Questions about the meaning and proper use of specific technical terms or notation within cryptography.

learn more… | top users | synonyms

6
votes
1answer
57 views

How distinct are the meanings of the terms “CSPRNG,” “DRBG” and “stream cipher”?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher ...
6
votes
1answer
66 views

Is the 'nonce' in bitcoin really a nonce?

Is the 'nonce' in bitcoin really a nonce? Reading definitions of nonce and salt it seems the number is used as a salt but the same value can occur in multiple blocks; there's no requirement or indeed ...
3
votes
2answers
207 views

What is the difference between PBE and symmetric key encryption?

What is the difference between PBE (password based encryption) and symmetric-key algorithms? My understanding is that symmetric-key algorithms like AES and Twofish are used in PBE. Hence PBE is just ...
4
votes
2answers
127 views

For what does “Rcon” stand for in Rijndael/AES?

How do we expand the abbreviation “Rcon” used in the Rijndael key schedule? I know what it is, I know how it works; I just do not know for what it is a shortcut for. I mean: if "Sbox" is ...
3
votes
1answer
53 views

Is rubberhose cryptanalysis a sidechannel - formally?

I recently was engaged in a discussion in Sec.SE where somebody used the term "sidechannel" to actually mean "circumvent the encryption". By what he said it was clear, that he wanted to not bother ...
0
votes
1answer
110 views

What is a branch number in the PAEQ algorithm?

I'm reading an article about authenticated encryption algorithm - PAEQ. It uses a permutation function AESQ, which has transormations from AES. And there is written about MegaSBoxes, which contain 4 ...
1
vote
1answer
37 views

What do associated data and message numbers mean?

I'm reading an article about authenticated encryption and don't understand some inputs to an encryption function. They are associated data, public and secret message numbers. Can you explain me their ...
24
votes
4answers
3k views

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
2
votes
0answers
36 views

How would you name and/or describe this algorithm?

First up: this is not a decoding request or anything. This is about terminology. Twice per year, we email another department to ask for a new licence file for their software. They are always slow to ...
3
votes
2answers
111 views

Classification of a stream cipher

How would one classify a stream cipher that is neither synchronous, nor self synchronizing? I would have thought asynchronous, but from all the sources I can find, asynchronous is synonymous with ...
4
votes
2answers
124 views

Name and security of these non-invertible functions?

I would like to learn more about a specific set of non invertible functions: The function should accept 2 inputs: one hidden and the other visible. The output and the function should also be ...
6
votes
2answers
203 views

Scrypt not “old enough” to be safe?

I just check all the questions with scrypt tag about that and usually it's said that scrypt is nice in theory and theoretically better than bcrypt and PKDF2, but it's too young to be "completely ...
8
votes
1answer
110 views

A general definition for cryptocurrencies

I am trying to find the definitions to several terms related to digital currencies. Unfortunately, I am always ending up on Bitcoin-oriented pages and websites which only take Bitcoin itself into ...
4
votes
1answer
108 views

What is an impure NIST true random number generator?

I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components: The entropy rate provided shall be ...
4
votes
1answer
64 views

What is the difference between MACTripleDES and TripleDES?

I was asked to encrypt/decrypt a string using MACTripleDES. Is there any difference between MACTripleDES and TripleDES? If, where exactly is the difference between both?
-1
votes
1answer
143 views

What is the difference between key size and block size (for AES)

We are working on AES and want to develop a website which should provide an encryption facility but we are not understanding the difference between key and the block size. More appropriately what does ...
1
vote
1answer
42 views

TCG design specification of TPM and nonce creation

I am reading TPM Main Part 1 Design Principles (PDF) which states: The creation of all nonce values MUST use the next $n$ bits from the TPM RNG. I do not know what this means, or how to find out ...
9
votes
1answer
377 views

What is cryptographic agility?

I keep seeing the term "Cryptographic Agility" referenced. What does it mean? For instance: https://msdn.microsoft.com/en-us/library/windows/desktop/bb204775(v=vs.85).aspx One of the key value ...
2
votes
1answer
85 views

What is the difference between “securely realizes” and “securely implements”?

In some security proofs it is stated that "a protocol securely realizes an ideal functionality" while in some others "a protocol securely implements an ideal functionality". Is there a meaningful ...
3
votes
1answer
87 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
-2
votes
2answers
121 views

Why are there so many stream ciphers out there and even ongoing research?

What make them better than OTP using a CSPRNG initialized with a secret key?
1
vote
2answers
157 views

MD5 Collision Attack Explained

In one of my assignments, I came across this line Due to MD5’s length-extension behavior, we can append any suffix to both messages and know that the longer messages will also collide. This lets ...
40
votes
1answer
4k views

What is a “freestart collision”?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
1
vote
1answer
220 views

SHA-256 “almost unique”?

I have seen numerous references on the internet of people describing SHA-256 as generating an "almost unique" hash. Exhibit A. there are more. Is there some mathematical basis to the almost ...
2
votes
1answer
102 views

What is the difference between CPA and IND-CPA?

I am writing a paper and I got comments from the reviewer that I don’t really understand. Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
2
votes
1answer
97 views

Define “cryptographer”

I often encounter the phrase "I am not a cryptographer". Is there a generally accepted definition for who is a cryptographer? What qualifications would be expected? For instance, should that person ...
5
votes
1answer
157 views

Is EncFS good for online storage services?

