1
vote
0answers
50 views

Are partial hashes used in cryptographic protocols?

In my question (and answer) about a partial hash code used within a signature application I found out that partial hash codes are sometimes used within protocols with a relatively restricted security ...
1
vote
2answers
334 views

garbled circuit vs fully homomorphic encryption

Consider an outsourced database to an untrusted cloud (think CryptDb), the question is how to compute a function $f(.)$ on the data. I think I understand how (fully or partially) homomorphic ...
15
votes
6answers
2k views

Could RDRAND (Intel) compromise entropy?

I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design. This petition was ...
2
votes
1answer
264 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key ...
2
votes
0answers
49 views

Secure Deduplication and Encryption in a data store

Assume: We have a centralized data store that can store whatever we need Every user is online Function $f : File \to Key$ gets access to the store, and is the same for all users. $g : Key \to File$ ...
0
votes
2answers
90 views

Homomorphic Encryption: how does the equality test on ciphertexts work?

Let's suppose we have a asymmetric crypto-system $H$ which is homomorphic with respect to some function $F$. Alice encrypts a message $m$ with her private key $e$ in the crypto-system $H$ and ...
3
votes
4answers
444 views

Do any non-US ciphers exist?

Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples. Are there any public ciphers produced by other states, China or Iran for example? ...
3
votes
0answers
89 views

Repeatable crypto

Is there a safe way to do crypto that will always produce the same result for a given input? My use case is transferring deltas of huge files, to a backup server. The backup server has no knowledge ...
3
votes
1answer
64 views

PGP String to Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
4
votes
2answers
195 views

What are Cryptographic Multi-linear Maps?

I've encountered this term many times in the fields of Fully-Homomorphic Encryption and Obfuscation. I want to learn those subject and Cryptographic Linear Maps seems to be an obstacle in the way. ...
2
votes
2answers
88 views

Asymmetric algorithm for one time signing of small cleartext

I want to generate a key pair such that the private key can be used once to sign a small message (1024 bytes) at some indeterminate point in the future and the public key can be used to verify that ...
1
vote
0answers
40 views

Managing data permissions/access through asymmetric cryptography

I want to manage authorization, as 3rd-party permissions, through asymmetric cryptography. I'm concerned about how is it possible to share access of encrypted data with N entities, and be able to ...
1
vote
0answers
46 views

Is it possible to design an identity-based key-exchange protocol that has (almost) comparable performance with HMQV and enjoys a tight reduction?

Recently, I'm thinking about a problem that is it possible to design an identity-based key-exchange protocol that has (almost) comparable performance with HMQV, but at the same time, enjoys a tight ...
1
vote
1answer
43 views

In HMQV, can one use multiple identities with one public key?

The HMQV protocol has 2 "identity" fields $\hat{A}, \hat{B}$ that are used in the dual signature - and it tries to guarantee that any properly-generated session key is only shared by a single $(A, B, ...
0
votes
1answer
116 views
+50

Proof for composed signatures

Assumes that we have 3 signature algorithms, $S^A$ with key pair $(sk^A,pk^A)$, $S^B$ with key pair $(sk^B,pk^B)$,$S^C$ with key pair $(sk^C,pk^C)$. We denote by $\epsilon$, $\epsilon'$ and ...
0
votes
1answer
111 views

How should I treat a new cipher release like Spritz?

