Questions tagged [algorithm-design]
Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its name.
146
questions
50
votes
6answers
8k views
Kerckhoffs’ principles – Why should I make my cipher public?
As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that
A cryptosystem should be secure ...
34
votes
3answers
20k views
Can one generalize the Diffie-Hellman key exchange to three or more parties?
Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties?
I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
48
votes
4answers
111k views
Difference between stream cipher and block cipher
I read that
A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time.
(...
25
votes
5answers
45k views
What is the lowest level of mathematics required in order to understand how encryption algorithms work?
What mathematical fields of knowledge would be required in order to get a good understanding of encryption algorithms?
Is it basic algebra, or is there a "higher education" mathematical field ...
8
votes
2answers
866 views
Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?
I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the ...
25
votes
9answers
8k views
Why not the one-time pad with pseudo-number generator
I am very new to cryptography (so be kind), but I have a question that may seem silly.
If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one ...
18
votes
7answers
5k views
Turning a cipher into a hashing function
This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;)
The first hashing functions created ...
7
votes
3answers
3k views
Is there a length-preserving encryption scheme?
Is there a length-preserving encryption scheme, that preserves the lengths of input sizes such that the length of the input plain text is same as length of the output cipher text ?
7
votes
2answers
646 views
Just how surjective is a cryptographic hash like SHA-1?
From “Are common cryptographic hashes bijective when hashing a single block of the same size as the output” and “How is injective, inverse, surjective & oneway related to cryptography”, it is ...
38
votes
3answers
19k views
What are the differences Between “White-Box Cryptography” and “Code Obfuscation”?
I have been reading the question "What is a white-box implementation of a cryptographic algorithm?" and it led to this short article / Q&A which states in question 2:
Q2: What is the difference ...
10
votes
1answer
2k views
Why Addition Mod 32?
I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not ...
3
votes
1answer
407 views
Building a stream-cipher out of a hash function?
I've already read this:
Is it feasible to build a stream cipher from a cryptographic hash function?
However, my proposed construction differs…
Suppose the hash generates N bits. These bits are split ...
0
votes
1answer
817 views
How to optimise Euclidean Algorithm for large numbers? -RSA
I am using the standard version of the Euclidian Algorithm (i.e. GCD(270, 192) = GCD(192, [270 % 192]) = ...repeat until 0) to determine if two numbers are coprime. I run the algorithm, check if the ...
19
votes
2answers
8k views
Why do block ciphers need a non-linear component (like an S-box)?
Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)?
How does it make the cipher more secure?
The only intuition I have ...
28
votes
2answers
6k views
Reason why “XOR” is a linear operation, but ordinary “addition” isn’t?
I'm new in cryptography and try to read some articles in this field.
Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity.
I have a simple ...
14
votes
3answers
4k views
What's a cryptographic primitive, really?
The more I encounter the term "cryptographic primitive," the less I feel confident that I truly understand what it means. Is it just me, or is there no universal definition for the term? Or does the ...
13
votes
3answers
897 views
Counter mode secure hash algorithm
Ever since the SHA-3 competition, I've been wondering if it is possible to create a hash algorithm that is easier to parallelize. The current algorithms all seem to require building a tree of hashes. ...
14
votes
1answer
4k views
Are there any specific requirements for the function $F$ in a Feistel cipher?
In a Feistel cipher (as shown below), it seems that the security of the cipher would be entirely dependent upon the function $F$. What requirements on $F$ are necessary for a secure Feistel cipher? Is ...
10
votes
4answers
9k views
Does encrypting twice using the same block cipher produce a security weakness?
If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system.
...
6
votes
2answers
598 views
Can we exchange the permutation of a sponge construction?
Part of a sponge construction (like SHA3 uses) is a fixed permutation $p$; which is clearly not one-way.
Could we, theoretically, exchange the permutation $p$ with any other permutation? What basic ...
5
votes
2answers
288 views
Would a HMAC digest make sense in an RSA / ECDSA signature?
When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
4
votes
2answers
3k views
Symmetric vs. Asymmetric cryptographic approaches to data security
I know the basic differences between Symmetric vs. Asymmetric cryptography, but I'd love to know more details:
Exactly why is the asymmetric approach slower than the symmetric?
Why does it make use ...
3
votes
2answers
309 views
Algorithm Design for only Mutual Information Sharing
Bob and Alice each have a bit string they want to keep private. They each want to know what the bitwise AND of their two strings would be without telling the other or anyone else listening to their ...
3
votes
1answer
163 views
How can I verifiably announce a choice without revealing its content?
Here is the simplified problem:
Alice chooses from a small set of possible values.
Bob guesses which value Alice picked.
Alice reveals what value she picked.
Alice's choice must stay secret ...
4
votes
1answer
279 views
What is the difference between strong/weak alignment?
In this answer there is the mention of "weak alignment", followed by an indication that it is related to "resistance to truncated differential cryptanalysis".
What exactly is the difference between ...
1
vote
1answer
575 views
How exactly is the input message of SHA-256 (pre-)processed?
I’m very interested how SHA-256 handles messages, but I’ve got 3 questions. (As I have already read in some answers before, SHA-256 is not directly performed on the message but on an array, thanks for ...
27
votes
2answers
4k views
What are recommended, general strategies to start block-cipher design and/or analysis?
