All Questions

0
votes
2answers
63 views

SHA1 calculation for millions of strings having common prefix

I have a function in which I need to calculate SHA1(common_prefix + random_string). I am calling this function many times so that calculation of SHA1 slows down the performance of the function. As for ...
0
votes
0answers
28 views

Additive differential probability

I am studying about additive differential probability. And I show a paper that is V.Velichkov et al., The Additive Differential Probability of ARX. I have a question in chapter 5.2. V.Velichkov et ...
2
votes
1answer
49 views

What is the difference between the 23 bi-affine and the 39 fully quadratic equations of the rijndael sbox?

In Cryptanalysis of Block Ciphers with Overdefined Systems of Equations Nicolas Courtois and Josef Pieprzyk define 23 so called bi-affine equations (in Appendix A of the paper) between the input x and ...
6
votes
1answer
2k views

What does the symbol $W_t$ mean in the SHA-256 specification?

I'm really confused about the computation about SHA 256. $$W_t = \begin{cases} M_t^{(i)} & 0 \leq t \leq 15 \\ &\\ \sigma_1^{256}(W_{t-2}) + W_{t-7} + \sigma_0^{256}(W_{t-15}) + W_{t-16} &...
0
votes
1answer
38 views

Additive Differential of XOR

I'm studying about Additive differential of XOR I saw two papers that are "H.Lipmaa et al., On the Additive Differential Probability of Exclusive-or" and "V.Velichkov et al., The Additive ...
2
votes
1answer
34 views

Does the AES-KW (Key Wrap Algorithm) perform authenticated encryption?

The RFC for AES-KW doesn't actually mention authentication, only integrity, where the unwrapping/decryption process should produce an identical IV of ...
0
votes
1answer
52 views

One-Time Pad Vulnerabilities [duplicate]

Why is it that a one time pad is vulnerable is the key is shorter than the message? I know that if a key is reused across multiple plaintexts, you can XOR two existing ciphertexts to get the pad, but ...
1
vote
0answers
55 views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
0
votes
0answers
28 views

What is a rank-1 constraint system?

Why not rank-2 constraint system or rank-3 constraint system? How do rank-1 constraint systems link to circuits?
0
votes
1answer
64 views

Codes of “SAS und Chiffrierdienst”

The german site "SAS und Chiffrierdienst der DDR" http://scz.bplaced.net has some interesting content under point 11.3 in the category "manuelle Verfahren" I found ciphers named from A to D. But I ...
0
votes
0answers
44 views

Are key files good authentication?

Let's say $p$ is the pool of files in a folder. And $k$ is the files in the pool that are "key files" for authenticating in a service. Note: The order of the key files matter. Then we have $c$ which ...
2
votes
0answers
15 views

Strategies for fast integrity attestation over multi party computation for large messages

I am looking for ways to efficiently perform integrity attestation over large messages using multi party computation. While, hashing (SHA1, 256...) is one alternative but it's painfully slow and grows ...
0
votes
1answer
55 views

The role of IV when AES is used as $PRF$

We want to use AES as a pseudorandom function. Given a random master key, we want to derive a set of pseudorandom values/keys, e.g say $n$ keys. Then from each of those derived keys, we want to derive ...
1
vote
1answer
34 views

Is chosen ciphertext attack used to obtain a key? [duplicate]

I don't understand what the goals are of a Chosen Ciphertext Attack. What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses. However, I ...
0
votes
1answer
53 views

Simple One time Pad Probability

We have a one time pad where: We have 8 bits. probability that a bit=0 is p. The key is common for all 8 bits. It can have a value of 0 or 1 with equal probability. After applying the XOR operation ...
1
vote
1answer
56 views

Cost of upgrading to PQCrypto

We already have recommendations on what PQCrypto to use: PDF (page 11) Symmetric encryption Thoroughly analyzed, 256-bit keys: AES-256 Salsa20 with a 256-bit key Symmetric ...
2
votes
0answers
48 views

Is this an error in the Pinocchio Protocol paper

I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which ...
1
vote
0answers
19 views

How to find efficient hardware implementation of sbox of lightweight block ciphers? [migrated]

Lightweight block ciphers are usually optimized for compact hardware implementations and sbox values are computed by implementing circuit using basic logic gates(AND, XOR, OR, NOR etc). What is the ...
0
votes
2answers
64 views

Is one time pad cipher reuse and random key secure?

