0
votes
1answer
153 views

How does knowing the factorization of N can help to obtain the secret?

Assuming $x=a^2 \pmod n$ and knowing $x$, $p$, $q$ how is it possible to obtain $a$?
0
votes
1answer
41 views

Is it a bad idea to use PGP encryption for structured/predictable data?

I'm working on an app and need to encrypt some structured data. The data will be turned into a string form (JSON) before getting encrypted. The data format I'm using will always start with a ...
0
votes
1answer
109 views

Are there any quantum-resistant symmetric encryption schemes?

It seems that quite a few currently available encryption schemes will possibly be broken by quantum computing. Are there any symmetric encryption schemes that will remain unbroken (either because of ...
3
votes
2answers
135 views

Power analysis and exponentiation by squaring

I am trying to understand how one can retrieve the secret exponent via a simple power analysis. Lets suppose that the exponentiation by squaring algorithm is implemented in its simplest form : ...
0
votes
0answers
18 views

Does Windows CNG store private information using LSA secrets?

I read that LSA Secrets have the capability of storing data privately, more importantly, ensuring that users without proper permissions cannot access that same data. Windows CNG has security measure ...
1
vote
1answer
50 views

How to choose the integer m in the general number field sieve (GNFS)?

Given an integer you want to factor $N$, GNFS starts by selecting a monic irreducible polynomial $f \in \mathbb{Z}[X]$ and an integer $m$ such that $f(m) \equiv 0 \text{ mod } N$. In practice, if $m$ ...
10
votes
2answers
2k views

If you hashed a hash an infinite number of times would you end up with a unique hash?

If you took a hashing algorithm for example MD5 and repeatedly passed the output hash back into the algorithm an arbitrarily large number of times would you eventually end up with one unique hash? My ...
0
votes
1answer
87 views

Collision attacks on digital signatures

After reading this document about MD5 collision attacks, I still don't understand how collisions can make digital signatures insecure. In the paper, the researchers created two files with the same ...
0
votes
2answers
74 views

Can I use the output from a DRBG directly as K for AES, or do I need to use a key generator algorithm?

NIST has 3 validated "Recommendation for Random Number Generation Using Deterministic Random Bit Generators" (DRBG's) that are based on NIST SP 800-90A: Hash_DRBG (based on hash functions) ...
0
votes
1answer
25 views

How to select a 'tweak' used in FE1 mode format preserving encryption?

I'm experimenting with this library Botan which includes a module for format preserving encryption based on FE1 mode. The parameters for the Encrypt method are as follows ...
1
vote
3answers
309 views

Block cipher does not provide security by itself

What is this statement all about? When I look at a block cipher it seems pretty hard to break it and the mathematics behind insure a good complexity. It may refer to key generation, initialization ...
0
votes
0answers
16 views

What is sLHAE (stateful length-hiding authenticated encryption)?

Can somebody please explaint me how does sLHAE works in TLS? I met this term in some TLS papers and struggled to understand how it works, specifically the "length-hiding" part.As to my understanding ...
3
votes
2answers
173 views

Key space vs Cardinality of 1024-bit RSA

I have been trying to figure out the encryption key space, and cardinality of 1024-bit RSA. From my understanding, the key generated from 1024-bit will be primes greater than $2^{1023}$ but less than ...
1
vote
1answer
50 views

Can Winternitz be easily converted to a many-time encryption scheme?

The Winternitz scheme is typically cited as being an OTS scheme. Can it also be used as a one-time encryption scheme? If it can be used as a one-time encryption scheme, then is it possible to easily ...
0
votes
2answers
92 views

SHA-512 partial preimage

I was looking at how SHA-512 works, and I have a question. Imagine I want an input $N$ of 512 bits whose hash in hexadecimal starts with the digits 12345678. How ...
3
votes
1answer
83 views

Is it safe to derive two different keys with the same password and key derivation function using two different salts?

I would like to know if the following process would harm the security of a fictional system if the persisted data would be stolen: in this system a user has a single password. The password will be ...
2
votes
1answer
62 views

Yubico's take on U2F key wrapping

I've been reading up on Yubico's implementation of U2F. What I understand so far is that two things are calculated. So upon registration first you calculate a private key by $PrivateKey = ...
0
votes
0answers
31 views

If a DES key correctly decrypts one message, what's the probability it's the real key?

