# All Questions

315 views

### Does perfect secrecy imply uniform ciphertext distribution?

I suspect the answer is no, but I am not able to either prove it, or provide an example. In Katz and Lindell's book, it is only said that with a perfectly secret encryption scheme, the plain and ...
174 views

### How does chosen ciphertext attack on Elgamal work?

Can it be proven that attacker can obtain the full message if he knows some plain-ciphertext pairs?
1k views

### Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?

The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ...
732 views

### Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties?

Consider the situation of a nation state (Blue) at war with another nation state (Red). Blue wants to deploy a secure cipher that blue currently can not break, but they are considered that Red could ...
2k views

### Design properties of the Rijndael finite field

So we've already had a question on replacing the Rijndael S-Box. My question is - can we use a different finite field other than the one given by $x^8 + x^4 + x^3 + x + 1$ in $GF(2^8)$. In other words,...
1k views

### How do you find a cheater in Shamir Secret Sharing?

If there are 4 people involved, and every two of them should be able to know the secret (the polynomial is just a line) and you are given f(x) and x for each of those people, and you know one of them ...
362 views

### Can double-encrypting be easier to break then either algorithm on its own?

As was pointed out in Martin Bonner's comment I cannot prove this, but it seems intuitively impossible. An encryption function is supposed to obscure the plaintext to the point where no information ...
3k views

### Diffie-Hellman: choosing wrong generator “g” parameter and its implications of practical attacks

In traditional DH one chooses two shared parameters: a large prime "p" and base "g", which is primitive root mod "p". Suppose generation algorithm is broken and "g" generates only a subgroup (group ...
2k views

### Why not use CTR with a randomized IV?

I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
101 views

### Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
473 views

### What is the state of cryptographic obfuscation in 2015?

Cryptographic Obfuscation is a technique that allows one to obfuscate source code in a secure way (as opposed to insecurely mangling it into spaghetti code.) For example, here is a way to protect a ...
180 views

### The internals of bcrypt

I'm attempting to get a better understanding of cryptography and have run into some questions about bcrypt. Bcrypt relies on the blowfish cipher, which is a reversible method of encryption. But ...
1k views

### Coefficients in Shamir's Secret Sharing Scheme

Sorry if this is a stupid question, but: in Shamir's scheme, we construct a polynomial and make our secret $S$ the zero-th coefficient $a_0$. What, if anything, necessitates this - in other words, can ...
2k views

### Why is the complexity of RSA-1024 80 bit and not 86 bit?

Why is the complexity of RSA-1024 80 bit and not 86.76611925028119 bit? Here is the complexity for the GNFS (pulled from the linked Wikipedia article): \exp\left( \left(\sqrt[3]{\frac{64}{...
2k views

### What is the largest performed/possible bruteforce attack to date?

I've read that cracking 128-bit key is currently out of reach of all humanity. However, I can't seem to find any information on what scope of brute force attacks have been performed or are possible at ...
410 views

### Exposing RSA private-key data… bad?

We know that exposing $p$, or $q$ or $\phi(n)$ results in trivial attacks on RSA since they allow us to factor $n$ and to compute the private exponent $d$. In OpenSSL (and most RSA implementations) ...
1k views

### A fair peer-based coin-flipping protocol?

I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight. This is how my idea ...
622 views

### Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
338 views

### Is multiplicative secret sharing secure?

I suggested mulitiplicative secret sharing in an answer to another question, but noted that I wasn't sure if it was even secure and was hoping someone would comment on the security. Since no one did, ...
2k views

