1
vote
0answers
149 views

How is key rotation defined?

I'm aware that it's advisable to rotate cryptographic keys periodically. HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length. It also accepts a salt, ...
1
vote
1answer
396 views

Help with example RSA problem

While learning about RSA, I found this example problem. The answer is supposed to be "a 4-digit number that is a pattern of digits." I have computed it to be 16657 twice. OK, now to see if you ...
2
votes
1answer
70 views

How does the possible attack on passwords and salts mentioned in PKCS#5 v2.1 work?

From PKCS#5 v2.1, 4.1 Salt (page 6, emphasis by me), also in v2.0, RFC 2898: In password-based encryption, the party encrypting a message can gain assurance that these benefits are realized ...
3
votes
3answers
660 views

Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
3
votes
2answers
267 views

How to calculate leaked information from a check digit

Given a check digit calculated using mod 11, of an encrypted numeric sequence of 8 digits, how much information can be known about the plaintext? More specifically, a single 3DES encrypted CBC block ...
10
votes
1answer
323 views

Which MACs can be converted into a secure unkeyed hash function?

It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
3
votes
2answers
150 views

Is this exponentation or bitwise XOR

I'm reading about SRP from this page and came accross the line that says a party computes v = g^x I am unfamiliar with reading cryptography texts. Does this mean gx, or g ⊕ x?
4
votes
1answer
129 views

low-exponent RSA

I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$. Suppose further the messages are ...
0
votes
2answers
266 views

Recommended authenticated stream cipher for minimum overhead?

I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ...
5
votes
2answers
1k views

Difference between “one-way function” and “cryptographic hash function”

What's the difference between a one-way function and a cryptographic hash function?
3
votes
1answer
1k views

What is U2FsdGVkX1?

Using CryptoJS 3.1 I noticed that using 3Des, the encrypted message always start with U2FsdGVkX1 Why is the first part of the encryption always the same? What information does this hold and ...
9
votes
1answer
489 views

How to build an electro-mechanical public key cipher machine?

It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT. Imagine, if the abstract idea of having a public key and a ...
4
votes
1answer
209 views

How hard is it to generate a partial RSA fingerprint collision?

When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ...
2
votes
2answers
213 views

Is it possible to cryptographically prove when was the last time a ciphertext was decrypted/encrypted?

I want to provide a service that encrypts and decrypts documents and I want to provide the users with proof that I haven't stolen their secret key and read their documents. I know I can prove when a ...
4
votes
1answer
386 views

Has GMAC mode a future outside GCM?

Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
1
vote
0answers
139 views

Hash function with values in a multiplicative group of prime order [closed]

I have to implement a cryptographic protocol which involves a cryptographic hash function $H: \{0,1\}^* \to G$. It is viewed as random oracle. $G$ is a multiplicative group of prime order. I want to ...
3
votes
1answer
636 views

Security of authenticated encryption modes gcm & ccm

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
3
votes
1answer
223 views

Anonymity in end-to-end encryption

Considering a scenario of anonymous data transfer between seller and buyer using proxies. If we consider that there are three proxies that are being selected by the buyer to obtain data from different ...
3
votes
1answer
2k views

How do I decrypt ciphertext with this cipher?

I have an encryption function $$E(p) = (ap + b) \mod{26}$$ where the parameters are $a=7$, $b = 10$, and $p$ is the plaintext letter. I was asked to decrypt the ciphertext ...
2
votes
3answers
4k views

OpenSSL AES 256-bit Key Management

I am using C and OpenSSL to encrypt files. After experimenting with the OpenSSL command line utility, it makes you enter a passphrase that can be any length, but uses that to create a 256-bit key. ...
16
votes
2answers
3k views

understanding a length extension attack

I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully ...
2
votes
2answers
249 views

Encrypting and MACing different data with same key

It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
1
vote
1answer
198 views

Scrypt as a KDF with one-time high-entropy input

I'm looking at using Scrypt as a KDF. Assume the following: the input will always be high-entropy random bytes generated by a CSPRNG the length of the input can vary from between 8 to 32 bytes the ...
2
votes
2answers
120 views

KDF with low-entropy salts

I need to derive a key from a username and a password. These are the only two things I have access to. What I thought is using PBKDF2 with username as the salt and password as the master password. ...
3
votes
2answers
578 views

Reason(s) for using a KDF for encryption keys

Assuming I already have a 256-key (32 char password) for AES encryption, comprised of random alpha-numeric characters and punctuation (95 possible ascii chars), generated by a decent PRNG, is there ...
1
vote
1answer
261 views

brute force attack on KDF vs KEY

if we believe 256bit keys are secure in AES against any brute force attack, is that possible we use a KDF (convert user's weak entered password in truecrypt into a fixed AES key) with too much round ...
2
votes
1answer
191 views

What information to include is the 'info' input for HKDF?

