# All Questions

81 views

We're building a data service that is expected to go out through a single "fat pipe" channel. The design requirement says that the data in the channel must be protected by authentication and ...
1k views

### Using an MD5 hash as a password

Suppose Alice is using a password prompt that only accepts up to 32 characters for any particular password. Memorization of long strings of random characters is not one of Alice's strengths, so she ...
435 views

### CSPRNG in JavaScript using Audio and Video

I ported GnuPG to Javascript using Emscripten (not released yet). Now I need a good replacement for /dev/random//dev/urandom. ...
422 views

### Why is the discrete log problem easy when the exponent comes from a binomial distribution?

I read in http://epubs.surrey.ac.uk/7219/2/esorics06.pdf that in exponential El Gamal the discrete log problem for recovering $m$ from $g^m$ can be made tractable when $m$ is drawn from a binomial ...
380 views

### Why is the following RSA PRNG cryptographically secure?

One requirement states that the generator has to withstand the next-bit test. Consider the following PRNG, where we calculate next output $x_i$ via the formula $x_i = x_{i-1}^ e\mod n$. I can see ...
459 views

### Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
372 views

### Designing a security system from scratch with a custom protocol, suggestions needed

For the reasons I cannot go into details, I need to design my own protocol and overall security system which will be used to establish secure data exchange between various devices (most notably ...
818 views

### Combining LFSRs for Stream Ciphers: Why do we need high non-linearity?

Linear Feedback Shift Registers (LFSRs) can be excellent (efficient, fast, and with good statistial properties) pseudo-random generators. Many stream ciphers are based on LFSRs and one of the possible ...
367 views

### How to do a literature search

How do I do a literature search of the research literature on cryptography? Assume there's some topic in cryptography I'd like to learn more about; how do I search the cryptographic research ...
362 views

### Does SRP reduce to DH key exchange when shared password is not secret?

I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later. I ...
907 views

### random number generator 10-side dice alternative

A lot of sites (e.g. Dirk Rijmenants') refer to 10-side dice to generate random number for one-time-pad. I was thinking about new ways to generate random numbers, letters and passwords. here what I ...
348 views

### Is the DES algorithm in OPENSSL random?

Look at the hex dumps of encrypted1.bin and encrypted2.bin . They both have same password A which was used to encrypt sampletext ...
426 views

### Finding hash almost-collisions

A few months ago, XKCD posted a challenge to find a plaintext which hashed (using Skein 1024 1024) to a specified value. Inputs were scored based on the hamming distance between the hash of the ...
294 views

### Cryptography based upon neural networks [closed]

I would like learn about use neural networks in cryptography. Is there any research literature on this subject? What should I do to learn about the subject? I am taking short course in neural ...
318 views

### Security of Salsa20 with some known plaintext?

Basic question- if I'm encoding a bunch of known filetypes with salsa20, will it still be secure if the plaintext header is known? Assume that a different IV and Key are generated before each file is ...
607 views

### Trying to better understand the failure of the Index Calculus for ECDLP

So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong). So basically the index calculus for the ...
141 views

### Does knowledge of original file size provide a cryptographic weakness?

I'm encrypting files using an AES-256 CBC cipher and an SHA-256 HMAC every 64KB in the file. Since AES CBC needs an amount of input bytes to be divisible by 16, I use PKCS#7 padding to bring the ...
410 views

### What kind of adversary is the cloud?

I just started some work on computation over encrypted data in the cloud. We're still in the early planning stages, and to really understand the kind of security we can offer I need to determine what ...
1k views

### Winzip AES256 vs PGP

If I use the AES256 option in Winzip to encrypt a file, is it any less safe or less secure than using pgp encryption?
686 views

### Recommended way of adding a pepper/secret key to password before hashing?

There have been several questions regarding password hashing here and on Security.SE. A "pepper" is sometimes mentioned – an application-specific secret key. The canonical answer on password hashing ...
1k views

### Increased CRC collision probability when adding bits to input message

The Scenario I have a message string I need to transport over a wireless network that may be unreliable. This message string is about 100 bits long, and is packaged with an 8-bit CRC. When the ...
266 views

### How to derive formulas for addition and multiplication in Jacobian coordinates

Is there a way to derive the formulas for point addition and multiplication on elliptic curves in Jacobian format by yourself? How could I have derived these formulas by myself?
289 views

### Many consecutive hashes to slow down brute force attack?

I've heard that hash algorithms like bcrypt are more secure because they take longer to complete, and therefore take much longer to prute force, without a noticable ...
196 views

### Weak One Way Function

Show The function $mult(a,b)$ is weak one way if the Integer Factorization Assumption is true. I am read the proof of this enunciated but I want know if I understand this in my way. The proof use the ...
373 views

