6
votes
3answers
878 views

McEliece Cryptosystem Implementations

Are there any current implementations (language irrelevant) of the McEliece Cryptosystem? I have been hunting around all day, and yet, have only found a few mathematical equations pertaining to the ...
3
votes
0answers
107 views

Question about proof of knowledge defintion?

I am just reading the "soundness"-definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover $P$ and a verifier $V$. $P$ convinces $V$ to know a secret ...
0
votes
1answer
175 views

RSA - Ecrypting the same data with the same public key = same ciphertext?

If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow? The most obvious way is encrypting the guessed plaintext with my public key and the same parameters ...
3
votes
1answer
148 views

implementing long term archive encryption

Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways: The ...
2
votes
1answer
168 views

How can a key pair be derived from an arbitrary hash?

If I correctly understand the concept of a "brain wallet" in BitCoin, you start with a passphrase, generate the hash of the passphrase, then somehow derive a public / private key from that to use as ...
3
votes
4answers
549 views

Tamper-proofing log files

Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ...
3
votes
2answers
401 views

What is the best way to store sensitive information on the client?

I am very inexperienced with cryptography and would like some advice on how to store some sensitive information on client machines. I have some information stored in a central database on my server. ...
1
vote
2answers
423 views

Does key authentication in SSH protect from MitM?

How do cryptography in SSH(2) work (secure channel establishment, authentication)? Does key authentication in SSH(2) protect from MitM by providing authentication and integrity and why?
1
vote
0answers
96 views

Algorithm digipass-like

I'm pretty sure there are famous algorithms for my problem, but I don't have enough knowledge in this field, so I need your lights. Here si the problem : Alice sends key X to Bob. Bob has an ...
5
votes
1answer
332 views

In textbook RSA with low public exponent, how big does a random message needs to be?

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
0
votes
1answer
374 views

Is this scheme a provably fair random number generation?

I have thought up a method for generating random numbers between a client and a server which I hope is fair: The client and server decide on a range in advance, $0$ trough $n-1$. The server ...
10
votes
1answer
3k views

repeating-key xor and hamming distance

I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
1
vote
1answer
200 views

Password verification

I'm looking for feedback on whether or not this is the proper way to approach password verification without transmitting the actual password. Are there any problems with this scheme. We are working ...
1
vote
4answers
324 views

Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data?

I am designing a simple and secure stream communication protocol. My idea was to build each message sent to the wire as: (message size || clear text || UHASH(message size || clear text)) $\oplus$ ...
4
votes
1answer
181 views

Combining AEAD with RSA

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
5
votes
2answers
451 views

Are cryptographic hash functions perfect hash functions?

For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to ...
2
votes
2answers
948 views

Keys required for cryptography

I am reading an article on cryptography at following location: http://www.entrust.com/resources/pdf/cryptointro.pdf Historically, encryption systems used what is known as symmetric cryptography. ...
4
votes
2answers
1k views

How were the number of rounds for different key sizes of AES selected?

The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
1
vote
1answer
73 views

What does “securely realize” mean?

I was wondering what "securely realizes" means. I see this in some cryptographic papers but I don't know what it means for a protocol to "securely realize" a function $F$. Is it just a fancy way of ...
2
votes
2answers
271 views

Chain several RSA encryptions without increasing the message size

I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time. In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
2
votes
1answer
97 views

What happen if a asymmetric crypto-system deals with only one key

Assume there is a crypto algorithm that deals with matrices to encrypt and decrypt. Regardless of the specification of such algorithm, what if the algorithm assumes that two parties can securely agree ...
7
votes
2answers
3k views

Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme

Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme? Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
5
votes
2answers
303 views

Security of tokenization of plain text conversations - cryptanalysis

I came across a marketing video here. They claim to perform AES encryption and tokenization of sensitive data, at the corporate gateway, before it leaves the company firewall destined for the public ...
4
votes
3answers
428 views

The utility of elliptic curve cryptography

Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve ...
1
vote
1answer
132 views

Connections between Instance Hiding and Fully Homomorphic Encryption

Another approach taken by researchers for carrying out computations over encrypted data is Instance Hiding. In brief, If a user wants to outsource the computation of a function for a particular input ...
3
votes
1answer
874 views

Triple-DES Brute Force

Shannon's paper states: A system is pure if all keys are equally likely and if for any three transformations, $T_i$, $T_j$, $T_k$ in the set, the product $T_iT_j^{-1}T_k$ is also a ...
1
vote
1answer
1k views

