# All Questions

91 views

### Hash of multiset of values, which lets me compute the hash of the union

Cryptographic hash functions normally take as input a bitstring. I am looking for a hash function that takes as input a finite multiset of values. In other words, given $S \subset \{0,1\}^*$, I want ...
4k views

### How do I derive the time complexity of encryption and decryption based on modular arithmetic?

I want to calculate the time complexity of two encryption and decryption algorithms. The first one (RSA-like) has the encryption $$C := M^e \bmod N$$ and decryption $$M_P := C^d \bmod N.$$ ...
77 views

### Altering the message space of Paillier

Is there any obstacle if we restrict in Paillier the plaintext values to be drawn from $\mathbb{Z}_N^*$ instead of $\mathbb{Z}_N$ as the original scheme indicates.
249 views

### Secure double encryption using CPA and CCA

Do you mind if you give me any hints, links or ideas about how to improve the security of double regular encryption and decryption, by using CPA game and CCA game, it sounds interesting question, and ...
110 views

I am trying to implement Efficient Robust Private Set Intersection using additive ElGamal. I am trying to run the full protocol mentioned in Section 3.4 on the following inputs: $p = 17$ (prime) $g ... 1answer 216 views ### I've got my private key compromised. How does CRL work? How does certificate revocation list (CRL) work? How can I send a request to the CA to add my current private key to the CRL, so no one except me can add my certificate to the CRL? Related: - How can ... 1answer 152 views ### credit card number encryption using aes-ctr mode I want to encrypt credit card numbers. I want to apply AES-CTR mode. Is it suitable for that? How can I store nonce and counter values for an individual credit card number? How can I send the ... 3answers 1k views ### Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable? The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ... 1answer 1k views ### Is Encrypt+HMAC stronger than AEAD? There are a few posts that I've come across that seem to infer that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes. ... 4answers 671 views ### Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? Consider the situation of a nation state (Blue) at war with another nation state (Red). Blue wants to deploy a secure cipher that blue currently can not break, but they are considered that Red could ... 2answers 2k views ### Design properties of the Rijndael finite field So we've already had a question on replacing the Rijndael S-Box. My question is - can we use a different finite field other than the one given by$x^8 + x^4 + x^3 + x + 1$in$GF(2^8)$. In other ... 1answer 3k views ### Diffie-Hellman: choosing wrong generator “g” parameter and its implications of practical attacks In traditional DH one chooses two shared parameters: a large prime "p" and base "g", which is primitive root mod "p". Suppose generation algorithm is broken and "g" generates only a subgroup (group ... 4answers 1k views ### How do you find a cheater in Shamir Secret Sharing? If there are 4 people involved, and every two of them should be able to know the secret (the polynomial is just a line) and you are given f(x) and x for each of those people, and you know one of them ... 1answer 2k views ### Why not use CTR with a randomized IV? I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ... 6answers 877 views ### How can I improve a password generation scheme based on a shared secret and URL? I currently use the following method to generate a different password on every website I have to login: password = SHA1 ( mainPassword . domainName . number ) ... 1answer 535 views ### Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6? I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ... 2answers 99 views ### Security game oracle queries Concerning private key (symmetric) IND-CPA game definition: Attacker$A$queries the encryption oracle polynomial number of times.$A$sends the challenger$C$a message pair$m_0$and$m_1$.$C$... 2answers 117 views ### Encrypt-Mix-Encrypt: Full Diffusion? I've read "A Parallelizable Enciphering Mode" by Halevi and Rogaway about the encrypt-mix-encrypt mode for ciphers and was asking myself if this mode provides "full" diffusion. So if an attacker ... 1answer 101 views ### Build set with PKI from reliable broadcast / random beacon I am trying to build a protocol (or find an existing one) for creating a set$S_2$with PKI from a set of parties$S_1$that initially does not know anything about the other parties. We assume ... 1answer 250 views ### Is it possible to weaken a bitcoin private key by “using” it elsewhere? What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ... 1answer 342 views ### What is 'key agility' in relation to symmetric-key encryption? I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ... 1answer 682 views ### Will rehashing an SHA256 hash continually, eventually produce every possible value? So let's say you had infinite time and energy. You have a hashed string of some sort. Because you have infinite time and energy, you can produce a collision(or the original value) easily enough. But, ... 0answers 437 views ### How can I find two strings$m_1$and$m_2$, knowing that I know$m_1 \oplus m_2$? [duplicate] Possible Duplicate: How does one attack a two-time pad (i.e. one time pad with key reuse)? I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first ... 1answer 3k views ### How large should a Diffie-Hellman p be? In a Diffie-Hellman exchange, the parties need to agree on a prime p and a base g in order to continue. Assuming some ... 3answers 338 views ### Designing a key expander out of ciphers Is it possible to compose or combine$n$ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate$n$ciphertexts from the same key,$k$, and that recovering the key,$k$, from ... 1answer 167 views ### RSA time function I am doing a paper on textbook RSA (highschool-level). I am explaining and proving the significance of the public key exponent in time and security. So far, I have encrypted a constant message with a ... 1answer 293 views ### Composing two one-way functions such that the result is not a one-way function Is it possible to have two distinct one-way functions (called, say,$h$and$g$) such that their composition$h \circ g = [\, x \mapsto h(g(x)) \,]$is not one-way? 2answers 541 views ### Quantum key distribution simulation I'm looking for a simulation of the Quantum Key Distribution protocol. Does anyone here have one that they could recommend? 1answer 151 views ### Are ideal hashes possible to create? In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve). Hence, isn't it ... 2answers 462 views ### Definition of a CSPRNG I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ... 3answers 673 views ### How to attack a fixed LCG with partial output? To show some colleague programmers exactly how broken C's rand() is (at least on Windows) I decided to break it. So everyone knows the exact parameters, MSVC's ... 1answer 302 views ### Is this method of deterministically using CBC secure? I'm trying to design a deterministic encryption scheme to enable searching in untrusted databases with the smallest possible IV overhead on ciphertexts. I know it's very bad practice but unfortunately ... 3answers 556 views ### P = NP and current cryptographic systems I've recently heard some people claiming that if the fact that P = NP is proven, most (all?) the current cryptographic algorithm considered secure like RSA will be unusable in secure systems. My ... 1answer 366 views ### Why is feed-forward mechanism used in hash functions? The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ... 2answers 425 views ### CPA Secure Chosen plaintext scheme The example for IND-CPA secure schemes given is generally: for a random r, Enc_k(m) =(r|| E_k(r) XOR m) where E is a PRF But does the role of r and k really matter--i.e. isn't this equally ... 1answer 978 views ### What happens to the entropy of a password when you hash it? For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5? 4answers 765 views ### What is the actual difference between security through obscurity and true encryption? In an abstract sense, aren't both the same? Don't their definitions boil down to the following? security through obscurity: trying to make sure some information cannot be obtained without knowing ... 1answer 230 views ### Why are there$ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
597 views

