Tag Info

Hot answers tagged

17

Well, cryptographers have been contemplating a post-quantum world for some time now. Quantum computing, although in its infancy as far as real-life computers go, has been studied in a theoretical sense for a quite a while. Shor's algorithm was published 19 years ago; Grover's, 17 years ago. These are the two most-famous quantum algorithms, I think, but the ...


15

Curve25519 was designed to take advantage of the Montgomery ladder, which combined with Montgomery curves forgoes the $Y$ coordinates, is side-channel resistant, and enables public keys to be any 255-bit string. The ladder looks something like this (pseudocode): Q[0] = P; Q[1] = 2*P; for(int i = log2(exponent) - 2; i >= 0; --i) { Q[ bit(exponent, i)] ...


13

A simple way to imagine the effect of the hash function is a truncation. A "good" hash function ought to behave like a random oracle. If your source has entropy $s$ bits, then this means that the source somehow assumes $2^s$ possible values. When processed with a random oracle with an $n$-bit output, you force the $2^s$ input values into $2^n$ possible ...


12

I have a list of Bitcoin-related publications here: Bitcoin Bibliography (Crypto & Security) They are all the academic papers (as opposed to whitepapers) that I know about, relating to security or cryptographic aspects (as opposed to economic or implementation aspects) of Bitcoin. Most are published.


11

Here's the Research article on the Bitcoin wiki: http://en.bitcoin.it/wiki/Research You might find some of the authors in the list have related research that is not directly related to Bitcoin so is absent from that list.


10

Randomness is not a property of strings of bits (or characters of any sort). Rather it is a property of the process that generates those strings. However, it is convenient to conflate the string with the thing that produced the string, and thus to speak about strings being “random” or “not random”. The string 00000, for example, is random if it was the ...


8

No, because even SHA-512 was considered overkill from a security perspective. It has 256-bit collision resistance, which is unbreakable. (The link is about keys but a similar argument applies.) If you think large quantum computers will be efficient, a 512-bit hash makes some sense, but even then a 1024-bit one wouldn't. A quantum computer requires ...


8

Pure Threefish has received less attention than Skein. Shortly speaking, it has a large security margin, and can be safely used for encryption. In more details, Threefish has been tweaked twice. The first two versions were vulnerable to rotational cryptanalysis in weak models (related-key attacks or distinguishers) up to 57 rounds. All these attacks are ...


8

The idea of "safe curve" is somewhat overrated. What you really want is a safe implementation which won't leak secret information when employed in some practical context. Leakage may occur in a variety of ways; some examples include timing attacks and implementation behaviour when encountering anomalous input. This is not an exhaustive list, and, depending ...


7

Vanilla textbook RSA does not include "padding and stuff", the term "textbook RSA" generally refers to simply encoding a plaintext message as an integer and raising it to an exponent. Implementing this is pretty easy, just follow the steps outlined on Wikipedia. You can easily translate those steps into some given programming language. Based on the rest of ...


7

Here is how you do a literature search, to find relevant research papers in the literature: You identify some search terms related to your topic, and search for them on Google Scholar and other places (e.g., Crypto.SE, via web search, on Citeseer). (For cryptographic work, also try searching Google with site:eprint.iacr.org and your search terms, to turn ...


7

In RSA as usually practiced (encryption or signature per PKCS#1, signature per X9.31, ISO/IEC 9796-2, FIPS 186), it is NOT necessary, or even common, to require $n=p⋅q$ with $p=2⋅p′+1$ and $q=2⋅q′+1$ with $p'$ and $q'$ huge primes, as stated in the question. IF that's done, it ensures that: any small odd $e>2$ (including the common $e=3$ and $e=65537$) ...


7

It's called a keyword cipher. See this question for some ways to break it.


7

Uniformity is a tricky one. SHA-256 (as well as SHA-3 for that matter) follows a heuristic approach. That is, the design is not based on a hardness assumption (for example, the factoring or discrete-log assumption) but on criteria that have only been verified empirically. As such, also the study of uniformity is an empirical study. The development of ...


7

Yes, they are (deterministically) equivalent. The original RSA paper (Section IX.C), working off Miller's results (Theorem 3), showed how knowing the secret exponent $d$ was probabilistically equivalent to factoring $n$. Later, using more advanced techniques, Coron and May showed how to deterministically reduce finding $d$ to factoring $n$.


