4
votes
3answers
1k views

Calculating the amount of zero bits to be appended to the message

From FIPS 180-3 Suppose that the length of the message, M, is l bits. Append the bit “1” to the end of the message, followed ...
6
votes
2answers
985 views

GPG symmetric encryption and javascript

I have a use case where I need to encrypt some text in the browser using javascript. Only the encrypted text will be stored on the server. The user should then be able to take the encrypted result and ...
7
votes
2answers
384 views

Pairing-friendly curves in small characteristic fields

There are several well-known techniques to generate pairing-friendly curves of degrees 1 to 36 on prime fields GF(p): Cocks-Pinch, MNT, Brezing-Weng, and several others. In extension fields GF(p^n), ...
7
votes
4answers
855 views

What is the signature scheme with the fastest batch verification protocol for multiple signers?

I'm looking for a scheme where signing may be costly (slow) but batch verification with different signers is the fastest possible. Modified ECDSA allows batch verification for different signers with ...
4
votes
2answers
624 views

What is the smallest plaintext/ciphertext size for an algorithm like?

When I read about a choosen plaintext attack, for example on AES the block size is always 128 bits, does it mean the attacker will only supply 128 bits data words as "plain text" ?
2
votes
2answers
190 views

Is there a cumulative commitment scheme?

For a certain application I need a commitment scheme where each user could make a commitment, and a single verification operation could verify all the commitments simultaneously, faster than single ...
4
votes
1answer
1k views

How to practically find solutions to a discrete logarithm?

Are there any ongoing or current practical attempts to solve instances of the discrete logarithm problem of the order of magnitude used in cryptographic applications, for example with a 256 bit ...
2
votes
1answer
135 views

How to collect, process, and transmit data securely?

In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
2
votes
1answer
216 views

Are there reference implementations of ECQV implicit certificates?

I am interested in exploring ECC implicit certificates, specifically using the ECQV protocol. While the actual implementation would not difficult to perform using building blocks provided by most ECC ...
6
votes
3answers
2k views

What place do prime numbers have in cryptography?

My understanding of hashing and encryption is rather limited. I certainly do not understand the mathematical formulas at play in these algorithms. With that said, what part do prime numbers play in ...
5
votes
4answers
174 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
6
votes
4answers
377 views

Does MD5 generate 128 independent bits?

I heard that there are 128 stochastically independent bits in an MD5 output. Is that true? If so, are there any citations or proofs for that?
5
votes
1answer
267 views

If a cryptanalytic breakthrough is made, what process should be followed?

If a researcher manages to make a cryptanalytic breakthrough on a cryptographic algorithm or protocol that is in use, what should they do? Has this ever happened before? What are the implications for ...
4
votes
2answers
185 views

How are constructs with data-dependent swaps and rotations cryptanalyzed?

Linear and differential cryptanalysis seem well suited for constructs with a (relatively) simple fixed structure of boolean expressions. But some ciphers incorporate swaps of array elements where the ...
24
votes
1answer
2k views

Could one prevent double spending in decentralized digital currencies (like Bitcoin) without all transactions being public?

A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
12
votes
3answers
1k views

Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?

Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
5
votes
1answer
262 views

Is it safe to encrypt a public key alongside a message with AES?

If I have a message M and a public key P, and I encrypt them alongside one another: CIPHER = AES(M + P, aes_key) Is CIPHER now weakened if someone knows what P ...
10
votes
5answers
2k views

What is the post-quantum cryptography alternative to Diffie-Hellman?

Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption ...
2
votes
4answers
319 views

Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list

I have a scenario similar to the one described in Wikipedia: hash list, but with a twist. I'm looking for a cryptographically secure hash function that would create the same root hash for the same ...
12
votes
2answers
465 views

Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?

Is combining digests (created using a hash function) using arithmetic addition, and then hashing and publishing the result, less secure than publishing the set of digests? Does the answer change if ...
2
votes
3answers
1k views

Dictionary attack on pass-phrases on common algorithms

I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
3
votes
2answers
402 views

Are there public slow-but-strong algorithms out there that resist brute-force attacks better?

I'm reading that AES uses 4x4 bytes (4*4*8 = 256 bits key) matrix for performances matters (since it's a requirement for common standard encryption algorithms), but are there implementations with ...
19
votes
2answers
4k views

Why does nobody use (or break) the Camellia Cipher?

If Camellia is of equivalent security and speed to AES, concerns arise. First of all, assuming the above, why is Camellia so rarely used in practice? Why aren't there any breaks in Camellia? Does ...
5
votes
1answer
1k views

Any good file format alternative to PGP for encrypting data at rest?

I'd like to create an encrypted file that: Can be decrypted on a variety of platforms (mainly Windows, OS X, and Linux) with knowledge of the key. Can be decrypted with existing tools (perhaps ...
3
votes
2answers
673 views

Using an RSA private key simultanously as an AES encryption key to generate random numbers?

Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the successor X9.31- standard to implement my PRNG. X9.17 uses DES, but ...
14
votes
2answers
536 views

How long would the 100 Year Cryptography Project have secured its data had it been started 100 years ago?

