2
votes
3answers
390 views

homomorphic encryption special case of multi party computation?

I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ...
2
votes
1answer
164 views

Why do we need extra hashing if we could use simpler scheme?

Lets say that we use init vector IV, key K and HMAC key H. Message is M. Mode of operation is CBC !!! We usually encrypt this way: ...
2
votes
4answers
644 views

PRNG taking advantage of very large seed

Can anyone suggest a good (CS)PRNG algorithm that takes advantage of having a very large (ideally arbitrarily large) seed? I'd like to use several kilobytes, perhaps several hundred kilobytes, of ...
2
votes
2answers
1k views

How to decrypt this RSA-like cipher

Suppose we have a RSA-type Modulus $n = pq$ with $p,q$ prime. We also pick a random public exponent $e$ with $\gcd(e,\varphi(n)) = 1$ and compute the private exponent $d$ with $de \equiv 1 ...
2
votes
2answers
4k views

How to get the keyword from a keyword cipher?

I was given a ciphertext and now I am trying to break it via looking for the keyword. This is a keyword cipher. So: PlainEnglish: ABCDEFGHIJKLMNOPQRSTUVWXYZ If ...
2
votes
2answers
511 views

Is the “Signed on date” of a PGP Signature Verified?

I noticed that PGP signatures have a "signed on" field. I was wondering if this is "trustworthy" information and if so how is it accomplished. For example, I can't see how it could be trusted ...
2
votes
1answer
179 views

Does an attacker gain an advantage if they have the initialisation vector?

Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?
2
votes
2answers
57 views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
2
votes
2answers
73 views

BOOLEAN FUNCTIONS: generate a function $f: \{0, 1\}^n \rightarrow \{0, 1\}$ from a $n \times n$ S-Box

I want to calculate the hamming weight of a S-Box using this formula: $\text{hw}(f) = \sum_{x=0}^{2^n-1} f(x)$. Where $f: \{0, 1\}^n \rightarrow \{0, 1\}$ My problem is that I don't know how to get ...
2
votes
1answer
153 views

Checking the integrity of RSA public key

Let's say I need to verify a digital signature and the public key is stored in untrusted storage which I need to fetch before I verify the digital signature. However, I can store the cryptographic ...
2
votes
2answers
185 views

How can I factorize a 350 bit (106 decimal digits) number in two prime factors?

I have this large number: 1728098743723095094470726818328193358068864405124007684733613106475812450278961107574624070107782941006379 which is the multiplication of two unknown large prime numbers. I ...
2
votes
1answer
141 views

Is it true that 7zip doesn't use any salt with its KDF?

This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679 If that's true, wouldn't that mean you can crack multiple ...
2
votes
1answer
231 views

RSA Signature Verification Implementation on Cortex M0

I have to implement RSA Signature Verification procedure (RSA-2048) on a Cortex M0 based MCU. My budget is 15kB Flash and 2-4kB Flash RAM. Is it even possible to do RSA on a low end MCU based on ...
2
votes
1answer
211 views

ECDH or RSA more secure for symmetric key wrapping?

Suppose a message is encrypted with a symmetric block cipher with a random key. RSA is often used to wrap the symmetric key using the recipient's public key. In this case, the size of the message is ...
2
votes
1answer
230 views

Is base64 the best two-way hash function to encrypt and trasmit a set of integer numbers via Internet?

I am writing a mobile game and I need to save my game data on my game server, So crackers can not find and access the saved files(data) on their mobile, the game data can be expressed by numbers, So, ...
2
votes
1answer
280 views

XTEA: patterns in plain text

I'm using XTEA to encrypt passwords that I store in a database. (I need to be able to decrypt these passwords later to log in on another system.) But now I have noticed something: if I decrypt a ...
2
votes
2answers
366 views

RSA: Is it secure to use the private key to encrypt and the public key to decrypt?

