0
votes
0answers
2 views

what does H3 (M, s, IDA) implies

I what is the difference between simple hash and random oracle..how to implement. how this, H3 (M, s, IDA) implement? Here M is the message ,s is the key IDA is the identity of user A.
0
votes
0answers
4 views

Are covert and rational adversaries same?

Aumann and Lindell defined covert adversaries in 2009 which is informally adversaries which have a epsilon-deterrence to cheat. Some authors (for ex. John R. Wallrabenstein) have defined similar ...
6
votes
2answers
165 views

Is HMAC-MD5 still secure for commitment or other common uses?

MD5 collisions have been out for some time. In spite of this, HMAC-MD5 is still secure for authenticating data1. This illustrates a strength of the HMAC construction, it does not require that the hash ...
6
votes
1answer
123 views

RSA with probable primes

I am a bit of a newbie to RSA encryption, so please be patient. I understand that for a 4096 bit RSA, the numbers p and q should be prime. And to have the best security, the p and q should both be ...
3
votes
4answers
228 views

Effective security of block cipher – equal the key size, or half the key size?

The Wikipedia “Key Size” article states: The security of an algorithm cannot exceed its key length (since any algorithm can be cracked by brute force), but it can be smaller. … … … Most ...
1
vote
1answer
33 views

Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
2
votes
1answer
71 views

Comparing n-multiple amount of merkle trees?

I would like to know what best steps are there in finding differences between a high order amount of merkle tree's or if a better associative structure should be used. I ask this questions because ...
1
vote
1answer
78 views

RSA public key exponent generation confusion

Quote from Wiki: $e$ having a short bit-length and small Hamming weight results in more efficient encryption — most commonly $2^{16} + 1 = 65537$. However, much smaller values of $e$ (such as $3$) ...
-2
votes
1answer
33 views

Would this be a plausible authenticated encryption scheme using nested encryption?

[This is was the most promising out of an incrementally developed set of (mostly flawed, to some degree) schemes I posted here, but I was told I should post each one separately] Assume $E$ is a block ...
0
votes
0answers
11 views

pgp public rsa key format

I have been trying to use Go (I could post the code, but I think I posted enough already...) to generate a pgp rsa key. However every time I try to encrypt something with it, something fails. However, ...
0
votes
2answers
34 views

Is it practical to use a stream cipher in a block cipher mode?

My idea is to use a stream cipher encrypting 16 bytes at a time as a primative block cipher in a mode of operation such as CBC mode. Is this practical or useful in any way?
0
votes
1answer
50 views

Finding public exponent e

I'm trying to create an algorithm to find the public exponent e given a plain (non-CRT) private key that doesn't include the public exponent, i.e. I've only got $n$ and $d$. A question has already ...
0
votes
0answers
22 views

How can I tell how a text was encrypted? [on hold]

How can I tell what encryption method was used to encrypt this text below? I noticed this sequence repeats "C04D57B02B2B61C4", could that be a hint? It also has leading zeroes, does that point to any ...
-4
votes
1answer
52 views

Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block?

The most promising of the 4 approaches described here (version 4) has been posted as a separate question. This post should be considered for archiving and historical purposes only. Disclaimer: the ...
0
votes
0answers
17 views

Ring signatures in ECC

Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret ...
0
votes
0answers
16 views

How many bits of entropy can I expect from /dev/urandom in iOS?

Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and ...
11
votes
5answers
1k views

Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
0
votes
0answers
25 views

Discrete log in Galois Extension Field

I was reading 'Pinocchio Coin' paper by Danezis et al. where they have said, "If we use the efficient pairing groups of Pinocchio, computing discrete logarithms in the exponent field $\mathbb{F}_p$ ...
2
votes
2answers
94 views
+100

How to prove that someone encrypted a specific (large) chunk of data

Alice encrypts her data with HER secret key. Then she sends the encrypted data to Bob who should encrypt it with HIS secret key. Caroline should then eventually get this double encrypted data. ...
0
votes
1answer
22 views

How to calculate RSA CRT parameters from public key and private exponent

Given the public key (n, e) and private exponent (d), how to calculate CRT parameters (p, q, dP, dQ, and qInv) of this RSA key pair?
-3
votes
3answers
166 views

Would this method deliver a perfectly non-malleable encryption for at least two blocks? [on hold]

Disclaimer: the algorithms I present here (and in other messages) are used as a hands-on way to learn about developing crypto algorithms, (and might also be of interest for other curious people), not ...
0
votes
2answers
38 views

Would this method allow fast authenticated encryption using only a single encryption operation per block?

[This approach is flawed. A different speculative approach using an RNG instead of the cipher as a source of entropy was posted as a separate question] Assume $E$ is a block cipher, $C_0 = IV$ and ...
-2
votes
0answers
24 views

Why don't we have hardware generate NON-pseudo, but REAL random numbers from meta-stable flip-flops? [on hold]

Software pseudo-random numbers can always be cracked because they are based on a seed and therefore deterministic. Therefore, why depend on anything that's deterministic for security? The only real ...
0
votes
0answers
17 views

public key for encrypting and both private and group key for decrypting [on hold]

A document is ecncrypted using publickey within a group(consists of many users with single public key and individual private key),then how to decrypt the document by using both public key and private ...
0
votes
0answers
52 views

Name of this attack?

I am studying Merkle tree signature. Let $\sigma=(s,Y_s,\sigma_{\text{OTS}},As)$ be a signature of certain document. Here $s$ is the index of leaf, $Y_s$ is the respectively OTS public key and $A_s$ ...
2
votes
1answer
72 views

Can spatial filters be used to factor composite numbers?