6

Using a MAC on the plaintext may potentially leak information about the plaintext (MAC algorithms do not necessarily ensure confidentiality of the data they are applied to, although some MAC algorithms like HMAC seem pretty safe). If you want to avoid this (theoretical) problem, then you should encrypt the MAC on the plaintext (i.e. MAC-then-encrypt, not ...


6

There is no uniform permutation; there is a permutation uniformly chosen from the set of all possible permutations over $Z_2^{128}$. It is evident that AES is not a uniformly chosen permutation, since its permutation is fixed for any key. One can consider a family $\{AES_K\}$ of AES permutations under all possible keys $K$. Even if the key is chosen ...


6

Safe primes (that are two times a prime plus one) and strong primes were at some point in time considered sensible. One reason was that safe primes ensures that Pollard's $p-1$ factoring algorithm stops working. However, safe primes are not enough. There are other related factoring algorithms, such as the $p+1$ method, and strong primes also stop them. The ...


6

Did you take a look at DjB's paper? One of his design criterias in order to improve performance is "Use a fixed position for the leading 1 in the secret key". The set of secret keys is defined to be $\{\underline{n} : n \in 2^{254} + 8\{0, 1, 2, 3,\ldots, 2^{251}-1\}\}$.


6

To answer point 2: No. When using a good encryption scheme, one aims to prove that the ciphertext is only negligibly different from random data. As such, without breaking the encryption scheme completely no information (for example the entropy) of the plaintext is leaked.


6

As far as I can tell, NIST has only one official document about entropy collection. SP-800-90B. The purpose of NIST Special Publication (SP) 800-90B is to specify the design and testing requirements for entropy sources that can be validated as approved entropy sources by NIST‘s CAVP and CMVP. It essentially defines a bunch of statistical tests to ...


5

I think what is meant by this paragraph is the language defined in report NES/DOC/TEC/WP2/007/2, "A System for Assisting Analysis of Some Block Ciphers", by Arueh Bibliowicz, Pnina Cohen, Eli Biham. It is listed on the "NESSIE public reports" page. The language is something like a special-purpose programming language for block ciphers. It supports functions ...


5

A quick web search for "randcam" showed me this german page Zufallszahlen aus der Webcam ("random numbers from the web cam"). (All other hits on the first Google result page are about an unrelated Pistonless rotary engine). This page is about a program available from the same site, which tries to gather entropy from a web cam and produce "real" random ...


5

Unfortunately Crypto.SE probably has very few lawyers, law enforcement officers, public policy experts, etc. Furthermore, Legal.SE doesn't exist yet. To further complicate the situation (at least in the US) the answer will probably vary from state to state. So, I'm going to do the best I can, but you are probably best off either calling police or a lawyer ...


5

The latest I know about is indeed "MD4 is Not One-Way." by Gaëtan Leurent (PDF) FSE 2008. Some of the more interesting and more recent publications to check on are "Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2", Jian Guo/San Ling/Christian Rechberger/Huaxiong Wang, 2010 (PDF) and the paper ...


5

Start with NIST Computer Security Division: FIPS (Federal Information Processing Standards) specifies multiple use scenarios in their Publications and Special Publications, many of which include the type of scenarios on your short list, as well as related scenarios. These are primarily for federal use, but if your use case matches that of the government ...


5

To be concise, true randomness boils down to the selected data being causally unrelated. That is, if each piece of data is the result of no common cause, then there is no relation by which the rest of the data can be predicted or inferred. So being unpredictable is a consequence of being truly random, but it is the lack of causal relationship that is the ...


5

Randomness is the information loss of any causal relationship between events. The universe needn't be a clockwork universe for the assumption of pervasive causality - if events are "sticky" and accrue localised causality in the same way that a molecular cloud accretes into stars and planets. The underlying cause of the speed of light might also be the prime ...


5

The most well known example of a cipher practically broken with linear attacks is by no doubt DES, a cipher with 56-bit key and 64-bit block. Equipped with a cluster of PCs in the year 1994, Mitsuru Matsui has experimentally found a secret key after 10 days of the analysis (the data generation took additional 40 days on the same machine set). By that time ...


5

Actually, there are also other reasons why one wants to use safe primes in the RSA setting (when working with hidden order groups in cryptographic protocols). When choosing the RSA modulus $n=pq$ to be the product of safe primes $p=2p'+1$ and $q=2q'+1$, then we also have the following: The subgroup of $Z_n^*$ of qadratic residues is cyclic and has order ...



Only top voted, non community-wiki answers of a minimum length are eligible