Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [standards]

Questions about official cryptographic standards and their implementation.

5
votes
3answers
170 views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
0
votes
1answer
46 views

What is multi-prime RSA (RSA-MP)?

I found some related question but no real explanation of what it is and when and why to use it. What are the benefits and downsides and is it recommended?
15
votes
2answers
1k views

Is there a contingency plan in the event of a catastrophic attack on AES?

NIST selected Rijndael in 2000 to be AES. In a paper from the Serpent authors, they mention that there was the possibility of choosing a second cipher as a backup in the case of any severe breaks: ...
15
votes
2answers
828 views

How did || come to be used in crypto texts to represent concatenation?

In RFC5647, NIST SP 800-38D, etc., || is used to denote concatenation. How did that come to be? In most programming languages ||...
0
votes
1answer
74 views

Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves [duplicate]

At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST. ECC Modulus RSA Prime Size 160 1024 224 2048 ...
0
votes
0answers
50 views

NIST ECC Curves without pairings

NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
1
vote
0answers
34 views

PCI DSS requirement 3.5.3

3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length key components or key shares, ...
25
votes
2answers
2k views

Why did TLS 1.3 prohibit PGP authentication?

There is a specification, in Informational(!) RFC 6091, for using PGP keys in TLS authentication, although I don’t think it has ever been implemented outside of GnuTLS (it’s certainly not in OpenSSL). ...
1
vote
1answer
30 views

Format of EC SubjectPublicKeyInfo

I am unable to account for an extra 0x00 byte in an EC SubjectPublicKeyInfo structure. ...
3
votes
1answer
48 views

Who assigns algorithm OIDs for cryptographic algorithms?

I am aware that this is at the border to security but I guess that I will rather find an answer here. The question is which institution generally assigns object identifiers for cryptographic ...
6
votes
3answers
2k views

Finding flaw in cryptographic protocol

If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute. How about Finding a flaw in cryptographic protocol?! How can you ...
3
votes
0answers
104 views

Is CLEFIA block cipher really lightweight? [closed]

CLEFIA is ISO/IEC 29192-2 standard in lightweight cryptography. According to this, the total GE area (I took the minimum) using .13 um is 2,488 (encryption mode) compared to piccolo-128 with GE area ...
3
votes
2answers
108 views

Is the IEEE 1363.1 standard of NTRU post-quantum secure?

I have a question regarding the IEEE 1363.1 standard for NTRU with padding, which offers CCA security. Does the IEEE standardized implementation offer post-quantum security as well? Also, what are ...
2
votes
2answers
71 views

Number of bits specified in standards implementation?

Currently deployed RSA and discrete logarithm implementation uses $1024$ to $2048$ bits. Hypothetically speaking if a crypto team produces a faster algorithm that moves current factoring and discrete ...
2
votes
1answer
93 views

What is certainty in a real world zero knowledge proof?

This question follows directly on from How do I explain zero knowledge proof to my 7 year old cousin? Most of the simplistic answers there suggest that proof is obtained iteratively, slowly reducing ...
14
votes
1answer
2k views

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
0
votes
2answers
91 views

Is it generally considered acceptable for app owners to be able to retrieve private keys from users when their apps offer end-to-end encryption?

E2EE promises that data sending between two endpoints can be decrypted by only those two endpoints. If an app offers E2EE but still has functions to retrieve private keys from users for any purposes ...
6
votes
3answers
471 views

Has any alternative to RSA and Discrete Logarithm been standardized for deployment?

Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse? So ...
5
votes
1answer
128 views

Standard parameters for Boneh–Lynn–Shacham signature?

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature. Are there standard parameters for BLS signature, (being?) defined ...
1
vote
1answer
148 views

Is it safe to use pairing-based cryptography in a commercial product?

My findings don't show any standardization(NIST, FIPS?) of pairing-based cryptography. Would this mean that it is a bad idea to incorporate pairing-based cryptography(bilinear groups) within a ...
5
votes
1answer
95 views

Is there a standard method to compare hardware-implemented ciphers?

I have been reviewing literature and I am trying to determine the best method to compare ciphers in hardware. The two methods that seem to be somewhat de facto standard the literature are looking at ...
6
votes
1answer
144 views

Generally accepted standard(s) for key managment?

I am using an application of which in its privacy policy it has been stated the they use generally accepted standards to protect data. They encrypt data on their servers. So, what is/are the "...
1
vote
2answers
208 views

Hashing Algorithm Integrity Validation

I am developing an application that will need to store a very large volume of hashed data per user for which I want to ensure I am doing everything possible to maximize security. At this point I ...
3
votes
1answer
197 views

How do you represent a compressed point on an elliptical curve over F2m?

I understand for prime curves it is just bytes(0x02 + flag) + bytes(x) where flag is the LSB of y. For the F2m curves I ...
1
vote
0answers
100 views

What are the best practice, and standard tools for blinding algorithms?

I'm developing an app that uses blind signatures. I'm having a hard time finding tools, and best practices for blinding. There is no PKCS. And everywhere I go, I find caveats of different blind ...
10
votes
3answers
345 views

What's up with unnamed elliptic curves in e-passports?

