All Questions
30,416
questions
5
votes
1
answer
237
views
State level "Weak Diffie-Hellman" working for SRP too?
I've read about the "Weak Diffie-Hellman" attack (paper, website), where a resourceful entity like a state can pre-compute values for known primes to aid solving the discrete logarithm ...
- 153
1
vote
0
answers
556
views
Solving Vigenére with unknown alphabet
I'm trying to decrypt a cipher that I suppose has been encrypted with Vigenére.
However I came about the following thought:
The cipher consists of characters from [...
- 93
2
votes
1
answer
432
views
Proving the security of a one-way function with partially known input
Let's say we have a construction like in this question: We have a OWF $h(.)$, a secret salt TXT, and a counter starting at 1, and we compute
...
- 1,431
0
votes
0
answers
108
views
Number of qubits and breaking hashes [duplicate]
Noting D-Wave's press release on a 1000 qubits quantum computer had me wondering...
Does the number of qubits nonlinearly change the speed/rate at breaking a SHA256 hash?
If someone makes a say 10,...
- 461
2
votes
1
answer
61
views
Data Switching and Information Leakage
Hypothesis: Let $z,a$ be uniformly random elements of a field $\mathbb{F}_p$ where $p$ is a large prime number. Also, let $(-z)$ be additive inverse of $z$.
I have a fixed secret value $x$. I mask it ...
- 1,583
4
votes
1
answer
1k
views
Deciphering “easy” ciphers without hints
I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic encryption/...
- 93
0
votes
1
answer
521
views
Why does TLS 1.2 use GCM with additional SHA hash? [duplicate]
I am studying the cipher suites provided by TLS 1.2 and found an interesting question.
TLS 1.2 adopts GCM for encryption and SHA256 or SHA384 for hash (e.g. TLS_RSA_WITH_AES_128_GCM_SHA256). But, GCM ...
- 11
0
votes
0
answers
351
views
Values of p and q when e = 3 (RSA)?
I am doing a paper on textbook RSA (this is for high school btw) and in my example I need two very large primes, but I want my $e = 3$.
Is there a short way to calculate the values of $p$ and $q$ ...
- 389
2
votes
1
answer
4k
views
SHA256: Padding a 512 bits length message
I am currently implementing the SHA256 hash-algorithm for a "custom-built" embeded-device. Obviously I have a problem with message padding. The routine I wrote does not work with message whose size ...
- 155
4
votes
3
answers
4k
views
HMAC key storage for a web app?
If one is going to use an HMAC, I.E: http://php.net/manual/en/function.hash-hmac.php, where exactly are they storing the key?
Without some sort of secure storage (i.e not in a local file or code), I ...
- 155
2
votes
1
answer
2k
views
Can a file encrypted with one tool be decrypted with different tool? [closed]
I'm new to cryptography and I'm trying implement a file encryption feature into a Python program but I'm running into a big issue...what is needed for someone else to decrypt the file?! Obviously, I ...
- 41
1
vote
1
answer
279
views
Properly storing an E-mail Password
I'm creating a messaging application that will use an outlook account to send an email. However, I'm unsure about the proper steps to store the e-mail password on the user's computer. Suppose I had ...
- 111
3
votes
1
answer
3k
views
RSA Signature Verification Implementation on Cortex M0
I have to implement RSA Signature Verification procedure (RSA-2048) on a Cortex M0 based MCU. My budget is 15kB Flash and 2-4kB Flash RAM.
Is it even possible to do RSA on a low end MCU based on ...
- 31
2
votes
1
answer
1k
views
Concrete example of Weil Pairing
I am trying to find a concrete example of the Weil Pairing.
What I have done until now is that I took $E=(x-1)(x-2)(x-3)$ over $F_5$.
I took $E[2]=\{\infty,(1,0),(2,0),(3,0)\}$.
I know that there ...
- 173
1
vote
3
answers
925
views
Adding dummy bytes to ciphertext
I was wondering if interleaving the resulting crypted data with dummy bytes placed at random positions but known in advance by the peers could improve security (no matter the algorithm and strength ...
- 235
5
votes
0
answers
112
views
Can cryptographically useful pairings only be used with elliptic curves?
As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve.
I was wondering if it is possible to construct pairings from general finite ...
