3
votes
2answers
572 views

Implementing PKCS#7 Padding on a Stream of Unknown Length?

I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
2
votes
3answers
412 views

Identification of correct plaintext after decryption in Rabin cryptosystem

In the Rabin cryptosystem, decrypting a message can produce four different outputs, of which only one is the correct plaintext. How can one know which of the outputs is the correct one?
1
vote
1answer
108 views

Pseudo Random Generator (PRG) from Rabin function

I'm trying to make a PRG using the Rabin function. The code (in Java) I wrote to implement the function is: ...
6
votes
2answers
403 views

Why are HOTP and TOTP implementations all using 6 digits and not more?

I was checking the RFC's after wondering for some time. In RFC 4226 - HOTP: An HMAC-Based One-Time Password Algorithm, it states on the appendix: A simple enhancement in terms of security would be ...
6
votes
1answer
163 views

Is there a security proof for the Triple-DES construction in the ideal cipher model?

Suppose one has an ideal block cipher $E \: : \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^k \times \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w \: \to \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w ...
2
votes
2answers
238 views

Algorithm Design for only Mutual Information Sharing

Bob and Alice each have a bit string they want to keep private. They each want to know what the bitwise AND of their two strings would be without telling the other or anyone else listening to their ...
10
votes
2answers
2k views

Is HMAC-DRBG or Hash-DRBG stronger?

Out of the two deterministic random bit generators defined in section 10.1 of NIST SP 800-90A (i.e. based on hash functions), which one is cryptographically stronger? Hash-DRBG (Section 10.1.1) ...
0
votes
2answers
395 views

One Time Pad Question

I have a ciphertext encoded with One Time Pad. I do not know the key. How can I find the possible keys which when decoded, will result in a meaningful plain text?
6
votes
2answers
1k views

AES key expansion: 256bit key

In AES algorithm, in the key schedule, Why does the expansion of a 256 bit key need an extra application of the S-box, unlike the expansion of 128 bit and 192 bit keys ? (The obvious answer would be ...
6
votes
3answers
908 views

Any practical uses of machine learning for cryptography?

I am about to go study for my masters in machine learning, data mining and high performance computing, but have recently become very interested in cryptography after taking Dan Boneh's Cryptography ...
10
votes
3answers
2k views

MIT says: mathematical theory behind encryption is wrong. What are the consequences?

A friend shared with me the following link: Encryption is less secure than we thought I'm not a security expert and could understand great part the article, except the section about noise, but what I ...
2
votes
5answers
1k views

Approach towards anonymous e-voting

I want to implement an internet-based e-voting system. Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy ...
3
votes
1answer
1k views

Can Elgamal be made additively homomorphic and how could it be used for E-voting?

Elgamal is a cryptosystem that is homomorphic over multiplication. How can I convert it to an additive homomorphic cryptosystem? How can I use this additive homomorphic Elgamal cryptosystem for ...
6
votes
1answer
142 views

How to construct a yes/no election protocol, such that only the result is revealed?

Can we use a threshold scheme to construct a (yes/no)-election protocol, such that every voter can give a positive or negative vote or he can abstain, and such that only the result of the election is ...
5
votes
2answers
142 views

Current Status of mixnets for voting

I am currently doing some research on universally verifiable mixnets, but it seems to me that there are too few papers about them after 2006 or so and most of them come from the team of Douglas ...
3
votes
2answers
139 views

Could this be a valid variation of the Schnorr protocol?

The Schnorr protocol is a 3-steps proof of knowledge of a discrete logarithm, whose interactive version works as follows. Let $p$ and $q$ be two public primes, such that $q \mid (p-1)$, and let $G$ ...
0
votes
2answers
167 views

Is there a way to encrypt multiple sets of data into one result, with separate keys decrypting each set of data

What I am picturing is something like this: Block A: "Hello, how are you today?" Block B: "The weather reminds me of summer." I encode this, giving me two keys and a resulting encrypted block e.g. ...
6
votes
2answers
655 views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...
2
votes
1answer
387 views

Do companies like CipherCloud really have the option to use homomorphic encryption?

I was reading How is CipherCloud doing homomorphic encryption? and was wondering: Is there a technically feasible way for companies like CipherCloud to use homomorphic encryption (HE) while ...
0
votes
1answer
193 views

What does the cipher-text overhead means?

I have two questions here. What does the cipher-text overhead means? Why we were suggested not to encrypts the plain-text itself instead just encrypts only the key (i.e random number)
1
vote
2answers
205 views

What security flaw exists in MAC authentication scenario?

What security flaw exists (if any) in the solution of this non-encrypted authentication scenario? An unencrypted message passes one-way from computer A to B. Its transmission is viewable by the ...
8
votes
2answers
2k views

Pre-image resistant but not 2nd pre-image resistant?

