# All Questions

173 views

### CPA distinguisher for matrix multiplication in GF(256) with randomized padding

What is the best CPA distinguisher for the function $F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$ described below? Let $E_k$ be a $2n\times2n$ matrix with elements in $GF(2^8)$, selected by generating bit ...
180 views

### In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?

In the 1978 RSA paper, it is recommended, among other things, to choose primes $p$ such that $(p-1)$ has a large prime factor $u$. This was motivated by Pollard's p-1 algorithm. Further, the authors ...
300 views

### My custom handshake

I am a beginner in cryptography and I designed a custom handshake between 2 entities $\rm C$ (client) and $\rm S$ (server) which should meet the following requirements: Requirements: The handshake ...
394 views

### Can I use guids / uuids as counters for key derivation?

I have a 512 bit master key, and 128 bit unique identifiers. I'm going to derive 256 bit keys to for use with deterministic and block ciphers. For reference, The KDF I'm going to use is Hash( C | ...
256 views

### Twofish key length

I'm using twofish. Say you have a 120 bit key, is there any difference in using a 128 bit bit keylength or a 256 bit one? Since the most significant digits of the key will be allo zero in both cases, ...
475 views

### RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
749 views

### Predicting PRNG given some of its previous output

I a have a question about PRNGs and this is my very first experience with them. I have the following generator that takes a 56-bit seed $p$ during initialization and then chooses both $X$ and $Y$ ...
800 views

### Efficient and stateless anti-forgery method

One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
341 views

### How are the primes used to generate RSA keys?

I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
976 views

### Crypto-Compression Algorithms?

I was wondering, whether there exist such algorithms/enciphering procedures which both compress and encrypt the input data. That means, for starters, the output will be both smaller in size and ...
287 views

### Is there any known malleability of scrypt outputs?

The scenario is single-use passphrase-based non-interactive message authentication. The obvious try to do this is to chose a random salt of the appropriate length and send: ...
2k views

### Why is the IV passed in the clear when it can be easily encrypted?

The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ...
700 views

### Encryption algorithm that produces dummy output on incorrect passwords

Background: I've been thinking about using encryption in the context of backing up files to untrusted locations (to the point of making the file publicly and widely distributed for practically ...
1k views

### Symmetric vs. Asymmetric cryptographic approaches to data security

I know the basic differences between Symmetric vs. Asymmetric cryptography, but I'd love to know more details: Exactly why is the asymmetric approach slower than the symmetric? Why does it make ...
868 views

### Can I use a one time pad key twice with random plaintext?

I understand the basics of OTP: $|\text{key space}| = |\text{plaintext space}|$ implies perfect security, key reuse destroys this. Cryptanalysis on the $N$-Time Pad for $N > 1$ involves finding ...
650 views

### ECC algorithm pollard's $\rho$ complexity

One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
186 views

### Can the premaster secret generated by SRP be used as a secure private key?

It seems like the pre-master secret generated during the SRP protocol would make a good source to generate a shared private key using a secure hash to compress it down into a 128/256 symmetric key. ...
1k views

### Trouble with diffie-hellman groups

Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is ...
231 views

### Cryptographically strong pseudo-random seq. generators

If a pseudo-random sequence generator is built so that it uses an n-bit seed and outputs a string that is of length x. Let's say one wants to generate a bit string of length y and uses the previous ...
50k views

### How secure is AES-256?

The cipher AES-256 is used among other places in TSL/SSL across the Internet. It's considered among the top ciphers. In theory it's not crackable since the combinations of keys are massive. Although ...
22k views

### How does one attack a two-time pad (i.e. one time pad with key reuse)?

My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need. I am new to ...
272 views

### Implementing Paillier Signature Scheme in Delphi

I've been trying to implement the Paillier Signature Scheme in Delphi, but I can't get it to work and I don't know where the problem is. First of all, I got my info about the scheme from this paper. ...
3k views

### Cryptographic security of PHP mt_rand() function using Mersenne Twister algo

At stackoverflow this question has been asked. It uses additional random entropy and a hash method (among others) to try and create a cryptographically secure pseudo-random number generator for PHP. ...
267 views