- 173
2
votes
0
answers
268
views
Scale-Invariant DGHV Scheme - Decryption
I have just started reading the Scale-Invariant Fully Homomorphic Encryption over the Integers paper and I'm a bit confused about something:
When decrypting the ciphertext:
$c = r + (m+2r^*) \cdot \...
- 21
3
votes
1
answer
1k
views
How to clock a linear feedback shift register?
I have some trouble understanding what happens when a LFSR is clocked. I have tried many examples but I do not get the correct result. Can anyone point out my errors?
I have the following polynomial: ...
- 33
0
votes
2
answers
119
views
How hard to solve the given mod problem
Let c = a.b mod p
where p is n bit prime number (e.g. 128 or 160 bit prime number);
a - random number between 1 and (p-1);
b - random number between 1 and (p-1);
Given c, a and p, how hard to ...
- 9
1
vote
1
answer
209
views
Is there a standard prefix random padding scheme?
Is there a standardized padding scheme which is prefix instead of postfix
and that uses random bytes except for the first byte which would be the
length of the padding?
- 385
3
votes
1
answer
530
views
Is there any benefit of changing the AES-CCM encryption key periodically even if the Nonce space is not exhausted yet?
I would like an answer that could be sustained by a mathematical proof.
Let's say I'm using AES-CCM to encrypt a lot of messages, and I always use a different nonce.
I know that when the nonce space ...
- 183
4
votes
1
answer
145
views
Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme?
Let's assume we have a message $M$ and it's signature $S$ and that $|$ is
the concatenation operator.
Should we encrypt $S|M$ or $M|S$?
Does it even matter?
- 385
0
votes
1
answer
124
views
How can I turn this cipher into a perfect cipher by altering only its encryption algorithm?
Given a toy cipher that picks a key, k, from the key space of {00,01,10} and a message,m, from the same set {00,01,10} and encrypts using E = m ⊕ k.
How can I change the encryption function E in ...
2
votes
1
answer
2k
views
What is required to decrypt an encrypted file?
At the risk of sounding stupid and being laughed at...I must ask this question. What is required to decrypt an encrypted file? Obviously you need the appropriate key to decrypt, but is any other ...
- 41
0
votes
2
answers
625
views
The benefit of PBKDF2 for big keyfile?
The man page of cryptsetup says:
Whenever a passphrase is added to a LUKS header (luksAddKey,
luksFormat), the user may specify how much the time the passphrase
processing should consume. The ...
- 103
5
votes
1
answer
3k
views
Given a linear block-cipher,how can an attacker decrypt any plaintext value encrypted,using 128 chosen ciphertexts
Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$
$$\operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, p_2)$...
2
votes
0
answers
46
views
Raw /dev/random output for keymat [duplicate]
Noob question:
It is my understanding that the raw output from
non-blocking /dev/random (where the kernel's entropy_avail estimate is equal to or greater than the number of random bits required)
...
- 21
4
votes
2
answers
2k
views
Very short signatures? (eg: 48bits?)
Our application requires some 'mild' form of 'proof of origin' for the tokens we issue (~200 bytes), however, the value of each is trivial.
The requirement is to provide 'tamper resistance' rather ...
10
votes
1
answer
9k
views
ECDH or RSA more secure for symmetric key wrapping?
Suppose a message is encrypted with a symmetric block cipher with a random key. RSA is often used to wrap the symmetric key using the recipient's public key.
In this case, the size of the message is ...
- 417
1
vote
3
answers
558
views
Does a padding oracle have the encryption key? Where in real life do I see such an oracle?
So after some searching, I kinda know the attack procedure of altering bit by bit. But I'm still confused how this is possible. If I understand it correctly, the attacker never has the key, or tries ...
- 197
0
votes
1
answer
29
views
Why many passes at file removal? [closed]
Why file removal tools offer gost 2 passes and British 3 passes or even gutman 35 passes options? In which case the single pseudo random pass is not enough?
- 101
5
votes
0
answers
431
views
Using a product of a series of curve25519 scalars as a private key [duplicate]
There are a few systems like the GNU Name System and the Sphinx mixnet packet format that employ a series of curve25519 scalars all multiplied together as a private key.
Are there any caveats to ...
- 1,116
4
votes
3
answers
2k
views
For any hash value, is there an infinite number of inputs that hash to it?
