2
votes
3answers
257 views

Why is Bcrypt called a Key Derivation Function?

I am trying to understand why is bcrypt called a Key Derivation Function? I looked up the details of Ekfblowfish on Usenix article here: ...
2
votes
2answers
384 views

Elliptic Curve Cryptography Encryption and text representation implementation

I'm writing a coursework and right now I've implemented the ECDSA algorithm, but I also need to encrypt and decrypt small text files (.txt) using elliptic curve cryptography. The problem is that I do ...
4
votes
4answers
700 views

Alternative to NSA encryption algorithm

I am looking for a strong alternative to elliptic curve cryptography. It should be something that could face quantum computing attacks, but nothing created by the NSA. I heard about isogeny key ...
2
votes
2answers
356 views

Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?

Encrypt-then-Authenticate (EtA) seems to generally be considered the better option, compared to Authenticate-then-Encrypt (AtE) (see this Crypto.SE question, for example). The people writing the RFC ...
0
votes
1answer
59 views

Executing encrypted code? [closed]

I want a code 'black box' that receives data inputs, processes those inputs, then sends out the outputs. I want the code to be encrypted, or somehow obfuscated. Is there any known way to do achieve ...
11
votes
1answer
256 views

Logjam on Elliptic Curves?

I think we're all aware of the Logjam attack. From now on we know that re-using primes for DH is a bad idea. But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
1
vote
0answers
56 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
1
vote
1answer
94 views

HKDF entropy extraction

I collect entropy from the following sources: system_entropy = System provided crypto entropy stream (CryptGenRandom on Windows) user_entropy = User-provided entropy - in a form of a byte stream of ...
4
votes
1answer
73 views

possible MITM attack against servers that used to support weak DH?

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid ...
0
votes
1answer
94 views

Security aspects of using a global values as nonce and additional data for AES? [closed]

is it a good idea to use global values as nonce / additional data? What problems can occur? What should be take in account when we deal with such parameters for encryption. Thanks
1
vote
1answer
700 views

Common Modulus Attack in RSA

Consider the following scenario: The Information Security Department (ISD) of an organization issues each of the organization's employees, domestic and abroad, with an individual RSA key. To simplify ...
0
votes
1answer
118 views

Huffman encoding of hashes

I have a huge list of MD5 hashes, which takes up quite some space. I was wondering if I would acheive (some) compression, by encoding the characters (which are A-F 0-9), with huffman coding. I made a ...
0
votes
0answers
45 views

Factorization of a number obtained by a modular multiplication operation can reveal factors of the used operands?

Consider a number $r$ obtained by: $r=a \cdot b \mod n$ Can knowing the factorization of $r$ reveal some information (bits) of $a$ and $b$ ?
2
votes
1answer
144 views

Attacking CBC with predictable but encrypted IV

Let P be a secure block cipher, eg AES-128. Let's say a server has a CBC encryption oracle which uses an attacker-selected yet unique nonce to generate the IV for each message = P(key, nonce). The ...
2
votes
2answers
92 views

Authenticated EC key exchange without a signing/signature scheme?

From my little understanding of EC-based authenticated key exchange protocols, I believe that it is not possible for authenticated key exchange without a signing/signature scheme. Is this correct? ...
0
votes
2answers
138 views

Is it possible to have identical public keys for different ciphers?

Is it possible (and is there any research I can read) to have 2 key pairs for different ciphers, for example RSA 1024 and some yet to be released EC (or other asymmetric cipher) than uses 1024 bit ...
0
votes
1answer
58 views

Break El-Gamal Algorithm by knowing the value of the random k

In El-Gamal Algorithm, the public key is $(p, g, A)$, and the secret key is $(a)$, in order to encrypt some data, the sender generate a random $k$, where: $(C_1, C_2) = (m.A^{k} \pmod{p}, g^{k} ...
4
votes
1answer
226 views

Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?

where $g$ is a group element in bilinear group $\mathbb{G}$. I understand it is very similar to the conventional DBDH problem, but $g^{1/b}$ is also known, possibly making it easier? Does anyone know ...
7
votes
1answer
312 views

Logjam: “composite order subgroups” explained for TLS developers and system admins?

I have read the recent logjam paper Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice. On page 11 in the Recommendations section, they state: ...
2
votes
1answer
152 views

Hash length extension attack - SHA256 to 512 - impossible, correct?

Just want to be sure about something before I sign off on a method we're about to put into place. We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the ...
1
vote
1answer
630 views

The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the ...
2
votes
2answers
731 views

P10 to P8 in S-DES

I am new to cryptography. During my learning I am facing a problem with S-DES. I am confused where P10 to P8 come from, and I’m ...
1
vote
2answers
654 views

Cryptanalysis of S-DES - Equations

I am trying to derive equations for s and t in the cryptanalysis of a Simple DES algorithm, but I haven't been able to deduce ...
0
votes
1answer
714 views

Ciphertext-only attack on Simplified DES

Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
1
vote
1answer
75 views

one-way deterministic hash for low entropy input?

