# All Questions

508 views

### Client and server using same SSL certificate - any issues?

I'm working on software where multiple components will communicate with each other using SSL. There would be one central component acting as a server, which would also require the clients to present ...
474 views

### How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?

In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring? The private key is an ...
783 views

### Can SRP be used with Elliptic Curves?

I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia. Edit: ok, can it be at least ...
177 views

### Which MAC scheme is quantum resistant?

will HMAC survive Grover algorithm ? if not then which MAC scheme provide post-quantum security ?
2k views

### Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$). That explains why we are using 256 bit ...
288 views

### It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?

I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
735 views

### one-time pad key related attack [duplicate]

In one-time pads we always say do not use same key twice to encrypt ASCII messages, but if we use a random key to XOR a random ...
452 views

### Is SpookyHash vulnerable to HashDoS?

Aumasson, Bernstein and Bosslet did an excellent job demonstrating fatal weaknesses in MurmurHash and CityHash, but what about SpookyHash? My first uneducated guess is that it would be much harder to ...
335 views

### Alice trusts Bob only when Bob trusts Alice

some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her. Is this something ...
212 views

### How to design a practical and secure MAC scheme?

I am sorry, but I need to introduce some concepts which are not directly related to cryptography to make myself clear, I hope I won't stun you with this ... (I'd rather explain it here than redirect ...
127 views

### Potential vulnerability in DH key selection - am I understanding this right?

I'm reading through a DH implementation, and I think I found a potential hole. Public $p$ and $g$ values are properly selected. A candidate secret value $\bar a$ is pseudo-randomly selected such ...
184 views

### Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$

Suppose, for some security parameter $n$ you choose a prime $p$ such that $p = 2^n+c$ for some relatively small $|c| < 2^m << 2^n$. I have seen such primes being called Pseudo-Mersenne Primes ...
584 views

### SSTP MSCHAP-V2 Authentication before SSL or after SSL Session

So with the recent news that there's a lovely new tool to crack MSChapV2 packets. So the question I have is on a SSTP Connection is the MSChapv2 handshake encrypted pre SSL setup or post. Obviously ...
163 views

### which asymmetric cipher provide highest performance?

to get highest performance Which asymmetric cipher provide fastest encryption/decryption ? ECC or DH ? what key size is recommended today ?
216 views

### How to use HMAC for large ciphertexts over TLS

HMAC used to secure chosen cipher-text attacks. if we are encrypting a large file (video) and sending it over TLS for decryption, how server can check MAC for ciphertext when we didn't sent whole of ...
613 views

### RSA private key format for Mega

I've been trying to reverse engineer Mega's (mega.co.nz) API calls. And stopped on the step where client needs to decrypt session id with provided RSA key. I can get key data, but I have no idea how ...
446 views

### Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?

I take the definition of safe prime as: a prime $p$ is safe when $(p-1)/2$ is prime. Safe primes of appropriate size are the standard choice for the modulus of cryptosystems related to the discrete ...
791 views

### Security of Deterministic Encryption Scheme

A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm. Although we ...
3k views

### Export from US of crypto software with key-size > 56 bits still needs permission?

Elsewhere someone stated that he couldn't publish his crypto software on the Internet, because US Export Regulations require approval, if the key size is greater than 56 bits. I know that several ...
2k views

### Even passwords are vulnerable to hash collision attacks?

As stated in this page large documents hashed using md5 maybe vulnerable to collision attacks. My question is even passwords of 6-30 character are vulnerable to such hash collision attacks? If yes, is ...
200 views

### Sensible usecase for restricting special characters in passwords? [closed]

Please See Why Not Allow Special Characters In a Password on Security. Several websites I've come across limit the allowed special characters for a password. My thought was, it should all be ...
102 views

### Secure modulus length for Diffie-Hellman [duplicate]

What is secure modulus length for modular exponentiation so that finding discrete log is computationaly impossible?
121 views

### reduces the coefficients of a modulo 3 on NTRU

i'm still don't understand about 'reduces the coefficients of a modulo 3' on NTRU tutorial $a = f*e = 3 - 7X - 10X^2 - 11X^3 + 10X^4 + 7X^5 + 6X^6 + 7X^7 + 5X^8 - 3X^9 -7X^{10} \pmod{32}.$ Note ...
276 views

### How to efficiently generate a stream of independent, but biased random bits?

Usually, in cryptography, one is interested in debiasing a stream of independent (true) random bits, and several algorithms exist to do this. What about the converse? Let's assume I have a stream of ...
1k views

### HRNG for One Time Pad

I have just advanced to the last grade of high school (in Denmark). In this year, we all get to do one big project, where we can build/invent/create whatever we want to "solve a problem". As I study ...
368 views

