1
vote
1answer
23 views
How hard is it to generate a partial RSA fingerprint collision?
When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ...
0
votes
0answers
4 views
Can two cipher letters per plaintext letter easily defeat character frequency analysis?
For a class 5 years ago I wrote a paper about defeating character frequency analysis by using two cipher letters per plaintext letter. I didn't get much feedback from the professor so I wonder if ...
1
vote
0answers
13 views
Clipper chip (SKIPJACK) key exchange protocol
According to the Wikipedia page for NSA (emphasis mine):
However, NSA's Fortezza hardware-based encryption cards, created for
the Clipper project, are still used within government, and NSA
...
1
vote
2answers
100 views
Is it possible to cryptographically prove when was the last time a ciphertext was decrypted/encrypted?
I want to provide a service that encrypts and decrypts documents and I want to provide the users with proof that I haven't stolen their secret key and read their documents.
I know I can prove when a ...
2
votes
1answer
83 views
Has GMAC mode a future outside GCM?
Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
1
vote
0answers
64 views
Hash function with values in a multiplicative group of prime order
I have to implement a cryptographic protocol which involves a cryptographic hash function $H: \{0,1\}^* \to G$. It is viewed as random oracle. $G$ is a multiplicative group of prime order.
I want to ...
0
votes
0answers
20 views
Reverse engineering from known ID inputs and 19/20-digits outputs
I am currently having few samples of a hash encryption function as per following
ID Hash
542591 6896202108404922949
3210 7693203936755907764
2455 14877541378540063734
2275 ...
1
vote
1answer
93 views
Security of authenticated encryption modes gcm & ccm
I have two questions for Clarification for AE mode choice criteria
GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
0
votes
0answers
21 views
public key distribution from a central server [migrated]
I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
2
votes
0answers
28 views
low-exponent RSA
I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1
Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$.
Suppose further the messages are ...
3
votes
4answers
150 views
Can cryptography be used to hide routing information from the router?
If Alice wants to talk to Bob and she has to involve a third party system run by Carol to establish, and possibly maintain, communications, then Carol knows that Alice and Bob communicated with each ...
2
votes
1answer
175 views
Anonymity in end-to-end encryption
Considering a scenario of anonymous data transfer between seller and buyer using proxies. If we consider that there are three proxies that are being selected by the buyer to obtain data from different ...
1
vote
1answer
129 views
How to choose between AES-CCM and AES-GCM for storage volume encryption
We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
0
votes
2answers
91 views
Recommended authenticated stream cipher for minimum overhead?
I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet.
This causes quite a bit of space overhead for small packets, so at first I ...
-1
votes
0answers
78 views
Factorization wanted [closed]
I am trying to factor
6770389183242962153995229561325734953985709474234543383365326043276409942870153199419967538710900938086776046853
which is a factor of 10*80!+1.
ECM did not find a factor, and ...
1
vote
1answer
89 views
How do I decrypt ciphertext with this cipher?
I have an encryption function
$$E(p) = (ap + b) \mod{26}$$
where the parameters are $a=7$, $b = 10$, and $p$ is the plaintext letter.
I was asked to decrypt the ciphertext
...
5
votes
0answers
76 views
How to build an electro-mechanical public key cipher machine?
It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT. My question is, if the abstract idea of having a public key ...
1
vote
3answers
65 views
OpenSSL AES 256-bit Key Management
I am using C and OpenSSL to encrypt files. After experimenting with the OpenSSL command line utility, it makes you enter a passphrase that can be any length, but uses that to create a 256-bit key.
...
2
votes
1answer
63 views
Why is H(message||secret_key) not vulnerable to length-extension attack?
Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$.
Why can't he perform the same ...
7
votes
2answers
619 views
understanding a length extension attack
I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully ...
2
votes
1answer
40 views
How do zero knowledge protocol with vertex-3-coloring work?
I'm currently not sure if I understood how the zero knowledge protocol with vertex-3-coloring works. I'll describe what I think I've understood and I'll write my questions in bold.
...
0
votes
0answers
27 views
BAN Logic, Problem to Idealize the protocols
I'm studying the BAN logic.
In the application of it, there is a step,where I have to idealize the protocol
that I'm analyzing.
I have problems to make this.
Anyone that has expertise in BAN logic ...
4
votes
7answers
252 views
Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
Background:
I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for ...
-2
votes
4answers
284 views
Would this simple encrypted chat program be feasible using One Time Pads?
Lets say I want to build a simple chat program that has encryption that is impossible to crack for anyone, even a theoretical government with a massive super computer. Ok here's my idea. You'll need ...
1
vote
2answers
70 views
Encrypting and MACing different data with same key
It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
1
vote
3answers
136 views
How Scrypt uses Salsa?
