3
votes
0answers
125 views

Which encryption method supports random reads?

I have a file containing 16-bit samples and I want to encrypt it, but the problem is that I need to be able to read any random 16-bit value from the file, and be to able to decrypt it, without reading ...
2
votes
1answer
2k views

Inverting the encryption equation of a symmetric cipher

I've just started a cryptography course. I am beginning to understand the concepts (I'm only in week 2) but I just can't get my head around the theories and principles when written as equations. I've ...
2
votes
1answer
129 views

Is it possible to find a preimage for a reduced size hash?

Given a message $M$ and a 256 bit key $K$, perform HMAC($K$, $M$) with a 256 bit hash function resulting in: $a$ = ...
3
votes
1answer
146 views

What does it mean to be simultaneously hardcore?

In this paper the term "simultaneously hardcore" is defined as: "We say that a block of bits of $x$ are simultaneously hard-core for a one-way function $f(x)$, if given $f(x)$ they cannot be ...
5
votes
2answers
173 views

Fast post-processing for broken RDRAND

Let's assume that the Intel RDRAND instruction does not return fully random numbers, e.g. because it has been engineered with a backdoor for the NSA. If the Intel RDRAND instruction is used directly ...
8
votes
2answers
681 views

Can one implement AES on 4-bit microcontroller?

It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID. I have yet to come across ...
4
votes
2answers
536 views

Signature schemes for underpowered devices (8bit microcontroller)

I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel. Recently ...
2
votes
1answer
669 views

HASH Algorithm for 8 bits MCU

I need to implement the HASH algorithm (MD5 & SHA-1) on an 8 bit MCU. I hear it can only be implemented on 32bit and sometimes 16bits MCU. Is that possible? I will appreciate link where possible. ...
3
votes
2answers
2k views

How is the key shared in symmetric key cryptography?

Symmetric key cryptography is an encryption system in which the sender and receiver of a message share a single, common key that is used to encrypt and decrypt the message. Is the key public or it is ...
4
votes
1answer
401 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
2
votes
3answers
452 views

Can PBKDF2 be used to create an XOR cipher key to encrypt random plaintext?

I want to encrypt a truly random plaintext (a key file) based on a user password. I'll use PBKDF2-HMAC-SHA256 to generate an encryption key from the password, but I'm wondering if I even need to ...
0
votes
1answer
181 views

PKCS1 and blind RSA signatures

Wikipedia's article on RSA blind signatures says that you need to raise the message $m$ to the secret exponent $d$ modulo the public modulus $N$. Implicit within that, it seems to me, is that m needs ...
0
votes
1answer
670 views

probability of N hash digits colliding

What is the probability of the first N hash digits colliding? for example i made a script that appends the first 5 digits of the file's sha1 hash to the name of the file. So will the probability of ...
1
vote
1answer
621 views

Proper way of doing encryption and authentication (PBKDF2 + AES)

I'm currently in the planning phase of an authentication and storage-ish service. The client needs a file ("ENCFILE") which he will work with. This file will be encrypted with AES256, and stored on ...
12
votes
3answers
2k views

What is the ideal cipher model?

What is the ideal cipher model? What assumptions does it make about a block cipher? How does it relate to assuming that my block cipher is a pseudo-random permutation (PRP)? When is the ideal ...
2
votes
0answers
154 views

Precise meaning of various terms related to universal hash functions

I've been reading about universal hashing, but I'm confused by all these different terms and notations. Could someone help me understand the precise meaning or relation between the following terms: ...
1
vote
0answers
47 views

one-time key, zero IV in stream cipher (e.g. AES-CTR) [duplicate]

Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to ...
3
votes
1answer
855 views

Possible ECC backdoor and its impact on Internet traffic

In a recent article, Bruce Schneier suggested that he prefers classic discrete log crypto over ECC because "I no longer trust the constants. I believe the NSA has manipulated them through their ...
2
votes
0answers
157 views

Integer factorization based password authentication

After looking at this security issue at DjangoProject, I started to think in a password-based authentication that places the burden of PBKDF2 (or whatever is the hashing function) on the client. So I ...
3
votes
2answers
309 views

bcrypt and pbkdf2 double hashing

If I want to protect myself from implementation of algorithm issues and inherent design flaws of algorithms in password hashing, what would be most secure way to combine two hashes? ...
2
votes
1answer
489 views

AES with different modes of operation

I'm taking up a cryptography class and this is for an assignment. We're asked to find the differences between AES/RSA in the different modes of operation vs the one timepad method. From wiki, I can ...
2
votes
1answer
124 views

Is it dangerous to use plaintext as IV in CBC?

Is it dangerous to use plaintext as IV in CBC? For example: I want to encrypt $p1$, $p2$ with CBC. However I use $p2$ as the IV for CBC purposes. What would be the risk of not using a IV based on ...
13
votes
2answers
4k views

What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?

For the purposes of signing and verifying signatures, what is the value of the hash function? Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process ...
2
votes
2answers
167 views

Privately Sum Values without Dealers, MPC

Suppose $n$ actors each hold a plaintext $p_i$. We wish to find $\sum p_i$, without leaking any information about individual $p_i$. Any actor (or any link in the network) could be controlled by an ...
2
votes
1answer
407 views

Why does openssl BN_generate_prime return only a fraction of the safe primes within the given bit range?

