# All Questions

257 views

### Parallel-resistant proof-of-work scheme?

I am looking for a proof-of-work scheme which cannot be effectively parallelized. For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function $f()$, a target ...
586 views

### Are RSA signatures deterministic?

If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, do I always will have the same signature? A Java example always return ...
229 views

### Non-cryptographic hash function as MAC for stream ciphers

I understand that for a stream cipher to be useful, there must be a way to verify that the message was not tampered with (bits were flipped by an attacker). So, instead of using some cryptographic ...
984 views

### Why do we need in RSA the modulus to be product of 2 primes?

I think I roughly understand how the RSA alorithm is working. However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$. I vaguely know it ...
551 views

### Are there secure stream ciphers that cannot be parallelized?

Are there any stream ciphers (or a deterministic random number generators, that should work as well I guess?) that cannot be parallelized? So for example if I seed it with a specific value, and then ...
324 views

### Security considerations for partially shared password databases

Programs like KeyPass and 1Password store password database files encrypted by a single password. If someone knows the protecting password ("Vault Key"), they can read the entire database ("secrets"). ...
588 views

### Can I pre-define the points in Shamir's Secret Sharing algorithm

With Shamir's secret sharing is it possible to pre-define the points returned by the algorithm? For simplicity if I have (k, n) where k=2, and n=4, and I have the points X,Y,Z, and Q. Can I create ...
91 views

### Is it safe to initialize secret keys by just reading /dev/random on Linux?

For a software, I don't want the user to choose weak keys, so I plan to just read the needed number of bytes from /dev/random to create the needed secret keys. Is it safe to do so?
91 views

### Present an attack for the combination of OTP and textbook RSA

Let $N=p \times q$ where $p$ and $q$ are two primes. Compute $\Phi (N) = (p-1)(q-1)$. Choose $e$ s.t. $1 < e < \Phi(N)$ and $gcd(e,\Phi(N))=1$. Compute $d = e^{-1}(mod \ \Phi(N))$. ...
78 views

### How can I design a cryptographically secure, key-dependent s-box?

I would like to design a cryptographically secure, key-dependent s-box, but I am not sure how. Mainly, because I am unsure about the difference in design compared to a random s-box. What is the ...
287 views

### Proper way to generate symmetric keys

I'm trying to educate my self in key management, how to store them, how to generate them, how to use them properly. I've been trying to find how you would generate a key for symmetric encryption (say ...
81 views

### Why are modes of operation used, what attacks do they prevent?

I know you always need to use a mode of operation when using a block cipher, AES for example, and Wikipedia has a good explanation for what modes of operation are Now I know if i do not use a mode of ...
101 views

### Roots in modulo field

I have a point $(X,Y)$ on an elliptical curve $E(a,b)$ where $a=-3$ and $B$ is a large number that is in hexadecimal from -51BD. To compress this point oficially in a program, we know that every $X$ ...
292 views

### Is there a way to systematically calculate the public exponent $e$ in RSA?

I'm learning RSA in one of my classes and we were given a problem: $p = 5$, $q = 11$ I have done the following steps: $n = 5 \cdot 11 = 55$ $\phi = (5-1)\cdot(11-1) = 40$ I know that to ...
386 views

### How does compression before encryption leak info about the input?

Apparently current best practices recommend that you do not compress before you encrypt. For example in this blog entry (*): http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ It ...
552 views

### How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?

I am currently trying to create an ECCCurve for E-521. Unfortunately, it is not currently a named curve in the library I am using, so I will have to define it manually. I am using the definition of ...
2k views

### How to calculate the maximum output size for data encrypted with a RSA Private Key?

I have an an encryption algorithm I am working with that looks like this: prv_key_enc(sha1_hash(data)) Where, the RSA parameters are: RSA/ECB/PKCS1Padding 1024 ...
498 views

### How is HKDF-Expand better than a simple hash?

Why do we need HKDF-Expand if we can simply hash the pseudorandom key to make it longer? The docs (in the link) say: The second stage "expands" the pseudorandom key to the desired length... ...
65 views

### Weaker Notion of Target Collision Resistance

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: While it might be easy to find a collision $M,M'$ in $F_K$ by making both $M,M'$ depend on $K$ ...
78 views

### Dependence on Keyed Hash Function

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: With an ACR hash function $F$ the key $K$ is announced and the adversary wins if she manages to ...
631 views

### Difference between collision resistance and target collision resistance

For a hash function, what's the difference between Collision Resistance and Target Collision Resistance?. I understand the definition of hash function collision resistance, but I don't know about ...
733 views

I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts. The problem is that I need to ...
254 views

### How large should a Diffie-Hellman p be if the messages are encrypted?

How large should the prime $p$ and generator $g$ values be in a Diffie-Hellman handshake if the messages are encrypted. If the key that encrypted the Diffie-Hellman messages becomes compromised, ...
482 views

### Nonce role on stream ciphers

Modern stream ciphers usually predicts the usage of a nonce (also termed as IV) in the cryptosystem. The cost of initializing the cipher with the nonce varies from algorithm to algorithm (for ...
228 views

### Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack

The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
515 views

### using Post-quantum asymmetric ciphers instead of RSA

We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks ...
2k views

### Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
374 views

### Why is a non fixed-length encryption scheme worse than a fixed-length one?

I have the following definition (highlights by me): An (efficient secret-key) encryption scheme $(Gen,Enc,Dec)$, where $Gen$ and $Enc$ are PPT algorithms and $Dec$ is a Deterministic Polytime ...
5k views

### What exactly is addition modulo $2^{32}$ in cryptography?

EDIT: I've been confusing this the whole time. What I've been wanting to say this whole time is addition modulo $2^{32}$ not addition modulo 32 as the question originally said. Thanks for pointing ...
1k views

### Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext

I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are ...
518 views

### Entropy of system data - use all and hash, or trim least significant bits?

I'm working on a background entropy collector for key generation that monitors hardware and produces an entropy pool. Here's my list of sources: Mouse position Keyboard timings (i.e. time between ...
223 views

### Shannon entropy calculation: is $H(A|R·A) = H(A)$?

Suppose I generate a random $m×m$ matrix $R$, where each of its elements belongs to $\mathbb Z_n$. I ensure that $R$ is invertible in $\mathbb Z_n^{m×m}$. Now I take a non-random $m×m$ ...
754 views

### Salts, how does the script know what the salt is?

I am new to PHP programming and trying to grasp the idea of hashing and encryption for protecting passwords, credit card details and such. I've done a lot of reading about MD5 which I think I ...
549 views

### A mathematical explanation of the DES encryption system

I need a mathematical explanation of what does the DES encryption system really do. This means I need more explanation than the one that offers FIPS, which is more an explanation for computer ...
137 views

### Proving an encrypted message contains (but does not 100% consist of) a plain-text message?

I have keypair (u,r), and two pieces of data, X and Y. I reveal X publicly but keep Y secret. Y has high entropy. I then concatenate X and Y, into Z. I encrypt Z, into "encrypt(Z,u) = Q". r is ...
82 views

### What is a man-in-the-middle attack (for instance in Diffie-Hellman)?

I'm new to cryptography and I just started learning about the Diffie-Hellman key agreement. I read that this system is vulnerable to a man-in-the-middle attack when used alone. What kind of attack is ...
142 views

### RSA private key d knowing e,n

I need to find RSA private key $(d, N)$ knowing $(e, N)$. It's "own" RSA implementation. As i know $p$ is random 70 bit number, then $q$ is $p-2^{10} < q < p+2^{10}$ $d$ is max 16 bit long with ...
123 views

### NTRU Encryption

It's using Euclidian inverse. Can you show it step by step? $$N=7, q=11, a = 3+2X^2 -3X^4 +X^6$$ the inverse of $a \pmod {11}$ is $$A=-2+4X+2X^2 +4X^3 -4X^4 +2X^5 -2X^6$$ How do we compute $A$?
366 views

### Proving the semantic security of the One Time pad

Currently hearing a lecture on cryptography, and the professor gave us the definition of semantic security, which is roughly the following (formally not quite complete, but you get the idea): ...
287 views

### Sharing an encrypted file between a group of people

Is there any way to share an encrypted file with a group? In the other words, can I encrypt a file with a public key so that each person in a group decrypt it with his/her private key? Is there any ...
396 views

### Cracking secret key of a MD5 hash?

I have a MD5 hash which is obtained by hashing certain strings appended by a pipe character ( | ). (I know the values of these) A secret key is added as a suffix to this (I don't know the secret key). ...
114 views

### DES-X , computation load and storage

The passage said that the computational load to attack DES-X can be reduced to approximately $2^{(56+64)}=2^{120}$ steps,and the storage of data sets should be $2^{64}$. But I can't figure why ...
248 views

I am trying to implement an FPE for a 19-digit long number. I am trying to follow the lecture of Prof. Dan Boneh and here is how I understand it: Get the nearest power of two greater than $10^{19} ... 0answers 58 views ### Smart card Strong authentication / Verification ( fingerprints) I'm trying to make a strong authentication software and embedded software in a java card. I have found many papers and publications about the subject… too much information to process and I'm working ... 2answers 400 views ### why inverse in diffie-hellman protocol will not give same value? Security of diffie hellman protocol is$K=g^{ab}$.if sender want to calculate value of$b$(given$a$) he can do$g^{{{ab}^b}^{-1}}$(where K=$g^{ab}$) which will give$g^{a}\$ as we are cancelling value ...
94 views

Using homomorphic encryption, I would like to be able to take an encrypted integer and either add 1 or -1 for a new encrypted value. I do not want the encrypted value to be recoverable - just the ...
468 views

### How can we get CA's public key?

To get a public key of some organization or someone we want to send an encrypted message to, we need to make a request to CA asking that organization's public key. CA then returns X509 certificate. It ...
264 views

### ECKS-PS algorithm: searching in encrypted data; bilinear maps

I have found an encryption algorithm named ECKS-PS (published in the paper Efficient conjunctive keyword search on encrypted data storage system) that allows an user to search in encrypted data. All ...