0
votes
1answer
12 views

Is perfect-forward secrecy achieved with RSA?

I am new to cryptography and am going through the book Understanding Cryptography by Paar and Pelzl. From what I understand Symmetric key distribution systems like Kerberos do not provide PFS ...
0
votes
0answers
4 views

Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
0
votes
1answer
46 views

Questions on FHE over the Integers - the question modified!

I modified my question since it is not as specific as I wanted. I'm studying FHE over the Integer which is https://eprint.iacr.org/2009/616.pdf I got questions about the proof of Lemma A.1. In page ...
3
votes
3answers
91 views

AES-GCM Disadvantage

What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ...
8
votes
2answers
1k views

Why is CBC with predictable IV considered insecure against CPA

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that is uses, the attacker can ...
24
votes
0answers
827 views

How is the MD2 hash function S-table constructed from Pi?

For fun, I'm learning more about cryptography and hashing. I'm implementing the MD2 hash function following RFC 1319 (http://tools.ietf.org/html/rfc1319). I'll preface by saying I know there are ...
0
votes
0answers
17 views

How do I extract the private key components $N$ and $D$ from a private RSA key? [migrated]

I have a private RSA key like – for example – this one: ...
1
vote
0answers
15 views

Symmetric-key login protocol

I'm trying to analyze a login protocol based on symmetric key cryptography. I'm just starting out, so this may very likely be a very bad idea, but nonetheless I'd like to hear your thoughts on it. ...
4
votes
0answers
218 views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
3
votes
1answer
83 views

Is this an acceptable All-or-Nothing Transform?

I was thinking about AONTs, and designed the one below, I call it CHANT for Chained-Hash All-or-Nothing Transform; it's my very first shot at something of the sort, and was hoping I could get your ...
6
votes
3answers
188 views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
3
votes
1answer
55 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
1
vote
1answer
105 views

Where can I download a database of RSA keys?

I'm looking to do some research into how RSA is used in the wild. I've read through a few papers and it seems other researchers have had no trouble collecting millions of keys to perform analysis on. ...
7
votes
4answers
205 views

Encrypting or HMACing password digests

Assuming I'm using bcrypt to digest passwords, is any additional security gained by either encrypting or HMACing the resulting digests? By requiring a key to compare password hashes, I would expect ...
3
votes
2answers
122 views

What are good combinations of public key algorithms or primitives for long term security?

There has been talk in literature about doing multiple encryption with different block ciphers or stream ciphers several times before, and the benefits and risks of such efforts. There may be hidden ...
2
votes
1answer
34 views

PGP String to Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
11
votes
5answers
2k views

How can rainbow tables be used for a dictionary attack?

I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ...
0
votes
0answers
42 views

How important is the evenness of the distribution when finding random primes? [duplicate]

There are two algorithms I know of for generating random primes: one generates a random integer in the desired range and then finds the first prime following it. The second generates a random integer, ...
1
vote
0answers
21 views

Create multiple IV's from shared secret

I've answered a question on Stackoverflow which asked how to handle an IV after key agreement. One option I thought out for CBC was to use: Diffie-Hellman to create a secret; Create a symmetric key ...
2
votes
0answers
68 views

Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i): Identification based on PK decryption and witness. Consider the following protocol: $A \leftarrow B: h(r), B, P_A(r,B)$ ...
-1
votes
0answers
30 views

SHA-256 RSA signature algorithm has thumbprint algorithm value as SHA-1. Is that valid? [on hold]

The field “Thumbprint algorithm” has an SHA-1 value , is that valid? Or should that be “SHA-256”? Also, there is and Alert symbol for the 3 fields: Basic Constraints Key Usage Enhanced Key Usage ...
2
votes
1answer
28 views

Encrypted files in an encrypted partition or folder

Recently I started wondering about multiple encryption and found pages upon pages of posts and debates about the security of cascades. Now, don’t worry – I'm not looking for someone to discuss a ...
8
votes
1answer
1k views

How many RSA keys before a collision?

I was wondering how many possible private/public keys exist? If a million people – for whatever reason – would try to generate 5 keys each in the same minute (on the same date and time) is there a ...
1
vote
2answers
110 views

Public key Issue - same key pair as existing one? [duplicate]

My question is a bit naive, but what if someone generates the same RSA key pair as someone else? This person would have the same private key and so would be able to decrypt messages not intended to ...
2
votes
1answer
75 views

Test Vectors for ciphers

While implementing ciphers (/hash functions, ...), I often face this problem: Where to find test vectors for it; so that I can guarantee my program is correct. It is generally a tedious job to find ...
2
votes
2answers
76 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
-2
votes
0answers
44 views

Would it be possible to crack the key used for params given DES [duplicate]

I am working on a product that will link back to another product. The problem is the GET params on the target product are encrypted using DES (I believe) so the params look like... ...
4
votes
1answer
74 views

OTT service using FPE

Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an ...
8
votes
1answer
197 views

PAK Diffie-Hellman vs. sharing high-entropy key

In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities: Let users set a (low-entropy) shared password and then perform some ...
8
votes
2answers
332 views

What current authenticated key exchange standards exist?