Are there any cryptographic hash functions for which there is a known pre-image attack, or a known second pre-image attack, but not both? The attack doesn't have to be practical - just anything that ...
1
vote
1answer
96 views

security amplification

Reading some papers on security amplification of weak-PRP written by Stefano Tessaro, I noticed the use of notion "epsilon-PRP" and the notion of "security amplification". These notions, in ...
0
votes
2answers
337 views

Cryptographic Symmetric Stream Cipher

Let me know a cryptographic symmetric stream cipher system with only two functions say S() and P() and it should satisfy the ...
1
vote
1answer
123 views

Random decomposition of symmetric key

Considering a symmetric cipher (i.e : AES in counter mode), is it possible for any given key to be randomly decomposed into other keys without knowing the message or the ciphertext, such as : ...
5
votes
2answers
729 views

How does one calculate the cryptoperiod?

NIST Special Publication 800-57 defines a cryptoperiod as the time span during which a specific key is authorized for use by legitimate entities, or the keys for a given system will remain in ...
4
votes
1answer
191 views

Why is the Pedersen commitment computationally binding?

This is how the Pedersen commitment seems to work: Let $p$ and $q$ be large primes such that $q \mid (p-1)$, let $g$ be a generator of the order-$q$ subgroup of $Z_p^{\star}$. Let $a$ be a random ...
4
votes
2answers
224 views

How to use salt when there is only one user

I am encrypting files for storage in an untrusted location, using a custom Java program to do that. There is only one user, but there are many files. I am using AES in CBC mode with PKCS5 padding, and ...
1
vote
2answers
427 views

Is it possible to subtract/multiply numbers using homomorphic encryption?

Most of the libraries I've seen allow you to add encrypted numbers. Is it possible to subtract and multiply them?
2
votes
1answer
151 views

Public Keys on Social Media

Is there any problem with using social media (i.e. Facebook) as a directory of public keys? For example, couldn't Alice put a note containing $(g^a \bmod p, g, p)$ on her Facebook page so she could ...
10
votes
1answer
2k views

Technical details of attack on Android bitcoin usage of SecureRandom

Reports are surfacing that Android's Java SecureRandom class has issues and isn't totally secure. A specific example of how this issue translates to applications is bitcoin, where reports are stating ...
1
vote
2answers
498 views

Cryptanalysis of S-DES - Equations

I am trying to derive equations for s and t in the cryptanalysis of a Simple DES algorithm, but I haven't been able to deduce ...
0
votes
1answer
310 views

How does certificate-based encryption solve key revocation problem?

How does certificate-based encryption solve key revocation problem? For example, if a user accidentally reveals its secret key or an attacker compromises it, the user may request revocation of its ...
3
votes
2answers
1k views

Decrypting DES with decrypted and encrypted data

I got two 8-byte strings. One which is decrypted is: FF FF FF FF FF FF FF FF and one which is encrypted is: ...
2
votes
1answer
5k views

How does DES decryption work? Is it the same as encryption or the reverse? [duplicate]

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?
3
votes
2answers
191 views

Does impersonating an SRP server give you enough information for an off-line dictionary attack?

In a comment to an answer I wrote to another question, CodesInChaos wrote that: "Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search." ...
4
votes
1answer
323 views

How Were secp*k1 elliptic curve generators chosen?

The Koblitz elliptic curves specified in the SEC2 document https://docs.google.com/viewer?url=http%3A%2F%2Fwww.secg.org%2Fcollateral%2Fsec2_final.pdf all have the nice feature that the parameters are ...
9
votes
2answers
601 views

Can AES decryption be used as encryption?

Definition E: AES encryption D: AES decryption x: plain text y: encrypted text k: key In original AES cipher, encryption: y = E(x, k) decryption: x = D(y, k) Then I define the "reverse AES ...
2
votes
2answers
211 views

What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?

I'm working with the affine representations of points of the Secp256k1 elliptic curve (from Bitcoin). I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed ...
3
votes
1answer
226 views

iOS Data Protection: What is the Input of the LFSR?

Every time a file on the data partition is created, Data Protection creates a new 256-bit key (the “per-file” key) and gives it to the hardware AES engine, which uses the key to encrypt the ...
2
votes
1answer
207 views

Does SRP reduce to DH key echange when shared password is not secret?

I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later. I ...
1
vote
1answer
457 views

How to supply the GCM authentication tag to the OpenSSL command line tools?

I'm using AES-256-GCM for authenticated encryption. In order to decrypt, the ruby OpenSSL library requires an auth_tag parameter (in addition to the key and iv). ...
14
votes
3answers
2k views

Can ECDSA signatures be safely made “deterministic”?

Using the terminology of the ECDSA wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
1
vote
1answer
215 views

why AKS is so slow in practice? [closed]

This note (http://maths-people.anu.edu.au/~brent/pd/primality4.pdf) states that AKS is not practical. However, it is known that AKS runs in polynomial-time, and I cannot understand where the slowness ...
5
votes
2answers
2k views

AES plaintext is smaller than 128 bits - how to expand?

We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
2
votes
1answer
171 views

Is this method of deterministically using CBC secure?

I'm trying to design a deterministic encryption scheme to enable searching in untrusted databases with the smallest possible IV overhead on ciphertexts. I know it's very bad practice but unfortunately ...
3
votes
1answer
132 views
6
votes
2answers
2k views
8
votes
1answer
5k views

How strong is the ECDSA algorithm?

Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
2
votes
3answers
793 views

why DES encryption uses different modes like ECB,OFB?

As without using modes we can also encrypt and decrypt data then what is the need of using modes in DES?

15 30 50 per page