# All Questions

57 views

### Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
63 views

### Majority encryption algorithm?

Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense: For some fixed $k < n$ every ...
54 views

### Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
178 views

### What is the meaning of IND-CCA secure under standard model? [duplicate]

I notice that in many research papers (viz. "Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption" by Cramer and Shoup) the authors showed that their ...
27 views

### Weaknesses of RSA for $e_A\neq e_B: \gcd(e_A,e_B)=1$ [duplicate]

If two people, A and B, are using a common RSA modulus N, and they select distinct exponents $e_A$ and $e_B$, such that they are coprime, why does this mean that someone can decrypt (in polynomial ...
32 views

### Increase in security with increase in size of salt [duplicate]

Does increasing or doubling the size of salt result in improved security? It will require some extra time to brute force the passwords, but any added advantage?
80 views

### Why is 128-bit considered “medium term” security?

Why is 128-bit encryption considered good enough for medium term security only? How is expected to be eventually broken? Quantum computing or brute force attack?
95 views

### Confusion about definition of homomorphic encryption

I am trying to better understand homomorphic encryption, but I feel like I keep getting inconsistent information in the papers that I am reading. One of the papers I am reading says the following: ...
72 views

### Inverting RSA using an oracle

Say you are given an efficient deterministic algorithm 'I' that can invert the RSA function on 1% of the points in $Z^*_{N}$. That is to say that if y $\in$ $Z^*_{N}$ is a "good" point for 'I', ...
99 views

### ElGamal - What if the Decisional Diffie-Hellmann problem could be solved?

I have read that if the DDH problem could be efficiently solved, the IND-CPA would not hold for ElGamal. I don't see why it makes ElGamal less secure if you have $g^a$, $g^b$ and $g^c$
31 views

56 views

### What is the security strength of an n-bit HMAC?

HMACs depend on preimage resistance, or so I have read. The security strength of hash function with an $n$-bit output against collision attacks is $2^{\frac{n}{2}}$. Against preimage attacks, it is ...
27 views

### What is the starting point of Hellman's TMTO method?

I understand what is happening and how the endpoint is computed but I'm still a bit unsure of where "SP" (Staring Point) came from. Are the starting points, randomly selected keys from the key-space ...
243 views

### Is GCM still recommended?

I stumbled across a forum thread where a security researcher seemed to have negative feelings towards GCM. I had always thought from prior readings that GCM was the current gold standard for ...
38 views

### Do I need to use null bytes and \x80 in hash length extension attack?

Say I want to perform a hash length extension attack. All the tools I have used use \x00 and \x80 to pad hashes (hlextend and hashpump). But is it necessary to use these bytes? Based on my ...
27 views

### Composing hash functions

Suppose there is a cryptographic hash function $H : \{0,1\}^* \to \mathbb G$. Now, we want to define a hash function $H' : \{0,1\}^* \to \mathbb G \times \mathbb G$. My first idea is to define $H'$ ...
74 views

### Schnorr signature security level as compared to AES/RSA

As per the Schnorr's original paper (1991), The Security Complexity $2^t$: We wish to choose the parameters $p$, $q$ so that forging a signature or an authentication requires about $2^t$ steps by ...