# All Questions

113 views

### Can substrings of a long string be efficiently authenticated?

Suppose one has a (strong) shared secret key and wishes to authenticate a very long string in a way that will allow the verifier to verify small substrings without reading much of the stored data and ...
129 views

### What kind of cryptography should i use?

I have a trusted third part A that issues an access token (xml file) to an untrusted client C that uses this token to log into an untrusted server S and access to the authorized files. I want only ...
386 views

### What are some good references for the implementation weaknesses in RSA

I'm pretty sure I understand textbook RSA. Choose p and q, large primes, and compute n=pq. Choose e such that $gcd(\phi(n),e)=1.$ Publish n and e. Compute d such that $de=1$ (mod $\phi(n)$). To ...
238 views

### What's efficient MPC protocol for determining if sum's bigger than y?

My secure multi-party computation (MPC) in need is simply to determine if a sum of two private variable is bigger than a given value $y$, as $f(x_0, x_1) = [(x_0 + x_1) > y]$ in which the value ...
479 views

### Can you identify the public key used to encrypt something?

If I encrypt a string with a public key, does the encrypted ciphertext reveal the public key I used to encrypt it? Basically, I don't want anyone to know who the ciphertext is addressed to. I'm ...
2k views

### How long to bruteforce a RSA key [duplicate]

Suppose I have a 2048 bit RSA public key, and want to brute force the corresponding private key. I guess there are 2048^16 possible combinations? How long would this take me to brute force with an ...
488 views

### When using HMAC, does key encoding matter?

Given: H is a good hash function with block size L. K is a key of length >= L (recommended by RFC 2104). Khex and Kbase64 are ASCII encodings of K. In the HMAC algorithm, is there a good reason to ...
379 views

### Is triple des similiar to RSA in that they message size is limited to the key size?

Is triple des similiar to rsa in that the message size you can encrypt is limited (unlike AES)? Yes you can break the message size into parts and apply it, but I'm not interested in doing that so I ...
80 views

### “proof of access” schemes

What is the state of the art way when implementing a scheme challenging a party to prove they have access to certain data? What I'm looking for something along the lines of Give them ...
146 views

am sorry, an a beginner, so please forgive me if i make mistakes, so here is what I understood: PBKDF2: uses HMAC, so, the message is the password, and the key that crypts the message is the salt? or ...
154 views

### How to compare two datasets „anonymously”?

Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation: There are 10 defined colors (blue, orange, yellow etc.) There are ...
183 views

### Is this OTP scheme safe?

I have a message $m_1$ and I want to encrypt it by XORing it with two keys $k_1$ and $k_2$: $$c_1 = m_1 \oplus k_1 \oplus k_2$$ So far so good. Now I was wondering if I could create a "fake" result ...
73 views

