# All Questions

82 views

### Probability of SHA256 Collisions for Certain Amount of Hashed Values

I wonder if you can help me figure out that question: Is there a known probability function f: N -> [0,1], that computes the probability of a sha256 collision for a certain amount of values to be ...
321 views

### Key sizes supported by 3DES

I read about 3DES encryption but I don't understand exactly what the specific meaning of key size is. For example I found that 3DES supports 64, 128, 192, and 256 bits key size. What are all the ...
89 views

### Regarding NTRU homomorphic properties

NTRU has some homomorphic properties modulo q, supporting both addition and multiplication. Due to its nature, it cannot support many of them. My main focus currently is in the addition, so the ...
112 views

### NTRU Encryption

It's using Euclidian inverse. Can you show it step by step? $$N=7, q=11, a = 3+2X^2 -3X^4 +X^6$$ the inverse of $a \pmod {11}$ is $$A=-2+4X+2X^2 +4X^3 -4X^4 +2X^5 -2X^6$$ How do we compute $A$?
98 views

### Replacing the PRF in PBKDF2 with Keccak

I am unable to find a reliable, tested library for a decent password based key derivation function e.g. Scrypt in the programming language I am using, but I have a reliable library for PBKDF2 (which ...
75 views

### Is it safe to prefix the a key with a known value?

Almost every encryption algorithm is based on a secret key. I wonder when the algorithm is considered safe, does that also imply that I can prefix (or suffix) the key with a known value, as long as ...
36 views

### Determining nonce between unsynced systems

It's my first venture into cryptography, and I'm struggling with how to use a nonce in an encryption standard between two digital radios. The two radios support AES encryption, only requiring a ...
64 views

### Security of integrity protection with HMAC vs AEAD

I'd like to know how the security of the integrity protection compares between: HMAC-SHA-256 with an 32 byte tag or a truncated 16 byte tag AES-GCM with a 16 byte tag AES-CCM with a 16 byte tag or ...
167 views

### Problem with testing MD5 collisions

I am trying to test MD5 collisions presented in “Collisions for Hash Functions MD4, MD5, HAVA” (PDF) by Xiaoyun Wang, Dengguo Feng, Xuejia Lai, Hongbo Yu; 2004. I wrote a PHP script to test it, but ...
108 views

### Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?

I am looking at the Koblitz method for encoding a message as an elliptic curve point. The first step given in the paper I'm reading is: "Choose an elliptic curve and its associated auxiliary base ...
60 views

### How to choose the integer m in the general number field sieve (GNFS)?

Given an integer you want to factor $N$, GNFS starts by selecting a monic irreducible polynomial $f \in \mathbb{Z}[X]$ and an integer $m$ such that $f(m) \equiv 0 \text{ mod } N$. In practice, if $m$ ...
86 views

### How does ccrypt work?

On many Linux/GNU distributions CCrypt (ccrypt) by Peter Selinger is available as a command line utility to encrypt files. How does the protocol work and is it ...
141 views

### ccrypt and its security

I would like to know how secure is ccrypt to encrypt files (like images, videos and other non-plain text data) using single password of 20+ chars length. It uses Rijndael with 256-bit block size and ...
221 views

### How does knowing the factorization of N help to obtain the secret?

Assuming $x=a^2 \pmod n$ and knowing $x$, $p$, $q$ how is it possible to obtain $a$?
74 views

### Send an encrypted question and return answer without decryption

Oke bear with me for a minute. Once upon a time someone mentioned a hypothetical way where you would send an encrypted question to Google and Google would return an answer without decrypting it. As ...
653 views

### Multiple private keys for single public key

I am currently working in security in mobile ad-hoc networks. I have several clusters, and I want to send some data encrypted with its public key, from the cluster head to the cluster members. I ...
60 views

### LUKS multiple key slots - what's the intuition?

LUKS volumes have the ability to allow multiple independently usable passwords, as explained here: [https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions] The intuition behind basic ...
261 views

### Is cryptanalysis of CTB-Locker really impossible?

It seems that CTB-Locker make a lot of victims nowadays, and yet, the full encryption scheme of it is now publicly known [1,2]. Would any of you could find a weakness to exploit in this encryption ...
111 views

### IV's for different AES encryption modes

I wanted to know if my understanding is correct! I have been reading up on aes encryption and modes(specifically CTR and CBC) and it took me sometime to understand the concept of IV. If the IV is ...
64 views

### How to store and use a Cryptographic Seed in a database [closed]

Companies such as Barclays use cryptographic seeds (for their PINsentry system), RSA do the same for RSA SecurID, but how do they safely secure the seeds in the database. With passwords you just hash ...
52 views

### How does the attacker include input before compression and encryption in CRIME?

I have read this article about the CRIME attack against TLS and SPDY. The article says that: What is not yet clear is how the attacker is including their input in the source material before it ...
108 views

### Generic name for (?hash) functions of form $\{0,1\}^n \rightarrow \{0,1\}^{poly(n)}$

Consider a function $$f: \{0,1\}^n \rightarrow \{0,1\}^{poly(n)}$$ with the following properties: hard to invert, i.e. given $f(x)$, hard to find $x$ hard to find a collision, i.e given $f(x)$, ...
134 views

### Diffie-Hellman Application

Alice and Bob want to perform a Diffie-Hellman key exchange using the group $G$, a primitive root $g$, Alice’s secret key $k_A$ and Bob’s secret key $k_B$. In each case below compute the element of ...
236 views