I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers.
Now, the ressources on the "black art" of design and ...
14
votes
3answers
1k views
What is the best way to put a backdoor in an encryption system?
How can you put a backdoor into an encryption algorithm? Are there any techniques that can be used to reduce the time it takes to break a key?
I am looking for practical examples encryption schemes ...
20
votes
3answers
7k views
Is there a string that's hash is equal to itself?
I was wondering if there's any string that has a hash equal to itself, so that – when using any (none specific) hash function – the hash would be equal to that string?
so that:
...
14
votes
2answers
21k views
Do identical strings always have the same SHA-256 value?
If you hash a string using SHA-256 on your computer, and I hash the same string using SHA-256 on my computer, will we generate the same value? Does the algorithm depend on a seed (so we'd both need ...
14
votes
3answers
4k views
Are there any secure commutative ciphers?
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.
My question is, here there any commutative ciphers out there that are secure ...
14
votes
2answers
4k views
How exactly does key whitening manage to increase security?
Wikipedia states that key whitening increases security:
In cryptography, key whitening is a technique intended to increase the security of an iterated block cipher. It consists of steps that ...
8
votes
1answer
491 views
Understanding the wide trail design strategy
I am trying to understand the wide trail design strategy. I have read the paper which describes it from the point of view of AES. From what I understand, it is a technique to increase diffusion in a ...
7
votes
1answer
1k views
Elliptic curve cryptography related key attacks [closed]
This question is an extension of Families of public/private keys in elliptic curve cryptography
As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
13
votes
1answer
1k views
How to choose constants in a cryptographic function?
A number of cryptographic functions have constants built in. For example, the constants used in RFC 2104 for HMAC, or the constants used in s-boxes (e.g., DES and AES), or MD5. In general, how are ...
6
votes
1answer
2k views
What are the constraints for an IV using AES in CBC mode?
I'm designing a protocol for use into a VPN software.
The VPN frames are encapsulated into AES-256 CBC encrypted frames. I understand that IVs must be uniquely used for each message encrypted with ...
3
votes
2answers
4k views
What happens if a SHA-256 input is too long (longer than 512 bits)?
What I understand is: When we parse a message into 512 bit message blocks. Then we extend the first message block to 64 entry array and start with the compression function.
What happens if the ...
2
votes
2answers
790 views
Homomorphic Encryption with Addition and Exponentiation
Is there any homomorphic encryption scheme which supports addition and power over cipher text ? Paillier is close but it supports addition and multiplication with a constant.
I am getting an output ...
9
votes
1answer
415 views
Are there any security issues when replacing the SHA-256 initialisation values?
As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words.
These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
5
votes
1answer
133 views
Could a strong round function be immune to slide attacks
An excerpt from the wikipedia article on slide attacks states:
...The only requirements for a slide attack to work on a cipher is that it can be broken down into multiple rounds of an identical F ...
5
votes
1answer
437 views
AES with shuffleBytes instead of shiftRows
I was examining how AES provides diffusion and noticed that indices of the shiftRows transposition step can be modeled as inputs/outputs of a 4x4 table:
...
3
votes
2answers
633 views
AES: How to create the S-box with Sage
The $Sage$ code for the AES $S-box$ is below and a link is here: Polynomial representation of the affine part of the AES S-box. An online version of $Sage$ to test this is here.
I understand most of ...
13
votes
4answers
3k views
Why is the permutation in AES (and other ciphers) not random or key-dependent?
If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks?
If this is so, then might we need fewer rounds for ...
13
votes
2answers
3k views
Why is CRC said to be linear?
It is commonly understood that CRC satisfies the linear identity with respect to the $\oplus$ (XOR) operation:
$\operatorname{CRC}(a) \oplus \operatorname{CRC}(b) = \operatorname{CRC}(a \oplus b)$
...
7
votes
2answers
3k views
Non-linearity of a boolean function
What's the definition of non-linearity of a boolean function? Roughly saying it is minimum number of times it equals any affine function. But I don't get it mathematically.
For example, if $f = ...
5
votes
3answers
439 views
Designing a key expander out of ciphers
Is it possible to compose or combine $n$ ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate $n$ ciphertexts from the same key, $k$, and that recovering the key, $k$, from ...
4
votes
1answer
781 views
Do any one-key-of-many cryptographic schemes exist?
I'm pretty sure I understand how public/private key cryptography works. Anybody can encrypt a message using a well-known public key, but only the person who holds the private key can decrypt it.
My ...
4
votes
1answer
559 views
One ciphertext, multiple keys, multiple messages
I recently came across following idea, does anyone know a name and if it is actually used?
A wants to send B a message (A and B know both have a common secret
key) and C wants to intercept it (...
3
votes
2answers
474 views
Non primitive lfsr sequence
Given a non-primitive LFSR sequence (i.e number of states is less than $2^n - 1$); how do we find out the the characteristic polynomial? Will Berlekamp-Massey algorithm work in this case?
for example;...
2
votes
2answers
217 views
Secret Sharing Scheme with variable share size?
Is there a secret sharing scheme construction that allows the shares to have different sizes/lengths?
For example a (3,3) scheme, where shares 1 and 2 have large sizes while share 3 has a very small ...