First, just to make sure I understand "salting" correctly: You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
112 views

### What is the difference between the standard representants of $\mathbb Z/q\mathbb Z$?

The symbol $\mathbb Z/q\mathbb Z$ (given that $q$ is prime) represents the prime field $\mathbb Z_q$. Basically, the elements of this field are represented by $\{0, 1, \dots, q-1\}$, let's call this ...
800 views

### Why does AES-GCM need a hash/MAC in TLS?

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
216 views

### ECDSA: How to retrieve a non-random k

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
303 views

### How could Fully Homomorphic Encryption support power operations?

Fully Homomorphic Encryption (FHE) enables arbitrary functions computed on encrypted data, because it supports both addition and multiplication. But I wonder if FHE supports power operations. For ...
1k views

### Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
178 views

### ElGamal in private set intersection: how to handle negative numbers?

I am trying to implement the Efficient Robust Private Set Intersection using Additive ElGamal. For this, from the client side, my inputs are $C = \{1, 2\}$. So, the polynomial is $(x-1)(x-2)$ which ...
401 views

### Is SHA-256 safe when used in this way?

I am wondering whether an attacker can gain any useful information from having several hashes of an unknown plaintext that differs in relatively few bits. For example, if provided with: ...
198 views

### What does this Authentication protocol achieve and what information is shared?

I'm having trouble with the following question from my class: "What is the purpose of the protocol, and how does it achieve this purpose and what shared information does A and B end up after ...
263 views

### Can we decrypt in this order when the message is encrypted twice?

If we encrypt a message twice with symmetric key $k_1$ first and then $k_2$ like $E_{k2}\{E_{k1}\{m\}\}$ , ideally we should decrypt with $k_2$ first and then $k_1$ but is it possible to decrypt with ...
I am looking for a proof-of-work scheme which cannot be effectively parallelized. For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function $f()$, a target ...