I went into prime generation issues the last week and eventually calculated 10^7 primes using erik tews safeprimegen python wrapper for openssl. (https://github.com/eriktews/gensafeprime) (System: ...
2
votes
1answer
6k views

Difference between linear cryptanalysis and differential cryptanalysis

What is the main difference between linear cryptanalysis and differential cryptanalysis? For example in relation to DES?
5
votes
1answer
385 views

Zero knowledge proof of possession of key

Suppose Alice has at some point in time produced ciphertext $C$ from message $M$ with key $k$. Suppose Alice has then passed $C$ to Bob, and also made a commitment to her key $k$ (thanks to ...
1
vote
1answer
669 views

Break a simple compression function of a cryptographic hash function

I have a very simple compression function, which looks like this in C++: ...
0
votes
2answers
146 views

Key Refresh in Diffie-Hellman

Assume the case, that two participants have agreed on a key $K=g^{ab} \mod p$ via Diffie Hellman. I have the need to change the key every now and then. The first idea I had was to simply initiate a ...
2
votes
3answers
375 views

Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?

Could you choose the number of PBKDF2 iterations based upon the system time? I've heard a few people recommend that the number of iterations for PBKDF2 should be doubled every two years (starting ...
4
votes
1answer
413 views

Proof of correct construction of a private key in distributed cryptography

In an exponential ElGamal encryption scheme where the key generation is done in a distributed way among $n$ trustees we have that each trustee $i$ (where $1 \leq i \leq n$): Selects a private key ...
6
votes
1answer
249 views

What exactly could be accomplished with a backdoor in Dual_EC_DRBG?

Assume that some entity really holds the private key corresponding to the recommended/dubious constants of Dual_EC_DRBG. According to this presentation, they would be able to reconstruct the internal ...
6
votes
2answers
328 views

Meaning of “family” in “family of hash functions”

Many definitions related to universal hashing mention the term "a family of hash functions, say $H$". What does this 'family' mean exactly? A numerical example would be appreciated. Also, what does it ...
1
vote
2answers
229 views

Is there a theoretical maximum useful keysize given the block-size?

Consider a block-cipher $F$ with a $N$-bit block-size and a $M$-bit key-size. That is, if $k$ is a $M$-bit key, $p$ is a $N$-bit block of plain-text and $c$ is a $N$-bit block of cipher-text, then: ...
2
votes
1answer
93 views

Is it possible to generate a message using the mac and the key?

Say that you have the Key and the MAC value that was generated from the Key using CBC. Is it possible to generate a message with just the mac and the key? If so, how would you do it?
2
votes
1answer
106 views

Recasting randomly generated numbers to other widths

Suppose I have a list of randomly generated uint_8's, uniform over the whole range of uint_8. I write them into a file as raw ...
2
votes
1answer
152 views

Can you help me understand PFS and wPFS?

Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them. My understanding is that: PFS ensures that, if the ...
2
votes
1answer
561 views

What key exchange do OpenSSL and CryptoAPI prefer by default?

Here is what I know. When I connect to a brand-new Linux Web server with Chrome and click the "lock" icon, the key exchange algorithm is described as "ECDHE_RSA". (Yes I know what that is.) When I ...
2
votes
1answer
412 views

Hide a weakness in ECC by choosing the prime or one of the curve coefficients

Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve $$E: y^2 \equiv x^3 -3x + b \pmod p$$ is cryptographically weak? You need to choose ...
9
votes
4answers
997 views

How do you find a cheater in Shamir Secret Sharing?

If there are 4 people involved, and every two of them should be able to know the secret (the polynomial is just a line) and you are given f(x) and x for each of those people, and you know one of them ...
4
votes
1answer
160 views

Can a PRNG with a fixed amount of entropy always be detected?

Given a fixed seed (i.e. no ongoing source on entropy), is there (practically or theoretically) any PRNG algorithm that can generate an infinite sequence of random numbers such that an observer cannot ...
1
vote
1answer
167 views

Is the “secure-as-worst-case” version of NTRU patented?

Does the improved version of NTRU — which is described in "Making NTRU as Secure as Worst-Case Problems over Ideal Lattices" by Stehlé and Steinfeld — fall under the same patents as the original?
3
votes
4answers
317 views

Is it possible to anonymize web traffic so that the IP Address cannot be determined while still being able to determine distinct IPs?

I'd like to find a way to anonymize IP addresses in web logs to ensure user privacy given the following requirements: If given an IP address, there is no way to look up which requests came from the ...
1
vote
1answer
186 views

General-purpose non-interactive multi-party computation protocol

Most of general purpose multi-party computation protocols are highly interactive. Especially the ones with Shamir's secret scheme, as there is a degree reduction step in multiplication that needs the ...
1
vote
1answer
363 views

Why are the first few bytes of a gpg encryption always the same?

If I run the command 'gpg -a -e < input.txt > output.txt' with completely different inputs (e.g. from /dev/urandom), the first 19 characters are always the same. What is this header? Is it ...
1
vote
1answer
104 views

Question about Fermat's little theorem

Why is $g^e \mod p = g^{e \mod (p-1)} \mod p$ if p is prime. I don't get it. It follows from Fermat's little theorem.
2
votes
2answers
167 views

Security of S/MIME in case of CA compromise

Suppose Alice and Bob are exchanging messages using S/MIME, protected by certificates that have been issued by either the same CA or by two mutually independent CAs. There exists an adversary Mallory ...
1
vote
1answer
158 views

Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers

As said in the heading, I want to know how the security of different padding methods, e.g. ANSI X.923, ISO 10126 and PKCS7, is compared to other methods to reach the needed block size, like ciphertext ...
12
votes
1answer
408 views

Security of pairing-based cryptography over binary fields regarding new attacks

In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$. Pairing-based cryptography using binary ...
4
votes
1answer
215 views

OMAC/CMAC constant for different block sizes

OMAC/CMAC only specifies constants for 64-bit (0x1B) and 128-bit (0x87) block size. I would like to know how to get constants ...

15 30 50 per page