I have been looking at both the paper as well as the sourcecode of Spritz — a spongy RC4-like stream cipher and hash function by Ronald L. Rivest and Jacob Schuldt. The paper states We have also ...
3
votes
1answer
40 views

Implementing the Mceliece Encryption - making the Generator Matrix

I am working on an implementation of the Mceliece Encryption system (MCE) and the Niederreiter encryption system. I have been through the basics of finite fields, polynomial arithmetic and some coding ...
1
vote
0answers
111 views

practically verifying block ciphers strength [on hold]

How do we verify practically the strength of a block ciphers? Most of the security analysis of block ciphers is usually around theoretical analysis and proofs in some random oracle model etc. For ...
2
votes
1answer
48 views

Question on Waters IBE

I'm reading “Efficient Identity-Based Encryption Without Random Oracles” by Brent Waters. In Page 9, I don't know how ...
2
votes
2answers
196 views

Composition of block ciphers and 3DES

There is some intriguing things about DES and 3DES. Now, I know that DES is weak and 3DES was an attempt to construct a more secure block-cipher from a deprecated one. Having this in mind, what ...
6
votes
3answers
248 views

Are there other digital certificate formats than X.509?

Hi I am a little new to security, but in researching digital certificates it seems the only format people describe is X.509. Are there other formats? If so what are they and where can I find ...
5
votes
2answers
118 views

Choice of authenticated encryption mode for whole messages

There are several well-regarded block cipher modes for authenticated encryption which have made their way into standards and protocols: CCM, EAX, GCM, OCB, … If I am designing a new messaging or ...
13
votes
1answer
827 views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
-4
votes
4answers
65 views

Solution with high decryption cost and low encryption cost

I am looking for any cryptographic solution that will meet those requirements : Only known method to get the encrypted string need to be brute force. Decrypting on modern computer not more than ...
5
votes
1answer
116 views

How would you encrypt-then-MAC when using pen-and-paper and a Caesar cipher?

I'll probably get shot for asking this, but I've got some kids (aged 8-10) in my neighbourhood that I've been showing/teaching the simple pen-and-paper Caesar cipher and they're successfully playing ...
6
votes
3answers
166 views

Good challenges for a crypto competition for teenagers

I'm holding a cryptography workshop for teenagers (around 16 years old) at our university. As part of the workshop, I'm planning to run a crypto competition with prizes: there will be different tasks, ...
0
votes
2answers
194 views

Proving HMAC collision probability bounds?

Could someone point to results or proofs about the probability of $$HMAC(k, m_1) = HMAC (k, m_2)$$ assuming the underlying hash function is SHA-256? Would those probabilities be higher/lower if $m_1$ ...
2
votes
1answer
34 views

How can finding a collision help an attacker with tampering messages with HMAC

As stated in the HMAC RFC (RFC 2104): The strongest attack known against HMAC is based on the frequency of collisions for the hash function H. How can a collision benefit an attacker? I would ...
4
votes
1answer
182 views

How does Random Oracle and Standard Model differ? [duplicate]

I am new to Crypto field. Many papers are boasting of not using Random Oracle model. Instead, those prove security in Standard Model. I am surprised how do these models differ. Can anyone please ...
0
votes
0answers
61 views

why should one use lattice-based systems in epassports in post- quantum computers era? [on hold]

I found that shor's algo would break the RSA and DH algorithm(though I dont understand the complete steps of shor's algo), all protocols of epassports would be broken so why cant it be not broken with ...
1
vote
1answer
179 views

RSA was rejected by which journal?

Is it true that first time RSA algorithm was rejected by a journal?
2
votes
1answer
117 views

Why are some key stretching methods better than others?

I'm trying to understand why some key stretching methods are better than others. The wikipedia article presents 3 different key stretching methods: A collision prone simple key stretching ...
5
votes
1answer
74 views

Understanding Genkin-Pipman-Tromer's ground potential, side channel attack on RSA

I'm pretty sure that by now folks might have come across this research from Genkin-Pipman-Tromer (GPT) on extracting the RSA key used by GnuPG (GPG) just by measuring the ground potential. I'm going ...
0
votes
3answers
79 views

Security of very simple XOR with random? [duplicate]

I am currently trying to implement a very fast and simple encryption algorithm in Lua for the purpose of using it with ComputerCraft. The main problem is that bitwise operations in Lua (5.2 at least) ...
4
votes
2answers
82 views

Are variable-length crypto hash functions still susceptible to collisions?

