All Questions
0
votes
0answers
44 views
“Free” key exchange in a Ed25519 PKI? [duplicate]
Assuming a PKI where everyone has a public/private Ed25519 keypair, can a secure shared secret be computed by calculating abB when Alice has keypair ...
6
votes
1answer
134 views
When do ECC patents end?
As the topic says, since when can ECC cryptography be freely used?
Isn't it widely used because of patents? There is no alternative to it on embedded devices and smart cards.
Just to mention: i am ...
2
votes
1answer
162 views
Are there any practical implementation of a homomorphic hashing or signature scheme?
A homomorphic hash function is a function $H : A \to B$ between two sets with some algebraic structure $(A, *)$ and $(B, \star)$ such that
$H$ is collision resistant, i.e. it is hard to find $x \neq ...
3
votes
3answers
133 views
What is the difference between a HMAC and a hash of data?
On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.
What exactly is the difference between an HMAC and a hash of a ...
0
votes
0answers
77 views
Why do we need to hash both the message and the $h$ value in ElGamal signature?
The professor left us a question on ElGamal signatures:
Given the hash function $H$ and message $M$, choose a random $r$ and compute $h=g^r$ and $H(M||h)$. Show that, if $H(M)$ is used instead of ...
3
votes
1answer
190 views
Is Truecrypt's multiple/cascading encryption safe?
Is Truecrypt use of cascading encryption safe? Is it useful? Truecrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very ...
1
vote
1answer
113 views
Generate an insecure public / private key pair
I am looking for a way to generate an "insecure" public key pair. and by insecure I actually mean a pair that is breakable using brute-force (or other encryption) methods.
As far as I know PGP ...
1
vote
1answer
89 views
Padding always the same, problem or not?
I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm.
My problem is that I split the message into ...
2
votes
1answer
76 views
What information to include when calculating the HMAC of ciphertext
I'm aware that it's crucial to include the IV when calculating the HMAC of a ciphertext (assuming an IV is used). Can anyone explain, in simple terms, why this is?
Furthermore, assume that there is ...
2
votes
1answer
90 views
Questions about proof of correct encryption in the Paillier cryptosystem
In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$.
A proof of correct encryption could look like presented in ...
-1
votes
1answer
100 views
Chosen Plaintext Attacks
Assuming the ability to launch Chosen Plaintext Attacks (CPA), how many oracle calls an attacker
needs to break the affine cipher? and how
3
votes
4answers
136 views
Turning a cipher into a hashing function
This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;)
The first hashing functions created ...
1
vote
0answers
57 views
How to represent point-at-infinity in affine coordinate
In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate.
Whether x=0 and y=0 can be considered as point-at-infinity in ...
0
votes
1answer
61 views
Nonce role on stream ciphers
Modern stream ciphers usually predicts the usage of a nonce (also termed as IV) in the cryptosystem. The cost of initializing the cipher with the nonce varies from algorithm to algorithm (for ...
1
vote
1answer
139 views
Which one is fastest? Karatsuba or Montgomery multiplication?
Is there any complexity analysis between Karatsuba and Montgomery multiplication algorithms? It seems that Karatsuba is more general in the sense that is not modulo tuned while Montgomery it is. Does ...
0
votes
0answers
71 views
Strong RSA problem in $\mathbb Z^*_{n^2}$
Comparing to this question, assume $C, M \in \mathbb Z^*_{n^2}$, $e \ge 3$, is it hard to compute $M$ that satisfies $C=M^e \mod n^2$ when $C$ and $(n, e)$ are given?
1
vote
2answers
149 views
Deriving HMAC key and cipher key from passphrase? [duplicate]
I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
3
votes
1answer
69 views
How hard are discrete logarithms problems in $\mathbb Z^{*}_{n}$ and $\mathbb Z^{*}_{n^2}$, where $n$ is the RSA $n=pq$
Use the notations form the Wikipedia article Paillier Cryptosystem
, assume that the chipertext $c$ and $c^{\lambda} \mod n^2$ are both given, is it possible to compute $\lambda$ easily?
1
vote
1answer
96 views
How to generate a random polynomial of degree $m$?
I am trying to do a homework in which implement a variation of this paper and I don't know how to generate a polynomial of degree $m-1$. This polynomial is used to generate the $y_0$ and $y_1$ values.
...
1
vote
4answers
174 views
Bad/Crackable Encryption Example?
I've been tasked with building up some security exercises (basic CTF training kind of stuff) for work. This should contain a bit of crypto, but my knowledge in this space has been limited to using the ...
4
votes
2answers
166 views
Why are the constants so simple in Keccak?
Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF)
The initial values of the state in Keccak is ...
1
vote
2answers
103 views
Fastest multiplication algorithm for efficient exponentiation in C++?
First I apologize if this question is better tailored for SO, but since I'm using the method for crypto stuff, I thought I'd ask anybody that might know here. Karatsuba algorithm does a pretty good ...
0
votes
0answers
32 views
How hard is a known prefix hash preimage attack?
Suppose the attacker knows X, Z such that
H(X || Y) = Z
If bit-length(Y) < 60 then a brute force attack is possible.
What if
bit-length(Z) = 256 (such as in SHA-256)
bit-length(X) = 128
...
0
votes
1answer
67 views
Is the following key stretching algorithm as memory hard as I think it is?
I'm having some fun designing a key stretching algorithm that can be implemented in pure Python. It's built entirely out of the standard library's hash functions in an attempt to at least wrest some ...