AES AddRoundKey

Looking at the first step of AES encryption I see that we XOR the key with the plaintext block. Why is the actual key involved at all, why not just use the round keys derived from the key schedule?
3
votes
1answer
245 views

Addition with Shamir secret sharing

When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$. I believe this would be the correct solution (correct me if I'm wrong): Each party ...
5
votes
2answers
998 views

Is encrypting a single 128 bit block with AES ECB “safe”

I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
17
votes
1answer
1k views

Should I trust CipherCloud? [closed]

Should I trust CipherCloud's system for "homomorphic encryption" of data in the cloud? Has the security of their system been subject to peer review or other cryptanalysis? Is there any known analysis ...
1
vote
1answer
104 views

How to learn the first bit of m in padded RSA

Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing ...
2
votes
1answer
257 views

What's the probable usage of Interlock Protocol

I've recently read some articles about the Interlock Protocol, Article by Ron Rivest and Adi Shamir. I'm wondering if it is possible to protect Key-exchange under Public-Key cryptography from the ...
2
votes
1answer
186 views

Can prepending “junk” be equivalent to an IV when encrypting using CBC?

We are encrypting a small positive integer (1-1000) with a constant key using AES256 encryption. We are considering two approaches to make this secure; use an initial vector (which we then need to ...
1
vote
2answers
217 views

How secure is passing a MAC to Python's random.seed before using random.choice to generate a MAC?

I'd like to use Python's random.choice seeded with a HMAC-SHA1 tag to generate a MAC encoded in a variable set of chars. ...
2
votes
0answers
80 views

PKC McEliece + $S$ + $P$ [closed]

I am trying implement the McEliece crytosystem in SAGE. My question is How I will be able to choose the appropriate matrix $S$ and $P$?. I ask this because when I trying obtain the vector $\hat{m}=mS$ ...
3
votes
2answers
191 views

GPG and PAR2 error correction data from the plain archive, will it compromise security?

I have the following scenario: Archives compressed with 7z, hundreds of MiB in size GPG to encrypt the archives (binary, without ASCII armor) PAR2 to create error correction data Question 1. ...
8
votes
1answer
4k views

Why exactly is Blowfish faster than AES?

I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
2
votes
2answers
294 views

Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies­-Meyer or Miyaguchi-Preneel are ...
3
votes
1answer
707 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
0
votes
1answer
464 views

Ciphertext-only attack on Simplified DES

Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
4
votes
3answers
345 views

Is there a way to use Shamir Secret Sharing with updatable data?

I want to divide a system that maintains these properties, based on Shamir's Secret Sharing: A secret key is split up to N pieces, where T of them are enough to reconstruct the key. The original key ...
-1
votes
2answers
396 views

May the problem with DES using OFB mode be generalized for all feistel ciphers

There is a problem with using DES as the block cipher in OFB mode, eg: the feedback that goes back into the next round will be encrypted with the same key $k$ resulting back into the plaintext IV used ...
1
vote
0answers
133 views

Perfect secrecy and change of plaintext probability distributions

How to prove that if a cryptosystem has perfect secrecy for a given plaintext probability distribution then it will have perfect secrecy for all other possible plaintext probability distributions? Do ...
1
vote
0answers
44 views

Encrypted Functions with Fully Homomorphic Encryption [duplicate]

While Fully Homomorphic Encryption schemes facilitate carrying out computations over encrypted data, can the function that has to be evaluated be encrypted too ? For example, if i have some programs ...
6
votes
1answer
543 views

Correct way to map random number to defined range?

Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX. What is the best way to map this random number to a ...
2
votes
1answer
217 views

DLP based crypto systems with multiple independent generators

One example of a DLP based crypto system (or rather DDH based crypto system) where the public key parameters include two independent generators of the subgroup, is Cramer Shoup. Since the security ...
2
votes
0answers
139 views

Correct way to truncate data to a range [duplicate]

2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm. I want to take a stream of k trusted random ...
1
vote
1answer
2k views

decryption many time pad [duplicate]

I have eleven ciphertexts that were encrypted with the same key (which I don't know). I want to decrypt the last ciphertext. I read similar question like Many time pad attack but I can't solve my ...
5
votes
1answer
217 views

Is there an existing AEAD scheme with minimal IV requirements?

Is there an existing AEAD scheme such that, for inputs with the same AD and IV ciphertexts are allowed to leak whether or not their plaintexts are equal, if the scheme can process the plaintext in a ...
2
votes
1answer
65 views

Comprehension question on a signature protocol based on the RSA assumption

We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...

15 30 50 per page