2
votes
2answers
405 views

Encrypting and MACing different data with same key

It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
2
votes
2answers
190 views

Does collision resistance stay when extending a hash function to a set domain?

Given a Cryptographic hash function $h$ for element $x$, let's extend it to sets via $H(S)=\prod_{x\in{S}}{h(x)}$. I am asking if the new hash $H$ (in domain of set) is still collision resistant? To ...
2
votes
2answers
245 views

What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?

I'm working with the affine representations of points of the Secp256k1 elliptic curve (from Bitcoin). I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed ...
2
votes
1answer
670 views

What is a fair exchange scheme?

The Wikipedia entry Fair exchange has only two lines, and the only paper I can find describing such a protocol is extremely complicated. Is this a new field in cryptology or can someone give an ...
2
votes
2answers
144 views

Does knowledge of original file size provide a cryptographic weakness?

I'm encrypting files using an AES-256 CBC cipher and an SHA-256 HMAC every 64KB in the file. Since AES CBC needs an amount of input bytes to be divisible by 16, I use PKCS#7 padding to bring the ...
2
votes
1answer
147 views

AES Message Authentication Vulnerability

My securities instructor recently posed this question to the class and I am bending my brain in half trying to figure it out. Suppose $y_1 = AES(K, x_1)$ and $y_2 = AES(K,x_2)$, and suppose you ...
2
votes
1answer
1k views

Question about the definition of a secure PRF

I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF. I understand the test goes as follows: A challenger picks a function $f$ such that $f \leftarrow ...
2
votes
3answers
171 views

How comparable is OFB to a one-time pad?

This is a rather trivial question, I just want to see if I get the concept right. In OFB you generate a pseudorandom stream based on some nonce, and you XOR that with the message to get the ...
2
votes
2answers
311 views

How to efficiently generate a stream of independent, but biased random bits?

Usually, in cryptography, one is interested in debiasing a stream of independent (true) random bits, and several algorithms exist to do this. What about the converse? Let's assume I have a stream of ...
2
votes
1answer
186 views

How can encryption software accept password lengths which are not one of the AES key lengths?

AES comes with key sizes of 128, 192, and 256 bit. But in Truecrypt or other crypto software we can use passwords of different length, even less than 128 bit or more than 256 bit. How is this ...
2
votes
1answer
1k views
2
votes
1answer
303 views

RSA Key generation Public exponent too big

I'm currently writing a paper about RSA (a self-chosen subject). I'm writing about the key-generation in RSA, and I have problem finding the public exponent e. I have chosen p = 61 and q = 53. Then ...
2
votes
2answers
561 views

AES key expansion vs. a hash

Is there something special about the AES key expansion algorithm that makes it secure, or it is a compromise between security and speed? For example, say with a key I expand it by taking pbkdf2(key) ...
2
votes
2answers
766 views

Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. It's the task from two-years ago exam. At the bottom I reminded one definition. Let $(Gen_E,Enc,Dec)$ be an ...
2
votes
2answers
560 views

Modifications of CBC-MAC

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. This post is very long, but this is because I remind here 2 long definitions. At the beginning I want to remind the ...
2
votes
4answers
916 views

One time pad key exchange

If two parties want to communicate with securely using OTP , how is the key ( that is lengthy as plain text) shared with other party for decryption ?
2
votes
1answer
337 views
2
votes
3answers
581 views

PRNG taking advantage of very large seed

Can anyone suggest a good (CS)PRNG algorithm that takes advantage of having a very large (ideally arbitrarily large) seed? I'd like to use several kilobytes, perhaps several hundred kilobytes, of ...
2
votes
1answer
828 views

Can we trust digital signatures?

Consider that Alice wants to send a digitally signed message to Bob. Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
2
votes
1answer
522 views

Padding for the TEA

Sorry if this is a noob questions, but I finally figured out how to implement the Tiny Encryption Algorithm in C++. My question is what to do about padding the key and the plaintext? I know that ...
2
votes
2answers
3k views

How to get the keyword from a keyword cipher?

I was given a ciphertext and now I am trying to break it via looking for the keyword. This is a keyword cipher. So: PlainEnglish: ABCDEFGHIJKLMNOPQRSTUVWXYZ If ...
2
votes
1answer
2k views

How to sign a message using RSA?

Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits. I don't know much about cryptography, but I can get these numbers ...
2
votes
2answers
2k views

Symmetric vs. Asymmetric cryptographic approaches to data security

I know the basic differences between Symmetric vs. Asymmetric cryptography, but I'd love to know more details: Exactly why is the asymmetric approach slower than the symmetric? Why does it make ...
2
votes
1answer
80 views

Rapidly changing passwords?

Suppose you need to authenticate yourself to a program with the password - but the program's source code is public, the program doesn't have access to any private information and all your ...
2
votes
3answers
339 views

Realize a MAC using a Pseudo-random function?

Given a pseudo-random function and assuming that we do not have any other tools, How can we construct a MAC? I believe this can be done. Would like to know if there is more than one way of doing ...
2
votes
1answer
3k views

Secure way to transfer data over NFC?

I am currently writing a payment system to accept payment details from an NFC enabled smartphone (BlackBerry 9900) to a Windows client (C#.NET) I am currently having two issues relating to security: ...
2
votes
2answers
374 views

Is EKE attackable by a brute-force password search?

So I'm trying to properly implement the EKE protocol and I'm using C# with the Windows CNG and ECDH key exchange. I need to use this because it's FIPS certified and all that jazz. So what I'm ...
2
votes
1answer
32 views

Can one passively load-balance HTTPS traffic based on TLS SNI?

Is it theoretically possible to passively snoop into the HTTPS traffic, reliably detect whether or not TLS SNI is attempted to be used by the client, and, if it is, redirect the stream of the ...
2
votes
1answer
63 views

Why does image size increase after steganography?