$Z=(N-XY)^2$ is a surface with absolute minima ($0s$) anywere $Y=N/X$. I know this question is naiive, but shouldn't it be possible to apply a lossy compression filter to this function which ...
0
votes
1answer
30 views

Using ECB as encryption mode, but encrypted messages are unique

As I understand, ECB should not be used as encryption mode unless you are encrypting single blocks of data which are always unique and only are encrypted once. I have a collection of ids represented ...
0
votes
1answer
26 views

Are pseudorandom permutation really permutation in mathematical sense?

In security, and specifically Block Cipher (AES, DES, etc), when we talk about pseudo random permutations, is the term "permutation" refer to the same meaning as in discrete mathematics. That is, the ...
-1
votes
0answers
44 views

Product of Sophie Germain Primes and safe primes [on hold]

I am testing the use of the product of 1024 bit safe primes as the RSA modulus, starting with Sophie Germain primes times their associated safe prime and the product of two sequential safe primes ...
0
votes
0answers
25 views

Can you find the search space? [duplicate]

Let A is a random number and has 512 bits.we make B from A and B has 1024 bits.Process of B is following: C=f(A) that f is hash and C has 160 bits.Then C pass in a parallel manner 7 different hash ...
2
votes
1answer
37 views

Compacting a substitution cipher key

In a substitution cipher, I recieve 3 bits and than I return another 3 bits. The key of this cipher could be a matrix represented as: ...
5
votes
2answers
2k views

In RSA, why is it important choosing e so that it is coprime to φ(n)?

When choosing the public exponent e, it is stressed that $e$ must be coprime to $\phi(n)$, i.e. $\gcd(\phi(n), e) = 1$. I know that a common choice is to have $e = 3$ (which requires a good padding ...
2
votes
3answers
209 views

Why is Bcrypt called a Key Derivation Function?

I am trying to understand why is bcrypt called a Key Derivation Function? I looked up the details of Ekfblowfish on Usenix article here: ...
0
votes
2answers
55 views

Elliptic Curve Cryptography Encryption and text representation implementation

I'm writing a coursework and right now I've implemented the ECDSA algorithm, but I also need to encrypt and decrypt small text files (.txt) using elliptic curve cryptography. The problem is that I do ...
2
votes
4answers
397 views

Alternative to NSA encryption algorithm

I am looking for a strong alternative to elliptic curve cryptography. It should be something that could face quantum computing attacks, but nothing created by the NSA. I heard about isogeny key ...
2
votes
2answers
174 views

Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?

Encrypt-then-Authenticate (EtA) seems to generally be considered the better option, compared to Authenticate-then-Encrypt (AtE) (see this Crypto.SE question, for example). The people writing the RFC ...
1
vote
1answer
15 views

Why do we truncate the hash when using DSA?

All the articles I read on the web about DSA keep telling me that the size of the hash needs to be truncated so that the bit length is equal to or lesser than the bit length of the prime number of the ...
0
votes
1answer
32 views

Executing encrypted code?

I want a code 'black box' that receives data inputs, processes those inputs, then sends out the outputs. I want the code to be encrypted, or somehow obfuscated. Is there any known way to do achieve ...
0
votes
1answer
28 views

Does the One Time Pad rely on confusion or diffusion?

From what I could research, XORing a random key adds confusion. But I do not undertand the rationale for that classification. Shannon's confusion is supposed to obscure the relationship between the ...
-3
votes
1answer
22 views

Can you find the search space?

Let $A$ is a random number and has $512$ bits.we make $B$ from $A$ and $B$ has $1024$ bits.Process of $B$ is following: $C=f(A)$ that $f$ is hash and $C$ has $160$ bits.Then $C$ pass in a ...
7
votes
1answer
81 views

Logjam on Elliptic Curves?

I think we're all aware of the Logjam attack. From now on we know that re-using primes for DH is a bad idea. But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
1
vote
0answers
25 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
1
vote
1answer
31 views

HKDF entropy extraction

I collect entropy from the following sources: system_entropy = System provided crypto entropy stream (CryptGenRandom on Windows) user_entropy = User-provided entropy - in a form of a byte stream of ...
4
votes
1answer
39 views

possible MITM attack against servers that used to support weak DH?

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid ...
2
votes
1answer
44 views

Encrypt-Mix-Encrypt: Full Diffusion?

I've read this paper about the encrypt-mix-encrypt mode for ciphers and was asking myself if this mode provides "full" diffusion. So if an attacker alters one bit of the ciphertext, how many bits ...
0
votes
1answer
85 views

Security aspects of using a global values as nonce and additional data for AES? [on hold]

is it a good idea to use global values as nonce / additional data? What problems can occur? What should be take in account when we deal with such parameters for encryption. Thanks
0
votes
1answer
94 views

Common Modulus Attack in RSA

Consider the following scenario: The Information Security Department (ISD) of an organization issues each of the organization's employees, domestic and abroad, with an individual RSA key. To simplify ...
1
vote
1answer
63 views

NTRU and one failed example

In NTRU crypto system I have used these polynomials and parameters: $N = 17, p = 7, q = 64$ and $f$ as private key is: $$f = -1 + x + x^2 - x^4 + x^6 + x^9 - x^{10}$$ So the inverse of $f$ in ring ...
-1
votes
0answers
15 views

Can Wireshark be used to trace SSL traffic to a server with DSA private key?

I tried to use wireshark to watch cipher negotiation between browser and a Tomcat server which uses DSA private key. and I got the following debug message: ...
-1
votes
0answers
20 views

A software for test and performance analysis of cryptographic algorithms

I'm new to cryptography and I have been assigned at college to do a comparison study between AES, DES, RC6 and SERPENT ciphers. Is there any graphical software than can help me analyze speed and ...

15 30 50 per page