# All Questions

373 views

For a stream of packets, where each packet is individually encrypted with a block cipher, it's desirable to have each encrypted packet only valid for that position in the stream. A message number ...
104 views

### Signing an integer, which may be increased

I have a 64 bit integer. It has some sort of signature so that one can be sure it is valid. Anyone may increase the integer, update the signature, and remove all trace of the old signature. But it is ...
1k views

### ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here http://www-cs-students.stanford.edu/~tjw/jsbn/ecdh.html If I generate a private key for alice I can get ...
125 views

### Is Triple-DES a group?

I know for a fact that DES is not a group, but are any of the Triple-Des versions a group? Why, or why not?
149 views

### Offline app authentication - embedding hashed password inside an encrypted file

I am working on an occasionally connected app. To allow the users to authenticate I created a profile which is encrypted and placed on the users machine. The first byte of the file contains the IV ...
125 views

### How to build a secure AE scheme with generic composition?

I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed ...
92 views

### Rating a steganographic system using Blum Blum Shub to locate hidden bits

Currently I'm building a toy steganography system based in a web browser. Besides all the obvious issues with building a system requiring extreme privacy into a browser (this is a toy!), I was curious ...
152 views

### What should the size of the private exponents in Diffie-Hellman key exchange for TLS be? [duplicate]

I'm using TLS with a Diffie-Hellman key exchange to negotiate the symmetric keys. How long should the exponents be?
159 views

### Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
368 views

### Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
4k views

### Finding a keylength in a repeating key XOR cipher

In an old cryptography FAQ, I found the following step described for determining a the length of the key a cipher was repeatedly XORed against: Discover the length of the key by counting ...
127 views

### What is meant by this notation in the ElGamal key generation process?

Alice chooses i) A large prime $p_A$ (say 200 to 300 digits) ii) A primitive element $\alpha_A$ modulo $p_A$, iii) A (possibly random) integer $d_A$ with $2 \le d_A \le p_A-2$. Alice ...
657 views

### uniqueness of the RSA public modulus

What is the probability that two separate RSA public moduli are the same? For example, consider a 2048-bit modulus. The number seems to be huge, but the choice for prime factors p and q is much more ...
1k views

### Encrypt a file once with 50 characters password or twice with 25 characters?

What better Encrypt the file once with 50 characters password or encrypt it twice each time with 25 characters password.
382 views

### Non-malleable file encryption using AES XTS 256?

I'm looking to do file encryption of a bunch of individual files, some small, some quite large. The files will be write-once/read-many, so I could use CBC, however, since the read-access needs to ...
26k views

### How does one attack a two-time pad (i.e. one time pad with key reuse)?

My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need. I am new to ...
83 views

### Is this any recognizable encoding or cipher? [closed]

I've been watching the Marble Hornets videos on YouTube (basically, an independent film series about a group of kids chased by the "Slender Man"), and in this video I saw something interesting. ...
144 views

### Best Asymmetric Encryption Standard for Communications? [closed]

I'm new to the standards of encryption. I understand the math behind RSA really well. I'm wanting to design an application for private peer to peer communications using RSA and wanted to know what ...
303 views

### md5: is reverse length-extension attack possible?

If I know H = md5( SECRET_KEY | DATA ) then I can calculate H' = md5( SECRET_KEY | DATA | DATA' ) That's length-extension ...
186 views

### Digital Signature Scheme Count

My question is How I will be able to count digital signature Scheme that can sign many documents with one private key. There are signature scheme as long as exists private keys in the keys spaces? or ...
122 views

### Is it possible to derive the midstate of a sha256 hash?

Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc". (In PHP: ...
599 views

### Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
335 views

### Map Bytes to Number

Using node.js crypto library I can generate cryptographically strong bytes. How can I use this to generate a random number between 0 and 9999 (both inclusive)?
176 views

### Signature with appendix

I see sometimes signatures schemes with appendix. This is about signatures schemes in which the message is needed in the verification algorithm, that is, the ouput of the signature algorithm is of the ...
234 views

