# All Questions

367 views

...
7k views

### Compare Blockmode CBC (with diffuser) against XTS

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
299 views

### reducing false positives in searchable encryption

Practical techniques for searchable encryption proposed by Song et al. [1] have a false positive rate of $l/2^m$ where $l$ is left half of encrypted bits and $m$ is right half and $l+m=n$ where $n$ is ...
769 views

### Why should CAST5 and 3DES not be used for encrypting files over 4GB?

On https://www.gnupg.org/faq/gnupg-faq.html#define_cast, it says that Like 3DES, its 64-bit block size means it should not be used to encrypt files larger than 4Gb in size… How and why does the ...
579 views

### Possible Digital Signature Hack?

I am starting to learn more about cryptography and I just read more about how asymmetric keys can make a digital certificate, and I would like if someone could explain me why the following case can't ...
477 views

### Message encrypted with a LFSR based stream cipher

I am learning about LFSR sequence and I came across this question: A 16-bit message consists of two ASCII characters. This message was encrypted with a one-time pad, and the key for the one-time pad ...
78 views

### Bridging the gap between security proofs and “real-world” security

I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs ...
179 views

### INT_32_BE in PBKDF2

Trying to understand PBKDF2 in detail. It is clear that the password and the salt is given to the PRF (which is HMAC-SHA-1 in the specification). But what is the role of the INT_32_BE(i)? What does it ...
60 views

### Are there any obvious techncial faults in F. Ruiz's 2013 URSA javascript cryptography? [closed]

The link to the cryptography is here: http://prgomez.com/ursa/ I have found the following simple javascript system of encryption/decryption portable and easy to use for emails and messaging sites, ...
110 views

### Cipher built from GPU primitives [closed]

Is it feasible to build a cipher (or hash) out of GPU or DSP primitives (e.g. big matrix multiplication, Fast Fourier Transform, big block SIMD, or hardware H.264/AVC codec)? Preferably those are slow ...
239 views

### Does brute force attack use the program that created the ciphertext?

I've read several articles about brute force cryptanalytic attacks, but none explicitly say what algorithm is being run for each attempt, nor what criteria is used to declare an attempt a success or a ...
78 views

### NIZK Proof of knowledge N of M discrete logarithms (threshold)

It is well known how to produce a NIZK that curvepoints $aG$ and $aP$ have the same discrete logarithm $a$ with respect to the curvepoints they are multiplied by. There is also a way to prove that a ...
132 views

### Brute Force Attack Strategies

A Brute Force Attack obviously involves attempting to decrypt ciphertext (with the associated plaintext being known) using all possible encryption keys. Aside from attempting all possible ...
922 views

### Is there benefit to signing unencrypted emails?

I came to this article from another comment on Crypto StackExchange. After reading it, I am wondering if there is any benefit to using a digital signature on unencrypted S/MIME emails?
84 views

### Hash function and indifferentiability [closed]

What are the properties derived from the fact that a hash function is indifferentiable from a random oracle?
106 views

### See any problems with this search-specific homomorphic encoding strategy?

I'm imagining this for use in the scenario of cloud-stored client-encrypted email, where, when seeking to do a string search across messages, you don't want to have to download every stored message in ...
94 views

### Keccak and compression functions

Keccak follows a sponge construction. Can we say that Keccak employs a compression function? Generally speaking, for sponge constructions, can we say that there is an underlying compression function?
139 views

### Determining average number of hash calls to get a hash that begins with X

I have been attempting to find an answer to a self-study question: If I have a hash algorithm that outputs 256 binary bits, on average, how many times would I have to call the hash function so ...
194 views

### Roots of polynomial in Shamir secret sharing

I need to know whether one can obtain any roots of the polynomial in Shamir secret sharing if he possesses less than threshold shares. For instance in (t,n) if he has t-1 shares can he obtain any ...
95 views

### stream cipher computation cost [closed]

With AES-CTR the computation time to encrypt a message of lengh $n$ blocks is $n$ computations of the block cipher. What is the running time to encrypt a message of $n$ bits using a stream cipher, ...
50 views

### Group Dependent Language

The text below has been taken from the below paper Groth-Sahai Paper. The relevant part is highlighted in red. What does this group-dependent language mean in this context? From the definition of a ...
349 views

### Strategy to crack a presumed substitution cipher

The ciphertext given is: ejitp spawa qleji taiul rtwll rflrl laoat wsqqj atgac kthls iraoa twlpl qjatw jufrh lhuts qataq itats aittk stqfj cae I've done ...
420 views

### What is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve?

I am trying to understand the FIDO U2F Raw Message Format, especially the format in which a user public key should be provided. The documentation says the following: A user public key [65 bytes]. ...
923 views

### Key management for military GPS receivers

I wonder what encryption scheme is used in high-precision encrypted GPS streams (the so-called “P(Y) code”). If there's a master key needed, then it has to be in every device. Yet the master key doesn'...
283 views

### What is “msg = group.random(GT)” in Charm encryption schemes?

In many encryption schemes in Charm the random group message is used instead of a text-message: msg = group.random(GT) For example, in CP-ABE scheme, random ...
443 views

### what is the difference between IBE and ABE schemes

Can somebody explain in simple words. real life example light help and limitations of these schemes etc.
3k views