Conclusion from an EncFS audit: EncFS is probably safe as long as the adversary only gets one copy of the ciphertext and nothing more. EncFS is not safe if the adversary has the ...
2
votes
2answers
274 views

Definition of authenticity

I came across various definitions of what authenticity means in cryptography. I would like to know which one is correct. The first definition - the one I always used - is the following: Data ...
2
votes
1answer
107 views

Hash and salt or salt and hash?

People say "hash and salt", but aren't you supposed to salt password the first, and then hash it? So that means its called "salt and hash" right?
0
votes
1answer
67 views

What is ε in differential privacy?

In ε-differential privacy, what does the ε refer to? Is it privacy value or the notation used? Can anyone provide an example of differential privacy?
11
votes
2answers
2k views

Terminology: differences between the terms “pre-master secret”, “master secret”, “private key”, and “shared secret”?

Both crypto.SE and security.SE have excellent Q&As about how TLS generates session keys (I have linked some at the bottom). In reading these threads I'm having troubles with terminology since the ...
1
vote
1answer
125 views

What is k in RSA?

I am currently learning about RSA since I didn't understand the public-key-system but now I am… kind of. So I am writing the numbers as follows: $p = prime\ number\\ q = prime\ number\\ N = ...
3
votes
1answer
93 views

What does “simulator” and “interactive” mean in a cryptographic credential system's definition of security?

Definition 1 on Page 7 of “An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation” by Camenisch and Lysyanskaya, uses the term “simulator” in defining the ...
4
votes
0answers
123 views

Explanation of part of a visual cryptography algorithm

I have been working on a project involving visual cryptography and I am stuck with the following problem. My question is related to this paper, AN IMPROVED VISUAL CRYPTOGRAPHY SCHEME FOR SECRET ...
1
vote
1answer
119 views

What is the difference between a PRF and a PRF+?

What is the difference between a PRF and a PRF+? I am understanding them to mean the same thing, but I imagine that is because I don't understand their differences. The IKE RFC defines a PRF as: ...
11
votes
1answer
831 views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
3
votes
1answer
135 views

Is secure communication without public-key crytography feasible?

We all know about public-key cryptosystems, and we know some of these are computationally secure (for the time being, of course). Are there any algorithms out there which allow safe communication ...
6
votes
1answer
235 views

What is “witness encryption”?

I recently skimmed over tho papers on time-lock encryption: “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan “How to Build Time-Lock Encryption” by Jager ...
3
votes
2answers
185 views

How to calculate if probability is negligible or not

If i have probability $Q = 2C(A\times B)$ where $A$ and $B$ are unknown probabilities and $C$ is a non-negligible probability, what can i speculate about probability $Q$ and how can i calculate bounds ...
2
votes
4answers
91 views

Definition of the term “key”

I've looked in many places (NIST, text books, online resources) and I cannot find an answer to the definition of the term "key" from a semantic point of view. Is it the "key" to cipher-texts (i.e. ...
1
vote
2answers
255 views

Attribute-based encryption for cloud storage

I'm trying to understand attribute-based encryption schemes. Almost all articles describe that they are designed for cloud storage, but as I understand, almost all computing (encryption & ...
2
votes
2answers
137 views

Inconsistent terminology for ciphers and algorithms

I've been baffled by all the different kinds of names which are given to cryptographic algorithms. There are block ciphers and stream ciphers (AES and RC4). There is symmetric and asymmetric ...
1
vote
1answer
234 views

Counter Mode (CTR) and mult-CPA

I am not sure if Counter Mode (CTR) encryption is mult-CPA (chosen-plaintext attack) secure or not.
3
votes
1answer
115 views

Generic name for (?hash) functions of form $\{0,1\}^n \rightarrow \{0,1\}^{poly(n)}$

Consider a function $$f: \{0,1\}^n \rightarrow \{0,1\}^{poly(n)} $$ with the following properties: hard to invert, i.e. given $f(x)$, hard to find $x$ hard to find a collision, i.e given $f(x)$, ...
0
votes
1answer
119 views

Is adaptive security the same as full security?

This question contains a great answer about adaptive security, but I haven't yet found a proper definition what full security is. Does a stronger security than adaptive security exist or are the two ...
0
votes
4answers
293 views

what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?

So normally if you do encrypt('a') twice in a row you'll get the same result. But sometimes (as is the case in SSH) this is not desirable. You want encrypt('a') + encrypt('a') == encrypt('aa'). What ...
10
votes
2answers
471 views

Definition of “pepper” in hash functions

I am confused about the notion of "pepper" in the context of storing hashes of users' passwords. Definition 1: A pepper is a secret key Looking around the Internet, for example here or here, a ...
0
votes
1answer
100 views

What is “electronic” in electronic codebook (ECB)?

This is an honest question regarding terminology. I believe that I understand why one mode to use a block cipher is called a codebook. But I wonder why electronic as a work appears here? Is it fair ...
6
votes
2answers
996 views

What does “circuits” mean in Cryptography?

I am not a hardcore cryptographer so this might be a really stupid question. I am looking through some papers in homomorphic encryption and discovered they describe computation as "circuits", why do ...
1
vote
1answer
80 views

The use of the term “sound” in cryptography [closed]

We often see the term "sound" in cryptography. What is the sense of this word ? Thank you.