I'm trying to reverse engineer key exchange protocol and faced with the following problem: Protocol is based on Diffie-Hellman key exchange method: g - generator m - modulus Alice: a - private key $A ... 2answers 506 views ### What does “message schedule” mean in SHA-256? I am trying to understand the sha-256 algorithm from FIPS 180-2. I understood the padding and parsing of the message string. However after that it states (page 15): For$i = 1$to$N$: { ... 3answers 372 views ### Block cipher fixed points A block cipher is a bijective map from the set of possible plaintexts to the set of ciphertexts, which are the same size and might as well be considered the same thing:$\theta: S\to S$. In this there ... 2answers 105 views ### Prepend information about encryption implementation to the stored data I want to preface this by saying i will not be using any of this code/information in a live project, this is only for learning/fun (so I welcome some speculation) I was looking at how the PHP crypt() ... 1answer 2k views ### Bcrypt VS Scrypt, Again? I found this article on SO, but the answer was short, and the subject was closed, What i don't understand, is: Which one of the two limits memory usage to avoid custom Hardware to break the password? ... 2answers 163 views ### Does collision resistance stay when extending a hash function to a set domain? Given a Cryptographic hash function$h$for element$x$, let's extend it to sets via$H(S)=\prod_{x\in{S}}{h(x)}$. I am asking if the new hash$H$(in domain of set) is still collision resistant? To ... 0answers 71 views ### Will D-Wave's quantum computers ruin classical encryption? [duplicate] D-Wave has commercially available 512-qbit quantum computers now. A lot of big names are taking it seriously. Google, NASA, and USRA have joined forces to start a quantum AI lab. How far are we ... 1answer 267 views ### In ECDSA, how many field operations are used for signature verification? I am wondering about the computational cost of ECDSA signature verification, in term of multiplications in the base field; and, as an aside, in term of (much cheaper) additions. To make things ... 1answer 220 views ### Why use$(r,s)$instead of$(r,s^{-1})$as DSA signature? A DSA signature consists of two scalars$(r,s)$. When signing$s$is generated as:$s=k^{-1}(H(m)+xr) \mod q$The signature is$(r,s)$When verifying$s$is only used to compute$w = s^{-1}$. So ... 1answer 359 views ### What do recent announcements about solving the DLP in$GF(2^{6120})$mean for RSA After just reading the post Do recent announcements about solving the DLP in$GF(2^{6120})$apply to schemes proposed for cryptographic use? I was a bit confused. DSA, ElGamal and others are based on ... 2answers 1k views ### Why are bitwise rotations used in cryptography? Any understanding I have of cryptography stops right around the cipher level. As such, I'm just curious as to why bit shifts and moreover circular bit shift are so prevalent in cryptography. 1answer 123 views ### How can I split a message in parts of similar size or smaller? I have a 130-160 characters message that I need to split in say, 3 parts, and be able to reconstruct it by recovering all 3 parts. I also need that these parts are type-able, meaning that they can't ... 2answers 297 views ### IV Security Clarification After doing lots of reading on SO and other websites relating to AES cryptography, I am trying to understand the security issues surrounding IV's. There seems to be a lot of confusion and ... 1answer 464 views ### When making public key fingerprints - is a sha1 hash still a good idea? I'm thinking about trying to save some space (and readability) when referencing 2k and 4k public keys (millions of them) by storing the fingerprint in some places instead of the full public key. ... 3answers 895 views ### If RSA is limited to 117-200 bytes or so, is that a very limited use case? Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size? I have read that you can only encrypt a message of around 117 to 200 ... 2answers 628 views ### Are block ciphers used in public key crypto? I was reading about block ciphers and most articles state they are being used in symmetric key cryptography. Are they also being used in public key cryptography? if not, what alternative pkc use? ... 1answer 46 views ### Distributing blocks with validation and non-dependant list generation Problem Suppose I have a system of nodes that can communicate with a parent node, but not among each other. Suppose then a file on the parent node is split up into blocks and divided among the ... 1answer 594 views ### How is text converted to a number for RSA? [duplicate] According to http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Key_generation the key length is the number of bits in n. So how can a message of many megabytes (millions of bits) be modded by a 1024 ... 1answer 385 views ### Encrypt-then-MAC paradigm I read that the Encrypt-then-MAC paradigm is provably secure. From what I understand, when using for example AES for encryption and HMAC_SHA256 for MAC generation (and the keys$K_1 \neq K_2$), this ... 2answers 270 views ### HMAC and assumptions on the cryptographic hash According to Wikipedia, a cryptographic hash function has the following properties: Pre-image resistance: Given$h$, it's difficult to find any message$m$such that$h = H(m)$. Second pre-image ... 1answer 282 views ### ECC Point Multiplication of Product I can calculate$Q = a\,b\,G$in several ways:$Q = a \, (b \, G)$or$Q = b \, (a \, G)$. These give the same result, as expected. But if I do$c = (a \, b) \bmod n$where$a \, b$is much greater ... 3answers 2k views ### Why crypto hash functions must be collision resistant and how to find resistant? Why cryptographic hash functions must be collision-free and is there any methods to evaluate whether a function is not resistant to collision? Thanks, 2answers 254 views ### Is entropy affected by time? I'm quite new to cryptographic systems, and today we discussed entropy at work. Since entropy is used to ensure the difficulty for an attacker to break in, I was wondering if the more time the high ... 1answer 70 views ### Why does the server in S/KEY authentication only store a single password? I've been reading about the S/KEY One-Time Password system on wikipedia here and was wondering why the server only stores a single password and not the list of one-time passwords like the client does. ... 1answer 495 views ### With HMAC, can an attacker recover the key, given many known plaintext/tag pairs? Given many pairs of$(m, t)$, can the attacker compute the key$k$satisfying$\text{HMAC}(k,m) = t$? (Assume that$k$was chosen at random.) 2answers 108 views ### A substitution based on a matrix vector product I choose at random an invertible square matrix A of size 128 in GF(2). I want to use this matrix as a substitution box. Is this a non linear transformation ? I've seen that substitution boxes are ... 1answer 322 views ### How insecure in practice? I am in attempt to understand relative insecurity of certain encryption schemes. Particularly of interest is DES and RC2. I know AES is better and should be used to encrypt. But practically, if ... 1answer 203 views ### Can somebody explain the major contributions of the tenants of the Gödel Prize 2013? As you may know, the Gödel Prize 2013 will be awarded this year to cryptographers (see this ACM press release). The people awarded are Antoine Joux, the team of Dan Boneh and Matthew K. Franklin. Can ... 1answer 317 views ### Can i modify data “protected” by a CRC16? There are 100 bytes with a CRC16. However I only know the first 50. I want to change byte 5 from a known value X to another value Y, and fix up the CRC16 to be valid - without knowing bytes 50-100. ... 1answer 162 views ### Which keys are necessary to decrypt Application data in a SSL connection? I'm debugging an application which communicates between client and server using a SSL/TLS connection, and want to capture and analyze the sent data. Are the client write keys and server write keys ... 2answers 161 views ### The security of the AES secret itself I am writing an application, running on a server, where multiple users access data from a database which is AES encrypted with a master secret. The master secret itself is initially randomly ... 2answers 288 views ### Pen-and-paper one-way function for externally-anonymous survey When conducting surveys, an Administrator might send an Enumerator to survey a Respondent. For "sensitive" questions (e.g. about embarrassing behavior), the Respondent may be fine with the truth being ... 0answers 143 views ### Complex Numbers on Elliptic Curves & Usage in Tate Pairing I'm working with understanding the internals of the Tate Pairing. I was going through an example of the curve$E: y^2 = x^3 + 3x$over$\mathbb{F_{11}}$. The author is showing the computation of ... 2answers 722 views ### Reversing SHA1 (don't know the correct term) Given sha1(pad(A) || pad(B)), where B is known, can I calculate sha1(pad(A))? pad(A) means its length is exactly 1 block (64 bytes for SHA-1) If yes, for which other hash functions it will work too? ... 3answers 1k views ### How robust is discrete logarithm in$GF(2^n)\$?

"Normal" discrete logarithm based cryptosystems (DSA, Diffie-Hellman, ElGamal) work in the finite field of integers modulo a big prime p. However, there exist other finite fields out there, in ...
1k views

### How to test if a number is a primitive root?

How to test if a number is a primitive root, assuming the modulus is a prime? And if not? Is it not enough if the number is relatively prime to the modulus or prime?