63 votes
Accepted

Why do 5G, 4G, etc., use non-conventional algorithms?

These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is ...
user avatar
  • 4,244
26 votes
Accepted

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

Is this number specified anywhere? It was formally specified in this RFC as the 1536 bit MODP group (although its use predates that RFC). However, from what I've seen, the 2048 bit MODP group from ...
user avatar
  • 134k
26 votes
Accepted

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private ...
user avatar
  • 134k
25 votes
Accepted

Why is the P-521 elliptic curve not in Suite B if AES-256 is?

The real question isn't "Why doesn't Suite B use P-521?" It is, "Why doesn't Suite B use AES-192?" NSA were only interested in 192-bit security for Suite B, but they chose to use AES-256 because AES-...
user avatar
25 votes
Accepted

Why did TLS 1.3 prohibit PGP authentication?

It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place): ...
user avatar
  • 85.9k
22 votes
Accepted

Finding flaw in cryptographic protocol

If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute. How about Finding a flaw in cryptographic protocol?! A protocol ...
user avatar
  • 19.2k
20 votes

Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

Is there any functional difference on how this process is conducted? One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and ...
user avatar
  • 134k
17 votes
Accepted

How are curve names constructed?

The prefix sec stands for "Standards for Efficient Cryptography" (per the eponymous group, in the sense of assembly of experts). Brainpool stands for the name of another assembly of experts. ...
user avatar
  • 125k
16 votes
Accepted

How did || come to be used in crypto texts to represent concatenation?

The origin is set theory and not programming languages. In the context of cryptography, I could describe a set that is $$x_1 \parallel x_2 \parallel \dots \parallel x_n$$ as a concatenation of the ...
user avatar
  • 4,244
16 votes

Is there a contingency plan in the event of a catastrophic attack on AES?

I'm not aware of any official NIST policy on the matter, so I can only make educated guesses. I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For ...
user avatar
  • 85.9k
15 votes
Accepted

What the X stands for in the front of Elliptic curve names like X25519

It is an open standard by IETF.org We can find the details in the mail archive of IETF, D. J. Bernstein's response; It has become increasingly common for "Curve25519" to refer to an ...
user avatar
  • 43.5k
14 votes
Accepted

Which cipher is used in the new 5G network?

Ericson's white paper lists them as The strong and well-proven security algorithms from the 4G system are reused. These are encryption algorithms based on SNOW 3G, AES-CTR, and ZUC; and integrity ...
user avatar
  • 43.5k
12 votes
Accepted

What's up with unnamed elliptic curves in e-passports?

I don't have any visibility into the BSI standardization process, and so this is a guess; I suspect one of two things happened: This is a potential way to deal with someone figuring out how to break ...
user avatar
  • 134k
11 votes

EC Schnorr signature: multiple standard?

Adding to other answers, I note that both schemes are related to (but clearly different from) those standardized in ISO/IEC 14888-3:2016 (non-functional preview): The BSI's EC-Schnorr original ...
user avatar
  • 125k
11 votes
Accepted

What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)

If you are seeking a government contract with China, you might be required to use Chinese government standards for cryptography, just like if you are seeking a government contract with the United ...
user avatar
10 votes
Accepted

What weaknesses in Hash_DRBG did NIST find and fix?

Please bear in mind that this information is all secondhand. I have not looked closely at the original drafts of Hash DRBG (although you might find a draft that's early enough if you peruse the FOIA ...
user avatar
10 votes

Why did NIST select Kyber and Dilithium?

NIST did consider the MATZOV attacks. If we read their Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process, we see in section 4.1.1 on page 29: During the ...
user avatar
  • 11.8k
9 votes
Accepted

Source for PKCS#11 Header Files

In May 2015, header files were uploaded to the OASIS PKCS 11 TC document repository by Dina Kurktchi-Nimeh that were versioned v2.40. However, they were uploaded to the "Working Drafts" folder. The ...
user avatar
  • 288
9 votes

How did || come to be used in crypto texts to represent concatenation?

Some languages like PL/I and Oracle Database SQL indeed use || for string concatenation. One reason is maybe that + might be ...
user avatar
  • 6,326
8 votes

Source for PKCS#11 Header Files

The PKCS#11 standard has transitioned from RSA to the OASIS group: https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=pkcs11 I am not sure why RSA/EMC's site doesn't mention this. I believe ...
user avatar
8 votes

Is standardizing a modified AES a good idea?

The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe. It's a bad idea! How much scrutiny has it received? Almost none. How much will it ...
user avatar
8 votes

EC Schnorr signature: multiple standard?

The $(r,s)$ version in theory is more secure than $(h,s)$. Bellare, Namprempre, Neven 2004 paper "Security Proofs for IBI and Signature Schemes" showed that Schnorr signature in the form of $(r,s)$ (...
user avatar
  • 91
8 votes
Accepted

Where in the FIPS documents is it stated that SHA-1 is not secure?

Much of what NIST publishes about cryptographic algorithms is in Special Publications. In this case it is SP 800-131 (pdf) where they describe transitioning away from old algorithms and key sizes. ...
user avatar
  • 31.3k
8 votes

What's up with unnamed elliptic curves in e-passports?

Political reasons likely wins. E.g. France has an own set of domain parameters. Note that when the spec was created that the Brainpool curves where rather new. Generating safe parameters is not ...
user avatar
  • 85.9k
8 votes

Notable Non-Western Cryptosystems that have been widely deployed?

Are there cryptosystems that have not been widely adopted in the West, that have been standardized by other major countries? Camellia is a block cipher similar in performance and security to AES. It ...
user avatar
  • 13.5k
7 votes
Accepted

Is there a standardized tree hash?

With SHA-3 Derived Functions (SP 800-185, pdf) there is now a standardized parallel hash based on SHA-3, called ParallelHash, appropriately. However, it is not a tree hash, but more of a hash-list-...
user avatar
  • 31.3k
7 votes
Accepted

Is there a standard way to use a nonce with HMAC?

Under the assumption that $(K,\text{Msg})\to H_K(\text{Msg})$ is a secure MAC (be it HMAC or any other MAC), and $\text{Nonce}$ does not repeat and is of fixed size, both $H_K(\text{Msg}||\text{Nonce})...
user avatar
  • 125k
7 votes

Is standardizing a modified AES a good idea?

I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the ...
7 votes

What does the TLS 1.2 client finished message contain?

rfc5246 7.4.9 defines verify_data as ...
user avatar
7 votes

What does the TLS 1.2 client finished message contain?

In the Finished Message FOR TLS, verify data is 12 byte long unless it is stated otherwise in the ciphersuite, so in your case it is 12 byte long. It is in the following handshake message form: ...
user avatar
  • 770

Only top scored, non community-wiki answers of a minimum length are eligible