### Using AES-CBC and providing the IV in file header -> security hole? [duplicate]

currently I audit some code I've written in the past to use KeePass 1.x databases. I stumbled over the following question: The database itself is decrypted with AES-CBC and inside the file header the ...
181 views

### How is key rotation defined?

I'm aware that it's advisable to rotate cryptographic keys periodically. HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length. It also accepts a salt, ...
548 views

### Help with example RSA problem

While learning about RSA, I found this example problem. The answer is supposed to be "a 4-digit number that is a pattern of digits." I have computed it to be 16657 twice. OK, now to see if you ...
74 views

### How does the possible attack on passwords and salts mentioned in PKCS#5 v2.1 work?

From PKCS#5 v2.1, 4.1 Salt (page 6, emphasis by me), also in v2.0, RFC 2898: In password-based encryption, the party encrypting a message can gain assurance that these benefits are realized ...
819 views

### Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
306 views

### How to calculate leaked information from a check digit

Given a check digit calculated using mod 11, of an encrypted numeric sequence of 8 digits, how much information can be known about the plaintext? More specifically, a single 3DES encrypted CBC block ...
357 views

### Which MACs can be converted into a secure unkeyed hash function?

It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
173 views

### Is this exponentation or bitwise XOR

I'm reading about SRP from this page and came accross the line that says a party computes v = g^x I am unfamiliar with reading cryptography texts. Does this mean gx, or g ⊕ x?
137 views

### low-exponent RSA

I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$. Suppose further the messages are ...
316 views

### Recommended authenticated stream cipher for minimum overhead?

I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ...
2k views

### Difference between “one-way function” and “cryptographic hash function”

What's the difference between a one-way function and a cryptographic hash function?
1k views

### What is U2FsdGVkX1?

Using CryptoJS 3.1 I noticed that using 3Des, the encrypted message always start with U2FsdGVkX1 Why is the first part of the encryption always the same? What information does this hold and ...
573 views

### How to build an electro-mechanical public key cipher machine?

It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT. Imagine, if the abstract idea of having a public key and a ...
259 views

### How hard is it to generate a partial RSA fingerprint collision?

When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ...
234 views

### Is it possible to cryptographically prove when was the last time a ciphertext was decrypted/encrypted?

I want to provide a service that encrypts and decrypts documents and I want to provide the users with proof that I haven't stolen their secret key and read their documents. I know I can prove when a ...
513 views

### Has GMAC mode a future outside GCM?

Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
154 views

### Hash function with values in a multiplicative group of prime order [closed]

I have to implement a cryptographic protocol which involves a cryptographic hash function $H: \{0,1\}^* \to G$. It is viewed as random oracle. $G$ is a multiplicative group of prime order. I want to ...
758 views

### Security of authenticated encryption modes gcm & ccm

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
231 views

### Anonymity in end-to-end encryption

Considering a scenario of anonymous data transfer between seller and buyer using proxies. If we consider that there are three proxies that are being selected by the buyer to obtain data from different ...
2k views

### How do I decrypt ciphertext with this cipher?

I have an encryption function $$E(p) = (ap + b) \mod{26}$$ where the parameters are $a=7$, $b = 10$, and $p$ is the plaintext letter. I was asked to decrypt the ciphertext ...
5k views

### OpenSSL AES 256-bit Key Management

I am using C and OpenSSL to encrypt files. After experimenting with the OpenSSL command line utility, it makes you enter a passphrase that can be any length, but uses that to create a 256-bit key. ...
4k views

### understanding a length extension attack

I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully ...
298 views

### Encrypting and MACing different data with same key

It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
218 views

### Scrypt as a KDF with one-time high-entropy input

I'm looking at using Scrypt as a KDF. Assume the following: the input will always be high-entropy random bytes generated by a CSPRNG the length of the input can vary from between 8 to 32 bytes the ...