Hot answers tagged

90

First, you're taking the question backwards. Inertia is the default position. You shouldn't be looking for reasons not to switch, but for reasons to switch. If there are no strong reasons to switch, nobody will switch. Security is not a reason. Between SHA-2 and SHA3, there is no reason to believe that one is more secure than the other. It isn't like when ...


14

Since this question is asking about opinions, it's hard to give the correct answer (alternatively, all possible answers are correct, because they're an opinion). However, my opinion: I believe that there are several aspects contributing to it: Most application designers (that is, the people who use crypto to actually solve a problem) generally don't ...


8

If you are seeking a government contract with China, you might be required to use Chinese government standards for cryptography, just like if you are seeking a government contract with the United States, you might be required to use United States government standards for cryptography. There are many national pride cryptography standards that have little ...


7

All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an unpredictable IV in the case of CBC. Only authenticated modes can achieve message integrity / authenticity. Others are all vulnerable because changes to the ciphertext ...


5

A copy and paste from page 16 of NIST document Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process; Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for key search on a block cipher with a 128-bit key (e.g. AES128) ...


3

I would like to know whether a specific PRNG satisfy the next-bit test or not. That requires analyzing the design of the PRNG. Will satisfying all of NIST statistical tests on PRNG guarantees passing the next-bit test? No. The NIST statistical tests are intended to test an implementation of a RNG. They are next to useless to tell if a PRNG is good or ...


3

A group if a set of elements and some operation that satisfy some requirements. This operation is usually called "addition" or "multiplication", depending on the group, even though it may not be actually the classic addition or multiplication. The integers $0 < x < p$ for some prime $p$ form a group under the modular multiplication operation (multiply ...


3

Here is what's likely going on: Charm represents Elliptic Curve points in affine coordinates, that is, explicit (x, y) values When doing a single point addition, OpenSSL adds the two points (internally coming up with a point in projective coordinates) and then converts them back into affine coordinates. Then final conversion involves a modular inverse ...


3

Are there any standard curves which support pairings? No, there are currently no pairing-friendly NIST curves; NIST has not announced any plans to approve of either a pairing-friendly curve, or any cryptographical operation that involves a pairing operation.


3

This is essentially because the best known generic algorithms for discrete logarithm, e.g., baby step giant step, have complexity $$O(\sqrt{G})=O(2^{n/2})$$ where $n$ is the number of bits to represent the elements of the elliptic curve group $G$. If the eliptic curve group is carefully chosen, that is. So, avoid anomalous curves, for example.


3

If $M$ is a uniform random $l \times k$ matrix, then the random function $H\colon x \mapsto M \cdot x$ is a 2-universal hash family[1] (paywall-free: (a), (b)). This means that for any $l$-bit strings $x$ and $y$, $\Pr[H(x) = H(y)] \leq 1/2^k$. If $H\colon \{0,1\}^l \to \{0,1\}^k$ is a 2-universal hash family and the random variable $X \in \{0,1\}^l$ has ...


3

The one metric that generically matters in cryptography for a physical entropy source is the min-entropy: the exponent of the most probable outcome, in bits. This depends on the physics of the entropy source. As long as it exceeds 256, you can feed a sample through a typical preimage-resistant hash function such as SHAKE256, a conditioner, and you will ...


2

You are right that it is generally foolish to try to use AES-GCM for zetabytes of data under a single key. The standard ought to have clearer data volume limits. For a long time, the folklore understanding was that a non-collision in a CTR stream doesn't really leak all that much…until sweet32 demonstrated that it actually can be a real problem. Still, ...


2

Still, the new internal state starts with $E(K,V+1) || E(K,V+2) || ... $. There is where you are incorrect; the CTR_DRBG_GENERATE function updates $V$ while it runs, and hence the new internal state is actually> $E(K,V+n+1) || E(K,V+n+2) || ... $ (where the $V$ value is initial value of $V$ when generate is called, not when the update is called). ...


2

A partial answer is that the 2012 version of SP 800-90A included a fourth DRBG construction, Dual_EC_DRBG (§10.3.1.2), for which the security_strength parameter was required. Since one DRBG flavor required this parameter, to have a common interface, all DRBG flavors had to take this parameter. In Dual_EC_DRBG, security_strength is used only for one thing: to ...


2

This has been answered on the PQC forum. The question was asked by El Hassane Laaji: Hello NTRU team Can you say me, why you didn't keep the NTRUencrypt-1024 release, is it because of > speed performance or security performance. Best regards. The reply came from John Schanck: Thanks for your question. To clarify for others, the "NTRUencrypt-...


2

The source of confusion may be the following. Theoretically, since the work of Andrew Yao, it has been known that the next bit test is equivalent to pseudorandomness. Informally, a sequence generator is pseudorandom if and only if no polynomial time probabilistic algorithm can predict its next bit with probability strictly greater than $1/2.$ See the notes ...


1

Clearly the installation of health tests must come after the development of the entropy source. As part of that development, you'd need to assess the min.entropy of your new system under whatever sampling methodology you choose. And Min Entropy H comes out of that assessment. It is "the min-entropy of the samples from a (digitized) noise source or of the ...


1

440 and 888 are the maximal values of seed length, that, when concatenated with 1 octet, yields a input to SHA256 and SHA512 respectively, requiring only 1 invocation of the compression function. These values are fixed in such way that, it precludes the use of other hash functions, even ones approved as SHA3. However, if one wants, the above rule can be ...


1

Crypto randomness tests are suggested by Ali in his paper while validating SHA-3. His team also used NIST for randomness testing. For more infor: https://eprint.iacr.org/2010/611.pdf Thankyou everyone!


1

Mostly option 2. People are lazy. Furthermore, those using SHA-2 have no good reason to switch. Those using SHA-1 are lazy, and have been lazy for a while. Another reason is compatibility, If I use SHA3 in my certificate some software may not be able to use it, and if SHA2 is fast and as secure for all practical purposes why should I opt for the less ...


1

See the page below https://www.bsi.bund.de/DE/Themen/Kryptografie_Kryptotechnologie/Kryptografie/Zufallszahlengeneratoren/zufallszahlengeneratoren_node.html I looked at it with the Google translator. There are quite a few useful links there. If you want full blown code for tests, you'd probably need to write your own. Related question: https://security....


1

There is a couple of reasons one would want to do SP800-56A key derivation in real life scenarios. Computational and communication cost - while it's true that for each usage the two parties could negotiate a fresh Diffie-Hellman shared secret $Z$ and use it to derive a session key, usually this process is computationally expensive and requires communication ...


1

The good thing about standards is that there are so many to choose from. The P-192, P-224, P-256, P-384 and P-521 names come from the FIPS DSS (Latest version of which is FIPS 186-4): https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf The secp224r1, secp384r1 and secp521r1 names come from SEC2: https://www.secg.org/sec2-v2.pdf The prime192v1 and ...


1

There are a few steps involved in the design: 1. design a sigma protocol with special soundness. 2. transform the above sigma protocol to a nizkpok. 3. use the above nizkpok to prove the possession of x, such that F(0) = y, where y is the public key, x is the private key, F is an OWF. The encryption is a PRF used to sample an OWF. When talking about H(r,m),...


1

It is very likely that in practice this doesn't make much of a difference. I haven't seen any implementations in hardware devices of the more intricate modes (check the FIPS certification pages for info on this). Mostly the CTR mode is used, then the feedback mode. Many HSM's only implement one of the three, making all HSM's nicely incompatible to each other ...


Only top voted, non community-wiki answers of a minimum length are eligible