I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with $... 1answer 436 views ### What is 'key agility' in relation to symmetric-key encryption? I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ... 1answer 253 views ### Can I use the ChaCha core as a 256-bit to 256-bit one-way function? I'm looking to implement Lamport signatures as a little fun project, and I need a fast one way function that maps$\{0,1\}^{256} \rightarrow \{0,1\}^{256}$. I was wondering whether I could safely use ... 1answer 778 views ### Practical uses of Manipulation Detection Code (MDC) and IGE I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of confidentiality-... 3answers 347 views ### Designing a key expander out of ciphers Is it possible to compose or combine$n$ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate$n$ciphertexts from the same key,$k$, and that recovering the key,$k$, from ... 2answers 818 views ### Is there a standard for OpenSSL-interoperable AES encryption? Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ... 1answer 769 views ### Will rehashing an SHA256 hash continually, eventually produce every possible value? So let's say you had infinite time and energy. You have a hashed string of some sort. Because you have infinite time and energy, you can produce a collision(or the original value) easily enough. But, ... 3answers 476 views ### What do$0^n$and$1^n$mean in cryptography? Let$f$=$\{f_k\}$be a pseudorandom function family. Let$G(x)$be a pseudo-random generator such that:$G(x) = f_x(0^k)f_x(1^k)$where$k=|x|$. I don't understand the meaning of$1^n$and ... 2answers 173 views ### Security game oracle queries Concerning private key (symmetric) IND-CPA game definition: Attacker$A$queries the encryption oracle polynomial number of times.$A$sends the challenger$C$a message pair$m_0$and$m_1$.$C$... 2answers 273 views ### How many possible Enigma machine settings? I'm trying to calculate the amount of settings the enigma machine has. I have found several sites regarding this topic, but it seems like there are two answers to my question. The first answer is 158,... 1answer 1k views ### What happens to the entropy of a password when you hash it? For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5? 3answers 655 views ### P = NP and current cryptographic systems I've recently heard some people claiming that if the fact that P = NP is proven, most (all?) the current cryptographic algorithm considered secure like RSA will be unusable in secure systems. My ... 3answers 665 views ### What is the appropriate public key encryption for secure coin flipping? I quote Bobby's question here since I encountered the same one... Random Coin Flip using ElGamal and a Trusted Party Consider the following protocol for two parties to flip a fair coin. Trusted ... 1answer 167 views ### Are ideal hashes possible to create? In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve). Hence, isn't it ... 2answers 560 views ### CPA Secure Chosen plaintext scheme The example for IND-CPA secure schemes given is generally: for a random r, Enc_k(m) =(r|| E_k(r) XOR m) where E is a PRF But does the role of r and k really matter--i.e. isn't this equally ... 1answer 307 views ### Formula for the number of expected collisions Say we have a hash function that produces$n$bit outputs. From the birthday problem that after around$\sqrt{2^n}$different inputs to the has function, we can expect a collision. Say instead that ... 1answer 2k views ### Why does Openssh use only SHA1 for signing and verifying of digital signatures? I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ... 1answer 266 views ### Why are there$ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
833 views

### How to attack a fixed LCG with partial output?

To show some colleague programmers exactly how broken C's rand() is (at least on Windows) I decided to break it. So everyone knows the exact parameters, MSVC's ...
974 views

### Two different keys decrypting same content

is there some generally available algorithm which will encrypt a short string and generate two unique keys so that any of the two can be used to decrypt the message again? It doesn't has to be "super ...
408 views

### What prevents a padding standard to cause a data loss?

In here different byte padding standards are listed as ANSI X.923, ISO 101.26, PKCS7, ISO/IEC 7816-4 and zero padding. All of them seems to apply padding to the last byte blocks. Odds are rare but ...
639 views

First, just to make sure I understand "salting" correctly: You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
3k views

### Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
894 views

### What is the actual difference between security through obscurity and true encryption?

In an abstract sense, aren't both the same? Don't their definitions boil down to the following? security through obscurity: trying to make sure some information cannot be obtained without knowing ...
415 views

### Why is feed-forward mechanism used in hash functions?

The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ...
64 views

### MD5 Hash outputs not produced

Are there any hash outputs not produced by the MD5 hash function? I need to use it as a placeholder for an empty hash while comparing two hashes.
2k views

### What does an RSA signature look like?

I am using OpenSSL libs to generate signatures. Internally, I learn that a signature is a hash of the message with some padding added to it. I am trying to understand the structure of a signature. If ...
227 views

### What does this Authentication protocol achieve and what information is shared?

I'm having trouble with the following question from my class: "What is the purpose of the protocol, and how does it achieve this purpose and what shared information does A and B end up after ...
1k views

### Why do we need in RSA the modulus to be product of 2 primes?

I think I roughly understand how the RSA alorithm is working. However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$. I vaguely know it ...
### What is the difference between the standard representants of $\mathbb Z/q\mathbb Z$?
The symbol $\mathbb Z/q\mathbb Z$ (given that $q$ is prime) represents the prime field $\mathbb Z_q$. Basically, the elements of this field are represented by $\{0, 1, \dots, q-1\}$, let's call this ...