1
vote
1answer
87 views

Why concatenate the key a second time in HMAC? [duplicate]

On Wikipedia it is said that HMAC is basically (without taking into account padding): $H(key\ \Vert\ H(key\ \Vert\ message))$ where $\Vert$ denotes concatenation. I understand the need to hash ...
1
vote
0answers
100 views

Which of following new (2013) ECC curves is the most secure or efficient?

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
1
vote
1answer
101 views

Hash functions with or without secret key

The classical definition of hash functions (found in books) are OK, but when studying a little more there is a lot of notions that seem ambiguous (contradictory) to me : Sometimes we have hash ...
0
votes
0answers
33 views

Problem implementing MixBytes functionality in Groestl

Disclaimer: School work. I am trying to implement Groestl through Java, and have got stuck on the MixBytes section which can be found here section 3.4.5 page 11. As per the description of matrix ...
-1
votes
1answer
37 views

Meet in the middle attack - message and key

I clearly understand the story of Alice and Bob: Alice and Bob are going to use double DES. They know the keys K1 and K2. Alice sends to Bob the encrypted message c= EK1(EK2(m)). Bob decrypts the ...
-1
votes
1answer
95 views

Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate]

First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ...
3
votes
0answers
78 views

How can I create an RSA modulus for which no one knows the factors?

It's easy to create an RSA modulus where almost no one knows the factors: for example, I can generate two 1024-bit primes $p$ and $q$ and set $n=pq$. If I publish $n$, I will be the only person in ...
21
votes
7answers
12k views

Google is using RC4, but isn't RC4 considered unsafe?

Why is Google using RC4 for their HTTPS/SSL? $ openssl s_client -connect www.google.com:443 | grep "Cipher is" New, TLSv1/SSLv3, Cipher is RC4-SHA Isn't RC4 ...
4
votes
1answer
323 views

What prevents a padding standard to cause a data loss?

In here different byte padding standards are listed as ANSI X.923, ISO 101.26, PKCS7, ISO/IEC 7816-4 and zero padding. All of them seems to apply padding to the last byte blocks. Odds are rare but ...
2
votes
2answers
3k views

Cipher Feedback Mode

I can't understand what CFB really is. It said in Wikipedia that CFB is same as CBC, but I find that CFB is more difficult than CBC. Can someone explain to me how CFB works. Such as how ...
-1
votes
1answer
89 views

Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate]

First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ...
0
votes
2answers
47 views

counter to indicate hotp count

I was trying to figure out how HOTP kept from wrapping over, when I saw this explanation of how it works, by Thomas Pornin [source]: The intended scenario is the following: the client has a ...
2
votes
1answer
110 views

Is this an acceptable implementation of ARC4 encryption for my system?

I am building an open source hardware system that will be used to control things over the internet. The system consists of a Base Station and Modules which use wireless communication at 2.4GHz to ...
1
vote
1answer
60 views

Difference between known-plaintext attack and forward search attack

I am looking at the different attacks on RSA. I came across known-plaintext attack where the public key can be used to encrypt all possible messages until it finds a match on the sent encrypted ...
0
votes
1answer
548 views

How is input message for SHA-2 padded?

I read about how is an input message prepared to be hashed by MD4,MD5 or SHA-1: Step1 Append padding bits The input message is "padded" (extended) so that its length (in bits) equals to 448 ...
1
vote
1answer
71 views

Why do we apply the concept of circuit in homomorphic encryption schemes?

I am a beginner to the concept of homomorphic encryption. One thing that makes me very confused is why we use the circuit concept or approach to homomorphic encryption. Gentry's paper does not discuss ...
3
votes
1answer
73 views

Should different key pairs be used for signing and encryption?

In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation: When a user turns ...
0
votes
3answers
105 views

Question on RSA trapdoor permutation

You plan to use a public-key cryptosystem based on the RSA trapdoor permutation in three different real-life applications, in which the attacker has, respectively, only one of the following resources: ...
4
votes
1answer
69 views

Difference RSA keypair creation openSSL and openPGP?

Creating a 2048bits RSA keypair I figured that doing this using openssl takes as an input 32bytes of "randomness" from /dev/urandom gpg (openGPG) takes as input ...
1
vote
2answers
419 views

RSA problem if i choose two specific small prime numbers?

I know that rsa normally is made to make it with big integers, but i trying to make the algorithm myself (with the help of wikipedia) and I´m making it with small numbers to track the problems easily. ...
2
votes
1answer
78 views

distribution for a subset of md5

I need to uniquely assign a 32 bit integer to a collection of human readable strings (i.e. they will not be generated with hash collision in mind). I don't expect more than a few thousand strings. I ...
2
votes
1answer
69 views

Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here: ...
5
votes
2answers
165 views

Reusing AES-CTR Keys and IVs for File Encryption

I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go. I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
1
vote
0answers
38 views

Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password

I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has ...
-1
votes
1answer
32 views

Affine encryption function

Let $f(x) = ax + b$ be an affine encryption function. $a$ and the cardinal of the field of our keys $K$ (in English, 26) must be coprime so that the encryption ...
1
vote
1answer
71 views

Modular protocol design

What does modular protocol design mean? Why does TLS not have modular protocol design? What protocols have modular design? (IPSec, SSH)
-1
votes
0answers
26 views

Winternitz checksum

I'm reading the One Time Signature Winternitz in this book [pag 38]. My question is Why is important the checksum? Is there any attack again Winternitz OTS if the checksum is hidden?
1
vote
4answers
115 views

Are there use cases where a signature itself needs to be signed?