This may sound weird: What if I don't let others know my public key, then use my private key to encrypt, and the public key to decrypt? Is this secure? Let me explain a little bit: Common usuage: ...
2
votes
2answers
46 views

(Uniformly) Random Value when an element is picked with $\frac{1}{p-1}- \frac{1}{(p-1)^2}\ $ probability

Let's $\mathbb{F}_p$ be a finite field where $p$ is a large prime number(e.g. 256-bit) I know if the probability that an element picked from the field is $\frac{1}{p-1}$ we say the element is picked ...
2
votes
3answers
152 views

How much processing power should you assume an attacker has?

The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers Is that a single attacker ...
2
votes
2answers
142 views

What is the advantage of AEAD ciphers?

What is the advantage of AEAD ciphers? Why is the TLS working group pushing for them? I thought modern cipher suites require SHA256 for authentication. What advantage is there to including Poly1305? ...
2
votes
2answers
121 views

Present an attack for the combination of OTP and textbook RSA

Let $N=p \times q$ where $p$ and $q$ are two primes. Compute $\Phi (N) = (p-1)(q-1)$. Choose $e$ s.t. $1 < e < \Phi(N)$ and $gcd(e,\Phi(N))=1$. Compute $d = e^{-1}(mod \ \Phi(N))$. ...
2
votes
2answers
131 views

Do all attacks against PKCS1 v1.5 encryption require an oracle

As far as I know, all attacks against RSA PKCS1 v1.5 require an oracle; is that true? Or are there any other attacks against it which are able to break it without an oracle? Background: I need to ...
2
votes
2answers
344 views

Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?

Encrypt-then-Authenticate (EtA) seems to generally be considered the better option, compared to Authenticate-then-Encrypt (AtE) (see this Crypto.SE question, for example). The people writing the RFC ...
2
votes
2answers
90 views

Is it hard to recover $p$ from $k \phi(p)$?

Given $k\phi(p)$, is it hard to recover $p$? Here, $p$ is a large prime, $\phi(\cdot)$ is Euler's totient function and $k$ is an unknown integer. Or what's the complexity to recover $p$ from $k ...
2
votes
4answers
90 views

Definition of the term “key”

I've looked in many places (NIST, text books, online resources) and I cannot find an answer to the definition of the term "key" from a semantic point of view. Is it the "key" to cipher-texts (i.e. ...
2
votes
2answers
536 views

Toy public/private key example open to frequency analysis?

I've been looking at an online Public Key Encryption Example (summarized below). It seems to me that choosing cyphertext = plaintext^(key) mod n would produce the ...
2
votes
1answer
4k views

Is it safe to use PBEWithMD5AndDES?

I'm encrypting some of my (not so much important) files with PBEWithMD5AndDES. Is it a strong method or it can be de-crypt easily without knowing my selected ...
2
votes
2answers
370 views

Why can the last block contain a full block of padding in CBC Encryption?

I'm trying to understand the SSL Poodle Attack and I'm wondering why the last block of a CBC Record can be full of padding? Wouldn't that mean that the useful data was already a multiple of the key ...
2
votes
2answers
365 views

Sophie Germain primes and safe primes

I am trying to find a list or table of safe prime numbers i.e. the ones that are based on the Sophie Germain primes i.e. $N = 2p + 1$ where $p$ is also prime. All I found till now is this database. ...
2
votes
1answer
378 views

Is it safe to AES-CBC and AES-CMAC both using the same key?

