# All Questions

4 views

### Rogue CA Certificate MD5 Collision Control

Papers from Marc Stevens et al show that X509 certificates that rely on MD5 signatures can break the assumed security model, that is, it allows for a forged certificate to have the same signature as a ...
9 views

### paradox on fully homomorphic equality checking

Imagine, a client encrypts a corpus of data (say documents of text) with the public key of a Fully Homomorphic Encryption scheme (FHE) and outsources the data to an untrusted server.Now the client ...
15 views

### Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...
6 views

### Problem with own AES implementation

First of all, I just implemented AES because I wanted to understand how it works and as a challange to see if I could do it and I won't use to encrypt anything important, ever. The (German) Wikipedia ...
31 views

### Which hash function is usually used in RSA?

I know there are several available, however I can't seem to find whether there is one standard one or not. I think I understand the process of digital signatures, just wondering which has function is ...
24 views

### RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private key is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What can be ...
14 views

### How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?

In both node.js and OpenSSL, I am seeing cipher "aes-256-gcm". However, in NIST Special Publication 800-38D, that defines GCM, I am reading: The underlying block cipher shall be approved, the ...
8 views

### Bitlocker on windows 10 [on hold]

How much does using Bitlocker on windows 10 slows the file processing on the drive? (I am planning on activating bitlocker on my C drive where my OS is present) and is it recommended to use bitlocker ...
30 views

### Cryptographic hash with ability to ignore specific bits based on a hidden pattern?

I'm looking to use password-style hashing to validate an environment, where some parts may be irrelevant. For example: ...
7 views

### Probabilistic Disjoint Verification

Let $r_1,...,r_n$ be routers in the same organization, and let $h_{CO}$ be the least significant 32 bits of the hash of data packet $CO$. Router $r_i$ verifies $CO$ if $h_{CO} ≡ i \bmod n$. Assuming ...
13 views

### Multiple NTRU public keys for the same private key?

An NTRU public key is generated essentially by multiplying the inverse of a polynomial $f$ by a polynomial $g$. The polynomial $f$ is the private key; $g$ is discarded. My question is: Is it insecure ...
9 views

### Fully homomorphic encryption arbitrary functions formulation

I am currently studying the interesting field of homomorphic encryption. I read that from a fully homomorphic encryption function that supports both addition and multiplication you can perform any ...
31 views

### Unbreakable encryption

I am a newbie, I know that I must be wrong, but I need a good explanation. How is it possible to break a cryptographic algorithm created by me, when only I know the algorithm and the key for ...
36 views

### Multi-Party Encryption for a Shared Document

Is there an encryption algorithm/protocol where any of a pre-defined set of keys/passwords will succeed in decrypting a document? The number of keys can be fixed, say, 10 or 20 possible passwords. ...
10 views

### StoredKey in Salted Challenge Response Mechanism (SCRAM)

In SCRAM (RFC5802, page 8) the client generates ClientKey to server, which is a derivation of the original password. This is communicated to the server in a secure ...
110 views

### What are the steps to decrypt a TLS 1.1 record?

My question is related to another question in Cryptography about TLS 1.1 and 1.2. I have read both RFC 2246 The TLS Protocol Version 1.0 and RFC 4346 The TLS Protocol Version 1.1. What I know is that ...
18 views

### Help understanding basic Franklin-Reiter related message attack

I am trying to understand this attack at the most basic level. I set up the following basic scenario: Let the public encryption exponent, e = 3. Let p, be some arbitrary but known (to the ...
184 views

### Autocorrelation in Autokey

I know that Vigenère can broken using auto-correlation (as explained at cryptool-online.org). Now my question is: Why does this also work with autokey (tested it using crypttool)? To prove that I ...
13 views

### key scheduling in rc4

Found this pseudocode of RC4 key scheduling in wiki : ...
20 views

### User revocation in Identity Based Encryption

I read several papers about user revocation in IBE recently. A common point is that when a user is revoked, some other valid users should also update their private keys. Does this mean that one ...
11 views

### Edwards / Montgomery ECC over binary extension fields

I recentely had a discussion about the redesign of our ECC code for the library I'm collaborating on and the person I was discussing with came up with Edwards and Montgomery curves over binary ...
75 views

### (Lightweight) Multicast one-way Authentication

Problem: I'm thinking about a lightweight solution to provide source authentication (only one source) to multiple receivers (multicast message). Context: Taking the problem to ground, we can think ...
16 views

