All Questions
30,268
questions
5
votes
1
answer
317
views
Algorithm or closed form solution that lets me directly compute the $n^{\text{th}}$ state of an LFSR?
I have a large linear feedback shift register with a known state and taps.
Now I want to compute the state of the LFSR after $n$ iterations.
The problem: $n$ is in the order of $2^{256}$ so just ...
5
votes
1
answer
4k
views
Elliptic curve and embedding degree
I am new to ECC. I am confused about what the embedding degree in an elliptic curve group represents and what is the impact of its values on the curve and security (small values or large values?)
...
5
votes
1
answer
745
views
ECDSA key recovery - floating point values
I'm currently attempting to recover an ECDSA key.
I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such,...
5
votes
2
answers
936
views
Converting a 5-bit s-box to its bit-sliced format
I'm currently trying to convert a 5-bit sbox (the one from this cipher: http://primates.ae/wp-content/uploads/primatesv1.02.pdf) to its bit-sliced format (i.e. to a boolean network).
Most papers ...
5
votes
2
answers
199
views
Is there a security problem with this prime generation algorithm?
I am facing the following algorithm to generate an RSA public key:
...
5
votes
5
answers
1k
views
How to disguise ciphertext
If I want to have a secret conversation, then I can encrypt it (with OTR etc). However, since big brother watches all communication, sending encrypted data will likely raise flags. Does anyone know of ...
5
votes
1
answer
1k
views
Faster alternative to HKDF
HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ...
5
votes
2
answers
1k
views
Why is 2048-bit RSA always paired with 320-bit ECC?
You may already have noticed that most smart cards ship with 2048-bit RSA support and 320-bit ECC over GF(p) support. You may have already asked yourself "why exactly 320-bit?". Now I remember having ...
5
votes
1
answer
1k
views
Is it true that 7zip doesn't use any salt with its KDF?
This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679
If that's true, wouldn't that mean you can crack multiple ...
5
votes
1
answer
458
views
Can Alice send Bob a secure message with only DSA and no key exchange?
Suppose Bob has a DSA key pair, and Alice has Bob's public key. Is there any secure way that Alice can send Bob a message only he can read if Bob can not send any reply?
I think the answer is no, ...
5
votes
4
answers
909
views
Which symmetric cipher is best for studying? [closed]
I would like to study a modern symmetric cipher (I have never studied a cipher before) and I was wondering which would be the best cipher for studying purposes of the following: AES (Rijndael), ...
5
votes
3
answers
2k
views
Fast PKI for embedded device
We are creating a device with a small microcontroller (20 MHz CPU 16 KiB RAM).
We need some way to securely send signed files to device (only signature, no encryption necessary). An external company ...
5
votes
1
answer
4k
views
Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure
Any thoughts on how this can be done?
Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for ...
5
votes
2
answers
26k
views
Meet-in-the-Middle attack on 3DES [duplicate]
How can I apply the Meet-in-the-Middle attack to the 3DES algorithm, and why does the literature say that 3DES is more secure than DES?
5
votes
2
answers
839
views
Weaker alternative to Ed25519?
For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast.
However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
5
votes
1
answer
30k
views
How to accurately calculate Unicity Distance for English?
The Unicity Distance for the DES cipher is around $8.6$ characters, and can be calculated using the $U=H(k)/D$ formula, where $D = R - r$, and where $R = 8$ is the number of bits in a byte (ASCII is 7 ...
5
votes
2
answers
2k
views
Generation of strong primes
It seems that this is pretty difficult to find large (above 1024 bits) strong primes, or at least such primes $p$ where $(p-1)$ has a very large prime factor. Is there any information regarding the ...
5
votes
1
answer
5k
views
how to calculate non linearity of AES S-box?
S-box has to satisfy different design criteria. How to calculate non-linearity , propagation criteria for an AES S-box?
5
votes
2
answers
3k
views
Use cases and implementations of RSA CRT
I discovered the chinese remainder theorem (CRT) version of RSA cryptosystem which is used in many crypto libraries (OpenSSL, Java...).
The use of this theorem improves the speed of decryption so, ...
5
votes
1
answer
1k
views
Why can't garbled circuits be reused?
There are a bunch of papers do research on resizable garbled circuits. But I wonder why garbled circuits cannot be reused?
For example, the constructor constructs a garbled circuit of "AND" like this:...
5
votes
1
answer
1k
views
Is it possible to demonstrate that md5(x) != x for any x?
I am looking for an easy to follow explanation, if possible, that demonstrates/proves the validity (or not!) of this assertion:
for any X, md5(X) != X (being X any string of 32 hex characters)
5
votes
2
answers
3k
views
Block Ciphers and (Non-)Generic Attacks
I am currently reading through Cryptography Engineering and came across this definition of block cipher security:
Definition 2 An attack on a block cipher is a non-generic method of
...
5
votes
2
answers
12k
views
Which stream cipher can we replace the RC4 in the SSL?
In cryptography, the Fluhrer, Mantin and Shamir attack is a particular stream cipher attack, a dedicated form of cryptanalysis for attacking the widely-used stream cipher RC4. The attack allows an ...
5
votes
2
answers
299
views
Can S/MIME be still considered secure?
Previoulsy I had asked this question at https://stackoverflow.com/questions/18235983/can-s-mime-be-still-considered-secure but I feel this forum is topic-wise the right place.
Recently there has been ...
