Questions about the meaning and proper use of specific technical terms or notation within cryptography.

learn more… | top users | synonyms

40
votes
1answer
4k views

What is a “freestart collision”?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
27
votes
2answers
13k views

What is the main difference between a key, an IV and a nonce?

What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their ...
24
votes
4answers
3k views

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
21
votes
6answers
3k views

Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
13
votes
6answers
8k views

Simply put, what does “perfect secrecy” mean?

I would like to ask for a clear (but maybe not so deep) explanation of what the term "perfect secrecy" means. As far as I have researched and understood, it has to do with probabilities of assuming ...
12
votes
2answers
2k views

Terminology: differences between the terms “pre-master secret”, “master secret”, “private key”, and “shared secret”?

Both crypto.SE and security.SE have excellent Q&As about how TLS generates session keys (I have linked some at the bottom). In reading these threads I'm having troubles with terminology since the ...
12
votes
1answer
7k views

Why is Diffie-Hellman considered in the context of public key cryptography?

In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography". As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
11
votes
5answers
8k views

What is the difference between CSPRNG and PRNG?

What is the difference between CSPRNG and PRNG? Is there performance differential between them? For example: We use PRNG for key generation which is very expensive and CSPRNG for IV/nonce in block ...
11
votes
7answers
2k views

How exactly is “true randomness” defined in the realms of cryptography?

Especially in relation to stream ciphers, I frequently read about (sometimes theoretical, sometimes practical) attacks that are able to "distinguish a ciphertext from a truly random stream". What's ...
11
votes
1answer
3k views

What are SNARKs?

What does it mean and what is it used for, I have been hearing this term a lot lately. From the context I've heard it talked about it seems to be connected with zero knowledge?
11
votes
1answer
837 views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
11
votes
1answer
391 views

What is the origin of the word “Keccak”?

Where does the word or acronym Keccak come from? Guido Bertoni, Joan Daemen, Michael Peeters, and Gilles Van Assche. Keccak sponge function family main document. Submission to NIST (updated), 2009. ...
10
votes
2answers
472 views

Definition of “pepper” in hash functions

I am confused about the notion of "pepper" in the context of storing hashes of users' passwords. Definition 1: A pepper is a secret key Looking around the Internet, for example here or here, a ...
9
votes
6answers
2k views

Cryptography vs Security

This may sound a little bit of basic but here it goes… Which of the following is correct? “Cryptography is under the security field”, or “Security is under the cryptography field?” Cryptography ...
9
votes
1answer
379 views

What is cryptographic agility?

I keep seeing the term "Cryptographic Agility" referenced. What does it mean? For instance: https://msdn.microsoft.com/en-us/library/windows/desktop/bb204775(v=vs.85).aspx One of the key value ...
8
votes
3answers
4k views

The exact difference between a permutation and a substitution

I've noticed confusing definitions about permutation and substitution, preventing to make the difference. A permutation changes the order of distincts elements of a set, but this can be writen as a ...
8
votes
2answers
675 views

Toy cipher — does it have a name?

When I was perhaps nine years, I borrowed a book from the library on various maths and CS topics. It outlined various simple ciphers, including one that I used a lot, just for fun. I can't remember ...
8
votes
1answer
652 views

Are there any authoritative definitions of “key stretching”?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
8
votes
1answer
110 views

A general definition for cryptocurrencies

I am trying to find the definitions to several terms related to digital currencies. Unfortunately, I am always ending up on Bitcoin-oriented pages and websites which only take Bitcoin itself into ...
7
votes
1answer
2k views

What is it meant by a “hybrid argument”?

Can anyone explain (or point to a reference for) what a hybrid argument is in a security proof, and when it's convenient or preferable to use it? Among some of the places where I've seen it ...
7
votes
1answer
229 views

What is the “artificial abort” technique?

In the security proof of Brent Waters's paper Efficient Identity-Based Encryption Without Random Oracles, he uses a novel “artificial abort” step on page 6. At this point the simulator is still ...
6
votes
2answers
204 views

Scrypt not “old enough” to be safe?

I just check all the questions with scrypt tag about that and usually it's said that scrypt is nice in theory and theoretically better than bcrypt and PKDF2, but it's too young to be "completely ...
6
votes
1answer
471 views

What does a “cycle” mean in cryptography benchmarks?

In this table of the "Crypto++ 5.6.0 Benchmarks", for example, cryptographic algorithm performance is measured in cycles per byte for symmetric ciphers, and in cycles per operation for asymmetric ...
6
votes
2answers
998 views

What does “circuits” mean in Cryptography?

I am not a hardcore cryptographer so this might be a really stupid question. I am looking through some papers in homomorphic encryption and discovered they describe computation as "circuits", why do ...
6
votes
1answer
235 views

What is “witness encryption”?

I recently skimmed over tho papers on time-lock encryption: “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan “How to Build Time-Lock Encryption” by Jager ...
6
votes
1answer
430 views

What is 'key agility' in relation to symmetric-key encryption?