### need guidance to decrypt php base 64 [on hold]

i have code encrypted using base 64 i need help to decrypt it , below is attached code , some hacker converted whole code to base 64 below is hint i see all pages i need help to decrypt it ...
232 views

### PGP String-to-Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
21 views

### need help to decrypt js encrypted using some aes [on hold]

I have few js code that run on browser and in encrypted using some aes. I think sjcl. below i code format ...
26 views

### Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in ...
20 views

### Lattice attacks against Multilinear Maps [CLT13]

I am currently studying an article on a construction of Multilinear maps. There are some attacks on the scheme presented by the authors and I got stuck at the one in section 5.1. I will try to ...
22 views

### Should I authenticate memory data which was loaded from authenticated disk file?

Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to ...
147 views

### Backdoorable hash function in password database

I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
170 views

### How can I use the whole potential of DES?

I have recently programmed the DES algorithm. Right now it works just with integers (or better to say chars) in the range <0;255>. How can I use its whole potential - using just ASCII would be a ...
25 views

### Deletion in RSA Accumulator

I am studying RSA Dynamic Accumulator and I have a doubt: why is more simple to calculate the new accumulator value after a deletion if is known the secret ϕ(n)? Is possible to calculate the deletion ...
11 views

### SSL with both local client and server [migrated]

I'm not sure whether this topic belongs in Cryptography, Programming or StackOverFlow so please forgive me if I don't add a useful question to this site. I want to give both server and client ...
534 views

### Does key authentication in SSH protect from MitM?

How do cryptography in SSH(2) work (secure channel establishment, authentication)? Does key authentication in SSH(2) protect from MitM by providing authentication and integrity and why?
39 views

### Memory hardness of key derivation function through XOR-ring multiple matrix values

For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function ...
24 views

### How to force non-negative int64_t output for blowfish encryption with int32_t input?

I would like to encrypt a series of small integers one by one. The range of them is about 0~10^8. The output must be non-negative int64_t integers. Since Blowfish is 64-bit cipher, I prefer to use it ...
32 views

### Reversible hash function

I met the following 'reversible hash' function applied on a data $d$ consisting of $d_1, \ldots, d_n$ words: $h_0(d) = 0, h_i(d) = c ∗ (d_i + h_{i−1}(d))$, for $0 < i \leq n$. $c$ is a small, odd ...
26k views

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
105 views

### ElGamal Generator g problem

Having an ElGamal encryption scheme with p=19 which value can not be assigned to g? The answers were : 1,7,11,2 I think you can't assign value 1 to g.
270 views

### ECC keys vulnerable to brute force attack?

I have started learning about Elliptic curve cryptography. Since the key size required in ECC is relatively lesser than the key size in RSA to provide the same amount of strong encryptions, I wonder ...
22 views

### Initializing PGP keys by one side

I am using a PGP method to encrypt and decrypt messages shared between users A and B. Upon the start of a message exchange is the initialization of the public and secret keys by both Users. Lets say ...
14 views

### Access Structures in Attribute Based Encryption [on hold]

What are the different access structures that can be used with Attribute Based Encryption?
101 views

Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password. Now I generates a public/private keypair. Then I send the public ...
53 views

### How to check if a function is significant or not?

f(n) = 1 / ( log n ) ^ 1/2 I know that this function is not negligible because it will never converge to zero even for large values of n. Now my question is, how ...
1k views

### Why is PuTTYgen-created RSA public exponent(e) not in {3,17,65537}?

As far as I know, RSA public exponent(e) should be one of {3,17,65537}. However, I found PuTTYgen-created RSA public exponent(e) is 0x25(37) by default,as follows, (PuTTYgen version: 0.66) I am ...
16 views

### How to implement CSPRGs in Python? [migrated]

I want to implement a CSPRNG for a stream cipher. I've tried implementing the BBS, but I've heard that it needs very big seeds to be secure. Is there a function in some library for Python 3 that adds ...
19 views

12 views

### How to do endpoint authentication? [on hold]

I want to mutual authentication. I want to prevent MITM. I don't know how to proof server identity without cert. I can't use TLS. What are the other options ?
2k views

### Which one is fastest? Karatsuba or Montgomery multiplication?

Is there any complexity analysis between Karatsuba and Montgomery multiplication algorithms? It seems that Karatsuba is more general in the sense that is not modulo tuned while Montgomery it is. Does ...
Say we have a computationally secure Message Authentication Code scheme (Gen, Tag, Ver). Let $Tag'_k(m):=$ first half bits of $Tag_k(m)$. Let's assume the range of tags is $n$bits. Is (Gen, Tag', ...