1
vote
2answers
90 views

Encrypting documents through a proxy key

Suppose I'm developing an app to secure a lot of documents. These documents were encrypted (say, using AES) with a key X. This key X is basically the password that the user enters before wanting to ...
2
votes
1answer
230 views

Finding a solution to a (sort of) discrete logarithm by asking questions

Let $p = kq + 1$ and $q$ be primes such that $log$ $q = n$, $log$ $k = n$ and such that the bit size of every prime factor of $k$ is bounded by $log$ $n$. Let $g$ be a generator of the unique ...
2
votes
1answer
311 views

DGK Cryptosystem Encryption Speedup

Following @poncho's nice clarification of the RSA speedup here, let's see if I'm able to do the same in the case of the DGK cryptosystem: We have pk = (n, g, h, u), sk = (p, q, $v_p$, $v_q$) which ...
2
votes
0answers
110 views

XSLT tranform in xmlsignature form, a part of xmldocument? [closed]

I have a HTML page(A Form) where user will enter his details. Details to enter are NameagesalarystateCity Now when user enters all details and click Button then I will create xml file containing the ...
4
votes
1answer
503 views

Does the Biclique attack on AES pose a credible risk to its security?

I have heard a lot about the biclique cryptanalysis research on AES, which as far as I know is the closest anyone has got to breaking AES. Exactly how close did they get? Does this attack propose a ...
3
votes
1answer
502 views

Advanced Encryption Standard Algorithm Secret Key

just a follow up question with this question.. How does the key schedule of Rijndael looks for keysizes other than 128 bit? A 256-bit key can still encrypt a block of plaintext in 128 bit? but in ...
3
votes
8answers
592 views

Does a public key absolutely need to be used to initiate an encrypted session?

I am a software developer working on an application with the .NET platform. This application needs to provide a secure connection and encrypt all data between the client and the server. It is a ...
4
votes
4answers
974 views

What is the largest performed/possible bruteforce attack to date?

I've read that cracking 128-bit key is currently out of reach of all humanity. However, I can't seem to find any information on what scope of brute force attacks have been performed or are possible at ...
1
vote
1answer
365 views

ECIES protocol - what does the || operation mean?

I am studying elliptic curves problems, which also includes study of related protocols such as ECIES. A there is a problem I don't understand operation $||$. What this operation mean? Some stuff is ...
3
votes
2answers
477 views

Inverses in Truncated Polynomial Rings

I've been trying a long time to understand a thing which is obviously extremely simple, but I just can't get it. Read this, please: The NTRUEncrypt PKCS uses the ring of truncated polynomials $R$ ...
1
vote
2answers
426 views

Real life collision when only using truncated hash

For MD5 two different inputs are known that produce the same 128 bit hash value. However, these inputs are artificially created for this specific purpose. For normal, real life inputs I believe no ...
1
vote
1answer
185 views

NTRUEncrypt - Choose the initial random polynomial

I'm trying to implement NTRUEncrypt but encounter some problems. I've finished all the basic functions that are needed for the scheme base on this Document, but I can't find an algorithm to check the ...
3
votes
2answers
996 views

Difficulty of breaking RSA for a given key size

Is it true that breaking a 1024-bit RSA key is as difficult as breaking a 128 bit symmetric key (e.g. AES)? I know that breaking a RSA key is equivalent to factoring the modulus $N$. To factor it, you ...
-1
votes
1answer
130 views

amateur cryptosystem -> a very long boolean expression -> attempt to reduce it [closed]

(newbie here) I try to analyze amateur cryptosystem and wondering, if it's possible to reduce it as reduce a very long boolean expression? What tool can I try to use?
5
votes
1answer
4k views

Chinese Remainder Theorem and RSA

Wikipedia has a nice section regarding the speedup of the RSA decryption using the Chinese Remainder Theorem here. I need to understand the implementation of a similar speedup for the encryption ...
5
votes
1answer
610 views

Are there any MGF1 and OS2IP functions available in C?

I need MGF1 and OS2IP functions, as defined in the PKCS #1 v2.1: RSA Cryptography Standard. Is there anything available in OpenSSL, or any other open C library?
10
votes
3answers
590 views

Does NTRU decrypt correctly now?

The NTRU public-key cryptosystem has a lot of interesting properties (being resistant to quantum computer attacks, being standardized by several important bodies), but it also has a pretty unique ...
5
votes
2answers
234 views

Is my HMAC secure if I have a complete series of HMAC'd prefix strings

Let's say I have a long sentence, like "The quick brown fox jumped over the lazy dog." Let's further say that I need to keep this string encrypted, so I use an HMAC. Let's further further say I want ...
3
votes
1answer
405 views

Is XOR in a CBC-like mode secure?

Assuming that $K_{n}$, $P_{n}$, and $C_{n}$ are individual bytes of the key, plaintext, and ciphertext respectively. The first byte of ciphertext is computed like this: $C_{1} = K_{1} \oplus P_{1}$ ...
3
votes
3answers
2k views

Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings

I'm building a system that has to take file paths, and generate a unique name for each one. I'm planning on using SHA1 as the hash function. My question is: do I have to deal with possible collisions ...
4
votes
1answer
443 views

How were the AES key and block length subsets of Rijndael selected?