The sender and receiver share two different secret keys: s1 and s2 both y bit values. 'x' is a randomly generated y bit value. The reader sends to the tag a challenge y = x ⊕ s1, and the receiver ...
2
votes
1answer
65 views

Formal definition of collision resistance for hash function

In my cryptography class, the professor said that collision resistance for a fixed hash function is not a "precise" definition. The reason is since a fixed hash function is a single instance of a ...
0
votes
0answers
8 views

What is the length of ciphertext for AES encryption using C#? [migrated]

From: Can we calculate AES ciphertext length based on the length of the plaintext? I see: output_size = input_size + (16 - (input_size % 16)) But this does not seem to correspond with what I see ...
-2
votes
1answer
39 views

What information can be gleamed by using a OTP twice with the same message?

So... C0 = K0 ⊕ M and C1 = K1 ⊕ M where K0, K1 are different random numbers. What information can you discern about the K0, K1 and M, if any? Could you use K0,K1 again with another different message ...
1
vote
1answer
35 views

HKDF: Difference between salt and info

I want to do generate individual AES keys for a number of smart cards, based on a random master key (key diversification) and the serial number of the card. According to the answers to this question ...
1
vote
1answer
84 views

Why does Carter-Wegman (and AES-GCM) use different keys for PRF and keyed-hash

So. As I understand, Carter-Wegman transforms a one-time MAC (which must be a difference unpredictable function (DUF)) by encrypting it with a PRF. The DUF and the PRF use two different keys, which ...
2
votes
1answer
74 views

Is a 2 bit one time pad just as secure as a 128 bit one time pad?

Obviously, it would be easier to stumble across the answer, but you still couldn't be sure it's correct. So it's still theoretically secure?
0
votes
1answer
36 views

Use exported certificate with private key to logon using Kerberos

First I just would like to mention, that my knowledge in windows authentification methods are very limited. So my question: Is it possible to use custom credential provider in windows to log on, that ...
2
votes
2answers
272 views

Any ideas to make an Electronic Voter Machine more secure? [closed]

EVMs are not secure they say. So how can we make it more secure tham the existing one using cryptography?
3
votes
2answers
62 views

In Diffie-Hellman, are $g$ and $p$ universal constants or are they chosen by one party according to a set of rules?

I can't find any clarity on this. In textbooks, what I'm reading suggests there's already a standardized $g$ and $p$ that everyone uses, but I can't find what they are. The closest I've come to is ...
2
votes
2answers
76 views

Is OTP with homomorphic encryption trivial?

If my key size is as large as the data I'm encoding, is it trivial to devise a theoretically secure homomorphic encryption scheme for integers (or else any finite/infinite group with order) that ...
2
votes
1answer
39 views

Encrypt challenge instead of storing it on the server

My server and my smartcard (MIFARE DESFire) want to establish that they have the same shared AES key. They want to do that with an untrusted client in the middle. Usually it works like this: Now ...
0
votes
2answers
115 views

What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message

A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server. The financial information will be stored as plain text on the ...
0
votes
1answer
60 views

How should one refer to the smallest remainders generated by a modulus within DH or DLP?

It's my understanding that the integer base and exponents chosen to create the initial public keys in DH are from the remainders of a modulus. For example, if the value of the modulus is $N=11$, a ...
2
votes
2answers
214 views

How to prove that finding a cycle in a cryptographic hash function is hard?

