# Tag Info

14

Both of the other answers tackle the question of encryption in a particular format, but I would argue that neither of them is necessarily a good fit for your use case. You want to be able to generate 20 character codes that a server will be able to verify. A symmetric MAC is sufficient for this use case, if you don't need the codes to contain any secret ...

11

What choice did they have? F1 is a bitwise function with three inputs and one output. There are $2^8 = 256$ such functions. Only 70 of them are "unbiased" (i.e. have as many 0 and 1 outputs in their image). If you further require that each input, as well as the order of inputs, matters for the output, you are left with only 36. However, those 36 are all ...

7

What you are asking is a straight application for Format Preserving Encryption, which builds ciphers which input and output are in a constrained format (generically: common to input and output, hence preserved). The FPE field has many articles with proven techniques; and proposed standards, including BPS and SP800-38G Draft. Specifically, it looks like ...

7

Even though Dobbertin could not provide a real collision of MD5, I would say that Hans Dobbertin first publicly described MD5 collision(s) in "The Status of MD5 After a Recent Attack" (PDF) – that was in 1996. To the best of my knowledge he was one of the first who recommended to no longer use MD5 when collision-resistance is needed/expected/required. On ...

6

In the first part of this answer, I consider the problem of decryption using leaked keys of a protocol not intended for that, which was my original reading of the question. I'll ignore that dominant industry practice is to use random symmetric session keys, leaving little opportunity to "hold a couple of secret keys" without knowing to what session they ...

5

The first publication of an MD5 collision was on 17-Aug-2004 17:44 UTC on the eprint archive server: Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu, Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD (third version). The results where fresh: the authors had just corrected IV endianness, that they got reversed in two earlier versions. Like 8 ...

5

I don't understand why this is important, but just want to note that the collision was first presented at the rump session at CRYPTO 2004, and was then later published. The earliest time-stamp is an ePrint report by Xiaoyun Wang and Dengguo Feng and Xuejia Lai and Hongbo Yu, called Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD. The date is ...

5

In very short: Assume you have an NP problem, stated as some condition to be met. Since it is a NP condition, the computational complexity to find a satisfying input (called the witness for the language) grows quite fast. The setup of such an encryption scheme is based on a multilinear map (a generalization of a bilinear map, but with arbitrary many ...

5

A symmetric cipher design contest was started in Ukraine around 2006, and this cipher (in Ukrainian and Russian: Мухомор) was there. For specifications, look for "Applied Radioelectronics" journal "Прикладная радиоэлектроника", 2007, No 2. http://anpre.org.ua/?q=pre_2007_2 http://dspace.nbuv.gov.ua/bitstream/handle/123456789/61794/06-Dolgov.pdf

4

The point why a simulation must not deviate too much from the real game is due to the following reasoning. You assume you have an adversary that wins the original game, but you do not know how the adversary acts if you deviate from the behaviour of the real game and the adversary can notice this. Exactly because you make no assumption whatsoever about the ...

4

You can use these schemes instead: “Evaluating 2-DNF Formulas on Ciphertexts”, or “A Simple BGN-type Cryptosystem from LWE”. These schemes enable you to do addition, a single multiplication, and more additions. For inner product, that's all you need (encrypt each item separately, multiply pairs, and add all together). Not everything needs FHE. In any ...

4

MD5 was designed with the goal that any change in the input uniformly affects all the bits of the output. It's not perfect, but it's pretty good. If you're choosing the input "randomly enough" (e.g., by appending random bits before hashing) then your question approaches this one: Given two randomly generated 8-bit strings, what is the probability that ...

4

Before answering the actual question, I will offer some general advice. It is important to pay attention, both in class and to the textbook you are reading. If learning how to solve such exercises is a key goal of the course, such solutions have very probably been discussed at length in class. Moreover, your textbook also has proof examples, and in this ...

4

As otus suggests in the comments, it's better to first calculate the frequency of each letter in the decrypted message, and then compare the frequency distribution to what would be expected for English text. For the comparison, you can use chi-squared ($\chi^2$) testing. (Actually, for just comparing the likelihoods of different decryptions, you don't even ...

3

As SOJPM says in their answer, the proofs for AES-GCM assumes that AES is a PRP. I can't believe that there is anywhere in the proof that using a PRF (possibly truncated) would break things -- but I haven't looked carefully for this. Depending on how the GCM proof is structured, (using/not using) the PRP/PRF switching lemma [1] may suffice, but I don't ...