Suppose an adversary gets a message-ciphertext pair $(M,C)$, where $C=DES_K(M)$. They do an exhaustive key reach to locate the lexicographically first key $T$ for which $C=DES_T(M)$. What's the ...
0
votes
0answers
23 views

Does Paillier Cryptosystem work in different message space? [duplicate]

I have a question about Paillier Cryptosystem. Assuming we have $c = Enc(m) = g^m \cdot r^N \mod N^2$ as the output of encryption algorithm, where $N=p_1p_2$ and $m \in \mathbb{Z}_q \subset ...
1
vote
2answers
92 views

Why aren't zero-knowledge proofs used for authentication in practice?

I read on Wikipedia that zero-knowledge proofs are not used for authentication in practice. Instead (I think) the server is entrusted with seeing a password in plaintext form, which it should then add ...
5
votes
4answers
4k views

Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings

I'm building a system that has to take file paths, and generate a unique name for each one. I'm planning on using SHA1 as the hash function. My question is: do I have to deal with possible collisions ...
1
vote
1answer
43 views

Reducing the keyspace for a brute force attack on a chained 64-bit xor

I have a block of data which I know is encrypted using a chained 64-bit xor (sorry if that makes no sense, I'm not familiar with crypto lingo). I know a little bit about what the plaintext should look ...
5
votes
3answers
398 views

What do $0^n$ and $1^n$ mean in cryptography?

Let $f$ = $\{f_k\}$ be a pseudorandom function family. Let $G(x)$ be a pseudo-random generator such that: $G(x) = f_x(0^k)f_x(1^k)$ where $k=|x|$. I don't understand the meaning of $1^n$ ...
0
votes
0answers
28 views

What crypto scheme should I use on embedded m2m system with assymetric uplink/downlink bandwidth?

I am working on implementing info security into custom m2m radiolink communication system, which has some restrictions: MCU based endpoint can transmit to gateway with packets max 16 bytes long, and ...
0
votes
2answers
84 views

Why are there no OTP ciphers?

We all know the OTP is unbreakable and we all love the OTP (judging by the amount of question on this site). The strength of the OTP is not that it is unable to find a word without the key but you ...
0
votes
1answer
36 views

Decrypting DES - limited information

I have a list of DES encrypted strings/data, they come in two lengths, 32 chars hex (16 bytes) or - I believe - 64 chars. I know the key, which is 8 ascii chars (I might add that I am the rightful ...
0
votes
3answers
21 views

FIPS 113 Computer Data Authentication

on the NIST website for Message authentication There is a mention of 2 approved algorithms, i am curious about the first one. the link to FIPS 113, Computer Data Authentication appears to be dead ...
1
vote
2answers
439 views

What are words in a HASH algorithms

From wikipedia: "They differ in the word size; SHA-256 uses 32-bit words where SHA-512 uses 64-bit words." In this context what do they mean with words? is it the same as a 32 bit (or 64 bit) block ...
0
votes
0answers
34 views

Registration and log in through public key cryptography?

I read about zero knowledge proofs. Let's say you want to create an account at a website. You choose a password $p$ and from $p$ you derive deterministically a public & private key pair $(e,d)$ ...
0
votes
0answers
97 views

What can cause similar MD5 hashes

I have a set of MD5 hashes with huge similarities in the second half of the hash, (made up) examples: ...
1
vote
0answers
45 views

Why does the ElGamal signature have the specific form that it does?

In the original paper, ElGamal(1985) starts his discussion of signatures by saying: "The signature ..... is chosen such that the equation: $\alpha^m = y^r r^s \text{mod p}$ (equation 3 from the ...
0
votes
0answers
46 views

arithmetic calculation problem to quadratic arithmetic program

I am reading the Pinocchio paper (verifiable computation): http://research.microsoft.com/pubs/180286/pinocchio.pdf The paper is rather hard for me. I am considering this calculation problem: ...
1
vote
1answer
48 views

Zero knowledge / proof of knowledge sudoku solution

I recently started a coursera course "cryptography 1" provided by Stanford university. In one point when explaining zero proof knowledge the instructor mentions the following: Almost any puzzle ...
5
votes
3answers
439 views

Is it possible to create a “proof-of-upload” system for BitTorrent ratio tracking?

One issue that private BitTorrent trackers that track users' share ratios often run into is how to keep track of people who are screwing with their upload statistics, something known as ...
2
votes
1answer
34 views

Why must the sender and receiver be synchronised in synchronous stream ciphers?

