# All Questions

2answers
6k views

### What is the difference between MAC and HMAC?

In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
2answers
184 views

### Is solving a modular linear equation a hard problem when the coefficient is not an invertible element?

Assume that we have a linear equation like this: $$ax=b \pmod n$$ when $x$ is the unknown, and $a$ is not an invertible element in $n$. is finding $x$ a hard problem? (by solving I mean finding an ...
3answers
698 views

### What goals is homomorphic encryption aiming to solve?

As I understand from this article about homomorphic encryption, it mainly aims to enhance the security of cloud computing. We should be able to encrypt data and send it to the cloud. After it is send, ...
1answer
276 views

### How to secure a mental poker protocol? [closed]

I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
2answers
574 views

### Simple RC4 key generation scheme

I would like to ask you about your opinion on the following scheme of combining a master key and a nonce and stretching the result to the full 256-bytes RC4 key. Master key $K_m$ is a pre-shared ...
3answers
338 views

### Why do we assume un-security of communication channel on every cryptography system

While reading about a few cryptographic systems, I noticed that we always assume the communication channel is not secured. Why is this assumption made? And, why the effort is being put into designing ...
2answers
362 views

### While generating a random Elliptic curve what are the conditions i have to considerd?

I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy? For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a ...
1answer
163 views

### How to solve the reverse of an equation that uses MOD?

I've been tasked with reverse engineering an unknown crypto function. The function uses the following constants: $a=380951$: I noticed that this is a prime number $b=3182$: I noted that this is a ...
1answer
137 views

### In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?

See this question. The comment by Brett Hale stated: On the other hand, ensuring $(p - 1)$ has a large prime factor requires very little extra effort. What's actually the 'little extra effort'?
2answers
217 views

### Is it safe for the ChaCha8 nonce to be deterministic?

ChaCha8 takes a 8 byte nonce (or IV) that should not be the same twice for the same key. Generating this nonce randomly makes me very very nervous for collisions. Is it safe to generate this nonce ...
1answer
70 views