I want to show that finding cycles in a cryptographic hash function is hard. My thought: assume there a black box, that given a cryptographic hash function $h$, finds some $x$ and $r$ in polynomial ...
0
votes
0answers
24 views

Is there a way to make a non-specific algorithm to decypher substitutions with “anti-frequency analysis” measures?

There's a code I'm trying to decypher. What I know is that it's a simple substitution, with just a few added rules intended to make frequency analysis and other super classic method a little less ...
2
votes
2answers
106 views

Would a HMAC digest make sense in an RSA / ECDSA signature?

When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
0
votes
1answer
71 views

How 'safe' is a 12-digit alphanumeric key?

To Access my data over a Portal i got a 12-digit alphanumeric key like: VGW8-U98T-TXLV How safe is this key? I don't want to know the chance to win with brute force. I want to know there are several ...
2
votes
0answers
64 views

Is AES resilient to chosen plaintext with access to related keys (key expansion primitives)?

I'm interested in knowing whether a cryptosystem is broken given access to a few primitives. $\DeclareMathOperator{\KEYEXP}{KEY\_EXP}$ $\DeclareMathOperator{\E}{E}$ Suppose that you have access to an ...
1
vote
0answers
36 views

Does the Richard Sorge cipher still provide good security?

Is the cipher used by soviet spy Richard Sorge still sufficiently secure nowadays?
3
votes
0answers
41 views

Effect of block size on diffusion rate

I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The ...
0
votes
1answer
43 views

How secure is Firestore / Google Cloud server-side encryption?

We use Firestore. On their Google help page they say it is AES encrypted. https://cloud.google.com/firestore/docs/server-side-encryption But this means in the moment a user is logging in, the data ...
7
votes
1answer
164 views

How did I get a nonuniform distribution of UUID4s across MD5 space?

We have a system that processes data. Each entity has an ID that is generated using uuid4() in Python. Later, that ID is used as a partition key for AWS Kinesis. ...
1
vote
0answers
40 views

Reversing Diffie Hellman from the secret

This is a homework assignment that's been giving me some trouble: By eavesdropping on a Diffie-Hellman key exchange, we observe modulus $p$ the base $3$ $A\ =\ 3^a \bmod p\quad$ and $B\ =\ 3^b \...
2
votes
1answer
49 views

NIST STS incorrect results for sample files

So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ...
2
votes
1answer
88 views

NIST security categories (post quantum)

Here (https://www.safecrypto.eu/pqclounge/round-2-candidates/) are collected all the proposals which passed the first round of NIST Post-Quantum Cryptography Standardisation process. What does the ...
2
votes
1answer
71 views

Using a KDF (PBKDF2) properly

I am new to crypto. I have a password for my user, e.g. &&38:while:HAVE:havana:60&& I want to encrypt several documents with 10 pages each with AES....
2
votes
1answer
83 views

Disjunctive zero knowledge proof of equality of committed values

I have read on ZK proof of equality of committed values, that is for $g^xh^y$ and $g^{x'}h^{y'}$, prove in ZK that $x = x'$ (can also be generalized if generators are different using sigma-protocols). ...
0
votes
1answer
53 views

How to find a triple of keys that maps plaintext to given cipherext using EDE

What is a practical method for for finding a triple of keys that maps a given plaintext to a given ciphertext using EDE? I think this requires something similar to a man-in-the-middle attack...
0
votes
1answer
29 views

Difference between Identity-based encryption and multiple key-pairs of public key encryption?

What is the difference between Identity-based encryption and multiple key-pairs of public key encryption scheme?? Suppose trusted key generator generates a bunch of public and private key pairs $(k_{\...
-1
votes
1answer
49 views

Brute forcing/hacking Secure passphrases - difficulty for random strings vs real words

I was wondering about this topic of brute forcing passwords,or ANY other way to deriving them - and asking myself whats more secure (relatively): A Password which includes A) 30 digits length- a ...
0
votes
0answers
19 views

Difference between double unilateral authentication and bilateral authentication?

What is the difference between applying bilateral authentication once and applying unilateral authentication twice?

15 30 50 per page