My problem is the following: we have a low entropy data called ID. (personal id number of 10 decimal digits plus a sum, and it contains a date) We want to create a data (H) which is the same for the ...
0
votes
0answers
208 views

Finding Patterns in Encrypted Data

I am looking for an application (Windows) or code example that might help me find patterns in an encrypted file. I have a ciphertext for which I want to see when a key is repeated. I am not trying ...
0
votes
1answer
38 views

HTTPS and plaintext authentication

I have client connecting a server over HTTPS to send and retrieve data. The client always connects through HTTPS The certificate is known to the client beforehand (hard coded into the software) The ...
1
vote
2answers
131 views

Severity of Cooking NIST P Curve Constants

Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
1
vote
1answer
92 views

Decryption of Huffman code

I know that Huffman is not a encryption method, but I have a bit-stream that I know it's Huffman coded. However, the tree/table that maps the codes to real characters is not available. Surprisingly, ...
0
votes
0answers
50 views

prepaid meters that rely on a disconnected system

i have some experience with cryptography in the banking sectors, mostly in block ciphers like DES 3DES etc. im interested in prepaid electricity meters as it is a number that is generated from a ...
1
vote
2answers
191 views

Integer encryption preserving equality

I have read too many different options for encryption that I now feel quite lost. I need a simple, secure (don't we all) scheme for encrypting integers (32-bit) with the following requirements: ...
3
votes
1answer
343 views

Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure

Any thoughts on how this can be done? Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for ...
6
votes
3answers
386 views

Is there a way to use bcrypt with passwords longer than 72 bytes securely?

From my understanding BCrypt truncates the password to 72 bytes. If a password is longer than 72 bytes, what is a way to store that password using bcrypt securely without compromising it? Or is this ...
0
votes
1answer
251 views

Why exactly Blowfish max key length is 448

Could anyone, please, tell me history of birth of Blowfish algorithm? Specifically, what is substantiation of Blowfish key length to be in range from 32 till 448 bits? Why, for example, it wasn't ...
7
votes
3answers
788 views

Order of cascaded ciphers

Does the order of a block cipher cascade (e.g. in TrueCrypt) make a difference to the security provided, assuming independant keys? For example: ...
2
votes
2answers
917 views

nonce of AES-GCM in SSL

It seems that the nonce of AES-GCM in SSL has 3 parts: salt, 4 bytes, generated in handshake, not changed in whole session nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL ...
-3
votes
1answer
125 views

Can i get a list of over hard and long RSA keys? i think i have found a vulnerability in RSA Algorithm [closed]

al-right, I need some examples of hard and long RSA keys cause i think i have found vulnerability in RSA. i need you to give me few hard Values of n (which is pxq) and i will tell you what p and q ...
0
votes
1answer
90 views

How to perform homomorphic multiplication in ElGamal?

How can I compute homomorphic multiplication in ElGamal? That is: Given two ciphertexts $(R_1,c_1)$ and $(R_2,c_2)$ corresponding to plaintexts $m_1$ and $m_2$ under some public key; how can I compute ...
1
vote
1answer
82 views

What should I think about these unique certificate serial numbers [closed]

I was looking at the serial numbers of the certificates for www.google.com and wordpress.com. Wordpress was listed by openssl as: 04:0B:D4:F8:25:88:C5 This serial is listed as the serial for both ...
0
votes
1answer
75 views

How do we know one-way functions can be iterated?

Suppose we have some one-way function $h$. Without further specification of $h$, how can we be sure that we can define another function $g(n) = h(h(n))$? That is, how do we know the range of $h$ is a ...
0
votes
1answer
134 views

Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?

I'm aware that MD5 is broken, and collisions have been found for it. I'm interested in other hashes (SHA-1, SHA-2, SHA-3) when truncated to the same digest size, i.e. 128 bits. The time complexity of ...
0
votes
1answer
225 views

RSA Signature : Process of Sign the message and Verify

I have read that the RSA numeric signature works as the following: Generation of keys : $p,q,N,e,d$ Process of signing the message $m$ (which is BigInteger) : it uses the secret key $sk=(p,q,d)$ so ...
2
votes
2answers
557 views

Is One Time Pad considered Chosen-Plaintext Attack Secure?

If we're considering Chosen-Plaintext Attack setting, then the adversary has access to the Encryption Oracle right, and we know that OTP is only considered secure if we use the key only once. How ...
4
votes
1answer
433 views

How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?

Wikipedia claims: A secure block cipher can be converted into a CSPRNG by running it in counter mode. This is done by choosing a random key and encrypting a 0, then encrypting a 1, then encrypting ...
5
votes
2answers
482 views

What makes an algorithm “fast in software” vs. “fast in hardware”?

When reading about different algorithms, I often encounter claims that various algorithms are "fast in software" (e.g. Salsa20) or "fast in hardware" (e.g. DES). What properties make a cipher ...
8
votes
4answers
298 views

Alice and Bob's crush

Suppose Alice and Bob both want to determine whether the other has a crush on him/her, but they only wish to share the information if the crush is mutual. Is there a cryptographic protocol that makes ...
0
votes
3answers
118 views

Is the hash function defined in this exercise collision-resistant?

I have this problem: "Let ${\rm Enc}_k(m)$ a safe block encryption system. We define a hash function $H(m)$ as follows: $m$ will be concatenated with $0$ until $|m|$ is a multiple of ...
2
votes
2answers
247 views

Post-quantum authenticated encryption

It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong. However, these statements are always made ...
0
votes
0answers
22 views

Is sending encrypted message and signed message a secure way of transmitting data? [duplicate]

I know that the industrial standard is normally sending data in the following format: Send Encr(msg, Sign(msg)) Is the following way a secure as well? ...
0
votes
1answer
33 views

Strenght of TLS handshake

I asked this question recently but I was told it is not save to simply send over the identifier for your crypto method you want to use. for example, say the server has crypto method 3 5 and 6, the ...

15 30 50 per page