# All Questions

33 views

### Why don’t all AES encryption tools used to encrypt an identical message with the same password produce the same ciphertext?

Alice and Bob meet regularly. They have agreed face-to-face a 128 bit password which they want use to encrypt/decrypt emails written between them. They decide to use 256-bit AES. Alice wrote her ...
16 views

Does a one-time-pad with multiplication instead of xor between the message and the key introduces security problems?
266 views

### Effective security of block cipher – equal the key size, or half the key size?

The Wikipedia “Key Size” article states: The security of an algorithm cannot exceed its key length (since any algorithm can be cracked by brute force), but it can be smaller. … … … Most ...
186 views

### VKO GOST R 34.10-2001 (described in RFC4357), Key Agreement Algorithm. Looking for its implementation/detailed description/examples

VKO GOST R 34.10-2001 was described in RFC4357 Page 7 But the description is very poor. Here it is: This algorithm creates a key encryption key (KEK) using 64 bit UKM, the sender's private key, ...
18 views

### Non-interactive zero-knowledge proof for discrete logarithm without random oracle

Is there any non-interactive zero-knowledge proof for discrete logarithm without random oracle over the group $\mathbb Z_p$?
124 views

### Sharing a secret key between many users

I would like to know if there is any security issue in sharing a secret key (of an asymmetric cryptography) between several users. I know that this secret key is no longer "secret", so it's no longer ...
57 views

### Do hand-based hash functions / MACs exist?

Is there research on a hash function or a MAC that can be executed without computers? I know there's a lot of history on hand-based ciphers and the OTP can easily be excecuted by hand. (By using ...
4k views

### Why hash the message before signing it with RSA?

The diagram below illustrates the process of digitally signing a message with RSA: As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the ...
181 views
+100

### How to prove that someone encrypted a specific (large) chunk of data

Alice encrypts her data with HER secret key. Then she sends the encrypted data to Bob who should encrypt it with HIS secret key. Caroline should then eventually get this double encrypted data. ...
43 views

### What is the difference between H(M) and H3(M, s, IDA)? [on hold]

What is the difference between H(M) and H3(M, s, IDA)? I am aware of Hash function with a Message and a Key, but there are three parameters in: H3(M, s, IDA). Here M is the message, s is the key, ...
66 views

### Improving on a clocked PRNG

I recently developed a PRNG from scratch with a little inspiration from the initialization function used in the HC stream cipher. The state ($S$) of the basic version is an array of 5 bytes and uses ...
120 views

### Looking for C++/Python Open Source code library for cryptanalysis of classical ciphers [on hold]

I've done a significant amount of coding over the years working on classical ciphers (e.g., Chaocipher, D'Agapeyeff). My main programming languages today are C++ and Python, although there was a time ...
20 views

### Does the encryption algorithm DES perform random permutations? If so how is information not lost?

"Before round 1 begins, all 64 bits of an incoming message and all 56 bits of the secret key are seperately permuted (shuffled)" My question is this : Is the shuffling of the bits performed randomly? ...
33 views

### Why is public key cryptography not widely used in governments? [on hold]

Are there any practical limitations? Govt driving license, passport, SSN could be digitally signed making it easy for anyone to validate. They can have a qr code in them which can be easily validated ...
187 views

### Computation indistinguishability questions

The definition I have is: Two probability ensembles $X = \{X_n\}_{n \in \mathbf{N}}$ and $X = \{Y_n\}_{n \in \mathbf{N}}$ are computationally indistinguishable if for every probabilistic ...
42 views

### Using ECB as encryption mode, but encrypted messages are unique

As I understand, ECB should not be used as encryption mode unless you are encrypting single blocks of data which are always unique and only are encrypted once. I have a collection of ids represented ...
216 views

### What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently ...
66 views

### Would this be a plausible authenticated encryption scheme using nested encryption?

[This is was the most promising out of an incrementally developed set of (mostly flawed, to some degree) schemes I posted here, but I was told I should post each one separately] This scheme is highly ...
40 views

### One time pad in CBC mode?

I have been searching about if it is more secure to use CBC mode in OTP but I can't find anywhere where people have sad that it is more secure. Question: Is CBC mode in OTP more secure? Because I ...
70 views

### Finding public exponent e

I'm trying to create an algorithm to find the public exponent e given a plain (non-CRT) private key that doesn't include the public exponent, i.e. I've only got $n$ and $d$. A question has already ...
3k views

### Is it possible to make time-locked encrytion algorithm?

I'm not sure if what I'm asking is even a valid question but here goes. Would it be possible to add a mechanism to an encryption algorithm that would mean it had to be a certain time of the day or a ...
28 views

### Bilinear pairing arithmetic - cryptographic accumulators

For calculating accumulated values for set of elements chosen randomly from say ${ e_1 ,e_2,...e_n}\varepsilon X$ we use the formula $acc= g^{f(e,s)}$ where $f(e,s)= (e_1+s)(e_2+s).....(e_n+s)$ ...
40 views

### Cryptographic enforcement schemes using Diffie-Hellman

If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ...
28 views

### Can a TLS client perform any DH regeneration?

I have only the barest understanding of cryptography, but I've been following the Logjam issue; some posts and articles (elsewhere) imply that a client can regenerate DH keys. Is Logjam solely a ...
24 views

