1
vote
1answer
15 views

How can a poor RNG impact security?

I have read this article and I do somehow "understand" that the reduction of entropy makes it easier to guess. But how exactly can the security be reduced by that? Can you give a concrete scenario, ...
0
votes
0answers
13 views

Derive $x$ when given $g,g^x$ and $g^{(1/x)}$?

If an adversary has access to the generator g of a group G and is given access to $g^{x}$ and $g^{(1/x)}$, will it make it any easier to derive the value of $x$ compared to when he had access to only ...
2
votes
2answers
159 views

Why can an elliptic curve private key be 1?

I often see in papers (e.g. this one) that for an elliptic curve with generator point $G$ and order $n$ the private key $d$ can take on any integer value in the range $[1, n)$. When $d = 1$ the ...
0
votes
2answers
30 views

Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
2
votes
1answer
26 views

Master keys' strengh

If I am going to use a master key to generate a session key, why the master key must be "stronger" than the session key? Like should not be distributing 128-bit AES keys derived from a 56-bit DES ...
0
votes
0answers
9 views

Use MDC to provide origin authentication for public key encryption?

Why can't we use an MDC to provide origin authentication when using public-key encryption?
4
votes
1answer
211 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...
6
votes
0answers
39 views

Collisions in the cyclotomic knapsack function

I've been working my way through the paper “Efficient Collision-Resistant Hashing from Worst-Case Assumptions on Cyclic Lattices” by Peikert and Rosen, and I've come across something that doesn't seem ...
1
vote
1answer
40 views

Where and how to store private keys in web applications for private messaging with web browsers

I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy ...
3
votes
1answer
44 views

Can you still decrypt XTS if half of the cipher text is deleted?

If a part of my data is damaged, corrupted, or deleted, is it then still possible to decrypt the rest of the data if you still have the key? The situation: a piece of data (something like a document ...
2
votes
2answers
520 views

Using bcrypt for MAC - is it correct and secure?

Suppose there is a hashing function: $$ph = bcrypt(sha256(m + k), salt)$$ Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...
3
votes
2answers
162 views

Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
1
vote
1answer
20 views

Use $e$ in GGH as shared secret?

I was wondering if we could construct a symmetric encryption scheme by assuming that the secret key itself in GGH is public and the shared "key" is the error vector $e$. To encrypt we would take the ...
-3
votes
0answers
26 views

What is this encryption type? [on hold]

I just get the encryption from some website. Here the encryption output: 1) ZFRSA00013GDU and this is the key before encrypted PKR003 2) YHZSA00100PE9 and this is the key before encrypted PJR011 ...
8
votes
1answer
53 views

About random self-reducibility of DDH

In Section 8 of this, Lindell presents a construction of an oblivious transfer protocol which is secure in the malicious model under the following variant of the DDH assumption (page 53): [F]or ...
4
votes
1answer
418 views

How to sign a large file for random-access reading?

I need to write an "Authoring" application which produces large files. These files must be signed so that the "Consuming" application knows that it was authored with a matching key. The consuming ...
7
votes
1answer
48 views

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.
0
votes
0answers
14 views

NORX parallel speedup?

How much of a speedup can be expected going from serial NORX (6441) to 4-way parallel NORX (6444) assuming the latter is implemented as 4 word-sliced instances of the former?
2
votes
0answers
68 views

Designing a secure protocol to avoid MITM?

Imagine that you are designing an online game, the framework consists of a player A, a game host H and a trusted central server S. The player A has a symmetric key KAS and id A that is known ...
4
votes
1answer
40 views

Padding schemes for asymmetric encryption with provable security in the standard model

Most padding schemes for asymmetric encryption (OAEP, OAEP+) are only proven secure in the random oracle model. Although no attacks are known, it would be nice to find a padding scheme with provable ...
-3
votes
0answers
18 views

Man-in-the-middle-Attack three Parties [duplicate]

How does this work in Diffie Hellman ? I'm working for days on this but i'm a little bit Confused. If Oscar changes only the last key (for example Kabc ) is this enough ?
2
votes
1answer
22 views

Using a round function intended for an SP network in a Feistel network?

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher? My thought is "yes" because: it already has ...
3
votes
0answers
52 views

How to generate an RSASSA-PSS signature with MGF1-SHA256?

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
1
vote
3answers
81 views

Can $d$ and $e$ be the same number in RSA?

I'm reading about RSA and I have doubts: 1) To choose $e$, this value have to be between $1$ and $phi=(p-1)(q-1)$, with $mdc(phi, e) = 1$, right? 2) In my example, $p = 139$ and $q = 491$. So $n = ...
5
votes
1answer
292 views

What does 0…0 and 1…1 mean

I am very new to cryptography but can someone explain what exactly does 0...0 and 1...1 mean in general term. Is it that 1st and ...
1
vote
1answer
17 views

Can a compressed checksum be considered unique

I'm kind of guessing that the answer may be no. Since the compression is trying to reduce the output size using various optimization methods, this may cancel the properties of a hash algorithm. But ...
3
votes
0answers
61 views

XTS and 256-bit data blocks

I am developer of an application that uses XTS with ciphers which use 128-bit blocks (AES, Serpent and Twofish). I now want to use XTS with a cipher which uses 256-bit blocks (Shacal-2). AFAIK, I ...
5
votes
1answer
187 views

Is the “New Hope” Lattice Key Exchange vulnerable to a lattice analog of the Bernstein BADA55 Attack?

