# All Questions

163 views

### Associative but NOT Commutative Reducing Function Construction with Existing Hash Function(s)

Is it possible to construct a binary reducing function based on any existing cryptographic hash function satisfying the associative property but not the commutative property? So formally: Using an ...
2k views

### Chosen plaintext vs Chosen ciphertext

What is the difference between chosen plaintext and chosen ciphertext attack? In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?
4k views

### Why are primes important for encryption

Why are primes so important? Why can't we just use a random number? My guess is that it's because finding a random prime require more computing power, than finding a random number. Can anybody confirm ...
147 views

### Security concern about reducing hash value using modulo operation

As stated in the title, what I am looking for is information about a "technique" that I would like to use in some of my algorithms. Sometimes I need to map a hash function's result into a range of ...
294 views

### test vectors for 3DES seem to in fact be testing DES - not 3DES

NIST SP 800-20 Appendix A has what presumably are supposed to be test vectors for 3DES except almost all of the test vectors utilize 8-byte keys and not the 24-byte keys that 3DES is supposed to have. ...
213 views

### Modular Reduction of polynomials in GF(2^m)

Hello I am having trouble understanding the algorithm implementation in hardware of the reduction process over galois fields of F(2^163) In the following process it ...
4k views

686 views

### Implement deniable encryption with AES/RSA

I'm on a crypto app using OpenSSL (I'm more an implementer/cryptographer than a cryptologist), mainly as a hobby, for now. My app will be able to encrypt a file (not a container) with symmetric or ...
64 views

### Obliviously computing the Least common multiple of two poylnomials

Consider I have two polynomials $f_1$ and $f_2$ of the same degree. I want to secure them (using any kind of encryption except FHE) and outsource them to an untrusted server. I want him to compute the ...
696 views

### PBKDF vs HKDF for pretty long key

I'm developing a messenger application with encrypted chats. In the first version of the app I've used PBKDF2 (10000 iterations, SHA1, random salt) to extend a short user password and generate keys ...
91 views

### Encrypting decryption key

What's that property called when a scheme is secure even if you encrypt the decryption key? Some schemes have problems when your plaintext is the decryption key (or just the key if symmetric).
125 views

### Does a cryptosystem provide unconditional security if and only if it provides perfect secrecy?

Is unconditional security and perfect secrecy one and the same thing, i.e a cryptosystem provides unconditional security if and only if it provides perfect secrecy ? I've wondered about the above and ...
302 views

### How were shift amount constants in MD5 found?

The md5 specification gives a series of 4 rounds to execute over a 16-word block. Each round has a repeating sequence of 4 shift amounts (s in ...
73 views

### Viability of an “Unconventional” Hashing Scheme?

I am playing around with the following hashing scheme: Start with a domain string (same for all users), Allow every user to mutate it in any way defining their own custom replacement rules, Append ...
170 views

### Specific example of a MAC in TLS?

This seems like quite a dumb question, but I really don't know if I'm finding a answer anywhere. I understand that if i access a website that is secured with TLS, we exchange ciphersuites and so on, ...
90 views

### For which RSA moduli, precisely, is $e=d$ for all $e$?

This question shows that there are at least two valid RSA moduli $n$, namely $35$ and $91$, such that for any $e$ coprime to $\lambda(n)$, $$e^2\equiv1\mod\lambda(n)\text.$$ Reading the linked ...
204 views

### Polynomial division hardware implementation

I am beginning the implementation of the polynomial binary division algorithm now as I understood i will be checking the MSB bit if 1 to XOR and shift the sum if 0 i will only shift. What I am not ...
218 views

### Best hash-algorithm [closed]

What is the most secure hash-algorithm. Can you also give the second best and the third best like this: 1. Test 2. test 3. TEST I dont care about the performance
453 views

### Alternative encryption algorithm

I need a alternative encryption alcorithm to AES. It shouldn't be AES, Twofish or Serpent and it must be very strong. I dont care about the performance.
69 views

I figured that a really secure password would be an AES 128 key. If this key were to be base 64 encoded, I could replace 4 random bytes in it in order to make it unusable unless you know which bytes ...
68 views

### Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption?

Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption ? I know that the one-time-pad doesn't have perfect secrecy and doesn't provide ...
161 views

### OpenSSL des-ede3 not producing same output as test vector implies it should be

I'm encrypting one of the standard TDEA/3DES/DES-EDE test vectors with openssl: ...
84 views

### Post-quantum hybrid encryption

Assume the following simplified protocol: seed = curve25519SharedKey(theirPublicKey, myPrivateKey) sharedKey = scrypt(seed, salt, sufficientlyHardWorkFactors...) cipherText = aes256(sharedKey, ...
150 views

### Formal relationship between encryption and random number generators?

Cryptographically secure random number generators seem to have similar properties to symmetric encryption: initial seed is permuted to produce a random numbers (key and ciphertext) given the seed, ...
195 views

### How to implement homomorphic multiplication for Elgamal?

I want to add the homomorphic property to Elgamal in libgcrypt. This is the core code I added to the library. ...
206 views

### How to use ElGamal to encrypt zero?

ElGamal encryption algorithm is as follows: To encrypt a value $m$, it chooses a random value $r$, and calculates $c_1=g^r$ $mod$ $q$ $c_2=m*h^r$ $mod$ $q$ where $g$ is the group generator, $x$ is ...
111 views

### To prove $r \cdot f_1 +f_2 \cdot (s+1)$ is secure

We define the polynomials $r, f_1,f_2,s \in R[x]$. Where $r$ is a random degree 1 polynomial and $s$ is a random polynomial such that: $degree(s)=degree(f_1)=degree(f_2)$, let $R$ be $\mathbb{Z}_p$ ...
114 views

### Are there signatures that don't have subliminal channels?

Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs? DSA or Shorr signatures need a nonce which can leak valuable information. There ...
84 views

### Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the hash....
321 views

### what are the plaintext's for the RC4 stream cipher test vectors in RFC6229?

https://tools.ietf.org/html/rfc6229 has stuff like this: ...
88 views

### What is the fixed point attribute of DES (when used with weak-keys)

I've heard in some lecture that the weak keys in DES implies the existence of $2^{32}$ fixed points in the algorithm, i.e. that $DES_k(x)=x$ for $2^{32}$ such $x$'s. I couldn't find anything about ...
43 views

### The purpose of the final xor in Davies–Meyer scheme [duplicate]

In Davies–Meyer hash construction scheme each block is xor'ed with the previous block cipher text. Why? The only obvious flaw I see in a scheme without this xor is the possibility to reconstruct a ...
99 views

### Security of DES P_BOX

I'm curious about the design of the P_BOX of DES. I found a paper on this topic, but it dates back to 1989. This means the effect of p-box values of the cipher immunity against Differential ...
111 views

### Attacker in a key exchange

I'm having trouble with the following question: $X(A) \rightarrow B:(A,N_X)$ $B \rightarrow X(S):(B,((A,N_X,T_B),K_{BS}),N_B)$ $X(A) \rightarrow B:(((A,N_X,T_B),K_{BS}),(N_B,N_X))$ ...
241 views

### Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
193 views