I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
6
votes
1answer
57 views

How distinct are the meanings of the terms “CSPRNG,” “DRBG” and “stream cipher”?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher ...
6
votes
1answer
67 views

Is the 'nonce' in bitcoin really a nonce?

Is the 'nonce' in bitcoin really a nonce? Reading definitions of nonce and salt it seems the number is used as a salt but the same value can occur in multiple blocks; there's no requirement or indeed ...
6
votes
1answer
197 views

What does pseudo pre-image of a hash function mean?

So finding a pre-image means given the hash value, one tries to find a message that gives this value using the function's standard IV. What about pseudo-preimage?
6
votes
2answers
651 views

Does data authenticity always, implicitly, provide data integrity?

Does a scheme which provides data authenticity (e.g. HMAC or RSA signature) always implicitly provide integrity? It seems, to me at least, that it must by necessity. However, I have seen ...
6
votes
1answer
313 views

Difference between actual attacks and theoretical attacks on SHA cryptographic series

Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
5
votes
3answers
633 views

What is the difference between a 'cipher' and a 'mode of operation'?

What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)? Aren't these both terms for the encryption/decryption technique?
5
votes
1answer
487 views

What is 'security margin'?

I have been academic papers about Rijndael, Serpent, and Twofish, and there is this term that is vague to me. I cannot find a tangible definition in google. Can someone briefly define, describe, ...
5
votes
1answer
158 views

Is EncFS good for online storage services?

Conclusion from an EncFS audit: EncFS is probably safe as long as the adversary only gets one copy of the ciphertext and nothing more. EncFS is not safe if the adversary has the ...
4
votes
2answers
124 views

Name and security of these non-invertible functions?

I would like to learn more about a specific set of non invertible functions: The function should accept 2 inputs: one hidden and the other visible. The output and the function should also be ...
4
votes
2answers
127 views

For what does “Rcon” stand for in Rijndael/AES?

How do we expand the abbreviation “Rcon” used in the Rijndael key schedule? I know what it is, I know how it works; I just do not know for what it is a shortcut for. I mean: if "Sbox" is ...
4
votes
1answer
2k views

What is “Implicit Authentication”?

What is “Implicit Authentication” in the context of authentication methods? I searched the Web but could not find any article that describes this. If anyone can describe it, that would be a great ...
4
votes
1answer
108 views

What is an impure NIST true random number generator?

I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components: The entropy rate provided shall be ...
4
votes
1answer
64 views

What is the difference between MACTripleDES and TripleDES?

I was asked to encrypt/decrypt a string using MACTripleDES. Is there any difference between MACTripleDES and TripleDES? If, where exactly is the difference between both?
4
votes
1answer
1k views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
4
votes
0answers
123 views

Explanation of part of a visual cryptography algorithm

I have been working on a project involving visual cryptography and I am stuck with the following problem. My question is related to this paper, AN IMPROVED VISUAL CRYPTOGRAPHY SCHEME FOR SECRET ...
3
votes
2answers
207 views

What is the difference between PBE and symmetric key encryption?

What is the difference between PBE (password based encryption) and symmetric-key algorithms? My understanding is that symmetric-key algorithms like AES and Twofish are used in PBE. Hence PBE is just ...
3
votes
3answers
155 views

The meaning of “scheme”

This question is a bit different from other questions here, but I think it is suitable to correctly understand the terminology of cryptography. Consider the following two sets of terms: Encryption ...
3
votes
1answer
87 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
3
votes
1answer
264 views

Difference between lightweight, online and low memory Authenticated Encryption schemes

What is the basic difference between the following types of Authenticated Encryption (AE) schemes? Lightweight Authenticated encryption Online Authenticated Encryption Authenticated Encryption for ...
3
votes
2answers
187 views

How to calculate if probability is negligible or not

If i have probability $Q = 2C(A\times B)$ where $A$ and $B$ are unknown probabilities and $C$ is a non-negligible probability, what can i speculate about probability $Q$ and how can i calculate bounds ...
3
votes
1answer
1k views

Non-linearity of a boolean function

What's the definition of non-linearity of a boolean function? Roughly saying it is minimum number of times it equals any affine function. But I don't get it mathematically. For example, if $f = ...
3
votes
2answers
111 views

Classification of a stream cipher

How would one classify a stream cipher that is neither synchronous, nor self synchronizing? I would have thought asynchronous, but from all the sources I can find, asynchronous is synonymous with ...
3
votes
1answer
93 views

What does “simulator” and “interactive” mean in a cryptographic credential system's definition of security?

Definition 1 on Page 7 of “An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation” by Camenisch and Lysyanskaya, uses the term “simulator” in defining the ...
3
votes
1answer
135 views

Is secure communication without public-key crytography feasible?

We all know about public-key cryptosystems, and we know some of these are computationally secure (for the time being, of course). Are there any algorithms out there which allow safe communication ...