1
vote
2answers
229 views

Idea for user/pass hashing to prevent rainbow tables, would it work?

I'm very new to cryptography (and security in general, for that matter), but I had an idea that I'm sure is very flawed, but is worth asking. If a computer user, online account, etc, needs to verify a ...
1
vote
2answers
113 views

Merkle Tree High Tree

I'm reading Merkle tree signatures and I like know if the security of the that scheme depends, also, of the high of the tree or only depends that hash function is resistant to collision?
2
votes
1answer
90 views

Why is Lamport-Diffie secure?

Why is Lamport-Diffie secure? I note that there is a demonstration based on onewayness (in the book postquantum cryptography). But a one way function is not sufficient to ensure that it can not infer ...
2
votes
1answer
18 views

Probability that two different files can have same MD5 hash for both an unencrypted and encrypted version (AES256, same key between files)

This math is way over my head, and don't even know if it can be done, but here are the assumptions: Take unencrypted File [Fu] of variable length, but assume 100KB as an example. Let File [Fe] be ...
2
votes
1answer
119 views

AES CTR rekeys rapidly, does this produce patterns? [on hold]

delete this question please..........
3
votes
2answers
334 views

How does using salt reduce rainbow table attack?

I could create a rainbow table for a particular salt value and still create a successful attack similar to one without salt value.
10
votes
4answers
2k views

How can rainbow tables be used for a dictionary attack?

I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ...
1
vote
1answer
145 views

Why we must hash lot of times in rainbow tables?

i dont get the utility to chain and reduce in generating rainbow tables. Hash function is made to not have collisions, or at least chain only 2 times so we dont return to the concept of the hash ...
2
votes
2answers
342 views

Is rainbow table attack applicable to any hash?

Typically when rainbow tables are discussed MD5 hash is used as an example. It's not quite clear whether this attack is specific just to MD5 or to a certain subset of hashes or to just any hash ...
6
votes
1answer
3k views

Example Rainbow Table Generation

I have read up on rainbow tables and think I understand the idea behind them. However, I find that it would be better for me to actually attempt to implement a (very basic) rainbow table generator in ...
4
votes
1answer
87 views

How can I find the order of the group that an elliptic curve is defined over?

I have a Weierstrass elliptic curve ($y^2=x^3+a \times x+b \mod p $) How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] ...
2
votes
1answer
52 views

Deterministic Rand function for Winternitz One Time Signatures

Suppose you are implementing a Generalized Merkle Signature Scheme, using the Winternitz One-Time Signature Scheme for the node signatures. Furthermore, suppose the implementation is to be stateless ...
1
vote
1answer
66 views

Generalized Merkle Signatures, SHA-3 and Sakura

Sakura specifies a tree hash mode for e.g. Keccak (SHA-3). Are there any reasons to use the Sakura tree hash mode in a Generalized Merkle Signature Scheme? It seems to me Sakura primarily solves a ...
1
vote
1answer
2k views

Simple example for CP-ABE (Ciphertext policy attribute-based encryption)

I'm currently working on Ciphertext Policy Attribute-Based Encryption (CP-ABE). So far I'm only using it with a basic understanding how it actually works. Now I want to understand it a bit better, but ...
2
votes
3answers
62 views

Does 3-DES take approximately the same time to encrypt 1B and 1KB?

I am using 3-DES to encrypt some data in Java. I decided to run some tests and plot some graphics to decide how to optimally pack data for its encryption (see how encryption/decryption time behave ...
-1
votes
0answers
25 views

Key Derivation from Random Seed

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing ...
4
votes
1answer
384 views

AES mixcolumn stage

I'm studying AES, and am having problems with the "mixcolumn" stage. I read about finite fields, but I still don't know. How do I construct $GF(2^8)$? ...
-1
votes
2answers
54 views

Elliptic curve group over a prime finite field $F_p$

If $p$ is a big prime, and the elliptic curve $E$ is defined over $F_p$ by the equation $y^2=x^3+ax+b$ where $a,b\in F_p$. The point on $E/F_p$ together with the infinite point $\mathcal{O}$ form a ...
-1
votes
0answers
45 views

Is complexity of ElGamal cryptosystem $O(log(n))$?

ElGamal cryptography is $y=g^d \mod p$ having complexity $O(log(p))$. $C1= g^r\mod p$ and similarly $C2$ and the decryption has same complexity of $O(log(p))$. So can we say that the total complexity ...
0
votes
0answers
61 views

Vigenère cipher: Security when key length and plaintext length are the same

I have read the Vigenère cipher is secure as long as the key length is the same as the length of the data to be ciphered. Is this true in cases where the same key is used multiple times. In that case ...
-1
votes
0answers
38 views

Calculating periodicity of a pseudo random number generator (Middle-square method) [on hold]

Below is a Python code that calculates the periodicity of the middle-square method for a given 4 digit-numbers: ...
2
votes
0answers
38 views

Where is the OID and ASN.1 specified for AES_CMAC?

