the size of the hash needs to be truncated so that the bit length is equal to or lesser than the bit length of the prime number of the ...
0
votes
1answer
60 views

Executing encrypted code? [closed]

I want a code 'black box' that receives data inputs, processes those inputs, then sends out the outputs. I want the code to be encrypted, or somehow obfuscated. Is there any known way to do achieve ...
12
votes
1answer
642 views

RSA with probable primes

I am a bit of a newbie to RSA encryption, so please be patient. I understand that for a 4096 bit RSA, the numbers p and q should be prime. And to have the best security, the p and q should both be ...
1
vote
0answers
56 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
3
votes
2answers
179 views

Does the One Time Pad rely on confusion or diffusion?

From what I could research, XORing a random key adds confusion. But I do not undertand the rationale for that classification. Shannon's confusion is supposed to obscure the relationship between the ...
3
votes
3answers
344 views

How to prove that someone encrypted a specific (large) chunk of data

Alice encrypts her data with HER secret key. Then she sends the encrypted data to Bob who should encrypt it with HIS secret key. Caroline should then eventually get this double encrypted data. ...
0
votes
1answer
130 views

Huffman encoding of hashes

I have a huge list of MD5 hashes, which takes up quite some space. I was wondering if I would acheive (some) compression, by encoding the characters (which are A-F 0-9), with huffman coding. I made a ...
1
vote
1answer
100 views

HKDF entropy extraction

I collect entropy from the following sources: system_entropy = System provided crypto entropy stream (CryptGenRandom on Windows) user_entropy = User-provided entropy - in a form of a byte stream of ...
4
votes
1answer
76 views

possible MITM attack against servers that used to support weak DH?

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid ...
2
votes
1answer
155 views

Attacking CBC with predictable but encrypted IV

Let P be a secure block cipher, eg AES-128. Let's say a server has a CBC encryption oracle which uses an attacker-selected yet unique nonce to generate the IV for each message = P(key, nonce). The ...
12
votes
1answer
264 views

Logjam on Elliptic Curves?

I think we're all aware of the Logjam attack. From now on we know that re-using primes for DH is a bad idea. But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
1
vote
2answers
42 views

Can a TLS client perform any DH regeneration?

I have only the barest understanding of cryptography, but I've been following the Logjam issue; some posts and articles (elsewhere) imply that a client can regenerate DH keys. Is Logjam solely a ...
0
votes
0answers
45 views

Factorization of a number obtained by a modular multiplication operation can reveal factors of the used operands?

Consider a number $r$ obtained by: $r=a \cdot b \mod n$ Can knowing the factorization of $r$ reveal some information (bits) of $a$ and $b$ ?
0
votes
1answer
68 views

Break El-Gamal Algorithm by knowing the value of the random k

In El-Gamal Algorithm, the public key is $(p, g, A)$, and the secret key is $(a)$, in order to encrypt some data, the sender generate a random $k$, where: $(C_1, C_2) = (m.A^{k} \pmod{p}, g^{k} \pmod{...
4
votes
1answer
123 views

Hard-core predicates: should the adversary be given $1^n$?

In most (all?) classical sources such as the book of Goldreich (2001), hard-core predicated are defined thus: A polynomial-time computable predicate $b : \{0,1\}^* \to \{0,1\}$ is a hard-core of a ...
2
votes
1answer
161 views

Hash length extension attack - SHA256 to 512 - impossible, correct?

Just want to be sure about something before I sign off on a method we're about to put into place. We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the ...

15 30 50 per page