# All Questions

0answers
13 views

### Does the encryption algorithm DES perform random permutations? If so how is information not lost?

"Before round 1 begins, all 64 bits of an incoming message and all 56 bits of the secret key are seperately permuted (shuffled)" My question is this : Is the shuffling of the bits performed randomly? ...
0answers
22 views

### Why is public key cryptography not widely used in governments? [on hold]

Are there any practical limitations? Govt driving license, passport, SSN could be digitally signed making it easy for anyone to validate. They can have a qr code in them which can be easily validated ...
2answers
148 views

### What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently ...
3answers
37 views

### One time pad in CBC mode?

I have been searching about if it is more secure to use CBC mode in OTP but I can't find anywhere where people have sad that it is more secure. Question: Is CBC mode in OTP more secure? Because I ...
0answers
13 views

### Type 1 pairings and encoding function from $\mathbb G_T$ to $\mathbb G$

Let $e : \mathbb G \times \mathbb G \to \mathbb G_T$ be a Type 1 bilinear pairing. Is it possible to define an encoding function $E : \mathbb G_T \to \mathbb G$? If so, how could this encoding ...
2answers
108 views

### Sharing a secret key between many users

I would like to know if there is any security issue in sharing a secret key (of an asymmetric cryptography) between several users. I know that this secret key is no longer "secret", so it's no longer ...
0answers
28 views

### Bilinear pairing arithmetic - cryptographic accumulators

For calculating accumulated values for set of elements chosen randomly from say ${ e_1 ,e_2,...e_n}\varepsilon X$ we use the formula $acc= g^{f(e,s)}$ where $f(e,s)= (e_1+s)(e_2+s).....(e_n+s)$ ...
1answer
41 views

### What is the difference between H(M) and H3(M, s, IDA)? [on hold]

What is the difference between H(M) and H3(M, s, IDA)? I am aware of Hash function with a Message and a Key, but there are three parameters in: H3(M, s, IDA). Here M is the message, s is the key, ...
1answer
20 views

### Are covert and rational adversaries same?

Aumann and Lindell defined covert adversaries in 2009 which is informally adversaries which have a epsilon-deterrence to cheat. Some authors (for ex. John R. Wallrabenstein) have defined similar ...
0answers
22 views

### PGP public RSA key format

I have been trying to use Go (I could post the code, but I think I posted enough already...) to generate a PGP RSA key. However every time I try to encrypt something with it, something fails. However, ...
0answers
32 views

### How can I tell how a text was encrypted? [on hold]

How can I tell what encryption method was used to encrypt this text below? I noticed this sequence repeats "C04D57B02B2B61C4", could that be a hint? It also has leading zeroes, does that point to any ...
0answers
36 views

### Cryptographic enforcement schemes using Diffie-Hellman

If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ...
1answer
64 views

### Would this be a plausible authenticated encryption scheme using nested encryption?

[This is was the most promising out of an incrementally developed set of (mostly flawed, to some degree) schemes I posted here, but I was told I should post each one separately] This scheme is highly ...
0answers
29 views

### Ring signatures in ECC

Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret ...
0answers
27 views

### How many bits of entropy can I expect from /dev/urandom in iOS?

Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and ...
0answers
31 views

### Discrete log in Galois Extension Field

I was reading 'Pinocchio Coin' paper by Danezis et al. where they have said, "If we use the efficient pairing groups of Pinocchio, computing discrete logarithms in the exponent field $\mathbb{F}_p$ ...
1answer
67 views

### Finding public exponent e

I'm trying to create an algorithm to find the public exponent e given a plain (non-CRT) private key that doesn't include the public exponent, i.e. I've only got $n$ and $d$. A question has already ...
1answer
28 views

### How to calculate RSA CRT parameters from public key and private exponent

Given the public key (n, e) and private exponent (d), how to calculate CRT parameters (p, q, dP, dQ, and qInv) of this RSA key pair?
2answers
51 views

### Is it practical to use a stream cipher in a block cipher mode?

My idea is to use a stream cipher encrypting 16 bytes at a time as a primative block cipher in a mode of operation such as CBC mode. Is this practical or useful in any way?
0answers
26 views

### Why don't we have hardware generate NON-pseudo, but REAL random numbers from meta-stable flip-flops? [on hold]

Software pseudo-random numbers can always be cracked because they are based on a seed and therefore deterministic. Therefore, why depend on anything that's deterministic for security? The only real ...
0answers
17 views

### public key for encrypting and both private and group key for decrypting [on hold]

A document is ecncrypted using publickey within a group(consists of many users with single public key and individual private key),then how to decrypt the document by using both public key and private ...
0answers
56 views

### Name of this attack?

I am studying Merkle tree signature. Let $\sigma=(s,Y_s,\sigma_{\text{OTS}},As)$ be a signature of certain document. Here $s$ is the index of leaf, $Y_s$ is the respectively OTS public key and $A_s$ ...
1answer
38 views

### Using ECB as encryption mode, but encrypted messages are unique

As I understand, ECB should not be used as encryption mode unless you are encrypting single blocks of data which are always unique and only are encrypted once. I have a collection of ids represented ...
1answer
30 views

### Are pseudorandom permutation really permutation in mathematical sense?

In security, and specifically Block Cipher (AES, DES, etc), when we talk about pseudo random permutations, is the term "permutation" refer to the same meaning as in discrete mathematics. That is, the ...
0answers
25 views

### Can you find the search space? [duplicate]

Let A is a random number and has 512 bits.we make B from A and B has 1024 bits.Process of B is following: C=f(A) that f is hash and C has 160 bits.Then C pass in a parallel manner 7 different hash ...
1answer
37 views

### Compacting a substitution cipher key

In a substitution cipher, I recieve 3 bits and than I return another 3 bits. The key of this cipher could be a matrix represented as: ...
1answer
55 views

### Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block?