I'm writing some code to digitally sign certain files (JSON, if you must know), and I'm trying to understand the use cases, not being a crypto guy myself. I understand there are use cases where ...
3
votes
1answer
293 views

Advantages using Diffie-Hellman or Elgamal

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of Elgamal, and most important why should we use one or the other? I do not see a clear difference ...
0
votes
4answers
399 views

Is the One Time Pad (OTP) considered a cryptographic hash function?

As the title states, would the One Time Pad (OTP) be considered a cryptographic hash function?
2
votes
0answers
67 views

What functions allow for practical indistinguishability obfuscation?

Recently, there has been a major theoretical breakthrough in program obfuscation, in the area of indistinguishability obfuscation. Background: Indistinguishability obfuscation is a form of program ...
2
votes
0answers
45 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
1
vote
1answer
3k views

How to solve MixColumns

I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this? I found some topic in the internet about MixColumns, but I still have a lot of question to ...
2
votes
4answers
337 views

How to perform Multiplicative Inverse Modulo in IDEA

How to perform the Multiplicative Inverse Modulo in International Data Encryption Algorithm? I don't understand on how to perform it… For example, let's say I have a value of ...
3
votes
3answers
242 views

Is it possible to work out the hash algorithm from a list of known message-hash pairs?

For example, in my situation I know hash(20) = 486e9638177faf1f34e49910491b77af. I also know the hashes for all values from 0 to 20. Is it possible to work out the ...
-1
votes
3answers
163 views

Padding of Original Message in MD5

what should I do if my original message is greater than 64 bits? what is the process of padding in MD5? As described in Internet Security: Cryptographic Principles, Algorithms and Protocols, page ...
4
votes
4answers
522 views

Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)

I have a question about Pseudo Random Functions. Let $f:\{0,1\}^m \times \{0,1\}^n → \{0,1\}^n$ be a secure PRF. Define $F(k,x) = f(k,x) - f(k, x-1 \bmod 2^{n}) \bmod 2^{n}$. Is $F$ is a secure ...
1
vote
0answers
151 views

Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements? [closed]

I am using nginx compiled with OpenSSL 1.0.1f (most current release available). Nginx allows administrators to set a configuration parameter called ssl_ecdh_curve, ...
5
votes
2answers
136 views

KCV and compatibility with block cipher modes of operation

There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ...
-3
votes
1answer
43 views

Selection of cryptographic functions for OAEP

I can't understand how the "cryptographic functions" are to be selected RSA + OAEP which are used in OAEP. How to choose these "cryptographic functions"(G and H)?
11
votes
3answers
1k views

Why does SHA-1 have 80 rounds?

Why does SHA-1 algorithm have exactly 80 rounds? Is it to reduce collisions? If yes, then why do SHA-2 and SHA-3 have a lower number of rounds?
1
vote
1answer
78 views

Is there need for message authentication if a public key is transmitted and then used to encrypt a symmetric key?

First I'd like to note that I'm really a beginner at cryptography, and while this interests me and while I have researched it in the past few months, there is still a lot of things that simply aren't ...
2
votes
1answer
85 views

How can I show that the DDH problem is self-reducible?

I have trouble to understand how I can show that the Decisional Diffie-Hellman problem (DDH) is self-reducible. I found this as a description of a random self-reducible problem. ...
2
votes
2answers
58 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
1
vote
1answer
99 views

ElGamal with elliptic curves I

It is very interesting to see @tylo's answer on ElGamal with elliptic curves. Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its $x$ coodrinate. ...
-1
votes
2answers
80 views

How to best mix two arbitrary/random n-bit words? [closed]

Given two arbitrary/random $n$-bit words, how could one best mix them to get one $n$-bit word for general crypto usages? I suppose that one should have an adequate measure of goodness of the mix ...
2
votes
2answers
70 views

Linear Cryptanalysis - possible without plaintext?

If Linear Cryptanalysis exploits the fact that the plaintext and ciphertext are not completely unrelated, is the attack possible without having access to the plaintext?
1
vote
0answers
78 views

AES encryption takes more time to decrypt than encrypt

Please let me know if this is not the right place to ask this question. I will remove it. I am trying to find how much time an AES encryption and decryption takes for a given amount of data and key. ...
0
votes
1answer
59 views

Changing a bit Changes Hash

I am very curious on the fact that SHA,MD5 and all related Hash Functions change the output even by changing one bit in input Message.Why is that?
1
vote
1answer
73 views

Can a monoalphabetic substitution cipher attain perfect secrecy?

Can a monoalphabetic substitution cipher attain perfect secrecy? Definition of perfect secrecy: $${\rm Pr}[\,{\rm Enc}_k(m_1) = c\,] = {\rm Pr}[\,{\rm Enc}_k(m_2) = c\,]$$

15 30 50 per page