### CBC-MAC: is it secure to authenticate a fixed length ciphertext?

Suppose I have a fixed-length arbitrary ciphertext. To authenticate such ciphertext: I generate a random AES Key $K_{auth}$. Then I compute the CBC-MAC Tag of the ciphertext with $K_{auth}$. ...
164 views

I have recently been playing with Chacha20-Poly1305 with libsodium, and all of the examples state the additional data portion of the tag is stored in plaintext when encrypted. But from what I can tell ...
78 views

### Can you exchange a shared key without any hardness assumptions?

Imagine that P=NP, and one way functions don't exist. Can two people end up with a random shared key of arbitrary length, if every exchange is public? They have true RNGs, and know who they are ...
47 views

### Automatic generation of secure passwords with the least inconvenience for a user

I'm working on a web site for a private company that should allow them to upload files, which will be later retrieved by their affiliates. The site will be available from a public Internet using ...
79 views

### ElGamal and Schnorr groups

As I gather, a normal practice for choosing a cyclic group for ElGamal key generation is to find a safe prime $p$ and use a multiplicative cyclic group with modulus $p$ and order $q = (p-1)/2$. ...
128 views

### Simple message authentication code

I used to figure that message authentication codes function like digital signatures: a hash of a message is calculated and then encrypted with a secret key. To verify the authenticity of a message, ...
323 views

### Is it an example of bilinear pairing?

Consider a bilinear pairing $e: G_1 \times G_2 \rightarrow G_T$. Let's assume, $G_1 = G_2 = G_T = (\mathbb{Z}_n,+)$, i.e. additive group of integer modulo $n$ and $e(x,y) = xy$ mod $n$. Isn't it an ...
157 views

### open source whitebox-crypto implementation

I am trying to code a simple WBC situation to help my understanding about white-box cryptography. Details: I have 2 programs, a "server" and a "client", the server utilises caesar cipher (key = 2) ...
51 views

### Confused with the role of AES round keys

AES works when each plaintext block is arranged in a 4x4 array of bytes called states. State goes through 10 rounds of encryption consisting of 4 operations: bytesub, shiftrow, mix columns and add ...
38 views

### TimeStamp in Cache-time attacks on AES [closed]

I have recently read about AES cache timing attacks. More specifically, I read Daniel Bernstein paper Cache-timing attacks on AES. I have a question about the code in Appendix A: ...
114 views

### What is the importance of adding round key in AES

I know this may not be the place to ask this but I have found it difficult to find an answer to this question. I know the steps of the AES encryption algorithm but I am finding it difficult to ...
236 views

### What is the algorithm behind PasswordDeriveBytes?

Microsoft has created an implementation of PBKDF1 in the PasswordDeriveBytes class. It can however generate more bytes than PBKDF1, which is limited to the number ...
165 views

### How to roll my own hardware RNG?

I am considering building a hardware RNG myself using cheap parts. Is this a good idea and safe enough? Random sources: amplified Zener noise from one randomly chosen ...
77 views

### Post processing of AAD and len A||C in a hardware AES GCM implementation

I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design ...
115 views

### Luby-Rackoff on Feistel ciphers [closed]

On page 46 of these lecture notes, it seems to say that if we have a Feistel cipher, and plaintexts $(L_0, R_0)$ and $(L_0^*, R_0^*)$ with corresponding encryptions, then we can determine the key? But ...
136 views

### test vectors for 3DES seem to in fact be testing DES - not 3DES

NIST SP 800-20 Appendix A has what presumably are supposed to be test vectors for 3DES except almost all of the test vectors utilize 8-byte keys and not the 24-byte keys that 3DES is supposed to have. ...
63 views

I figured that a really secure password would be an AES 128 key. If this key were to be base 64 encoded, I could replace 4 random bytes in it in order to make it unusable unless you know which bytes ...
76 views

### Perfect secrecy of a crypto system

Suppose we have the following crypto system: $P = C = K = \{0, 1, . . . , n − 1\}$, $E_k(x) = (x + k) \bmod n$ and $D_k(y) = (y − k) \bmod n$. Prove that the crytosystem has perfect secrecy. Perfect ...
93 views

### RSA Protocol behind Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
99 views

### Why do we have fixed output length in the algorithm SHA1

Why do we have fixed output length in the algorithm SHA1 . is there any explanation about that
98 views

### RSA-blind signatures vs. DSA-blind signatures

I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to ...
69 views

### Reduced message expansion in NTRU

In the original NTRU proposal from 1998, it says on page 16: It may be worth mentioning, though, that there is a simple. masking technique that can be used to significantly reduce message ...
43 views

### Use of the master key in Delerablée's Identity-based Broadcast Encryption

I'm reading “Identity-Based Broadcast Encryption with Constant Size Ciphertexts and Private Keys” by Cécile Delerablée. On page 207, the encryption process needs $\gamma$ which is part of the master ...
55 views

### What is the functional role of CKY-I and CKY-R in ISAKMP (IKEv1)?

According to RFC 2409: CKY-I and CKY-R are the Initiator's cookie and the Responder's cookie, respectively, from the ISAKMP header. Each CKY is a 64 bit value that is included in each ISAKMP ...
85 views

### Retrieve timestamp from TOTP value

TOTP (Time-based One-Time Password) as I understand is an algorithm that uses the current time as a variable along with a shared key to generate a secured token. Wiki page for reference: ...