### SHA1 no longer considered secure for SSL Certificates — what about Cipher Suites?

Many browsers and Internet companies have recently claimed that SSL Certificates with a signature algorithm of SHA1 will imminently no longer be considered secure. Most notably, Google and Google ...
114 views

### Deprecation of RSA-SHA-1 in DKIM keys?

I recently noticed that OpenDKIM on my mail server is objecting to DKIM signatures from a client, saying their key is insecure. It may be that that's due to lack of secure DNS (confirmation anyone?) ...
334 views

### How do disk encryption programs solve the “IV problem”?

I was reading a paper on the "elephant diffuser" used in BitLocker and it got me wondering how other systems (e.g. TrueCrypt before it shutdown) solved the problem the elephant diffuser was meant to ...
130 views

### Basic question about design of program with data encryption

I need to store encrypted files on a hard disk. The actual code side is not important for me now (I plan to use C# and AES-GCM encryption from Bouncy Castle library, please tell me if you think that's ...
118 views

### simple encryption scheme turns out to be “somewhat homomorphic”

In the paper Fully Homomorphic Encryption over the Integers in the introduction: How do I calculate $r$ and $q$ of this equation in the picture? $r \approx 2^{\sqrt{\eta}}$ and $q \approx 2^{\eta^3}$...
227 views

### Fully Homomorphic Encryption over the Integers - perform an operation on an encrypted data

In Fully Homomorphic Encryption scheme represented here Fully Homomorphic Encryption over the Integers In the Evaluate process (see section “3.1 The Construction” of the paper): Evaluate(pk, C, c1, ...
171 views

### Is this modified Schnorr signature scheme secure?

Signing Let y = g^x, which is your public/private keypair. Let r = g^v, for random v Let c = H(M) Let z = (v + cx) mod q The signature is the pair (r,z) Verifying g^z = ry^c mod p We further ...
474 views

### What weaknesses in Hash_DRBG did NIST find and fix?

Matthew Green states in the Practical Kleptography presentation (video, at about 12:15) that Hash_DRBG (from SP800-90A) as originally proposed by NSA had potentially exploitable flaws or bugs and that ...
514 views

### Generation of N bit prime numbers -> what is the actual range?

Short version: When generating a prime number of N bits, should I draw random numbers from the range $[0 , 2^n]$, or $[2^{(n-1)} , 2^n]$? Context: I'm trying to implement a toy-version of RSA as a ...
377 views

### Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity?

Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity? My reasoning is that the attacker doesn't know all the plaintext, so by having a hash, the ...
70 views

### Forward pseudorandom permutation [closed]

Please consider the following scenario: The user A and B use their keys, K1 and K2 respectively. Each client have a vector of elements. Each client separately permutes his vector using his key and ...
301 views

Is there any consensus (i.e. are there any research results) on the benefits and drawbacks of various padding schemes? Generally there seem to be two kinds of them: random paddings, like ISO10126 ...
426 views

### Bouncy Castle elliptic curve from explicit parameters (E-521)

I'd like to use a curve that's not included in the Bouncy Castle EC named curves spec, specifically E-521. According to the BC javadocs, you need a few values in order to do this: q, a, and b for the ...
113 views

### Is elliptic curve point multiplication semantically secure?

Is elliptic curve point multiplication semantically secure? I'd like to know if there are some sets of elliptic curve parameters (e.g. NIST curves) that are proved to be semantically secure or that ...
2k views

### Why do the elliptic curves recommended by NIST use 521 bits rather than 512?

Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3: Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the ...
406 views

### Security properties and Cryptography objectives applied in algorithms

We all know there are five properties of Security. They are: Confidentiality Availability Authorization Integrity and Provenance As Security and Cryptography are co-related these properties ...
75 views

### exchanging private key between service and iPhone app - digital signing

I need to do digital signing of my request data which will be sent to the server. My server sends distinct private keys to her clients after authentication and expects all responses to be digitally ...
484 views

### AES-128 with weak key

Doing malware research (simple crypto locker) I found out that it uses AES-128 with weak key - every one of the sixteen bytes is represented by (a-z,A-Z,0-9). Thus simple brute-force attack should ...
44 views

### Plaintext-aware encryption for symmetric schemes?

The notion of plaintext-awareness is well-known for asymmetric encryption, but the notion seems to make sense for symmetric encryption as well. Is this a known concept?
387 views

### Modes of operation for Public Key Encryption schemes

Symmetric key encryption schemes have well defined modes of operations for achieving deterministic (ECB) or Randomized (CBC, OFB, CTR ) etc. and other applications of the same. But are they defined ...
199 views

### Ways to make a “doomsday” cryptocurrency which becomes untradable

As a social experiment (not a money-making scheme), I'm interested in developing a crazy cryptocurrency which, by its very design, will become worthless and untradable after a certain point. Ideally, ...
690 views

### Why is 224 bit ecdsa faster than 192 bit ecdsa?

I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ...
In many articles i have found directly the calculation of prime elliptic curve. How can i calculate this prime $p$ ? For example if I consider NIST P-256, $p = 2^{256}-2^{224}+2^{192}+2^{96}-1$. Why ?...