Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [standards]

Questions about official cryptographic standards and their implementation.

0
votes
1answer
31 views

Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves [duplicate]

At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST. ECC Modulus RSA Prime Size 160 1024 224 2048 ...
0
votes
0answers
28 views

NIST ECC Curves without pairings

NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
1
vote
0answers
24 views

PCI DSS requirement 3.5.3

3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length key components or key shares, ...
25
votes
2answers
2k views

Why did TLS 1.3 prohibit PGP authentication?

There is a specification, in Informational(!) RFC 6091, for using PGP keys in TLS authentication, although I don’t think it has ever been implemented outside of GnuTLS (it’s certainly not in OpenSSL). ...
1
vote
1answer
22 views

Format of EC SubjectPublicKeyInfo

I am unable to account for an extra 0x00 byte in an EC SubjectPublicKeyInfo structure. ...
3
votes
1answer
35 views

Who assigns algorithm OIDs for cryptographic algorithms?

I am aware that this is at the border to security but I guess that I will rather find an answer here. The question is which institution generally assigns object identifiers for cryptographic ...
6
votes
3answers
2k views

Finding flaw in cryptographic protocol

If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute. How about Finding a flaw in cryptographic protocol?! How can you ...
3
votes
0answers
81 views

Is CLEFIA block cipher really lightweight? [closed]

CLEFIA is ISO/IEC 29192-2 standard in lightweight cryptography. According to this, the total GE area (I took the minimum) using .13 um is 2,488 (encryption mode) compared to piccolo-128 with GE area ...
3
votes
2answers
88 views

Is the IEEE 1363.1 standard of NTRU post-quantum secure?

I have a question regarding the IEEE 1363.1 standard for NTRU with padding, which offers CCA security. Does the IEEE standardized implementation offer post-quantum security as well? Also, what are ...
2
votes
2answers
70 views

Number of bits specified in standards implementation?

Currently deployed RSA and discrete logarithm implementation uses $1024$ to $2048$ bits. Hypothetically speaking if a crypto team produces a faster algorithm that moves current factoring and discrete ...
2
votes
1answer
86 views

What is certainty in a real world zero knowledge proof?

This question follows directly on from How do I explain zero knowledge proof to my 7 year old cousin? Most of the simplistic answers there suggest that proof is obtained iteratively, slowly reducing ...
14
votes
1answer
2k views

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
0
votes
2answers
88 views

Is it generally considered acceptable for app owners to be able to retrieve private keys from users when their apps offer end-to-end encryption?

E2EE promises that data sending between two endpoints can be decrypted by only those two endpoints. If an app offers E2EE but still has functions to retrieve private keys from users for any purposes ...
6
votes
3answers
413 views

Has any alternative to RSA and Discrete Logarithm been standardized for deployment?

Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse? So ...
5
votes
1answer
122 views

Standard parameters for Boneh–Lynn–Shacham signature?

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature. Are there standard parameters for BLS signature, (being?) defined ...
1
vote
1answer
138 views

Is it safe to use pairing-based cryptography in a commercial product?

My findings don't show any standardization(NIST, FIPS?) of pairing-based cryptography. Would this mean that it is a bad idea to incorporate pairing-based cryptography(bilinear groups) within a ...
5
votes
1answer
95 views

Is there a standard method to compare hardware-implemented ciphers?

I have been reviewing literature and I am trying to determine the best method to compare ciphers in hardware. The two methods that seem to be somewhat de facto standard the literature are looking at ...
6
votes
1answer
141 views

Generally accepted standard(s) for key managment?

I am using an application of which in its privacy policy it has been stated the they use generally accepted standards to protect data. They encrypt data on their servers. So, what is/are the "...
1
vote
2answers
191 views

Hashing Algorithm Integrity Validation

I am developing an application that will need to store a very large volume of hashed data per user for which I want to ensure I am doing everything possible to maximize security. At this point I ...
3
votes
1answer
180 views

How do you represent a compressed point on an elliptical curve over F2m?

I understand for prime curves it is just bytes(0x02 + flag) + bytes(x) where flag is the LSB of y. For the F2m curves I ...
1
vote
0answers
95 views

What are the best practice, and standard tools for blinding algorithms?

I'm developing an app that uses blind signatures. I'm having a hard time finding tools, and best practices for blinding. There is no PKCS. And everywhere I go, I find caveats of different blind ...
10
votes
3answers
338 views

What's up with unnamed elliptic curves in e-passports?

At my work I deal with the cryptographic aspects of the international E-Passport specification (the crypto chips embedded in your passports, the kiosks at airports that talk to them, and the ...
2
votes
1answer
153 views

Where in FIPS documents stated that SHA-1 is not secure?

SHA-1 is not secured for a very long time, but I still can see it here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf Where in FIPS documents stated that SHA-1 is not secure?
6
votes
1answer
2k views

What is the major difference between FIPS 186-2 and FIPS 186-4?