I would like to know why the sender and receiver must be synchronized in synchronous stream ciphers as said in Synchronous stream cipher. Why is there no synchronization between the sender and ...
1
vote
0answers
73 views

Paillier Encryption: problems with double encryption

Given have two public keys $k1$ and $k2$, $E_{k1}(E_{k2}(m_1))$ and $m_2$. Is it possible to calculate $E_{k1}(E_{k2}(m_1 + m2))$? (or with multiplication instead of addition) At a first glance, I ...
1
vote
2answers
73 views

How to attack the Two Time Pad?

I encrypt 2 random keys with the same 'one' time pad. You can get both encrypted keys. You don't know anything besides the size. Is there a way to attack the two time pad in this scenario? And what ...
0
votes
2answers
46 views

Looking for encryption algorithm not subject to known-plaintext attack with IV reuse

I've encountered an interesting problem where we can basically say the following: We need to encrypt messages, but we have no room to store IVs. We can synthesize IVs; however an attacker would be ...
0
votes
1answer
54 views

Adding a Random component to CBC MAC in order to enlarge the tag space

CBC MAC that is using AES as the underlying block cipher, has tag space of 2^128. If we add a random single block, concatenating it with the tag, and encrypt it again in AES CBC mode, with additional ...
0
votes
1answer
42 views

Why Might XOR's Lead to Hash Functions Lacking 2nd Pre-image Resistance?

My hash function is as follows: Cut the string in half (assume even length of 2m) XOR's the two halves together Take the result of the XOR and pass it to a function (a one-to-one and "onto" ...
0
votes
1answer
99 views

Encryption of plain text using stream cipher algorithm

We know that in stream cipher algorithms plain text and generated key are Xored byte by byte. Generated key depends on how much plain text there is and on that basis key will generate and plain text ...
1
vote
0answers
42 views

Matsui's Linear attack on DES P box

I'm trying to understand Matsui's linear attack on DES and I have something I don't understand in his paper. In his paper he say that: $NS_{5}(16,15)=12$ (which is OK) and from that he say that: ...
0
votes
1answer
100 views

Permuted vectors

Consider we have two vectors $v_1, v_2$ of size $n$, and each vector contains $n$ elements. We permute the vectors as: $\pi (k_1,v_1), \pi (k_2,v_2)$. Where $\pi (k_i,v)$ denotes a permutation of a ...
1
vote
2answers
48 views

Is a padding oracle attack possible if data is only encrypted internally on a server (e.g. for storage)?

I read something about the padding oracle attack when analysing the use of an AES-encryption of data in a database and was "scared" it could be a serious issue. But after investigating a bit further, ...
1
vote
1answer
29 views

How do revocation certificates work in PGP?

I've already read how to build and upload them, but I'm wondering how revocation certificates work, what informations they hold and so on. Suppose my private key is compromised, but I have a ...
0
votes
1answer
53 views

Bilinear map + commitment

Let $\mathbb{G}_1,\mathbb{G}_2,\mathbb{G}_T$ be yclic group of the same order and $ e: \mathbb{G}_1 \times \mathbb{G}_2\rightarrow \mathbb{G}_T$, such that $u\in \mathbb{G}_1, g \in \mathbb{G}_2, ...
7
votes
1answer
82 views

Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?

A 2DES like cipher $c=E^{(2)}_{K_2}(E^{(1)}_{K_1}(p))$ where both halves have an $n$ bit key is vulnerable to a meet-in-the-middle attack. Meet-in-the-middle using a big table Create a table ...
0
votes
3answers
62 views

Is the Salsa20/ChaCha20 keystream generation one-way?

Is it possible to recompute the Salsa20 or ChaCha20 key in a realistic time if the keystream and the nonce are given to an attacker? Or is the keystream generation one-way, like a cryptographic has ...
0
votes
3answers
43 views

Question about decryption

I have a question about decryption. Let's say I have a bunch of files that are encrypted. Someone gains access to those files, and finds out that he already has one of them, unencrypted. My question ...
0
votes
1answer
39 views

Are more S boxes more secure in a SP-Network?

The classic DES uses 8 different fixed S boxes. If computer memory was not an issue, would say 800 different S boxes be more secure? I'm thinking of a SP-network that would only run on a server like ...

15 30 50 per page