I just recently learned that the SHA-3 finalist Keccak allows for variable length output. As the only answer to this question states, "[it] need to have an output length at least equal to the input ...
4
votes
1answer
130 views

Is hashing a list of hashes safe?

I have an arbitrary long list of hashes (e.g. git tree hashes), and I'm wondering by how much I am increasing the risk of hash collisions by condensing them into a single hash, like so: ...
3
votes
1answer
65 views

PBKDF2 Salt and Password Ordering

I am currently reading about PBKDF2, and understand that the salt is used only once, while the password is used multiple times in the computation of the final key (see this question). How would the ...
0
votes
0answers
54 views

Can Bitcoin HD public keys be used for symmetric encryption?

I asked this at bitcoin.stackexchange.com first, but it seems that this is more of a crypto-question anyway. I'm interested in using a Hierarchical Deterministic Bitcoin wallet branch as a "shared ...
3
votes
1answer
55 views

Possible CPA or CCA attack when using AES-CBC mode under the following situation?

Both client and server know a shared key in advance. Both sides us EVP_BytesToKey() derive a pair of same key and same IV. Then, client and server start transferring data encrypted by AES-CBC mode ...
1
vote
1answer
132 views

What's the point of a Meet In The Middle attack using i.e. double AES with throw-away keys?

What's the point of a Meet In The Middle attack while using, for example, a double AES encryption and using one time keys? You can recover the keys for a secret message already known and you can't use ...
3
votes
1answer
64 views

Partial hash code protocol for security tokens providing signatures

I've read the following two sentences within a beta protocol specification, which references ISO/IEC 7816-8 for PSO:HASH which already contains notions of a "partial hash". The off-card entity is ...
1
vote
1answer
38 views

Comparing Difference Distribution Tables

I have been studying the Diff. Cryptanalysis and finding it hard to do a problem. The problem is I have calculated the tables programmatically and found that the second table has a max value of 6 ...
2
votes
1answer
47 views

PBKDF2-SHA256+SHA256 for password storage

I recently came across an interesting paper detailing the use of hardened session cookies. Each cookie includes a preimage of the password hash, and the preimage is hashed once more and compared to ...
28
votes
7answers
14k views

Google is using RC4, but isn't RC4 considered unsafe?

Why is Google using RC4 for their HTTPS/SSL? $ openssl s_client -connect www.google.com:443 | grep "Cipher is" New, TLSv1/SSLv3, Cipher is RC4-SHA Isn't RC4 ...
-1
votes
1answer
84 views

What's the best packet cipher mode for use with UDP for example? Advantages or disadvantages of any alternatives?

Cipher modes typically assume data is streamed or read from a reliable channel with guaranteed ordering. However, many communication transports, such as UDP, are not reliable and don't guarantee order ...
8
votes
1answer
672 views

How is SHA1 different from MD5?

On the surface, SHA1 and MD5 look pretty similar. Their diagrams include chunks of bits, bit rotation, xor and special functions. Their implementations are roughly the same length (at least the ones ...
7
votes
2answers
249 views

Is using EAX mode with a 64-bit block cipher a bad idea?

EAX mode produces an authentication tag no longer than the length of the underlying cipher's blocksize. So in the case of using Blowfish (a 64-bit block cipher) in EAX mode, the resulting tag would ...
4
votes
1answer
291 views

What are the advantages of CBC over ECB?

From this question I understand that, for a block cipher, using CBC is better than ECB. It seems that if one only has part of the cipher text, then decryption is difficult because the decryption ...
1
vote
0answers
47 views

How to distribute symmetric key between $n$ entities?

If there are $n$ servers for broadcasting a symmetric key in such a manner that following holds: No server alone can find the key $K$ alone. Any two servers can pass $k_i$ and $k_j$ such that ...
1
vote
1answer
45 views

EAX: OMAC and CMAC

OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2? If it is OMAC1, does that mean it ...

15 30 50 per page