### What does $(\mathbb{Z}_n^*)^2$ mean?

In a paper they write once, $(\mathbb{Z}_n^*)^2$. Is this the group of quadratic residues or is it something else? Here the theorem: Under the strong RSA assumption, given a modulus $n$, along with ...
79 views

### How to hash a structure that needs to include that hash's outcome?

so I am busy writing a TCP protocol in which I send a "packet header" with each packet of data. This packet header is a structure that contains information about the data that was sent. I want to ...
362 views

### Injecting salt into PyCrypto KDF - useful?

I have noted some sources indicate that when using a KDF like PBKDF2 (alternatively) some advocate injecting the salt at the time of execution - like this: ...
332 views

### Attacking AES/CCM with random IV

A cryptosystem is using AES-128 in CCM mode with random IV. Suppose an attacker capable of: asking the cryptosystem to encrypt a single plaintext as many times as he wants; and asking the ...
202 views

### Are digital signatures secure for signing lots of small messages?

I need to sign the numbers from 1 to 1 billion (literally this, it's not an analogy) using a digital signature and then send these numbers in a particular order to someone. The message is not private ...
341 views

### Solving a discrete logarithm using GDlog

I am trying to calculate an $x$, such that $t = g^x \pmod p$ in order to crack a weak ElGamal encryption for university. I found GDlog, but I cant figure out how I can use the input to calculate my ...
531 views

### RSA leak bits to factor N

Suppose you randomly generate large primes p and q as in RSA, and then tell me N=pq but not p or q. Then, you would like to actually let me factor N, except you should tell me as few bits of ...
1k views

### Why is SRP not widely used?

SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations? I tried to ...
554 views

### how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media?

I want to store a password securely on a storage (suppose in a usual unencrypted file). I use this password as AES key to encrypt itself (using AES-ECB) & then store it on the media (the password ...
1k views

### Implementing secret reconstruction in Shamir's Secret Sharing

I am trying to implement Shamir's secret sharing in C++. I have got the generation of shares working. However, I am very confused with the reconstruction of shares. I get the part on how three users ...
1k views

### Is there any strong enough pen-and-paper or mind cipher?

Some ciphers are talked about at “Is there a secure cryptosystem that can be performed mentally?”, but (at the time of writing) I don't see an answer. Are they strong enough, or are non-computer ...
329 views

### What's the difference between AES and earlier block ciphers?

Is there any difference except speed and key and block size from user's point of view? Or does AES have something that ideal block cipher doesn't have?
229 views

### Indistinguishability attack example

I want solve the next exercise. The author defined the experiment for the cryptosystem $\Pi$, the adversary $A$ and the security parameter $n$ as follows $\mathsf{PRIV_{EAV}}(\Pi,A,n)$ The ...
482 views

### How to derive two keys from one password

What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
1k views

### Is AES really used for Top Secret stuff?

I've read almost everywhere that AES-256 can be used for Top Secret material (in the US). Is it really used or is it some kind of decoy to hide the more advanced algorithm they might use ?
201 views

### Elliptic Curve is DH function or PKI?

can we reuse same ECC key on TLS for long terms or it must be used just once? (i mean can we use ECC like RSA?) is there patent free ECC implementation ?
235 views

### What length should the padding be when encrypting or signing with RSA?

I am wondering what length the padding should be when encrypting or signing with RSA. Does it matter what length the padding is, and if so — what length should it be? Another point: Should it be ...
873 views

### CBC-MAC , fixed length, all blocks returned

CBC-MAC, with fixed length message. Is it safe to return all ciphered blocks instead of the last? My intuition says it is less secure, since is gives an attacker more information. But how could one ...
449 views

### encrypt message with one digest 0-9 instead of 01-26

How much will the security of one-time pad decrease if I use one digit from 0-9 instead of 1-26? for example plaintext = "blue" and ...
1k views

### Encrypt a single file, chunk-by-chunk, each chunk using different key (AES)

Encrypt a single file, chunk-by-chunk, each chunk using different key. I am a security newbie (only took 2 security courses before) But currently I am using this encryption method for my Android ...
724 views

### Have I understood pedersen commitment correctly?

I want to do a one-sided integer commitment scheme. I.e. the whole process must be non-interactive where I at one point first publicly reveal some data and then at a later time reveal the committed ...
78 views

### Book Didactic Security Notions [closed]

I want study more about cryptography reading papers, but I have a problems to understand few concepts: security notions, random oracle model, IND-CCA, ... etc. I began study this concepts by internet: ...
410 views

### Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash?

$H(s,r)=d$ is a function that hashes the secret string $s$ with a salt $r$, and returns a digest $d$. $r$ may be arbitrarily chosen and each $r$ returns a different $d$. For any $d$, $r$ is known from ...
426 views

### Is it worth applying a MAC on data in a HSM?

I'm building a basic HSM out of an Arduino, and am using the following scheme to store data: Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction). Secondary ...