Can anyone please tell me the major difference between FIPS 186-2 and FIPS 186-4? I know with FIPS 140-2 they want the DSS standard to be FIPS 186-4, but what difference does it make?
1
vote
0answers
104 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
15
votes
2answers
2k views

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ...
1
vote
0answers
165 views

Encrypting/Decrypting using RSA and AES; standards?

I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo code the actions taking place are like this: Alice's actions for sending a secret, ...
15
votes
4answers
2k views

EC Schnorr signature: multiple standard?

I 'm working on some EC-Schnorr signature code. Reading various papers on that, it's seems EC-Schnorr is not standardized as well as ECDSA. For example, I found two main differences in two main ...
4
votes
2answers
2k views

What does the TLS 1.2 client finished message contain?

I am implementing TLS 1.2 and I'm stuck on the client finished message. My question is: what is the size and structure of a clients finished message in TLS 1.2 when using the ...
0
votes
0answers
83 views

Key size limitations due to software compatibility?

At the moment, much popular encryption-based software routinely handles up to 4096 bit keys and standard usage is broadly migrating from 1024 to 2048 bit keys. Hashes widely used are MD5/SHA1/SHA256 (...
4
votes
3answers
516 views

Homomorphism and Zero Knowledge in FIPS 140-2 compliant systems

I am analyzing a system that needs to be at least level 3 FIPS 140-2 compliant. The system may leverage from homomorphic and Zero Knowledge constructs, but, as far as I can see, the algorithms ...
2
votes
1answer
75 views

Can one passively load-balance HTTPS traffic based on TLS SNI?

Is it theoretically possible to passively snoop into the HTTPS traffic, reliably detect whether or not TLS SNI is attempted to be used by the client, and, if it is, redirect the stream of the ...
3
votes
1answer
255 views

What is the canonical way of creating Merkle tree branches?

I'm currently looking into creating some compact Merkle tree branches to prove that a given hash was included in a given Merkle root. My initial thought was to list the leaf, the Merkle root and all ...
1
vote
1answer
97 views

Where can I get the correct and precise algorithms for elliptic curve cryptography?

I have been asked to implement cryptographic operations using elliptic curves. I would like to get precise algorithms for various processes like key generation, digital signature and verification. I ...
15
votes
2answers
419 views

Is there a standardized tree hash?

SHA-1, SHA-2, and the standardized version of SHA-3 are all sequential. This is impractical for hashing very large files distributed across machines. Any sequential hash can be straightforwardly ...
1
vote
1answer
80 views

Is there a standard prefix random padding scheme?

Is there a standardized padding scheme which is prefix instead of postfix and that uses random bytes except for the first byte which would be the length of the padding?
1
vote
1answer
188 views

Clarification of RFC2246 with regards to Finished Message

I'm working on a client handshake finished message for a TLS client, and I'm reading through the RFC 2246 spec. The spec states (in section 7.4.9): The hash contained in finished messages sent by ...
6
votes
1answer
2k views

Standard format to encode AES cipher and random IV

As far as I understood, a secret key (same length as CBC block size) and an initialization vector (IV) are needed to decrypt a AES-256-CBC encrypted string. As the IV should better be random, it has ...
6
votes
2answers
388 views

Is standardizing a modified AES a good idea?

"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of"A New Encryption Standard of Ukraine: The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper ...
4
votes
4answers
2k views

Source for PKCS#11 Header Files

Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there ...
0
votes
1answer
329 views

What does the acronym “CRT” stand for in the PKCS #1 specification?

What does the acronym "CRT" stand for in the PKCS #1 specification? Does it stand for "Chinese Remainder Theorem"? Thanks, Pete
6
votes
1answer
105 views

Would key stretching help mitigate concerns with “verifiably random”?

Daniel J. Bernstein (and others) have expressed concern over how "verifiably random" curve parameters are generated. He points out that hashing a public seed doesn't prevent, say, the US government (...
1
vote
1answer
2k views

How to create a PEM file for storing an RSA key?

I have an RSA private key $\{d,n\}$ and a public key $\{e,n\}$, where $n$ is the modulus, and I also have the prime factors $p$ and $q$ of $n$. I want to create a PEM file containing this information,...
2
votes
0answers
152 views

Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate ...
6
votes
2answers
902 views

BER or DER X9.62 for ECDSA signature

The signature format for ECDSA signatures can be encoded using ASN.1 integers according to X9.62 or it can comprise of two integers with the same size as the key size. In case the X9.62 format is ...
4
votes
1answer
881 views

What weaknesses in Hash_DRBG did NIST find and fix?

Matthew Green states in the Practical Kleptography presentation (video, at about 12:15) that Hash_DRBG (from SP800-90A) as originally proposed by NSA had potentially exploitable flaws or bugs and that ...
4
votes
2answers
413 views

PGP String-to-Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
5
votes
2answers
2k views

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
2
votes
2answers
404 views

Password-based encrypted key storage?

RFC 5959 specifies the encrypted storage of private keys based on PBKDF2-HMAC-SHA-256 and AES encryption (in ECB mode). Is there a particular reason AES is used, instead of simply XORing the key ...
20
votes
5answers
3k views

How useful is NIST's Randomness Beacon for cryptographic use?

NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...