7
votes
3answers
2k views

Why hash or salt when signing?

I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV. Why is that needed?
5
votes
1answer
600 views

Are there any MGF1 and OS2IP functions available in C?

I need MGF1 and OS2IP functions, as defined in the PKCS #1 v2.1: RSA Cryptography Standard. Is there anything available in OpenSSL, or any other open C library?
7
votes
1answer
420 views

CBC key lifetime, or, “how big is too big?”

IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB. My case isn't using IPSec, ...
11
votes
1answer
965 views

Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?

I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32 Giga Bytes of ciphertext) by the method devised by Paul C. van Oorschot ...
7
votes
1answer
746 views

In which situations is a length-extension attack a problem?

A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem? I guess certain naive ...
4
votes
2answers
192 views

Is a random length-extension worth the effort?

I'm conceiving an application that uses cryptographic tools and concepts for securing data. I know that's difficult and risky, therefore I prefer to ask around before implementing anything. When ...
-4
votes
1answer
568 views

Advantages of each encryption mode [closed]

What is the advantages of each encryption mode to other encryption mode.. for example what are advantages of CBC to PCBC, CBC to CFB just like that. so that I can filter what would be the best ...
4
votes
1answer
704 views

Can you help me understand the Common Modulus Attack in a Lucas Group?

I'm trying to decrypt a message that is encrypted using a LUC encryption scheme and running into roadblocks. I know that with RSA if Alice and Bob use the same public modulus but different encryption ...
2
votes
1answer
1k views

How to sign a message using RSA?

Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits. I don't know much about cryptography, but I can get these numbers ...
4
votes
2answers
514 views

Questions about Key Derivation Functions

My understanding is that a KDF is a function that takes a master secret and generates multiple keys. It is secure as long as the keys are "independent". If this is true, the following definition would ...
-4
votes
1answer
281 views
6
votes
0answers
617 views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
1
vote
0answers
61 views

cipher text only attack - how to know when to stop when brute-force attack? [duplicate]

Possible Duplicate: How can I do a brute force (ciphertext only) attack on an CBC-encrypted message? My question is about a cipher text only attack - I have as input only the initialization ...
3
votes
3answers
217 views

Are asymptotic lower bounds relevant to cryptography?

An asymptotic lower bound such as exponential-hardness is generally thought to imply that a problem is "inherently difficult". Encryption that is "inherently difficult" to break is thought to be ...
4
votes
1answer
166 views

Question about hash collisions

If we have a hash function $h(x)$ and then a hash function $H(X) = h(h(X_0) || h(X_1))$ where $X_0$ is the first half of $X$, $X_1$ is the second half of $X$ and $||$ is concatenation. Then assuming ...
1
vote
1answer
309 views

Existing dictionaries of popular words to help solve a random substitution cipher?

I'm trying to find faster ways to solve this: http://cryptogram.org/solve_cipher.html Actually lists of common words are good, but they are often limited to 1000 words. I found this, but I'm not ...
3
votes
1answer
189 views

Elgamal test vectors

I know that Elgamal algorithms have fallen out of fashion, and they are not included in any widespread cryptographic standard nowadays. However, they are still present in several popular crypto ...
10
votes
2answers
560 views

Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
3
votes
2answers
2k views

How to perform file encryption using 128-Bit AES?

I am confused, how can I encrypt a file using 128 Bit Advanced Encryption Standard? Do I need only to encrypt the file name and it's content or is there something that I need to do to encrypt it? Is ...
-2
votes
3answers
1k views

How secure is the Vigenère cipher in file encryption if you encrypt the password first?

I created a basic file encryption method, that seems pretty secure to me (based on an answer below, it seems to be an implementation of the Vigenère cipher) , but one of my colleagues claims that it ...
4
votes
1answer
494 views

Does the Biclique attack on AES pose a credible risk to its security?

I have heard a lot about the biclique cryptanalysis research on AES, which as far as I know is the closest anyone has got to breaking AES. Exactly how close did they get? Does this attack propose a ...
2
votes
1answer
6k views

How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
4
votes
1answer
523 views

Is this authenticated one-way communication protocol secure?