### PGP public RSA key format

I have been trying to use Go (I could post the code, but I think I posted enough already...) to generate a PGP RSA key. However every time I try to encrypt something with it, something fails. However, ...
212 views

### Is HMAC-MD5 still secure for commitment or other common uses?

MD5 collisions have been out for some time. In spite of this, HMAC-MD5 is still secure for authenticating data1. This illustrates a strength of the HMAC construction, it does not require that the hash ...
66 views

### Image sharing without data overhead

The idea is to share n images among n persons so that all images can be reconstructed by someone in possession of all shares. However, there must not be any data overhead (which means the shares sent ...
47 views

### Cannot verify rsa signature on Android [migrated]

I'm trying to sign an encrypted message with a private key and verify it in Java. This is my first time working with encryption and signatures so I'm not sure how it is supposed to work and I'm kind ...
98 views

### Hash function such that fx(hash(s1),hash(s2)) = hash(concat(s1,s2))

First, I'm not a mathematician, so I may express this question awkwardly. Feel free to chuckle. I'm wondering if there exists a hash function h such that for given strings s1 and s2, and string ...
99 views

### RSA public key exponent generation confusion

Quote from Wiki: $e$ having a short bit-length and small Hamming weight results in more efficient encryption — most commonly $2^{16} + 1 = 65537$. However, much smaller values of $e$ (such as $3$) ...
16 views

### Type 1 pairings and encoding function from $\mathbb G_T$ to $\mathbb G$

Let $e : \mathbb G \times \mathbb G \to \mathbb G_T$ be a Type 1 bilinear pairing. Is it possible to define an encoding function $E : \mathbb G_T \to \mathbb G$? If so, how could this encoding ...
20 views

### Are covert and rational adversaries same?

Aumann and Lindell defined covert adversaries in 2009 which is informally adversaries which have a epsilon-deterrence to cheat. Some authors (for ex. John R. Wallrabenstein) have defined similar ...
150 views

### RSA with probable primes

I am a bit of a newbie to RSA encryption, so please be patient. I understand that for a 4096 bit RSA, the numbers p and q should be prime. And to have the best security, the p and q should both be ...
36 views

### Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
76 views

### Comparing n-multiple amount of merkle trees?

I would like to know what best steps are there in finding differences between a high order amount of merkle tree's or if a better associative structure should be used. I ask this questions because ...
51 views

### Is it practical to use a stream cipher in a block cipher mode?

My idea is to use a stream cipher encrypting 16 bytes at a time as a primative block cipher in a mode of operation such as CBC mode. Is this practical or useful in any way?
34 views

### How can I tell how a text was encrypted? [on hold]

How can I tell what encryption method was used to encrypt this text below? I noticed this sequence repeats "C04D57B02B2B61C4", could that be a hint? It also has leading zeroes, does that point to any ...
56 views

### Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block?

The most promising of the 4 approaches described here (version 4) has been posted as a separate question. This post should be considered for archiving and historical purposes only. Disclaimer: the ...
30 views

### Ring signatures in ECC

Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret ...
27 views

### How many bits of entropy can I expect from /dev/urandom in iOS?

Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and ...
1k views

### Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
31 views

I was reading 'Pinocchio Coin' paper by Danezis et al. where they have said, "If we use the efficient pairing groups of Pinocchio, computing discrete logarithms in the exponent field $\mathbb{F}_p$ ...
28 views

### How to calculate RSA CRT parameters from public key and private exponent

Given the public key (n, e) and private exponent (d), how to calculate CRT parameters (p, q, dP, dQ, and qInv) of this RSA key pair?
170 views

### Would this method deliver a perfectly non-malleable encryption for at least two blocks? [on hold]

Disclaimer: the algorithms I present here (and in other messages) are used as a hands-on way to learn about developing crypto algorithms, (and might also be of interest for other curious people), not ...
40 views

### Would this method allow fast authenticated encryption using only a single encryption operation per block?

[This approach is flawed. A different speculative approach using an RNG instead of the cipher as a source of entropy was posted as a separate question] Assume $E$ is a block cipher, $C_0 = IV$ and ...
26 views

### Why don't we have hardware generate NON-pseudo, but REAL random numbers from meta-stable flip-flops? [on hold]

Software pseudo-random numbers can always be cracked because they are based on a seed and therefore deterministic. Therefore, why depend on anything that's deterministic for security? The only real ...
17 views

### public key for encrypting and both private and group key for decrypting [on hold]

A document is ecncrypted using publickey within a group(consists of many users with single public key and individual private key),then how to decrypt the document by using both public key and private ...
58 views

### Name of this attack?

I am studying Merkle tree signature. Let $\sigma=(s,Y_s,\sigma_{\text{OTS}},As)$ be a signature of certain document. Here $s$ is the index of leaf, $Y_s$ is the respectively OTS public key and $A_s$ ...
$Z=(N-XY)^2$ is a surface with absolute minima ($0s$) anywere $Y=N/X$. I know this question is naiive, but shouldn't it be possible to apply a lossy compression filter to this function which ...