There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ...
2
votes
2answers
130 views

Bouncy jdk 1.51 Serpent KAT tests vs Nessie vectors

Having a little trouble getting Nessie vectors working with the Bouncy Castle SerpentEngine. Do the Nessie vectors require a mode or some pre-processing? Nessie Serpent 128, set 1, vector 0 reads: ...
2
votes
2answers
483 views

SHACAL in SHA-256

I was reading about hash functions, namely SHA, and I read that it is made of the Merkle-Damgard construction. And then the text said that the compression function used is based on the Davis-Meyer ...
2
votes
1answer
137 views

Empty message Hash length

I am learning Hash Algorithms and in a presentation (PDF) about these algorithms I read that: Length of $h(m)$ much shorter then length of $m$. Now my question is: What if we talk about an ...
2
votes
1answer
87 views

Familiar key signing over video call

Say that a friend of mine and I have both generated new PGP keys, and we want to use a video call to verify each other's new keys because we live on opposite sides of the planet. While we could both ...
2
votes
1answer
192 views

Encrypting the same message using different schemes

$E_1$ and $E_2$ are IND-CPA secure encryption schemes. $E$ is defined as: $k_1,k_2 \leftarrow K_1 \times K_2$ . $E_{k_1,k_2}(m) \leftarrow E_{1,k_1}(m)||E_{2,k_2}(m)$. Hope the notations are in an ...
2
votes
1answer
442 views

Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?

I have just started studying Elliptic Curve Cryptography, and I have this doubt. In ECC the group operation is addition (and not multiplication). So, why is ECDLP stated as a variation of the discrete ...
2
votes
1answer
2k views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
2
votes
3answers
383 views

How can we sign a contract digitally between two parties?

I'm trying to sign a contract with another party, without using handwritten signatures. I've just read through Applied Cryptography, but there doesn't seem to be a protocol that can solve this ...
2
votes
2answers
415 views

Random numbers for Rabin-Miller primality tests

I've implemented a Rabin-Miller primality test fuction following Wikipedia and the book Applied Cryptography. Now I'm using it for generating primes with a string seed. The book suggests the following ...
2
votes
2answers
3k views

At what stage is DHE and RSA used during the SSL/TLS handshake?

At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further ...
2
votes
2answers
3k views

OpenSSL PBKDF2 documentation

I'm using OpenSSL 0.9.8 on OSX Maverick, and I want to use a PBKDF but I can't find any doc/man about it on OpenSSL's website. I'm working on QCA, an OpenSSL wrapper for Qt, and when I arrived there ...
2
votes
2answers
142 views

What is the impact of different modes on pseudo randomness of AES?

AES in CBC-MAC mode is proven to be good PRF . But is there any study done on other modes ? how good is ECB mode as PRF ?
2
votes
2answers
183 views

Speed up modular exponentation with fixed base and modulus

Can someone explain, how $a^x \mod N$ can be speeded up, when $a$ and $N$ are known constants? How big is the gain and what resources are needed? ...
2
votes
2answers
766 views

How should we interpret the cryptanalysis results of SIMON and SPECK?

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for ...
2
votes
3answers
572 views

OFB or CTR mode without an IV

I'm reading the SSL specs here. The interesting thing seems to be that RC4 is not re-keyed with a new IV for each message. The stream cipher state is simply carried over to the next record. Why is ...
2
votes
2answers
435 views

What does the linear assumption over bilinear groups mean?

In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say: In both schemes we rely on the linear assumption over bilinear groups. What ...
2
votes
1answer
638 views

LFSR using words

If I've got an LFSR, let's say a 16-bit Fibonacci LFSR as shown in the corresponding wikipedia article, which generates maximum length sequences, could I use it to create word sequences instead of bit ...
2
votes
1answer
129 views

How do these figures represent a boolean function?

In the Wikipedia article "Bent functions", there are some figures representing those Bent functions: How do these figures represent a boolean function ?
2
votes
1answer
418 views

What kind of machine can generate 100-400 digits prime number? RSA

The 64 bit machine's biggest number can be 2^63 (9,223,372,036,854,775,807). So what kind of a monstrous machine can generate 100-400 digits prime number? I probably don't understand something, so ...
2
votes
2answers
766 views

Is scrypt a hashing function, encryption, or PBKDF?

I have installed a python implementation of scrypt and noticed it has several functions, both an encrypt and hash function. Yet Wikipedia lists it as being used for PBKDF instead of PBKDF2. Is scrypt ...

15 30 50 per page