I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
2
votes
2answers
531 views

Finding the LFSR and connection polynomial for binary sequence. [closed]

I have written a C implementation of the Berlekamp-Massey algorithm to work on finite fields of size any prime. It works on most input, except for the following binary GF(2) sequence: $0110010101101$ ...
2
votes
1answer
73 views

Distributed knowledge problem

I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
5
votes
1answer
273 views

Can a digital money system exist, that's secure, anonymous and allows offline transactions?

I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that ...
1
vote
1answer
57 views

Proving item association without revealing one of the associated items

I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category. I have two associated pieces of information: tag — known by both parties. Unique per ...
1
vote
1answer
4k views

How to solve MixColumns

I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this? I found some topic in the internet about MixColumns, but I still have a lot of question to ...
1
vote
1answer
116 views

Tips on conceiving safe software messaging platform

I have a personal project in mind in which I plan to use cryptography in order to let the users be confident in the fact that, even if all data get's stolen, it would be virtually impossible to crack ...
4
votes
3answers
479 views

How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
3
votes
2answers
1k views

How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ...
3
votes
3answers
300 views

How much bigger does a precomputed lookup table get when salt is added?

I am trying to wrap my head around the benefits of salt in cryptography. http://en.wikipedia.org/wiki/Salt_(cryptography) I understand that adding salt makes it harder to precompute a table. But ...
6
votes
3answers
522 views

Security equivalence proofs for breaking RSA

It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring. In otherwords, ...
0
votes
0answers
211 views

Most frequently used digital signature schemes in the recent years

I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today. I'm only really interested in what is employed recently (ie. last couple ...
6
votes
1answer
963 views

Deterministic nonces in CTR mode

I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
7
votes
2answers
967 views

Can one reduce the size of ECDSA-like signatures?

Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature. Is ...
5
votes
2answers
494 views

Can RSA encryption produce collisions?

In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.) My question is, can $m^e$ be ...
2
votes
2answers
305 views

Simple xor cipher extension

Probably the simplest cipher is the xor cipher with a single integer. One can extend this to use more than one integer by several means. I'm wondering if there is any benefit to doing more than this: ...
1
vote
0answers
70 views

Is it possible to build an unfair noisy channel from 1 out of 2 oblivious transfer [closed]

For a fair channel, sender sends a bit b and receiver gets it with probability 1/2 and gets b's flipped value with probability 1/2. It is trivial to build a fair noisy channel from 1 out of 2 ...
6
votes
1answer
261 views

Useful pairings for cryptography

I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
3
votes
1answer
321 views

Blind signature with openssl

I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
5
votes
2answers
2k views

What are advantages of using a HMAC over RSA with SHA-1 hashes?

I am currently studying for an exam and this was a previous question: Give one advantage of using HMACs over using RSA to sign SHA-1 hashes. My thoughts are that it has something to do with the ...
3
votes
1answer
839 views

X9.62 Multiplying an elliptic curve point by a number

I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number. As far as i understand X9.62 gives some recommendation for doing it but i ...
2
votes
1answer
1k views

AES-NI implementation examples

Newer Intel and AMD processors have hardware support for implementing AES using the instruction set AES-NI (instructions AESENC, AESKEYGENASSIST etc). Do you know of any clean example implementation ...
2
votes
1answer
534 views

What is the correct way to generate cryptographically-secure pseudorandom numbers in C?

I am learning about crypto, purely for my own interest. As part of that I am implementing a simple 'one time pad' toolset in C. Naturally I need to generate random numbers to create the pad, and they ...
1
vote
0answers
138 views

Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function ...
2
votes
1answer
2k views

Big-O Notation: Encryption Algorithms

I am currently completing a dissertation concerning the encryption of data through a variety of cryptographic algorithms. I have spent much time reading journals and papers but as yet have been ...
1
vote
2answers
253 views

One-way function and factoring

I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
3
votes
1answer
152 views

DIfferent inner and outer hash functions for NIST Recommended HMAC?

The NIST recommended HMAC uses $$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$ Is it ...
3
votes
1answer
342 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...

15 30 50 per page