Bcrypt use Blowfish to crypt a derived key from the passphrase, Blowfish is a cryptographic algorithm, but here it is said that:
Note that
Salsa20/8 Core is not a cryptographic hash function ...
0
votes
1answer
108 views
Scrypt as a KDF with one-time high-entropy input
I'm looking at using Scrypt as a KDF. Assume the following:
the input will always be high-entropy random bytes generated by a CSPRNG
the length of the input can vary from between 8 to 32 bytes
the ...
1
vote
2answers
84 views
KDF with low-entropy salts
I need to derive a key from a username and a password. These are the only two things I have access to. What I thought is using PBKDF2 with username as the salt and password as the master password.
...
3
votes
2answers
164 views
Reason(s) for using a KDF for encryption keys
Assuming I already have a 256-key (32 char password) for AES encryption, comprised of random alpha-numeric characters and punctuation (95 possible ascii chars), generated by a decent PRNG, is there ...
0
votes
1answer
98 views
brute force attack on KDF vs KEY
if we believe 256bit keys are secure in AES against any brute force attack, is that possible we use a KDF (convert user's weak entered password in truecrypt into a fixed AES key) with too much round ...
2
votes
1answer
51 views
What information to include is the 'info' input for HKDF?
The RFC states the following:
3.2. The 'info' Input to HKDF
While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main ...
1
vote
1answer
99 views
Why is Bcrypt called a Key Derivation Function?
I am trying to understand why is bcrypt called a Key Derivation Function?
I looked up the details of Ekfblowfish on Usenix article here:
...
3
votes
1answer
100 views
Key collision in scrypt and hkdf
I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ...
2
votes
1answer
211 views
Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?
I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and ...
2
votes
1answer
124 views
Cracking an RSA with no padding and very small e
I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
0
votes
1answer
64 views
Is there a problem with constructing a CSPRNG using MD5 or SHA1?
Is there any security concerns with building a CSPRNG using a broken hash function like MD5 or SHA1? The design is such that a CRC-like function is used for mixing entropy and MD5 is used as the ...
1
vote
2answers
98 views
CSPRNG in JavaScript using Audio and Video
I ported GnuPG to Javascript using Emscripten (not released yet).
Now I need a good replacement for /dev/random//dev/urandom.
...
3
votes
2answers
128 views
How is de-synchronisation of HOTP solved?
From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
1
vote
0answers
81 views
Storing counter value of HOTP at client side [closed]
How can we store counter value on the client side in HOTP??
3
votes
1answer
1k views
What are the advantages of TOTP over HOTP?
HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What ...
1
vote
1answer
126 views
synchronization of counters in HOTP
How is synchronization of counter values achieved in the HOTP protocol?
As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
2
votes
1answer
122 views
Is it considered insecure in an HOTP implementation to publicly provide the next counter?
I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
5
votes
2answers
193 views
Why does HOTP use such a complex truncate function?
In the HOTP protocol after calculating a 20 byte hash it is truncated to 4 bytes.
For this first an offset is calculated (low-order 4 bits of the last byte) which determines the four bytes to be ...
6
votes
1answer
662 views
How does HOTP keep in sync?
My understanding of HOTP is that each password is unique and based on a counter.
$$PASSWORD = HOTP_1(K,C)$$
Where $C$ is an incremental counter.
What I wish to know, is how you keep the client ...
0
votes
1answer
111 views
Decimal to binary question [closed]
This is an easy question, but I can't explain it lol, how would you guys explain it?
There is a procedure for converting a decimal number to binary in the following way: repeatedly divide the number ...
2
votes
2answers
148 views
Which categories of cipher are semantically secure under a chosen-plaintext attack?
I am trying to get my head around the circumstances under which a cipher is (or is not) semantically secure under a chosen-plaintext attack.
I can't seem to find a good reference explaining this.
I ...
3
votes
2answers
239 views
Is it generally possible to employ brute force methods when the encryption scheme is not known? Why or why not?
Lets say you are presented with an encrypted string of bits or text, and no other information. What would be necessary before you could apply brute force methods to decrypting the string? How would a ...
9
votes
2answers
1k views
Why use an Initialization Vector (IV)?
Why use an Initialization Vector (IV)?
How are IV's used?
What are the advantages/disadvantages of using an IV?
Why use an IV instead of a longer key in which some section of the key is pubic?
What ...
2
votes
2answers
208 views
Questions about Key Derivation Functions
My understanding is that a KDF is a function that takes a master secret and generates multiple keys. It is secure as long as the keys are "independent". If this is true, the following definition would ...
1
vote
2answers
72 views
GGM PRG construction: Why do we need to change keys all the time with underlying PRG
When constructing a PRF that has n bit input using the GGM PRG, why do we always have to recursively run the PRG using its previous output as a seed key n times. Instead, why don't we run the PRG n ...
