All Questions
18,380 questions
3
votes
2answers
151 views
Is forward secrecy overhyped or necessary?
Forward Secrecy, also perfect forward secrecy, gives assurance about session keys even the private key is compromised. This is achieved by generating a random key per session without using a ...
-1
votes
0answers
30 views
Is simple EC arithmetics enough to construct security proofs?
Using the simple rules of modular arithmetics for Elliptic Curves, including associative and commutative rules for $+$ and $*$, where uppercase letters are points and lowercase are scalars on the ...
-2
votes
1answer
46 views
Method for generating random number(s) [closed]
I was reading about random numbers and their usage in security. I'd like to verify with more experienced people how good this method of generating random numbers will be.
Human beings are very hard ...
6
votes
0answers
60 views
Offline Group Key Agreement - Cross Device Syncing
I have a specific use case I am interested in. I have spent the better part of the night reading research papers. I am beginning to believe what I want is not possible so I wanted to confirm here.
...
-1
votes
1answer
38 views
What is the difference between Forgery and Chosen-Message Attacks?
I did some researches about forgery attack and chosen-message attack.
For me, forgery attacks are more focused on the verifiability whereas chosen-message attacks are similar to brute-force attacks.
...
2
votes
1answer
45 views
Niederreiter cryptosystem
I can't understand how Niederreiter cryptosystem
works. If $c=mH^{'T}$ than why we cannot compute $m$ directly by multiplying $c$ with the $(H^{'T})^{-1}$? Can you give me an example of a "fast ...
0
votes
1answer
95 views
Is LibreSSL affected? - Downgrade Attack on TLS 1.3
https://news.ycombinator.com/item?id=19111707
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/
No ...
1
vote
1answer
62 views
Implement Google Adiantum else where?
Google made the headlines with its new Adiantum encryption method, and i read (TechCrunch) that:
In the meantime don’t expect any instant gains, but future low-power
devices may offer better ...
0
votes
0answers
55 views
Is RSA in decline across the board?
From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA.
Is this the general case?
-1
votes
1answer
51 views
Is a hash more or just equally representative of the first [hashlength] bytes of the hashed one-time pad?
[Clarification edit further down.]
To distinguish already existing one-time pad files by their content instead of just their name ...
... is hashing meaningful? Or would the first X bytes (Length ...
0
votes
0answers
23 views
To get 128-bit security for RSA, the modulus should be 4096 bits. How was that determined? [duplicate]
My understanding of security level is that for a crypto scheme to have n-bit security means it would take $2^n$ operations to break it.
For something like AES with a 128-bit key, it's straight-...
15
votes
9answers
5k views
Is one-time pad encryption vulnerable when near identical data is sent many times with different OTP?
Let's assume a text file that grows at its very end but is otherwise not edited. We now have 100 transmissions of this, but OTP-encrypted (different OTP each time, of course). The first 50% of the ...
0
votes
1answer
23 views
Using key derived using HKDF or NIST sp800-108 with AES-CCM/GCM
Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be ...
3
votes
2answers
319 views
Encrypting between nodes that have RSA keys: Diffie-Hellman or random secret key?
I have two peers with RSA keys; they want to encrypt a non-trivially sized message between them, so I want a random AES symmetric secret key, which is encrypted with Bob's public RSA key, and sent ...
-1
votes
1answer
44 views
If I hash ABC123, where ABC123 appears five times inside the file, will each of the five instances of ABC123 appear as identical hash values? [closed]
If I hash the word SOUND, where the word SOUND appears five times inside the file, will each of the five instances of SOUND appear as identical hash values?
0
votes
1answer
71 views
Storing passwords in a publicly available database
I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them.
In the browser, ...
1
vote
0answers
55 views
Participant workflow in the Cryptography competitions [closed]
I learned about the NIST hash function competition which generated SHA3. It says it inspired a Password hashing competition too, which resulted in Argon2.
What I'm wondering is what people generally ...
-1
votes
0answers
48 views
Finding $P$ when we know $2\times P$ in given Elliptic Curve [duplicate]
For a given elliptic curve $E$ like this $y^2 = x^3 + Ax + B \pmod p$, can we find the point $P$ if we know that the $Q = 2\times P = (a, b)$?
For example $E:\ y^2 = x^3 + x + 1 \pmod {10007}$, we ...
0
votes
1answer
38 views
How can I verify certificate signature algorithm in TLS 1.3 using PSS?
I've read this post but I'm still unable to understand some things.
I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
-1
votes
1answer
72 views
Original papers for hashing functions
I would like to learn how hashing functions are discovered / created. In part of this process I think it would be helpful to see the original works or papers of any authors of cryptographic or non-...
2
votes
0answers
43 views
Adding new share (Shamir Secret Shares ) [duplicate]
I am using this https://github.com/gburca/ssss-js Shamir implementation. I generated 4 shares from secret (threshold of 2).
I am wondering if I can recreate (interpolate) original polynomial from ...
3
votes
1answer
49 views
What is the purpose of an Authentication Tag in AEAD encryption schemes?
AEAD encryption schemes produce something referred to as an "authentication tag." What does this tag consist of, what is its purpose, and is the tag itself human-readable data such as a plaintext ...
1
vote
0answers
24 views
Witness-Extended Emulation
I am reading up on Sonic: Zero Knowledge SNARKS from Linear - Sized Universal And Updateable Structured Reference Strings.
An excerpt:
For soundness, we do not use the standard definition of ...
2
votes
1answer
39 views
How to identify RSASSA-PSS from rsaEncryption OID?