The RFC states the following: 3.2. The 'info' Input to HKDF While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main ...
1
vote
1answer
176 views

Why is Bcrypt called a Key Derivation Function?

I am trying to understand why is bcrypt called a Key Derivation Function? I looked up the details of Ekfblowfish on Usenix article here: ...
4
votes
1answer
257 views

Key collision in scrypt and hkdf

I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ...
3
votes
1answer
357 views

Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?

I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and ...
2
votes
1answer
328 views

Cracking an RSA with no padding and very small e

I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
0
votes
1answer
205 views

Is there a problem with constructing a CSPRNG using MD5 or SHA1?

Is there any security concerns with building a CSPRNG using a broken hash function like MD5 or SHA1? The design is such that a CRC-like function is used for mixing entropy and MD5 is used as the ...
2
votes
2answers
356 views

CSPRNG in JavaScript using Audio and Video

I ported GnuPG to Javascript using Emscripten (not released yet). Now I need a good replacement for /dev/random//dev/urandom. ...
3
votes
2answers
260 views

How is de-synchronisation of HOTP solved?

From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
2
votes
1answer
207 views

synchronization of counters in HOTP

How is synchronization of counter values achieved in the HOTP protocol? As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
2
votes
1answer
264 views

Is it considered insecure in an HOTP implementation to publicly provide the next counter?

I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
7
votes
2answers
325 views

Why does HOTP use such a complex truncate function?

In the HOTP protocol after calculating a 20 byte hash it is truncated to 4 bytes. For this first an offset is calculated (low-order 4 bits of the last byte) which determines the four bytes to be ...
12
votes
1answer
1k views

How does HOTP keep in sync?

My understanding of HOTP is that each password is unique and based on a counter. $$PASSWORD = HOTP_1(K,C)$$ Where $C$ is an incremental counter. What I wish to know, is how you keep the client ...
3
votes
2answers
1k views

Which categories of cipher are semantically secure under a chosen-plaintext attack?

I am trying to get my head around the circumstances under which a cipher is (or is not) semantically secure under a chosen-plaintext attack. I can't seem to find a good reference explaining this. I ...
4
votes
2answers
362 views

Is it generally possible to employ brute force methods when the encryption scheme is not known? Why or why not?

Lets say you are presented with an encrypted string of bits or text, and no other information. What would be necessary before you could apply brute force methods to decrypting the string? How would a ...
18
votes
2answers
6k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is pubic? What ...
2
votes
2answers
145 views

GGM PRG construction: Why do we need to change keys all the time with underlying PRG

When constructing a PRF that has n bit input using the GGM PRG, why do we always have to recursively run the PRG using its previous output as a seed key n times. Instead, why don't we run the PRG n ...
2
votes
1answer
192 views

How does the birthday attack work in AUTH and UF-CMA games?

In the AUTH and UF-CMA games, an adversary is required to forge a ciphertext or message/tag pair to win the game. Given an encryption scheme $E$ and a PRF $F$, let $\hat{E} = C || F_k(C)$ and $C = ...
8
votes
1answer
507 views

Are there any authoritative definitions of “key stretching”?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
0
votes
1answer
142 views

Can one detect if two pairs of elements in Zp have the same exponential relation?

Suppose that $p$ is a safe prime of 2048 bits ($p = 2q + 1$, and $q$ is prime). Suppose that one is given two pairs $(x_1, y_1)$ and $(x_2, y_2)$ such that: $y_1 = x_1^{r_1} \pmod p$ $y_2 = ...
5
votes
2answers
4k views

In RSA, do I calculate d from e or e from d?

In the original paper introducing RSA, it is implied that one should first choose $d$ and then calulate $e$ from $p$, $q$, and $d$. However, I have found in other places (such as the wikipedia article ...
1
vote
2answers
275 views

Amateur question: two-way RSA?

Is this a sensible scheme for 2-way client/server communication? A client connects to a server. The server and client both generate RSA keys, and send over the public ones to each other. If the client ...
1
vote
1answer
175 views

Preimage resistance hash in digital signature

I'm studying about preimage resistance property of the hash functions. In particularly I'm reading as the missing of this property can be fatal in digital signatures that use RSA. Further details: ...
1
vote
0answers
70 views

Why is it impractical to generate a semiprime dictionary? [duplicate]

This might be a very simple question. However, I am just learning the concept, so just excuse me. I am wondering why there is not any attempt to generate all semiprime numbers? (as an dict. attack to ...
2
votes
1answer
454 views

length extension attack on an MD5 hash of a text file of about 10K Bytes?

How much computing time on a typical desktop computer would it take to find a new length and new data to extend a text file of about 10K Bytes with a given MD5 hash?

15 30 50 per page