Bruce Schneier writes (back in 2005) in a post on cryptanalysis of SHA-1:
SHA-1 produces a 160-bit hash. That is, every message hashes down
to a 160-bit number. Given that there are an ...
3
votes
1
answer
3k
views
Testing hash functions for collision resistance
I was hoping to implement a software that allows testing a user-defined hash function for cryptographic properties (Meant to pique interest in cryptographic hash function for a school showcase), as ...
- 51
1
vote
2
answers
14k
views
MD5 Collision Attack Explained
In one of my assignments, I came across this:
Due to MD5’s length-extension behavior, we can append any suffix to both messages and know that the longer messages will also collide. This lets us ...
- 231
7
votes
1
answer
693
views
Encoding scalar values to points on Ed25519
I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519.
...
- 171
4
votes
2
answers
826
views
Weakness of SRP after server compromise
From SRP section 3:
The host stores user passwords as triplets of the form
{ <username>, <password verifier>, <salt> }
Password entries are ...
3
votes
1
answer
97
views
Weaknesses of RFC6628
In RFC6628 section 2.2, they say:
w = The password remembered by the user.
W = The password verifier registered in the server. <...
6
votes
1
answer
4k
views
Is it possible to find a Mersenne Twister seed given only the first output?
Suppose I have a Mersenne Twister seeded with some unknown value, and I’ve been given the first output. Given only this first output, and no other information, is it possible to derive the unknown ...
- 163
3
votes
1
answer
251
views
Can homomorphic decryption of DES be practical?
I was reading this paper Homomorphic evaluation of the AES Circuit by Gentry et al. when I thought if something similar can be done with DES or 3DES, e.g. it is plausible to decrypt DES ...
- 223
4
votes
1
answer
375
views
Effect of message length on collision attacks
I know that message collisions are supposed to be hard to calculate for a good cryptographic hash.
Given 1k worth of data, it's hard to find another 1k worth of data that collides with the same hash.
...
- 141
6
votes
2
answers
560
views
What is the complexity of finding SHA-1 collisions?
Given the recent news about SHA-1 collisions, what is the complexity of finding a SHA-1 collision?
Marc Steven's HashClash is still detailing about 260. Does the previous complexity still hold?
user10496
4
votes
1
answer
250
views
Are HTTPS web sessions non-repudiable?
(This is probably a basic question, and may be a duplicate; if so, just let me know.)
Suppose there are two clients A and B, ...
- 143
9
votes
3
answers
5k
views
Can an ephemeral RSA key give forward secrecy?
Suppose party A generates an ephemeral RSA key and sends the public key to B. Party B then generates a symmetric key, encrypts it with Party A's public key and sends the Ciphertext to Party A. Party ...
- 241
5
votes
1
answer
530
views
Avalanche effect sample size
With a fixed key size – key has 128 bits, while block size is 8 byte – how do I calculate how many different keys and texts I have to test for an cryptanalytic statistics study?
Differently worded: ...
3
votes
1
answer
283
views
Are there full cycle cryptographic/one-way hash primitives?
I'm looking for behavior similiar to that of LCGs, (i.e. input and output sizes are same). Full cycle of $2^{32}$ different inputs generates full cycle of $2^{32}$ different outputs, distribution of ...
- 173
2
votes
1
answer
726
views
Inverting One-Way Functions
One of the conditions that a one-way function has to satisfy is the following:
$$Pr[A(f(x))\in f^{-1}(f(x))] \leq negl(n)$$
Now, suppose that we have the following function that's not one way:
$$f(x)...
- 71
1
vote
1
answer
162
views
Encrypt hash using hash of hash?
I wonder what is wrong with this scheme for authentication.
Server sends random challenge, C
Client returns (C, B(P)) encrypted in H(B(P)) where B(P) is high work factor salted hash of the user ...
- 167
5
votes
2
answers
577
views
What is the notion of an interactive assumption?
In this paper: Sequential Aggregate Signatures with Short Public Keys: Design, Analysis and Implementation Studies the authors sell the paper as the first who propose Aggregate signatures without ...
- 6,160
1
vote
1
answer
766
views
PKCS5 having no padding?
I am using the javax.crypto.Cipher in Java to do AES/CBC/PKCS5Padding encryption. What I am observing is that, if you try to encrypt a Plaintext with no padding, PKCS5 adds another entire block just ...
user28238