I am working on a steganography technique. Sometimes I need to send my steganographed images online to my friends but in the process the image gets compressed destroying all the data. I found ways to ...
2
votes
2answers
65 views

Certificate Signature Algorithm differs from Signature Algorithm Negotiated for Connection

With the upcoming sunsetting of SHA-1 by browsers I was checking signature algorithms for sites I visit. I'm using Firefox 43.0.2 on Windows. I noticed something interesting when I visited the site ...
2
votes
1answer
93 views

textbook RSA signature scheme security

Are textbook RSA signatures secure if an Adversary does not have access to ask signing oracle queries?
2
votes
2answers
184 views

How can I use the whole potential of DES?

I have recently programmed the DES algorithm. Right now it works just with integers (or better to say chars) in the range <0;255>. How can I use its whole potential - using just ASCII would be a ...
2
votes
2answers
88 views

Is it possible to recover an RSA modulus from its signatures?

Let's say that you have some small number of RSA signatures of known data: you know some pairs $(m_k, c_k)$ such that ${c_k}^e \equiv m_k \pmod n$. If you know $e$, because probably it's one of $\{3, ...
2
votes
2answers
67 views

Encrypt letters separately?

I am trying to encrypt the word Hello using RSA. When encrypting Hello’s integer representation, is each letter encrypted ...
2
votes
2answers
73 views

regular expression matching on encrypted data using secure multiparty computation

Lets consider Secure Multiparty Computation based on Secret Sharing schemes (rather than Garbled Circuits approach). If we have to do regular expression matching on secret shares of words of texts. ...
2
votes
1answer
305 views

Is there an additively homomorphic encryption scheme that supports calculating a square root on the ciphertext?

I need an additively homomorphic encryption scheme that satisfies: $D(\sqrt{E(m)}) \approx \sqrt{m}$. It seems that the lifted ElGamal satisfies this, but it is hard to do decryption if the message ...
2
votes
2answers
87 views

Is pseudorandom function also a one-way function?

Can I assume this? Specifically, I want to know if the following two cases are valid. Suppose $prf_k(m)=c$ One-wayness: Only given $c$, we cannot reveal $m$. Without key $k$, even given $m$, cannot ...
2
votes
1answer
65 views

Changing encryption key without revealing the original key

Say that Alice encrypts a $plaintext$ with $key_{m}$ and gives the $ciphertext_m$ to Bob. Alice wants to send several gigabytes of $plaintext$ to Eve but she is on a mobile 3G connection. So instead, ...
2
votes
1answer
91 views

Stream Ciphers and cycling questions

For all PRNGs (including CSPRNGs) lets say there is a sequence x, y, z, then when the PRNG cycles back to x, then the sequence following it will be exactly the same as before. Is this true for all ...
2
votes
1answer
79 views

Practical benefit of using a KDF?

I see that KDFs should be used in systems that rely on PSKs, but what practical benefit does it provide? For instance, suppose the system relies on a shared secret for AES encryption and decryption. ...
2
votes
1answer
58 views

Is it secure to use order preserving encryption in practice?

When I read papers, I often see the comments, "order-preserving encryption is deterministic and it is not IND-CPA secure", or in general "it is not secure enough to be implemented in practice". So I ...
2
votes
2answers
85 views

Why is ECIES complex?

Wouldn't encrypting a message with AES, then encrypting the (randomly generated) AES key and IV with the EC public key suffice? What attack vectors does ECIES protect against, that an ...
2
votes
2answers
140 views

Definition of authenticity

I came across various definitions of what authenticity means in cryptography. I would like to know which one is correct. The first definition - the one I always used - is the following: Data ...
2
votes
1answer
78 views

Crypto-period for keys used in PRF

I am wondering about the crypto-period for keys used in pseudo-random functions. For example, let's say I am using HMAC-SHA256 with a secret key $K$. After how many computes do I have to update $K$? ...
2
votes
1answer
52 views

PRF and pairwise independent hash function

I'm confused with the concepts of pairwise independent hash function and pseudorandom function. They seem identical to me. A family of hash functions $H=\{ h:U \to [m] \}$ is $k$-independent if for ...
2
votes
2answers
55 views

Privacy and Integrity in Public Cryptography

I'm trying to figure out which is the best way to get privacy and integrity together in public cryptography. Alice needs to send multiple files $f$ (may be big) to Bob. I've thought: Alice computes ...
2
votes
1answer
79 views

In $\mathbb Z/p\mathbb Z$, is $(a+b\cdot r)$ a random value for fixed $a,b$ and random $r$?

Let $p$ be a prime number. Consider two fixed values $a,b\in\mathbb Z/p\mathbb Z$, where $b\neq0$, and a uniformly random value $r\leftarrow \mathbb Z/p\mathbb Z$. Is $v=a+b\cdot r$ a uniformly ...
2
votes
1answer
95 views

Why the $IV$ used in Merkle-Damgard has to be fixed to a specific value?

I just can't figure out why on earth the $IV$ in Merkle-Damgard has to be fixed (that's what the Katz-Lindell book says)? Because even if you choose it randomly from say $\{{0,1}\}^n$ then the ...
2
votes
1answer
111 views

Why isn't a table used to solve the large number factoring problem?

Lots of modern encryption (RSA comes to mind) are based on the fact that factoring large numbers is hard. However, multiplying large numbers is much easier, and table lookups are very easy. Since ...
2
votes
1answer
71 views

What is this encryption system called?

Let's say you want to break down a message, for simplicity it is just a bit $0$ or $1$, $m$ into two messages $(m_1, m_2)$ as follows: If $m =0$, then $(m_1, m_2) = (0, 0)$ with probability $1/2$ and ...

15 30 50 per page