Most Popular
1500 questions
13
votes
1 answer
Diffie-Hellman Parameter Check: when g = 2, must p ≡ 11 (mod 24)?
I'm adding some Diffie-Hellman groups to a program as specified in RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE).
When I test some of the group parameters per OpenSSL's DH_check, a result is returned…
user10496
13
votes
1 answer
Difference between CBC-MAC and CMAC
According to Wikipedia, CMAC is based on a variation of CBC-MAC and fixes some security deficiencies in it. However, I could not find a simple and clear explanation of what the differences between the two algorithms actually are, so I thought I'd…
enigma
- 133
- 1
- 1
- 7
13
votes
2 answers
At what stage is DHE and RSA used during the SSL/TLS handshake?
At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further communications. I am confused how DHE, AES and RSA…
Ali Gajani
- 418
- 2
- 6
- 12
13
votes
1 answer
Why does OpenSSL append extra bytes when encrypting with aes-128-ecb?
Plaintext:
Attack at dawn!!
Hex:
41747461636b206174206461776e2121
Key:
abcdefghijklmnop
Hex:
6162636465666768696a6b6c6d6e6f70)
Through calculations done both by hand and with various sites online, the result should…
k_sel
- 233
- 1
- 2
- 4
13
votes
3 answers
What happens to entropy after hashing?
What happens to entropy after hashing?
Suppose you have a key with entropy $k$. Can entropy $k$ be increased by hashing the key?
user10988
- 183
- 1
- 5
13
votes
1 answer
Difference between Pedersen commitment and commitment based on ElGamal
Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme?
For the sake of completeness, I recall what both of them look like.
Given two public and large primes $p$ and…
LRM
- 1,356
- 10
- 24
13
votes
1 answer
Difference between computational and statistical indistinguishabilities
What is the difference between the two notions of computational and statistical indistinguishability?
Dingo13
- 2,867
- 3
- 27
- 46
13
votes
2 answers
Has threefish successfully been attacked (practically or theoretically)?
Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating:
Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a 256-bit key, 6.1 clock cycles/byte with a 512-bit key,…
Trina
- 694
- 7
- 21
13
votes
1 answer
How to choose constants in a cryptographic function?
A number of cryptographic functions have constants built in. For example, the constants used in RFC 2104 for HMAC, or the constants used in s-boxes (e.g., DES and AES), or MD5. In general, how are constants such as these generated so as not to…
mikeazo
- 38,563
- 8
- 112
- 180
13
votes
1 answer
Security considerations on "expand 32-byte k"-magic number in the Salsa20 family of stream ciphers?
I'm currently examining the NaCl library written by Daniel J. Bernstein and I noticed that the library hard codes the sigma:
static const unsigned char sigma[16] = "expand 32-byte k";
In all the salsa stream…
Pascal
- 233
- 2
- 7
13
votes
2 answers
What can make an implementation of a large integer library unsafe for cryptography
Unfortunately, I don't have any references, but I remember people mentioning that some large integer libraries can be unsafe to use for writing cryptographic algorithms such as the RSA.
That made me curious if anyone knows of any examples of…
Keen
- 233
- 1
- 7
13
votes
1 answer
Is the first version of the Message-Digest algorithm by Ronald Rivest publically available?
Diving into the history and evolution of the Message-Digest algorithm by Ronald Rivest, I have been able to track back papers from MD6 down to MD2. Yet, somehow I can not seem to be able to find any papers, specifications or even the slightest…
e-sushi
- 17,891
- 12
- 83
- 229
12
votes
1 answer
Current Consensus on Security of Lattice Based Cryptography?
In an edit to an answer by user forest, it was mentioned that there has been a new attack developed for lattice-based cryptography. I thought lattice-based cryptography is a fairly well established way of providing quantum-computing-proof security,…
Steven Sagona
- 313
- 1
- 12
12
votes
1 answer
What signature schemes allow recovering the public key from a signature?
It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone.
This seems like an interesting property; as far as I know, RSA doesn't share it.
Depending on the application, this can both be…
lxgr
- 1,798
- 1
- 13
- 22
12
votes
1 answer
Technical details of attack on Android bitcoin usage of SecureRandom
Reports are surfacing that Android's Java SecureRandom class has issues and isn't totally secure.
A specific example of how this issue translates to applications is bitcoin, where reports are stating that the bitcoin wallet is at risk of theft. With…
makerofthings7
- 2,621
- 1
- 20
- 36