### Comparison: complexity measures vs. security

Assume that you want to compare several cryptographic primitives (say, encryption schemes), and choose one. You need to consider several complexity measures, such as the key length, encryption time, ...
443 views

### File encryption with one keypair?

I'm working on a program that uses an ECC keypair in a (password protected) PKCS12 file (.pfx) to encrypt files. I like this method because I think it will be higher security (using ECDH to negotiate ...
437 views

### How to compute the dot product on encrypted values?

Is there a practical homomorphic encryption scheme that can give reasonable execution time results in computing a dot product: $$a_1*b_1 + a_2*b_2 +a_3*b_3 +\ldots+ a_n*b_n$$ I imagine the scheme will ...
272 views

### Could a very long password theoretically eliminate the need for a slow hash?

Before I provide details, I want to clarify that I am not looking to implement this practically, but I'm only asking to get a better understanding. The way I currently understand it, we use slow ...
128 views

### Key Exchange and anonymity issue

If Alice (sender) sends a private message embedded with public key of the Bob(recipient) through onion network, so in this key exchange, does Bob remains anonymous to Alice as Alice knows about the ...
119 views

### RSA Certificate Owner and Issuer line meanings?

Apologies if this question is not in the right place. I've recently been looking through some RSA certificates ( specifically, Android apk .rsa files) and I'm having trouble deciphering the one and ...
247 views

### How large should a Diffie-Hellman p be if the messages are encrypted?

How large should the prime $p$ and generator $g$ values be in a Diffie-Hellman handshake if the messages are encrypted. If the key that encrypted the Diffie-Hellman messages becomes compromised, ...
254 views

### Encrypting and Decrypting a 19-digits long BigInteger

How can I take a maximum 19-digits long BigInteger and encrypt it with the following rules: The result must be based on digits and lower-case English letters ...
2k views

### How does the rand() function in C work? [closed]

I want to know how rand() works (even when I don't provide any seed how it produces PRNs?) thanks!
1k views

### Brute forcing an HMAC

Given current technology such as GPUs and GPU cracking software I was wondering if anyone has an idea on how long it would take to brute force the key used to derive an HMAC?
152 views

### How comparable is OFB to a one-time pad?

This is a rather trivial question, I just want to see if I get the concept right. In OFB you generate a pseudorandom stream based on some nonce, and you XOR that with the message to get the ...
5k views

### What makes a hash function good for password hashing?

Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
27 views

### Encryption with Deduplication [duplicate]

Suppose I have a file server running ZFS with file deduplication enabled, and I have two users that are sharing files: Alice and Carol. If Alice uploads huge_file.tgz to her www/ directory, and Carol ...
147 views

### Does Linear Cramer-Shoup have pseudo-random ciphertexts?

"Linear Cramer-Shoup" is defined on pages 4 and 5 of $\:$ eprint.iacr.org/2007/074.pdf . Are the ciphertexts in Linear Cramer-Shoup computationally indistinguishable from uniform under a ...
1k views

### Where to store the private key and the public key in a communication protocol

I want to create a simple secured connection protocol over TCP/IP. I just want to connect from my mobile device to a server securely. Firstly I thought to use an SSL connection, but I changed my ...
162 views

### Selecting a large NUMS Safe prime

Suppose I want to use the following simple hash function. For a mesage $m$, take some public $a$ and prime $p$ and raise $a^m \bmod p$ (never mind the computational expense of this operation). This ...
321 views

### When confusion is applied during encryption?

I know confusion is used in cryptography to make it more difficult to identify any relationship between the ciphertext and the symmetric key. I want to know when the confusion is applied during ...
287 views

### computing inverses in truncated polynomial rings manually for NTRU encryption [duplicate]

Can someone explain how to find inverses in truncated polynomial rings manually (i.e. on pen and paper)? As an example from the tutorial: Example. Take $N=7$, $q=11$, $a=3+2X^2-3X^4+X^6$. The ...
683 views

### Is this encryption algorithm build from MD5 secure?

I'm being asked to use an encryption algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm ...
80 views

### Can a LIRA system work with cjdns or other decentralized meshnets?

LIRA (Lightweight Incentivized Routing for Anonymity) is a scheme to incentivize participants in Tor to contribute resources, in particular bandwidth. The paper talks about it being used for Tor. Can ...
927 views

### BCrypt vs Key Stretching MD5

Ars technica posted an article about the latest in cyber warfare from the stuxnet crew. They key stretched MD5 by iterating it 10,000 times. It seems to be effective at handicapping HashCat's gpu ...
750 views

### Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
265 views

### Solving congruences using PARI

I'm having trouble finding info in the docs about how to solve a system of congruences. The closest I can find is 'matsolvemod' in here: ...
I'm reading a cryptanalysis on Blowfish, and I've come across something that I don't quite get. Let's denote $$\delta = a \oplus a'$$ where a and a' are bytes that cause a collision in some S-box ...