2
votes
2answers
677 views

Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus ...
2
votes
2answers
539 views

what are the uses of tweaks in block ciphers?

Few block cipher modes has additional parameter , tweaks , especially the ones that are format preserving . Now the comments section of this blog entry says such tweaks can be used for BIN numbers, ...
2
votes
1answer
734 views

How does one use AES block cipher modes of operation?

This is the sequel to my previous question about AES block cipher modes of operation. (See: AES block cipher modes of operation) Now, here is my real problem. I have to use a block cipher with 8 bit ...
2
votes
1answer
219 views

Which platforms are most vulnerable to Simple Power Analyse Attack

In a "Simple Power Analyse Attack", the difference in power consumption during multiply or square operation is used. In the RSA decryption process with the "Square and Multiply" algorithm, both ...
2
votes
1answer
660 views

How hard/easy will be to break a SHA-1 or SHA-256 hash if the attacker knows part of the original text?

I'm creating an algorithm to hash some text variables (20/30 characters long) to send them across an insecure channel. I'm not dealing with high security data, so no credits card numbers or any other ...
2
votes
1answer
572 views

Rijndael: explanation of Rcon on Wikipedia?

I stumbled onto the explanation of Rijndael Rcon on Wikipedia, and I can't follow it. The example for Rcon indicates that Rcon(9) is 0x1b. That could make sense… <...
2
votes
1answer
4k views

OpenSSL padding

I would like to know how much padding OpenSSL algorithms expect.
2
votes
1answer
617 views

AES with different modes of operation

I'm taking up a cryptography class and this is for an assignment. We're asked to find the differences between AES/RSA in the different modes of operation vs the one timepad method. From wiki, I can ...
2
votes
2answers
1k views

Does it make sense to have a compression function that uses 64-bit of the message to create an output of 64-bit?

I have a very simple compression function, which looks like this in C++: ...
2
votes
2answers
830 views

Is there an encryption/decryption algorithm that can give two different outputs?

The recent revelations that airport staff can detain travellers in an interrogation room and force them to give over passwords to encrypted-HDD laptops under threat of jail time has made me think ...
2
votes
1answer
155 views

Do any (non-hardware) RNGs exist which could be used to create an OTP for crypto purposes?

I've stumbled (jobwise) over a system where small messages (512 Bytes or less) are encrypted and decrypted using a simple XOR using a OTP. That OTP is created using a seed based on the individual user ...
2
votes
1answer
390 views

random number generator and seed

I'm working with openssl cryptographic libraries, I'm new to all these cryptographic stuffs and slowly I'm learning all these. I have a doubt regarding random number generator, I'm using ...
2
votes
1answer
2k views

Am I insecurely implementing AES in Python? [closed]

My name is Pat, I'm a rising high school senior interested in Comp Sci. I've taken interest in cryptography following the NSA scandal. Since this is the first time I've ever implemented encryption ...
2
votes
3answers
147 views

Securing content and login with “same” password

I'm writing a client application that wants to store some secret information with a storage service. The client has to authenticate the user with the service and the service should not be able to ...
2
votes
1answer
559 views

Solve a system of non linear equations over GF

I have the following set of equations: $$M_{1}=\frac{y_1-y_0}{x_1-x_0}$$ $$M_{2}=\frac{y_2-y_0}{x_2-x_0}$$ $M_1, M_2, x_1, y_1, x_2, y_2,$ are known and they are chosen from a $GF(2^m)$. I want ...
2
votes
2answers
137 views

What prevents continued hashing of a key from being used as a cipher when xored with plaintext? [duplicate]

This is just an idea I had while looking through some threads so take it as you will. Given a plaintext of any length and a key that a specific hash function is capable of taking as input(I mention ...
2
votes
1answer
373 views

How to prove a cipher resistant to differential cryptanalysis?

How do you prove that a cipher is resistant to differential cryptanalysis? It's said that Rijndael has been proven resistance to differential cryptanalysis. How do cryptographers do that?
2
votes
3answers
967 views

additive ElGamal encryption algorithm

I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts. The problem is that I need to ...
2
votes
1answer
163 views

Offline app authentication - embedding hashed password inside an encrypted file

I am working on an occasionally connected app. To allow the users to authenticate I created a profile which is encrypted and placed on the users machine. The first byte of the file contains the IV ...
2
votes
2answers
251 views

Is it possible to cryptographically prove when was the last time a ciphertext was decrypted/encrypted?

I want to provide a service that encrypts and decrypts documents and I want to provide the users with proof that I haven't stolen their secret key and read their documents. I know I can prove when a ...
2
votes
1answer
3k views

Bcrypt VS Scrypt, Again?

I found this article on SO, but the answer was short, and the subject was closed, What i don't understand, is: Which one of the two limits memory usage to avoid custom Hardware to break the password? ...
2
votes
1answer
521 views

Encrypt-then-MAC paradigm

I read that the Encrypt-then-MAC paradigm is provably secure. From what I understand, when using for example AES for encryption and HMAC_SHA256 for MAC generation (and the keys $K_1 \neq K_2$), this ...
2
votes
3answers
434 views

Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages

I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system. So we have Bob -- The person who sends the message (and knows it's recipients) ...
2
votes
2answers
6k views

AES+CTR+HMAC Encryption and Authentication on an Arduino

In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel. We have chosen AES in CTR ...
2
votes
1answer
120 views

Why constrain the message lengths in indistinguishability in the presence of an eavesdropper?