5
votes
1
answer
543
views
Does zero-padding the secret in Shamir's sharing scheme increase security?
When performed in binary Galois fields $GF_{2^n}$, Shamir's threshold secret sharing scheme produces shares that are each the same bit-size as the secret. Though the scheme is "perfectly secure" in ...
5
votes
1
answer
898
views
Why doesn't this replay attack work on ECDSA?
I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
5
votes
1
answer
484
views
Why pairing based crypto is suitable for some particular cryptographic primitives?
Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for ...
5
votes
1
answer
4k
views
AES CCM vs CCMP
Are the terms AES CCM and AES CCMP are equivalent, or is there any technical differences between the two?
5
votes
1
answer
3k
views
Can we trust digital signatures?
Consider that Alice wants to send a digitally signed message to Bob.
Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
5
votes
3
answers
501
views
Is the $\ell$-Diffie Hellman Inversion easy when g is known?
From here they define the $\ell$-Diffie Hellman inversion problem as:
Given $g^{a},g^{a^2}\ldots,g^{a^{\ell}} \in G$, compute $g^{a^{-1}}$
Would this problem become easy if the generator $g$ is also ...
5
votes
1
answer
3k
views
Why is ElGamal considered non-deterministic?
One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is).
What makes it non-deterministic? Is this advantageous to security? How else does this property ...
5
votes
1
answer
3k
views
Are there two-way encryption algorithms that include a work factor?
I recently learned about the hashing algorithm bcrypt, which allows you to specify a "work factor" for the hash which can be incremented to stay ahead of Moore's Law. I understand there are some other ...
5
votes
2
answers
631
views
Generating X ids on Y offline machines in a short time period without collision
In theory this is what I have :
Around 10 000 offline machines
Each machine will generate around 10 000 ids
I can program the machine in any way I want, but I prefer a low memory and low cpu
They all ...
5
votes
2
answers
9k
views
Are SHA-256 and SHA-512 collision resistant?
Context: Designing a TinyUrl system. The user inputs a lengthy URL and the system computes the hash and encodes it binary64 and sends it back to the user.
From what I understood so far (from this ...
5
votes
1
answer
1k
views
Looking at just EC Public Key parameters, how can you tell if it is invalid?
I am trying to handle when a parsers goes off the rails and reads an EC public keys wrong (just the X and Y components, I know the curve prior).
Right now I check for the following (false means ...
5
votes
2
answers
397
views
Recommendation of lightweight RNG for Miller-Rabin primality test
Miller-Rabin tests the compositeness of candidate numbers (hence, input $x$) that's often used as a primality test.
The M-R test requires different random numbers for accuracy and confidence in the ...
5
votes
1
answer
964
views
How is it possible that these two encryption functions yield the same result?
I opened this post in stackoverflow some time ago where I explained a problem I had about not finding a way that would allow to successfully get the result of a string encrypted with a "aes-256-...
5
votes
1
answer
332
views
Advantages of Paillier vs Goldwasser-Micali
It is easy to see that both Paillier and Goldwasser-Micali are homomorphic addition schemes and are secure, but what would be the advantages of choosing one over the other?
5
votes
3
answers
1k
views
Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?
This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers.
I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
5
votes
3
answers
2k
views
What happens if you increment MAX counter in AES-CTR?
Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
5
votes
1
answer
1k
views
How to Implement Deterministic Encryption Safely in .NET
I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
5
votes
2
answers
10k
views
What is the difference between a Vigenère cipher and a one time pad cipher?
I'm doing a decryption competition at a nearby college. We are allowed one cheat sheet so I'm trying to make one. I realized that the Vigenère cipher was very similar to the one time pad and wanted ...
5
votes
1
answer
3k
views
Encrypting AES in ECB mode
I'm fairly new to cryptography and am starting to understand this weird art of Mathematics and theory. One thing I am trying to understand and do is encrypting a plaintext into ciphertext using AES in ...
5
votes
1
answer
829
views
The role of Shift Register Cascades in Cryptography?
Clearly, there are stages when binary bits are needed and this can be done with the help of Linear Feedback Shift Registers.
Registers are required to be connected in such a manner that one register ...
5
votes
1
answer
955
views
Are ciphertext-only attacks on LFSRs possible?
Reading about LFSR, I know that breaking an LFSR by knowing it's design and having enough (plaintext, ciphertext) pairs is an relatively easy task but let's assume we know the design of LFSR and a ...
5
votes
2
answers
570
views
Do very short values make a peppered hash less secure?
Given many very short (or low-entropy) values – like 6-digit numbers – that are stored as hashes using a fixed secret pepper, e.g.:
...
5
votes
1
answer
18k
views
Is there a way to tell if a given string is a sha256 hash?
Just like, for instance, we can easily check if a given number is a visa card number, by verifying prefix and checksum - can we do anything similar for hash?
5
votes
1
answer
2k
views
What is the maximum number of shares in Shamir's Secret Sharing?
I am using codahale’s Shamir's Secret Sharing implementation of Shamir's secret sharing from Github.
I am using this to generate a 32 byte random key encryption key (KEK) to encrypt a 32 byte data ...
5
votes
3
answers
243
views
Is there any benefit to *really* strong passwords?
Suppose you had these two passwords:
...
5
votes
3
answers
2k
views
Substitution-permutation network visualizer
I'm doing differential analysis of a toy block cipher in which I've to extract the differential characteristic of the first n-1 rounds.
However, I can't do that very well as I can't see the network ...