At my work I deal with the cryptographic aspects of the international E-Passport specification (the crypto chips embedded in your passports, the kiosks at airports that talk to them, and the ...
2
votes
1answer
170 views

Where in FIPS documents stated that SHA-1 is not secure?

SHA-1 is not secured for a very long time, but I still can see it here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf Where in FIPS documents stated that SHA-1 is not secure?
6
votes
1answer
3k views

What is the major difference between FIPS 186-2 and FIPS 186-4?

Can anyone please tell me the major difference between FIPS 186-2 and FIPS 186-4? I know with FIPS 140-2 they want the DSS standard to be FIPS 186-4, but what difference does it make?
1
vote
0answers
106 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
15
votes
2answers
2k views

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ...
1
vote
0answers
184 views

Encrypting/Decrypting using RSA and AES; standards?

I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo code the actions taking place are like this: Alice's actions for sending a secret, ...
15
votes
4answers
2k views

EC Schnorr signature: multiple standard?

I 'm working on some EC-Schnorr signature code. Reading various papers on that, it's seems EC-Schnorr is not standardized as well as ECDSA. For example, I found two main differences in two main ...
4
votes
2answers
3k views

What does the TLS 1.2 client finished message contain?

I am implementing TLS 1.2 and I'm stuck on the client finished message. My question is: what is the size and structure of a clients finished message in TLS 1.2 when using the ...
0
votes
0answers
85 views

Key size limitations due to software compatibility?

At the moment, much popular encryption-based software routinely handles up to 4096 bit keys and standard usage is broadly migrating from 1024 to 2048 bit keys. Hashes widely used are MD5/SHA1/SHA256 (...
4
votes
3answers
532 views

Homomorphism and Zero Knowledge in FIPS 140-2 compliant systems

I am analyzing a system that needs to be at least level 3 FIPS 140-2 compliant. The system may leverage from homomorphic and Zero Knowledge constructs, but, as far as I can see, the algorithms ...
2
votes
1answer
77 views

Can one passively load-balance HTTPS traffic based on TLS SNI?

Is it theoretically possible to passively snoop into the HTTPS traffic, reliably detect whether or not TLS SNI is attempted to be used by the client, and, if it is, redirect the stream of the ...
3
votes
1answer
274 views

What is the canonical way of creating Merkle tree branches?

I'm currently looking into creating some compact Merkle tree branches to prove that a given hash was included in a given Merkle root. My initial thought was to list the leaf, the Merkle root and all ...
1
vote
1answer
97 views

Where can I get the correct and precise algorithms for elliptic curve cryptography?

I have been asked to implement cryptographic operations using elliptic curves. I would like to get precise algorithms for various processes like key generation, digital signature and verification. I ...
15
votes
2answers
441 views

Is there a standardized tree hash?

SHA-1, SHA-2, and the standardized version of SHA-3 are all sequential. This is impractical for hashing very large files distributed across machines. Any sequential hash can be straightforwardly ...
1
vote
1answer
81 views

Is there a standard prefix random padding scheme?

Is there a standardized padding scheme which is prefix instead of postfix and that uses random bytes except for the first byte which would be the length of the padding?
1
vote
1answer
195 views

Clarification of RFC2246 with regards to Finished Message

I'm working on a client handshake finished message for a TLS client, and I'm reading through the RFC 2246 spec. The spec states (in section 7.4.9): The hash contained in finished messages sent by ...
6
votes
1answer
2k views

Standard format to encode AES cipher and random IV

As far as I understood, a secret key (same length as CBC block size) and an initialization vector (IV) are needed to decrypt a AES-256-CBC encrypted string. As the IV should better be random, it has ...
6
votes
2answers
394 views

Is standardizing a modified AES a good idea?

"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of"A New Encryption Standard of Ukraine: The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper ...
5
votes
4answers
2k views

Source for PKCS#11 Header Files

Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there ...
0
votes
1answer
341 views

What does the acronym “CRT” stand for in the PKCS #1 specification?

What does the acronym "CRT" stand for in the PKCS #1 specification? Does it stand for "Chinese Remainder Theorem"? Thanks, Pete
6
votes
1answer
105 views

Would key stretching help mitigate concerns with “verifiably random”?

Daniel J. Bernstein (and others) have expressed concern over how "verifiably random" curve parameters are generated. He points out that hashing a public seed doesn't prevent, say, the US government (...
1
vote
1answer
2k views

How to create a PEM file for storing an RSA key?

I have an RSA private key $\{d,n\}$ and a public key $\{e,n\}$, where $n$ is the modulus, and I also have the prime factors $p$ and $q$ of $n$. I want to create a PEM file containing this information,...
2
votes
0answers
152 views

Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate ...
7
votes
2answers
983 views

BER or DER X9.62 for ECDSA signature

The signature format for ECDSA signatures can be encoded using ASN.1 integers according to X9.62 or it can comprise of two integers with the same size as the key size. In case the X9.62 format is ...
5
votes
1answer
923 views

What weaknesses in Hash_DRBG did NIST find and fix?

Matthew Green states in the Practical Kleptography presentation (video, at about 12:15) that Hash_DRBG (from SP800-90A) as originally proposed by NSA had potentially exploitable flaws or bugs and that ...