I need your help with a very basic concept in cryptography which I can't understand/prove on my own. I'm trying to prove and understand why, under "indistinguishability in the presence of an ...
2
votes
1answer
182 views

Selecting a large NUMS Safe prime

Suppose I want to use the following simple hash function. For a mesage $m$, take some public $a$ and prime $p$ and raise $a^m \bmod p$ (never mind the computational expense of this operation). This ...
2
votes
2answers
388 views

How to verify a number encrypted with an unknown key

Alice and Bob are going to follow the protocol below. Are there any crypto-constructions to help Bob verify the correctness of the answer he gets?: Alice encrypts a set of numbers using some ...
2
votes
1answer
260 views

How large should a Diffie-Hellman p be if the messages are encrypted?

How large should the prime $p$ and generator $g$ values be in a Diffie-Hellman handshake if the messages are encrypted. If the key that encrypted the Diffie-Hellman messages becomes compromised, ...
2
votes
1answer
248 views

Zero-knowledge proof that a group element is a quadratic residue?

In a paper it says: "To convince a verifier that a group element is a quadratic residue, the prover executes the following proof with the verifier": $PK \left\{ (\alpha) : y = \pm g^\alpha \right\}$ ...
2
votes
2answers
343 views

Is it safe for the ChaCha8 nonce to be deterministic?

ChaCha8 takes a 8 byte nonce (or IV) that should not be the same twice for the same key. Generating this nonce randomly makes me very very nervous for collisions. Is it safe to generate this nonce ...
2
votes
3answers
1k views

Master keys for decrypting?

I'm not a Cryptography expert, but i've seen this topic sometimes on the Web: Master decrypt keys. Most of the people said that "Master decrypt key" does not exist. This makes sense if you developed ...
2
votes
1answer
2k views

What are rounds in the context of ciphers?

Another recent question on security margin included in its answer the discussion of how many rounds are broken so far. What is the definition of a round?
2
votes
1answer
870 views

Using Chi-Square for Vigenère Cipher

I am writing a program which will use Chi-Square to determine which is the correct keyword for a ciphertext via Vigenère cipher. I came across a website that describes the Chi-Square statistics in a ...
2
votes
2answers
212 views

GGM PRG construction: Why do we need to change keys all the time with underlying PRG

When constructing a PRF that has n bit input using the GGM PRG, why do we always have to recursively run the PRG using its previous output as a seed key n times. Instead, why don't we run the PRG n ...
2
votes
2answers
572 views

Simple homomorphic crypto for 32-bit integers

I'm looking for a simple way to perform homomorphic crypto on 32-bit integers. My only requirement is that I can add and subtract from the plaintext value without actually decrypting it. The crypto ...
2
votes
1answer
407 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = $E_{k_1}(...
2
votes
2answers
153 views

High Power Computing for Crypto Research

Obviously, much of cryptography requires the assumption that adversaries have bounded computing power. So, I was wondering, are there any fields in cryptographic research for which high power ...
2
votes
1answer
153 views

What's the strategy for future directions in cryptography? Bigger numbers/faster searching, or new methods, say, of factoring?

I'm taking a course in cryptography, and I would value any comments. This is not too technical a question, but more about directions or strategy in cryptography. My question is, is public key ...
2
votes
3answers
3k views

ANSI X9.31 standards for generating random numbers

The NIST-Recommended Random Number Generator Based on ANSI X9.31 Appendix A.2.4 Using the 3-Key Triple DES and AES Algorithms has 3DES being used three times for each 64-bit block of random data ...
2
votes
3answers
154 views

Public keys and their protocols

I'm having difficulties understanding exactly what this protocol means: $S \to D : \{N_S , S\}K_D$ $D \to S : \{N_S , N_D \}K_S$ $S \to D : \{N_D \}K_D$ "where $S$ represents the supervisor’s ...
2
votes
1answer
408 views

What is an oracle adversary?

I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
2
votes
2answers
240 views

Breaking RSA, given a special kind of oracle that decrypts related ciphertexts for us

Let $c=E^{RSA}_{e}(w)$ be the ciphertext belonging to the plaintext $w$ if an $RSA$ system is used. Assume that the public exponent $e$ satisfies $e \le 10$. Furthermore, assume there is an oracle ...
2
votes
2answers
133 views

Can you use the same key to provide a signature and a MAC?

Apologies if this is a stupid question, but I'd be grateful if someone could provide an answer. I'm assuming that you need to use different keys to provide these functions, is that correct?
2
votes
1answer
435 views

Increase number of rounds for SPN and Feistel ciphers

Read a post on Schneiers blog (and again 2011) about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. ...
2
votes
2answers
755 views

Avalanche noise RNG for one-time pad use

I came across this little HRNG widget and was really intrigued as I have been looking for a decent but afordable source for truly random bits to use in a one-time pad. The question is, would a HRNG ...
2
votes
4answers
1k views

One time pad key exchange

If two parties want to communicate with securely using OTP , how is the key ( that is lengthy as plain text) shared with other party for decryption ?
2
votes
1answer
464 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key (...
2
votes
1answer
458 views

Proving correctness of pseudorandom generator construction given existing pseudorandom generator

Say if I have a given pseudorandom generator G which takes a k-bit input and outputs a 3k-bit number. How should I show that a specific construction using this pseudorandom generator is valid? For ...
2
votes
1answer
182 views

How could block encryption in counter mode be secure from viewpoint of entropy?

A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for ...
2
votes
1answer
4k views

How to decrypt AES in CBC

i am having problems understanding how CBC works! I know that it is a chain and the IV is XORed with the PT but then what? I mean we encrypt it with key k and the result is the CT which we use for the ...

15 30 50 per page