Assume that we have an already assigned Multiplicative Cyclic Group $\mathbb Z_p^*$ with order $q=p-1$, and $p$ is a prime number, is it possible to create a bilinear function $\hat{e}: \mathbb Z_p^* ... 0answers 137 views ### Unique GCM/CCM initial counters without recipient side message counters I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ... 1answer 432 views ### Are RSA signatures deterministic? If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, do I always will have the same signature? A Java example always return ... 0answers 86 views ### Is SHA-1 collision free on data up to 20 bytes long? [duplicate] Is SHA-1 collision free on data up to 20 bytes long (lenght of hash / internal state)? That means that every input produce unique output, but you surely know that, i just write it in order my question ... 2answers 343 views ### Is SHA-1 still practical secure under specific scenarios? It is conjectured that SHA-1 has been broken from the "research" perspective but no in real world. That is that there is an algebraic attack that explores weaknesses on its algrebraic construction. ... 1answer 332 views ### Question about why RSA is hard to attack I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ... 1answer 385 views ### Generate an insecure public / private key pair I am looking for a way to generate an "insecure" public key pair. and by insecure I actually mean a pair that is breakable using brute-force (or other encryption) methods. As far as I know PGP ... 1answer 401 views ### Why are RSA keys encoded with ASN.1 for TLS? Browser vendors use ASN.1 encoding for RSA certificates in the TLS protocol. RSA public keys are just a number, so why do we need encode them to something else? That increases the risk of security ... 3answers 1k views ### Why is RSA encryption significantly faster than decryption? I am designing an implementation of RSA . I recorded computation times in Java by using System.currentTimeMillis(). It returned an encryption time of 0.05 ms and ... 1answer 282 views ### Questions about proof of correct encryption in the Paillier cryptosystem In the Paillier cryptosystem [1] the encryption of$m \in \mathbb{Z}_N$with randomness$r \in \mathbb{Z}_n^*$is$c = g^m r^n \bmod{n^2}$. A proof of correct encryption could look like presented in ... 0answers 168 views ### Why do we need to hash both the message and the$h$value in ElGamal signature? The professor left us a question on ElGamal signatures: Given the hash function$H$and message$M$, choose a random$r$and compute$h=g^r$and$H(M||h)$. Show that, if$H(M)$is used instead of ... 1answer 1k views ### Can I find two specific words with the same md5 hash? I want to find two strings containing special words like "yes" or "no", mixed with random characters, for which the MD5 hash is equal. An example of what I'm looking for: ... 3answers 618 views ### What is the difference between a HMAC and a hash of data? On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data. What exactly is the difference between an HMAC and a hash of a ... 1answer 129 views ### Padding always the same, problem or not? I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm. My problem is that I split the message into ... 1answer 155 views ### What information to include when calculating the HMAC of ciphertext I'm aware that it's crucial to include the IV when calculating the HMAC of a ciphertext (assuming an IV is used). Can anyone explain, in simple terms, why this is? Furthermore, assume that there is ... 4answers 324 views ### Bad/Crackable Encryption Example? I've been tasked with building up some security exercises (basic CTF training kind of stuff) for work. This should contain a bit of crypto, but my knowledge in this space has been limited to using the ... 1answer 298 views ### How to generate a random polynomial of degree$m$? I am trying to do a homework in which implement a variation of this paper and I don't know how to generate a polynomial of degree$m-1$. This polynomial is used to generate the$y_0$and$y_1$values. ... 1answer 1k views ### Which one is fastest? Karatsuba or Montgomery multiplication? Is there any complexity analysis between Karatsuba and Montgomery multiplication algorithms? It seems that Karatsuba is more general in the sense that is not modulo tuned while Montgomery it is. Does ... 2answers 741 views ### Deriving HMAC key and cipher key from passphrase? [duplicate] I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ... 1answer 313 views ### Nonce role on stream ciphers Modern stream ciphers usually predicts the usage of a nonce (also termed as IV) in the cryptosystem. The cost of initializing the cipher with the nonce varies from algorithm to algorithm (for ... 0answers 83 views ### Strong RSA problem in$\mathbb Z^*_{n^2}$Comparing to this question, assume$C, M \in \mathbb Z^*_{n^2}$,$e \ge 3$, is it hard to compute$M$that satisfies$C=M^e \mod n^2$when$C$and$(n, e)$are given? 1answer 112 views ### How hard are discrete logarithms problems in$\mathbb Z^{*}_{n}$and$\mathbb Z^{*}_{n^2}$, where$n$is the RSA$n=pq$Use the notations form the Wikipedia article Paillier Cryptosystem , assume that the chipertext$c$and$c^{\lambda} \mod n^2$are both given, is it possible to compute$\lambda$easily? 1answer 164 views ### Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model? First of all, the Guillou-Quisquater digital signature scheme is: Note everything is$\bmod n$. Message is denoted by$m$. Private key:$s$Public key: Hash function$H$,$e$, ... 2answers 949 views ### Fastest multiplication algorithm for efficient exponentiation in C++? First I apologize if this question is better tailored for SO, but since I'm using the method for crypto stuff, I thought I'd ask anybody that might know here. Karatsuba algorithm does a pretty good ... 1answer 400 views ### Digital signatures in SSL/TLS-like protocols The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ... 1answer 2k views ### From hash to Cryptographic hash After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for MAC usage, due to a certain type of DDos attack ... 1answer 205 views ### Is the following key stretching algorithm as memory hard as I think it is? I'm having some fun designing a key stretching algorithm that can be implemented in pure Python. It's built entirely out of the standard library's hash functions in an attempt to at least wrest some ... 2answers 292 views ### Computational indistinguishability and example of non polynomial algorithm The wikipedia page on computational indistinguishability says that two ensembles are not distinguishable if "any non-uniform probabilistic polynomial time algorithm A" cannot tell them apart. To help ... 2answers 249 views ### homomorphic encryption special case of multi party computation? I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ... 2answers 638 views ### Is storing original file size in an encrypted file header a bad idea? I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ... 2answers 1k views ### Validating successful decryption in AES I have a program which uses AES-256 in CBC mode to encrypt and decrypt files. As I have quickly realized, AES will even use an incorrect passphrase to decrypt data, which leaves me with no way to ... 0answers 48 views ### Is there a way to analyse xxHash and tell, either by human analysis, or with an automated tool, that this hash function is or is not cryptographic? [duplicate] After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for Internet usage, due to a certain type of DDos attack ... 1answer 1k views ### AES key/ciphertext space sizes This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit ... 1answer 182 views ### Why is Blum-Goldwasser not IND-CCA-2 secure? Consider the Blum-Goldwasser encryption scheme as described on Wikipedia. I was told that it was not IND-CCA-2 secure. I heard there was malleabilty, probably it has to do with XOR-ing. But I do not ... 1answer 77 views ### Could use an explanation of the notation for an oracle adversary In the definition below, what exactly does it mean for the adversary (not even sure that's the correct term?) to equal one? $$\underset{K}{Pr} \left [A^{F_k(\cdot)} = 1 \right ]$$ Source (Page ... 0answers 78 views ### How can I validate generated session keys in SRP-6a protocol I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys. On the client I generated a SHA1 ... 1answer 831 views ### How does Output Feedback mode use the initialization vector? How can I process Initialization Vector inside the Block Cipher Encryption box (using for example AES) together with the Key? Will I encrypt the Initialization Vector like a block of plaintext? So ... 1answer 1k views ### Use of CBC-AES-256 to encrypt usernames I came across some code in our project that encrypts usernames (limited to 50 chars, most are less than 10) using the following parameters: IV size is 16 bytes Key size is 32 bytes Algorithm is ... 2answers 335 views ### AES encryption with shared IV Sorry about the horrible title, didn't now what to say. I'm trying to avoid having to send an IV with every message purely to keep packet sizes down, so I thought of a method to establish a "IV ... 2answers 402 views ### Number of states in a LFSR Do all$2^{\ell}$(where$\ell\$ is the bit length of the shift register) states always occur in a LFSR or can I choose my taps badly so some states are skipped and the period is shortened? If so is ...

15 30 50 per page