I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under ...
1
vote
1answer
73 views

Is MAC-then-encrypt with stream ciphers secure?

While thinking about this recent question about a hash-then encrypt design, I reread the MAC-encrypt vs. encrypt-MAC question and noticed this answer quoting a paper showing that MAC-then-encrypt is ...
22
votes
2answers
765 views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows ...
1
vote
1answer
63 views

Protocol composition [on hold]

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
1
vote
1answer
66 views

Adding an IV to an AES implementation

I have an embedded project that requires AES, I seem to have found an AES implementation that fits the bill here: http://www.literatecode.com/aes256, but it does not include an IV. Are there any ...
3
votes
1answer
94 views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
3
votes
1answer
386 views

How does rolling code works?

I have general questions regarding rolling codes. Basically there is a sender and a reciever. Both have a sequence generator. The reciever checks if the recieved sequence matches the newly generated. ...
1
vote
0answers
52 views

Universal hashing techniques based on matrix multiplication

The article here says below, about a universal hashing technique based on matrix multiplications. "However, there is a little known method based on using a random matrix. It has lots of advantages - ...
4
votes
1answer
234 views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
1
vote
2answers
50 views

Different padding rules for Merkle-Damgard and Keccak/sponge function

We learned that length padding was used in Merkle-Damgard where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
1
vote
2answers
153 views

Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
-2
votes
1answer
43 views

Textbook RSA with exponent e=3 [duplicate]

I remember $e=3$ is a bad choice for textbook RSA. But I can't really recall why. What happens if I choose $e=3$? Can I retrieve the message by simply calculating $\sqrt[3]{c}$? Why can't I do that ...
2
votes
1answer
71 views

Secure way to store fixed size string of digits

I need to store a string of digits (0-9) of a fixed size in my database securely. I've already performed a rainbow table attack on a plain hash, and it broke it in a matter of seconds. One option I ...
1
vote
1answer
97 views

Which algorithm do you recommend for practical use to generate unique passwords for each website?

So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm ...
3
votes
2answers
203 views

Reordering non-block-aligned parts with DES in ECB mode

I was given a ciphertext file which was encrypted using DES in ECB mode. It is known that the plainttext that was encrypted has the following form: Each line of text consists of a payroll followed ...
5
votes
3answers
558 views

RSA with modulus n=p²q

I've been wondering what would happen if the RSA modulus would be $n=p^2q$ instead of $n=pq$. I feel like there is an obvious security flaw (as there is with most modifications). Would this choise of ...
1
vote
1answer
84 views

Cryptography: Oblivious Transfer with at most one transfer?

I am trying find a transfer method for this problem. Suppose Alice and Bob both has access to a function $\text{F}$ with two parameters. $\text{F}(x,y)$ randomly returns $p$ to alice and $q$ to Bob ...
1
vote
1answer
123 views

MAC using a modified CBC mode of operation

I'd like to know whether the following modified CBC-MAC is secure (given a fixed IV). Source: an old course on Network Security Are there some obvious attacks I can't see?
-2
votes
0answers
55 views

How can I solve this modular equation? [on hold]

I want to know what's the most efficient way to solve following equation: $5 \times x \mod{13} = 2\\ x = ?$ This is just an example. I am looking for a way to solve any equation of this kind.
4
votes
1answer
582 views

Advantages using Diffie-Hellman or Elgamal

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of Elgamal, and most important why should we use one or the other? I do not see a clear difference ...
4
votes
2answers
120 views

Spoofing protocol nonce

Amy and Betty have a shared key $k$, and the protocol below is to provide a mutual authentication for both Betty and Amy. A sends B : $n_a$ B sends A : $n_b \;\|\; E(k, n_a)$ A sends B : $E(k, n_b)$ ...
1
vote
4answers
464 views

RSA with composite numbers

It has been said that RSA uses a modulus product of two prime numbers for security reasons. But does RSA even work correctly if we allow composite integers instead? I think that the answer is "NO". ...
5
votes
4answers
174 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
2
votes
1answer
55 views

Is my implementation of a PRG at least intuitively secure?

I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism. Basicly I take a random ...
1
vote
1answer
133 views

Ciphertext indistinguishability (IND-CPA) for symmetric cryptography

My understanding are these steps are necessary for symmetric cryptography to be IND-CPA: The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger. The challenger selects one of ...
1
vote
1answer
47 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
3
votes
2answers
302 views

How do we operate IV+1?

This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation? For example, if I have the IV ...
3
votes
0answers
96 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
1
vote
1answer
24 views

Validity of authentication scheme?

Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie ...

15 30 50 per page