If neither of the 'big two' of TLS Handshake and IKE are appropriate in a given situation, what alternative Authenticated Key Exchange (AKE) standards exist and are recommended? Many protocols have ...
4
votes
3answers
100 views

Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication. We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting ...
5
votes
2answers
479 views

How does a rolling code work?

I have general questions regarding rolling codes. Basically there is a sender and a receiver. Both have a sequence generator. The receiver checks if the received sequence matches the newly generated. ...
2
votes
1answer
127 views

Significance of repetition in XOR cipher text

I'm attempting to recover plain-text ($P_1, P_2$) from two uneven cipher-text strings ($C_1, C_2$) that I suspect used the same key ($K$). When I XOR $C_1$ and $C_2$ together to obtain ($P_1 + ...
4
votes
1answer
65 views

Key Derivation from random salted seed, HMAC and HMAC based KDF

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing ...
3
votes
2answers
94 views

CSPRNG that cannot be used as random extractor

Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any ...
4
votes
1answer
96 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
15
votes
9answers
1k views

Why not the one-time pad with pseudo-number generator

I am very new to cryptography (so be kind), but I have a question that may seem silly. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one ...
6
votes
1answer
63 views

The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme ...
1
vote
0answers
14 views

TLS WG Charter and Security Goals [migrated]

I was looking at the TLS Working Group Charter. I noticed that confidentiality and integrity of messages for those who desire it are not goals for the group. Naively, I believe confidentiality and ...
0
votes
1answer
93 views

Vigenère cipher: Security when key length and plaintext length are the same

I have read the Vigenère cipher is secure as long as the key length is the same as the length of the data to be ciphered. Is this true in cases where the same key is used multiple times. In that case ...
0
votes
1answer
102 views

Known plaintext attack on ElGamal encryption

Assume that Alice uses Bob’s ElGamal public key (  = 2, Yb = 8) to send two messages M = 17 and M’ = 37 using the same random integer k = 9. Eve intercepts the ciphertext and somehow she finds the ...
1
vote
1answer
51 views

Whitening and randomness extraction

The Von Neumann randomness extractor is explicitly mentioned in the randomness extractor page of Wikipedia, but strangely enough that page does not contain any reference to whitening the results of an ...
2
votes
0answers
68 views

Understanding Lattice based cryptosystem [on hold]

I have heard that there is one paradigm of Public key cryptosystem, called Lattice based crytography. Further, its security claims are such that it will not be affected even if the quantum computers ...
-1
votes
0answers
73 views

A problem about zero knowledge proofs

$En()$ is a certain encryption function, $G$ is a cyclic group with order $q$ (a prime), $g,h$ are two generators of $G$. $\lambda_1,\lambda_2 \in Z_q^*$, $\mu$ has the relation $\mathcal{R} ...
2
votes
1answer
184 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
5
votes
1answer
177 views

Elliptic Curve Cryptography

I have been trying this for a while. But I couldn't get it. How can I determine the point of intersection of the tangent line at (0, 0) on the curve $y^2 + y = x^3 + x^2$ ?
4
votes
1answer
117 views

Compression function to guarantee randomness of one time pads?

First of all, I would like to note that I am not building my own crypto. I am simply curious and would like to learn. What I am wondering is this: if we are worried about randomness of something ...
-5
votes
1answer
72 views

RSA Key and RSA Security

Is there any relationship between the RSA keypair standard and RSA security? Keypair: http://en.wikipedia.org/wiki/RSA_(cryptosystem) Security: http://en.wikipedia.org/wiki/RSA_Security If not, ...
2
votes
0answers
75 views

Can you help me understand this “Message Modification by Meet-in-the-Middle” related to Tiger Hash? [on hold]

I found this paper that explains how to attack a reduced round tiger hash, but I'm having a hard time understanding some of the mathematical notation. Could someone explain the section "Message ...
0
votes
1answer
94 views

How to implement a Cryptographic Pseudo Random Function

I need three pseudo random functions which all take a seed S (t-bits long). The functions should map from $d$ bits to $d$ bits $d$ bits to $1$ bit $d$ bits to $t$ bits $d$ is $10$ bits $t$ is ...

15 30 50 per page