My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
1
vote
2answers
3k views

Initialization vector length insufficient in AES

I use AES with AES/CBC/PKCS5Padding with the following encryption and decryption code sections in Java: ...
4
votes
2answers
2k views

Why DSA cannot be used for encryption?

Here it is mentioned that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the DSA public key to ...
5
votes
3answers
1k views

Encryption with “constant” initialization vector considered harmful

I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice. For stream ciphers not doing ...
5
votes
1answer
743 views

Do Rabin Fingerprints have any advantages over CRC?

Background In both, bitstrings are interpreted as a polnomical over GF(2) and they each can be used to implement a hash over a sliding window. The definitions of each are as follows: Rabin ...
6
votes
1answer
284 views

How to enhance randomness of AES?

I'm using PHP to encrypt a string and Java to decrypt it on a remote server. To perform the encryption, I'm using the strategy that can be found here. My problem is that the strings I encrypt are ...
-1
votes
1answer
194 views

How can we find Public key have only 8 or 16bits? How many messages does Eve need to know the Public key in RSA?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
6
votes
1answer
687 views

How can disk encryption systems (like Truecrypt) resist frequency analysis when they allow random access?

I don't understand how disk encryption (e.g. TrueCrypt) is supposed to resist frequency analysis. If blocks can be randomly accessed (which they can), doesn't that mean that frequency-domain ...
-1
votes
1answer
3k views

How does one implement the Inverse of AES' MixColumns

I got an answer in the related question about Mixcolumn for encryption, but how about decryption? what will I do? Because it said that I will used this: During decryption the Mix Column the ...
2
votes
2answers
280 views

Order of hashing concatenation

A = hash("blue" + X); B = hash("pink" + X); If A and the literals are known and X is unknown, are there attacks on B aside from the attacks on directly on hash()? ...
2
votes
2answers
364 views

Is it possible to figure out the public key from encrypted text?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
3
votes
0answers
233 views

RSA reencryption scheme

Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user? Basically, such an algorithm would probably be ...
2
votes
1answer
220 views

Public Key Encryption with forward secrecy

Is there a known non-trivial system with plausibly secure public key encryption where: 1. $\;\;$ the $\:$ time $\:$ function is efficiently computable 2. $\;\;$ [pubkey,privkey] $\:$ pairs are ...
4
votes
1answer
918 views

How many RSA keys before a collision?

I was wondering how many possibilities of private/public keys there are? If a million people for whatever reason tried to generate 5keys each in the same minute (on the same date and time) is there a ...
1
vote
1answer
429 views

Recovering the key in an ElGamal Signature Scheme variant

From page 318 in Stinson's "Cryptography: Theory and Practice", question 7.3: Suppose that Alice is using ElGamal Signature Scheme. In order to save time in generating >the random numbers k that ...
2
votes
2answers
287 views

How do I demonstrate that a PRNG not designed for cryptography is not suitable for generating passwords?

This is a replication of this question on Stack Overflow. There's class Random in .NET runtime which is designed for use as a cheap fast source of pseudo-random ...
2
votes
3answers
433 views

RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
4
votes
1answer
156 views

Do public/private pairs work both ways?

Public/private key algorithms such as RSA encrypt a message with a private key but only decrypted with another (mathematically related) key. Can the public key decrypt the messages encrypted with ...
6
votes
1answer
208 views

Message space in security definitions

What is the message space in the following example and how does a message space relate to a security definition? I mean, what difference does it make to such a definition if your message space is ...
4
votes
1answer
522 views

Elliptic curves for ECDSA

i'm trying to implement parameters generation for ECDSA according to SEC1 v2.0: Input: The approximate security level in bits = t is {80, 112, 128, 192, 256} ...
6
votes
3answers
524 views

Security equivalence proofs for breaking RSA

It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring. In otherwords, ...
4
votes
2answers
624 views

What is the smallest plaintext/ciphertext size for an algorithm like?

When I read about a choosen plaintext attack, for example on AES the block size is always 128 bits, does it mean the attacker will only supply 128 bits data words as "plain text" ?
5
votes
2answers
478 views

Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode

I was not able to understand why we practically need a CPA security in Cipher Block Chaining. (which insist on having a random IV), let say if the encryption is not CPA secure i.e , the adversary can ...
3
votes
1answer
236 views

Has there been any cryptanalysis of RC4-52?

Several websites ( such as Is there a secure cryptosystem that can be performed mentally? ) briefly mention RC4-52 as a modification of standard RC4. RC4-52 has only with 52 instead of 256 elements ...
5
votes
1answer
153 views

Digital signature for an expiring password

I would like to create a publicly available tool that is used to generate a password that gives a limited time access to a resource. My idea is to digitally sign the current date with a private key ...
5
votes
1answer
201 views

One-way hash on encrypted data, result hidden from hasher

I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
6
votes
3answers
2k views

How does the key schedule of Rijndael looks for keysizes other than 128 bit?

It said in Wikipedia that: [....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the ...
6
votes
1answer
498 views

A fair peer-based coin-flipping protocol?

I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight. This is how my idea ...
18
votes
4answers
1k views

How to fairly select a random number for a game without trusting a third party?

Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.) Can this be done such that each player has the power to be ...
7
votes
2answers
629 views

Does AES have any fixed-points?

Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M? If yes, how do I go about (efficiently) finding such a pair?

15 30 50 per page