Following the RFC 8446 it states that:
RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using
RSASSA-PSS [RFC8017] with mask generation function 1. The digest
used in ...
2
votes
1answer
40 views
Amplifying PRF Advantage
I am trying to solve this question and I have no idea how to find the value for $q$. I know that I am supposed to find the probability of $q>3q/512$ in terms of the equation $q$, but not sure how?
...
3
votes
1answer
42 views
What does 2-flat mean when discussing APN permutations?
I am currently reading a research paper that uses the term 2-flat. However, I don't understand what this term means.
For example, the paper mentions in its definition of APN that for all distinct $a$,...
0
votes
1answer
71 views
The meaning of formal and semi-formal in cryptography
The question is about "formal" analysis, proofs, etc... What is a correct definition of a formal proof, or a formal analysis? Is there a good way and a bad way to formally prove something. What is the ...
3
votes
1answer
153 views
Diffie-Hellman private key recover with non-prime modulus
Say we have a classic Diffie-Hellman key exchange. We have the following parameters of a public key:
p,g,y
Where $p$ is the modulus, $g$ is the base, $y$ is the ...
6
votes
1answer
119 views
Distinguishing generators of RSA primes and moduli
We are trying to distinguish two RSA prime generators:
Prime generator 1
draw uniformly at random an integer $p$ with $2^{1023.5}<p<2^{1024}$, until it is prime
output $p$.
Prime generator 2
...
5
votes
0answers
69 views
Does a masked look-up table prevent cache timing attacks?
When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
2
votes
1answer
56 views
Find hash and signature algorithms used in an X.509 certificate signed with RSASSA-PSS
I'm trying to understand the new PSS scheme, but having trouble figuring out how to parse it properly.
When receiving a certificate with OID of RSASSA-PSS, how can I know which hash and signing ...
0
votes
0answers
50 views
Could be generated a symmetric key for every message?
I would like to use IES (x25519 and AES-GCM), but every message used a new session key, does that affect the performance of the system?
do I need to used session key to refer to the key that used by ...
0
votes
0answers
13 views
Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security? [duplicate]
In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...
-1
votes
0answers
50 views
Prove that if a SES is statistically secure then it is computationally secure as well
Statistical security definition has a condition that the adversary is not computationally bounded which makes it stricter than Computational security but how would one mathematically prove it using ...
1
vote
1answer
44 views
How is overflow handled in word addition steps in Salsa20?
I feel like I'm completely missing something there. The quarter-round proceeds as follows:
...
3
votes
2answers
2k views
Example of cryptography random number
I read that random numbers are being used in cryptography and security. I think I have idea how to truly generate true random, non-deterministic number. But before continuing further I'd like to ask ...
0
votes
1answer
36 views
What is the difference between static and dynamic tokens?
First, what is the difference between hardware and software tokens?
Tokens are "what you have" for example a car key or a chipcard. This would be (I think) hardware tokens? But what are software ...
1
vote
1answer
75 views
Is it safe to send IV in plain text for every request?
Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
1
vote
1answer
51 views
ZK due to rewinds, why we need poly number of rewinds?
I've been looking into rewinding techniques for proving ZK and got a bit confused.
This answer is good, but I still have questions about challenge size and the number of rewinds.
Consider an ...
2
votes
1answer
48 views
Emphemeral key creation from a long term shared secret (without DH)
Assuming I cannot use DH scheme, and the long term key is known to both sides, is there a known algorithm / standard that defines how to derive a short term key from a long term key?
1
vote
0answers
28 views
Rewinding Argument and Forking lemma
In Dan Boneh's crypto book, there is a section describing the "Rewinding Lemma", however I cannot find it explained in other sources on the internet.
How does this differ from the forking lemma?
4
votes
2answers
490 views
How can I hash an input into an arbitrary domain point?
I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest ...
4
votes
1answer
473 views
Is there a feasible preimage attack for any hash function (no matter how deprecated) today?
Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack?
All hashes that are nowadays considered 'broken' (...
0
votes
1answer
124 views
What's an entropy measure for the sequence $0, 1, 0, 1, 0, 1, …$?
I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting $0, 1, 0, 1, 0, ...$ and having the maximum entropy as given by $E(S)$. Shouldn't $E(S)$ measure ...
0
votes
0answers
27 views
Mitigating leakage of asymmetric encryption scheme leaking the length of plaintext
Asymmetric encryption schemes do leak something about the encrypted plaintext: the length of the plaintext. How can this be mitigated?
My solution: Padding the plaintext with some string of the ...
0
votes
0answers
24 views
How the ciphertext generated within a CP-ABE scheme is structured?
In ciphertext policy attribute based encryption 1 we use a tree structure with different keys into order to access attributes and the attributes are embedded to the ciphertext.
Could you please let ...
-1
votes
1answer
101 views
How to change hash checksum of a text file without changing the contents in the file
I have created a text file called test.txt and the content of the file is Hello World
I would like to change the SHA checksum hash without modifying the contents and filename. Is there any way to do ...
3
votes
0answers
52 views
1-digit MAC with error-catching properties?
The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
0
votes
0answers
23 views
Data masking / Data obfuscation for string int float and date , preserving order and exact matches
I've to mask data into some different value but to keep their property such as order an exact match (substring is yet impossible)
What's the state of the art in data masking? I've some data on which ...
6
votes
1answer
244 views
Does Format Preserving Encryption have significant advantages over a randomly generated lookup table?
I have a need to anonymise phone numbers so that I can carry out testing and analysis work on telecoms data sets and comply with GDPR. I typically receive a batch of a few hundred thousand events ...