### What challenge should I use in a challenge-response proof-of-work?

In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them. Client connects Server ...
837 views

### Do Rabin Fingerprints have any advantages over CRC?

Background In both, bitstrings are interpreted as a polnomical over GF(2) and they each can be used to implement a hash over a sliding window. The definitions of each are as follows: Rabin ...
482 views

### Does AES specify error messages when using the wrong password to decrypt?

I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do ...
710 views

### RC4 : Keystream reconstruction?

First up: it's a step in some challenge found on the Internet, where we get an application and a file. The application must be feed with that file and a password (the password is the flag for the ...
9k views

### What are the advantages of TOTP over HOTP?

HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What ...
382 views

### Does AES with whitening mode have the following property?

This mode is that each time a random number $K$ is generated, you XOR it with plaintext $M$ and then pass the result to AES. Since AES is a pseudo random permutation, does AES have the following ...
932 views

### Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
335 views

### Are there any Implementations of Secure Indexes? [closed]

There are several papers about Secure Indexes, for Example "Searchable Symmetric Encryption: Improved Definitions and Efficient Constructions" and "Secure Indexes". ...
75 views

Suppose you need to authenticate yourself to a program with the password - but the program's source code is public, the program doesn't have access to any private information and all your ...
406 views

### Can a user of a password-protected Wi-Fi sniff on other user's communication?

Imagine a Wi-Fi network protected by WEP/WPA/WPA2. Users can join the network in case they know the pre-shared key of the access point. Is it possible for a user A (who has successfully logged into ...
342 views

### Openssl implementation of improved sha1 hashing [closed]

I want to use the improved sha1 hashing algorithm from the Intel blog described here Intel sha1 hashing. Currently I am using Openssl sha1 hashing in my application. I wanted to know if anybody has ...
405 views

### Making ECDSA public keys one bit shorter

In compressed form, ECDSA public keys are one bit larger than the curve size. There are some situations where this extra bit is extremely inelegant. So I had the following idea as a way to remove it. ...
641 views

### How to authenticate over open channel?

I am making an arduino project to open my garage door. I want to make it so users with the passphrase can open the door. Due to computational restrictions it is unlikely encryption is possible. ...
913 views

### Is RSA padding needed for single recipient, one-time, unique random message?

I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ...
247 views

### ZKIP for Paillier public key correctness

I'm using the Paillier cryptosystem in a protocol similar to mental poker. In the beginning of the protocol, each player generates a Paillier public key $(n,g)$. Later in the protocol, a player may ...
293 views

### Which encodings have |encoding key| >> |decoding key|?

I'm looking for an encoding scheme that requires a very large encoding key E (>10MB) and suffices with a relatively small decoding key ...
875 views

### What is the PRG period of stream ciphers such as RC4 or Salsa20?

I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ...
1k views

### Is compressing data prior to encryption necessary to reduce plaintext redundancy?

As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy. I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
216 views

### BigInteger in Java and Randomness

I'm looking for some PRNGs and – as I have been using Java for a long period of time – I thought that the BitInteger class, together with the ...
96 views

### Educational videos for security topics [closed]

Is there anything like the famous "sorting out sorting" video in cryptography/security. I am looking for some nice videos that explaines SSL, SET, IPSec, PGP, S/MIME ....
2k views

### How to calculate an IV when I have a shared private key?

I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
276 views

### Factoring a polynomial over a GF [closed]

I have the following question: What polynomial, when factored over the field $GF (2^8)$ based on the irreducible polynomial that is used in Rijndael, will factor into all the polynomials in the ...
205 views

### Is a subset of a random set still random?

Suppose you have an infinite list of random bytes, and you select the first N bytes that correspond to printable ASCII characters. Is this list of N bytes still as secure (e.g. for the purpose of a ...
365 views

### Checking a key before actually using it

I have a block of data crypted using twofish with a key of 128 bit. The data must be accessed from a GUI, the user gives the key, the block is decoded and the real data is accessed. Problem is that ...
655 views

### How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?

I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...