The most promising of the 4 approaches described here (version 4) has been posted as a separate question. This post should be considered for archiving and historical purposes only. Disclaimer: the ...
2answers
40 views

### Would this method allow fast authenticated encryption using only a single encryption operation per block?

[This approach is flawed. A different speculative approach using an RNG instead of the cipher as a source of entropy was posted as a separate question] Assume $E$ is a block cipher, $C_0 = IV$ and ...
2answers
178 views

### Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?

Encrypt-then-Authenticate (EtA) seems to generally be considered the better option, compared to Authenticate-then-Encrypt (AtE) (see this Crypto.SE question, for example). The people writing the RFC ...
1answer
18 views

### Why do we truncate the hash when using DSA?

All the articles I read on the web about DSA keep telling me that the size of the hash needs to be truncated so that the bit length is equal to or lesser than the bit length of the prime number of the ...
1answer
33 views

### Executing encrypted code? [on hold]

I want a code 'black box' that receives data inputs, processes those inputs, then sends out the outputs. I want the code to be encrypted, or somehow obfuscated. Is there any known way to do achieve ...
1answer
147 views

### RSA with probable primes

I am a bit of a newbie to RSA encryption, so please be patient. I understand that for a 4096 bit RSA, the numbers p and q should be prime. And to have the best security, the p and q should both be ...
1answer
26 views

### Can you find the search space?

Let $A$ is a random number and has $512$ bits.we make $B$ from $A$ and $B$ has $1024$ bits.Process of $B$ is following: $C=f(A)$ that $f$ is hash and $C$ has $160$ bits.Then $C$ pass in a ...
0answers
44 views

### Product of Sophie Germain Primes and safe primes [on hold]

I am testing the use of the product of 1024 bit safe primes as the RSA modulus, starting with Sophie Germain primes times their associated safe prime and the product of two sequential safe primes ...
0answers
28 views

### Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
1answer
28 views

### Does the One Time Pad rely on confusion or diffusion?

From what I could research, XORing a random key adds confusion. But I do not undertand the rationale for that classification. Shannon's confusion is supposed to obscure the relationship between the ...
0answers
15 views

### Can Wireshark be used to trace SSL traffic to a server with DSA private key?

I tried to use wireshark to watch cipher negotiation between browser and a Tomcat server which uses DSA private key. and I got the following debug message: ...
3answers
153 views
+100

### How to prove that someone encrypted a specific (large) chunk of data

Alice encrypts her data with HER secret key. Then she sends the encrypted data to Bob who should encrypt it with HIS secret key. Caroline should then eventually get this double encrypted data. ...
0answers
20 views

### A software for test and performance analysis of cryptographic algorithms

I'm new to cryptography and I have been assigned at college to do a comparison study between AES, DES, RC6 and SERPENT ciphers. Is there any graphical software than can help me analyze speed and ...
1answer
31 views

### Huffman encoding of hashes

I have a huge list of MD5 hashes, which takes up quite some space. I was wondering if I would acheive (some) compression, by encoding the characters (which are A-F 0-9), with huffman coding. I made a ...
0answers
27 views

### Curve41417 example

I have done an example, attached as image file, of the algorithm in Curve41417 by Daniel J. Bernstein et al. but my answer is not correct. I have checked it multiple times but couldn't find the ...
1answer
34 views

### HKDF entropy extraction

I collect entropy from the following sources: system_entropy = System provided crypto entropy stream (CryptGenRandom on Windows) user_entropy = User-provided entropy - in a form of a byte stream of ...
1answer
40 views

### possible MITM attack against servers that used to support weak DH?

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid ...
1answer
28 views

### Attacking CBC with predictable but encrypted IV

Let P be a secure block cipher, eg AES-128. Let's say a server has a CBC encryption oracle which uses an attacker-selected yet unique nonce to generate the IV for each message = P(key, nonce). The ...
1answer
89 views

### Logjam on Elliptic Curves?

I think we're all aware of the Logjam attack. From now on we know that re-using primes for DH is a bad idea. But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
2answers
26 views

### Can a TLS client perform any DH regeneration?

I have only the barest understanding of cryptography, but I've been following the Logjam issue; some posts and articles (elsewhere) imply that a client can regenerate DH keys. Is Logjam solely a ...
0answers
38 views

### Factorization of a number obtained by a modular multiplication operation can reveal factors of the used operands?

Consider a number $r$ obtained by: $r=a \cdot b \mod n$ Can knowing the factorization of $r$ reveal some information (bits) of $a$ and $b$ ?
1answer
24 views

1answer
47 views

### Hash length extension attack - SHA256 to 512 - impossible, correct?

Just want to be sure about something before I sign off on a method we're about to put into place. We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the ...

15 30 50 per page