0
votes
2answers
128 views
Why nobody considers counter re-keying as a standard Block Cipher Mode?
One of the simplest possible cipher modes is setting each successive key as a function F of the previous one.
K[0] = Master key
C[i] = E(K[i],P[i]), K[i]=F(K[i-1])
This is similar to the counter ...
0
votes
2answers
152 views
Algorithm/Technique for Steganography
What is the most used Algorithm/Technique in Steganography? I made some research about the algorithm/technique and I think Least Significat Bit(LSB) is the most used algorithm, is there any more ...
0
votes
1answer
119 views
Digital signatures in SSL/TLS-like protocols
The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ...
4
votes
0answers
158 views
Security of pairing-based cryptography over binary fields regarding new attacks
In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$.
Pairing-based cryptography using binary ...
1
vote
1answer
81 views
Symmetric encryption mode where ciphertext size is plain text size
I've had many questions on Stackoverflow on how to minimize the output of a cipher - during encryption of course - to the same size as the input. Obviously this is possible for a single block of ...
6
votes
1answer
167 views
Can I find two specific words with the same md5 hash?
I want to find two strings containing special words like "yes" or "no", mixed with random characters, for which the MD5 hash is equal.
An example of what I'm looking for:
...
1
vote
1answer
63 views
Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?
First of all, the Guillou-Quisquater digital signature scheme is:
Note everything is $\bmod n$. Message is denoted by $m$.
Private key: $s$
Public key: Hash function $H$, $e$, ...
-1
votes
2answers
119 views
Computational indistinguishability and example of non polynomial algorithm
The wikipedia page on computational indistinguishability says that two ensembles are not distinguishable if "any non-uniform probabilistic polynomial time algorithm A" cannot tell them apart. To help ...
-1
votes
1answer
41 views
Security system theoretical task [closed]
Imagine that you are responsible for implementation of a new security system in a company which boss insists on having new encryption algorithm.
Here are couple of solutions which has been presented ...
3
votes
3answers
167 views
Why do we assume un-security of communication channel on every cryptography system
While reading about a few cryptographic systems, I noticed that we always assume the communication channel is not secured. Why is this assumption made? And, why the effort is being put into designing ...
-1
votes
1answer
96 views
What is a good intro to cryptography book? [closed]
I'm a math major in college and its mostly theoretical like analysis, etc. and I have been interested in the idea of cryptography, so naturally I'm interested in possibly studying up on it a litle bit ...
2
votes
2answers
178 views
Validating successful decryption in AES
I have a program which uses AES-256 in CBC mode to encrypt and decrypt files. As I have quickly realized, AES will even use an incorrect passphrase to decrypt data, which leaves me with no way to ...
4
votes
1answer
304 views
From hash to Cryptographic hash
After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for MAC usage, due to a certain type of DDos attack ...
0
votes
1answer
94 views
Why are RSA keys encoded with ASN.1 for TLS?
Browser vendors use ASN.1 encoding for RSA certificates in the TLS protocol. RSA public keys are just a number, so why do we need encode them to something else? That increases the risk of security ...
0
votes
0answers
67 views
MD5 > Would multiple hashings increase security? [closed]
A Simple question,
if i run a string trough the standard md5 encryption function multiple times, does it increase security the more i do it? does it protect against rainbow tables? etc.
1
vote
0answers
41 views
Is there a way to analyse xxHash and tell, either by human analysis, or with an automated tool, that this hash function is or is not cryptographic? [duplicate]
After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for Internet usage, due to a certain type of DDos attack ...
2
votes
2answers
145 views
Is storing original file size in an encrypted file header a bad idea?
I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ...
2
votes
0answers
54 views
Implementing PKCS#7 Padding on a Stream of Unknown Length?
I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
0
votes
1answer
42 views
RSA Certificate Owner and Issuer line meanings?
Apologies if this question is not in the right place.
I've recently been looking through some RSA certificates ( specifically, Android apk .rsa files) and I'm having trouble deciphering the one and ...
0
votes
1answer
65 views
Why is Blum-Goldwasser not IND-CCA-2 secure?
Consider the Blum-Goldwasser encryption scheme as described on Wikipedia. I was told that it was not IND-CCA-2 secure.
I heard there was malleabilty, probably it has to do with XOR-ing. But I do not ...
0
votes
1answer
42 views
Could use an explanation of the notation for an oracle adversary
In the definition below, what exactly does it mean for the adversary (not even sure that's the correct term?) to equal one?
$$
\underset{K}{Pr} \left [A^{F_k(\cdot)} = 1 \right ]
$$
Source (Page ...
1
vote
1answer
120 views
AES key/ciphertext space sizes
This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit ...
0
votes
3answers
127 views
File encryption with one keypair?
I'm working on a program that uses an ECC keypair in a (password protected) PKCS12 file (.pfx) to encrypt files. I like this method because I think it will be higher security (using ECDH to negotiate ...
1
vote
1answer
97 views
Master keys for decrypting?
I'm not a Cryptography expert, but i've seen this topic sometimes on the Web: Master decrypt keys.
Most of the people said that "Master decrypt key" does not exist.
This makes sense if you developed ...
0
votes
0answers
23 views
How can I validate generated session keys in SRP-6a protocol
I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys.
On the client I generated a SHA1 ...
0
votes
1answer
72 views
What are unified addition and differential addition in elliptic curve point arithmetic?
A lot of papers use these terms but I do not find a proper explanation of them. Can somebody tell the meaning / difference / intuition / application and if possible with an example.