In the paper, "Post Quantum Key Exhange - A New Hope," the authors present a lattice-based key exchange based on the work of Chris Peikert. In this "New Hope" key exchange the authors try to gain ...
0
votes
1answer
13 views

Chosen Ciphertext Attack on the Public Key in PGP

In Secrets & Lies (2000), Schneier describes a chosen ciphertext attack on the public key under PGP: "Since RSA and ElGamal are malleable, known changes can be made to the symmetric key that ...
4
votes
0answers
22 views

Correlation Immunity Of 4 bit S Box

I have a 4 bit S Box byte[] S = new byte[16] { 0x9, 0xE, 0x5, 0x6, 0xA, 0x2, 0x3, 0xC, 0xF, 0x0, 0x4, 0xD, 0x7, 0xB, 0x1, 0x8 }; How can i calculate Correlation ...
-2
votes
0answers
21 views

How to know the size of an encrypted key that is encrypted using public key

I encrypted a key with a size of 32 bytes. I encrypted it using a public key. How will I know how big is the encrypted key(ciph)? My code: ...
0
votes
0answers
42 views

What does Video Encryption Algorithm really do? [on hold]

So I read some paper suggesting video encryption algorithm (VEA) for encrypting video like MPEG, but when I google it, it only shows how it works in general, no mention about how it gets the key to ...
3
votes
2answers
250 views

Which elliptic curves are quantum resistant? [on hold]

If I want to learn about quantum resistant crytography what are the best resources? Which type of elliptic curves should I be studying?
4
votes
1answer
61 views

Differential & linear characteristics for integer multiplication

What are the probabilities of differential & linear characteristics for the function that XORs the high and low bits from a $n \times n \rightarrow 2n$ bit multiplication? I remember reading ...
3
votes
0answers
38 views

Can the attack in https://eprint.iacr.org/2008/469.pdf be parallelized?

Can this attack be parallelized? It is a $2^{57}$ complexity collision attack on SHA-1 based on disturbance vectors. If it is practical it is easy on a GPU ($\approx1.1$ GPU-days). If it is ...
4
votes
2answers
40 views

How long should a HMAC cryptographic key be?

In the top answer to this question the answerer says 'with a sufficently long key'. I am using a SHA1-HMAC (may switch to SHA256-HMAC) algorithm to verify cookies sent to clients as authentication ...
5
votes
1answer
57 views

Is ElGamal encryption still secure if the randomness is known to be even?

In ElGamal encryption $(g^r, g^mg^{kr})$, if the randomness $r$ is always chosen from even numbers, and the attacker knows about this, is it still provable secure?
3
votes
1answer
25 views

How does Feistel cipher create diffusion between blocks?

From what I've read about Feistel ciphers, I can understand that within each block, there is both confusion and diffusion. But it is unclear to me how a Feistel cipher permutates among blocks of data. ...
2
votes
1answer
32 views

Why are {0,1}-matrices almost-MDS only when n is 2, 3, or 4?

In this paper authors claim that {0,1}-matrices are almost-MDS (have branch number n - 1) on when n is 2, 3, or 4. For example, how can this two matrices have the same branch number? ...
3
votes
0answers
41 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
0
votes
1answer
31 views

Creating ECDH using OpenSSL

For academic reasons, I'm playing around with OpennSSL 1.0.2g. I tested RSA encryption/decryption. I created key exchange with DHKE. But I'm struggling to find a way, to create ECDH, using only ...
-2
votes
0answers
30 views

How do Galios fields work in AES? [duplicate]

I am trying to learn how AES functions but I keep hanging at the subject of Galios fields. I am reading a lot about them but I just can not find an understandable explaination in how they work. Could ...
3
votes
3answers
88 views

Can an adversary distinguish a private key from a pseudo-random string of the same length?

Apologies if this is a dumb question but allow me to describe the dilemma I have: Suppose that I am protecting a private key on a device using a password & PBKDF2. The obvious attack would be an ...
1
vote
1answer
39 views

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures ...
-3
votes
0answers
30 views

how a MITM attack works against tripartite in DH? [on hold]

Must Oscar change only the Key $K_{abc}$ (Alice, Bob and Charlie) or does he have one key for everyone of them ?
3
votes
2answers
587 views

How does blocksize affect security?

I have recently read about how blockciphers and how stream ciphers work, and although I think I finally got everything right, I'm still wondering how increasing blocksize increases security.
-2
votes
0answers
20 views

Having trouble with a double encoded keyword sypher [on hold]

IIYFATKOHRFDQLRTUKFOLDTIQLTFAZLGZFUNCKYCEFUCUQUGCWWOGYSOCZTXGZPNHYPMPQDOLNONAZOEQLUSEYELNUDEPQDOKPTIPQTYCZUZQQORUFANHQRGHIUJUQOEQQUWKEURLYHCSLUCUUUFKLUNAYLRUFAZQZONKYIGBKYITDOEAWGDPIKOOTRCUJLIGZWNSZGC ...
3
votes
2answers
62 views

Can I use a block cipher in CTR mode to generate keys from a master key?

Suppose I have an AEAD mode based on a block cipher that requires two or more keys. In some cases, there is a complex proof that one key suffices. But finding such a proof is hard. An alternative ...
18
votes
4answers
3k views

Why does RSA need p and q to be prime numbers?

This is a clarifying thread after finding: What makes RSA secure by using prime numbers?. Despite the fact that this question was answered already, I am still struggling to really grasp the ...
-2
votes
0answers
38 views

Man in the middle attack including 3 parties [closed]

How could a man in the middle attack work with 3 different parties in Diffie Hellman?

15 30 50 per page