The goal of the Tahoe-LAFS 100 Year Cryptography project is to "enhance Tahoe-LAFS's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 ...
3
votes
2answers
136 views

What is sent on the initial communication with Kerberos?

When a user wants to communicate with another user (let's say Alice and Bob), what is sent over the network during the initial communication? Alice uses her Kerberos client and enters her password ...
3
votes
3answers
583 views

Is public-key cryptography the only option in this scenario?

Two parties: a client and a server are to a agree on a symmetric key. Both the client and the server are aware of a master password. The way this is currently done ...
5
votes
1answer
137 views

Proof that Alternating Step Generator and modifed ASG' have equivalent security?

The Alternating Step Generator (ASG) is a PRNG combining 3 LFSRs. Output of the ASG is the XOR of the output of two clock-gated LFSRs. At each step, a single one of these LFSRs is clocked, according ...
8
votes
3answers
262 views

Is there an algorithm to find the number of intersections of two sets?

Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
10
votes
3answers
459 views

Are these emerging threats against AES affecting your designs?

Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount. The first key recovery attack on the full AES-128 with computational complexity ...
28
votes
10answers
5k views

Now that quantum computers have been out for a while, has RSA been cracked?

D-wave systems has released a commercially viable quantum computer. This means in theory, that all asymmetric encryption algorithms — such as RSA — are now useless due to the speed at which quantum ...
4
votes
3answers
341 views

How can two different passphrases unlock the same content?

I have heard that in enterprises it is common that the IT admin has a master passphrase that can unlock any content that an employee encrypts. It would be temping to think, that the IT admin's ...
14
votes
4answers
998 views

What security do Cryptographic Sponges offer against generic quantum attacks?

In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...
5
votes
3answers
736 views

Is the number of creatable torrents limited?

Currently, a magnet link containing a 40-digits long SHA-hash value, is assigned to every torrent which is created. Therefore, this hash should be unique to identify a torrent and send the right bytes ...
3
votes
4answers
433 views

Verify product without revealing multipliers

Situation: Several participants contribute encrypted random numbers. These numbers will be used to generate community-agreed random (by simple multiplication). Question: Is there any way to detect ...
3
votes
3answers
317 views

Where can I find useful data for cryptography/coding theory?

When implementing cryptographic/coding theory algorithms one need to use data like big prime numbers, numbers in $Z_n$ and their inverses, irreducible polynomials in $Z_n[x]$ and so on... While ...
16
votes
1answer
4k views

Why can't one implement bcrypt in Cuda?

I had heard that although it's easy to implement message digest functions like MD5, SHA-1, SHA-256 etc. in CUDA (or any other GPU platform), it is impossible to implement bcrypt there. bcrypt is ...
8
votes
4answers
835 views

What tests can I do to ensure my PRNG is working correctly?

In the past I have used the Chi-squared test to check the statistical randomness of my generator. Is this a good test to use? Are there other tests?
9
votes
3answers
3k views

What is the relation between RSA & Fermat's little theorem?

I came across this while refreshing my cryptography brain cells. From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally ...
12
votes
2answers
3k views

Differences Between White-Box Cryptography and Code Obfuscation

I have been reading the question "What is a white-box implementation of a cryptographic algorithm?" and it led to this short article / Q&A which states in question 2: Q2: What is the ...
6
votes
5answers
660 views

Applications of Group Ciphers

I've been reading a paper [1], and I've ran across something called a "Group Cipher", which is similar to homomorphic encryption, with an important difference. In homomorphic encryption we have an ...
18
votes
2answers
3k views

What is entropy?

We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
11
votes
3answers
2k views

Which algorithms are used to factorize large integers?

Even if RSA decided to cancel the Factoring Challenge, it seems that some teams keep working on it. According to Wikipedia, RSA-768 has been factored in late 2009. What are the current large integer ...
24
votes
3answers
10k views

How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
15
votes
7answers
2k views

Is calculating a hash code for a large file in parallel less secure than doing it sequentially?

I would like to improve the performance of hashing large files, say for example in the tens of gigabytes in size. Normally, you sequentially hash the bytes of the files using a hash function (say, ...
8
votes
6answers
770 views

How can I improve a password generation scheme based on a shared secret and URL?

I currently use the following method to generate a different password on every website I have to login: password = SHA1 ( mainPassword . domainName . number ) ...
1
vote
1answer
610 views

The use of cribs [closed]

I'm looking to incorporate more crib usage in breaking ciphers in unknown enciphering schemes, or at least to gleam what information I may. This seems to be a big hurdle to me, and I'm looking for ...
6
votes
1answer
223 views

Is the Representation Problem hard on elliptic curves?

The RP in ECC would be to find $a_1,\ldots,a_n$ (integers) given $P$ and $Q_1,\ldots,Q_n$ (points in the EC) such that $P = a_1 \cdot Q_1 + \ldots + a_n \cdot Q_n$. Is it hard when DH-like ...
1
vote
1answer
4k views

c# Correct Triple Des Block Encryption Usage

I found the below code online, but in its original state, the encryption was not using any padding (Padding.None), and was encrypting in blocks of 8. I wasn't able to get this code to properly encrypt ...

15 30 50 per page