3

I don't believe he is answering the right question. You essentially asked "why are public keys so much larger than symmetric keys", and after his first sentence (which started to address the question, but was a bit vague), he tried to answer the distinct question "why are public key operations so much slower" (not that he got the details of that correct; ...

3

I'm sorry, but I don't believe that there are any known 'one way permutations' for small inputs (that stay one way if you know the 'key'). When we create a cryptographic permutation (or bijection; that's what we call a 'full cycle' function), we have two basic ways to do it: We can take a series of easy to invert permutations ("round functions"), and glue ...

3

IND-CPA is equivalent to semantic security under CPA.

3

The shared secret that Diffie-Hellman produces is known as the premaster secret. This is then passed through the cipher suite's PRF to get the master secret, which is then passed through the PRF again to get the various keys and IVs. The master secret is always exactly 48 bytes long; the keys can be as long as needed. Now, the PRF. TLS tends to use a PRF ...

3

I don't know of a use of Lamport's scheme precisely as Lamport originally published it; however if we include generalizations of the idea (such as Winternitz signatures), then it has been used as the basis of Hash Based Signatures, such as this proposal

3

First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the cofactor; it is typically either 1, 4 or 8. The values of $q$ and $h$ will be part of the curve definition. As you know, with straight DH, we agree on a point ...

3

According to Handbook of Applied Cryptography (15.3.2, ii), ANSI X9.9 (which SEJPM mentioned in the comments but I have no access to) defined CFB-MAC only as a compatible alternative to CBC-MAC: The X9.9 MAC algorithm may be implemented using either the cipher-block chaining (CBC) or 64-bit cipher feedback (CFB-64) mode, initialized to produce the same ...

3

Standards for Efficient Cryptography Group has published SEC1: Elliptic Curve Cryptography (pdf) about elliptic curve algorithms. If it does not explain the mathematics well enough for your purposes, there is also Fundamental Elliptic Curve Cryptography Algorithms (RFC 6090, from IETF) you could look at. There are a lot of issues you can run into, so ...

3

As of now I can think of four different applications for XOFs. Note that some change the padding depending on the requested output size and so the outputs are truly unrelated, Skein does this. Signature message hashing. Using an XOF you don't have to rely on ad-hoc constructions for hashing the message in signature schemes to the appropriate size. For ...

2

It appears there are no official test vectors for PBKDF2-HMAC-SHA256. A StackOverflow user has posted some test vectors that others have validated. Here are the test vectors for HMAC-SHA2 which you should also be running. That said, if you have "implemented some other things that will make the final output different", then you do not have PBKDF2. PBKDF2 is ...

2

Based on the clarifications in the comments, what you are looking for is a block cipher over 100 bits. This will enable you to Base32 encode into a 20 byte string, and to decrypt as well. Note that encrypting directly with a block cipher is in general not secure. However, I assume that with promo codes you will always encrypt a unique plaintext. If this ...

2

Ok, if there is no standard, then "I do it my way": Let $i$ be a root of a fixed minimum polynomial of $GF(p^2)$ and $x$ be an element in $GF(p^2)$. Then $x:= x_1+x_2*i$ can be represented as a vector $(x_1,x_2) \in GF(p)^2$. Now convert $x_1$ and $x_2$ with the FE2OSP function form IEEE P1363 and concatenate them $FE2OSP(x_1)|| FE2OSP(x_2)$. An ...

2

I know of no standard like that and also doubt it exists. It would have similar disadvantages as random padding at the end, which is no longer in use: subliminal channel, consumption of randomness which may be expensive. Additionally, it would require knowing the message length in advance, which is a practical limitation.

2

You are describing a replay attack. The most simple method to prevent this is to include a message counter as part of the message, and reject any message with a counter equal to or less than the last message. The message counter should be large enough so that key changes would occur before the counter loops. A 32-bit message counter allows 100 messages per ...

2

How do cryptographic systems handle such situations? … What actually is done in real life? In real life, cryptography handles situations like the one you describe by using “authentication”. Authentication links an action, a message or a situation to an identity. In the example you describe, this will practically boil down to a validation of something an ...

Only top voted, non community-wiki answers of a minimum length are eligible