# All Questions

163 views

### Understanding Genkin-Pipman-Tromer's ground potential, side channel attack on RSA

I'm pretty sure that by now folks might have come across this research from Genkin-Pipman-Tromer (GPT) on extracting the RSA key used by GnuPG (GPG) just by measuring the ground potential. I'm going ...
1k views

### Security of very simple XOR with random? [duplicate]

I am currently trying to implement a very fast and simple encryption algorithm in Lua for the purpose of using it with ComputerCraft. The main problem is that bitwise operations in Lua (5.2 at least) ...
205 views

### Are variable-length crypto hash functions still susceptible to collisions?

I just recently learned that the SHA-3 finalist Keccak allows for variable length output. As the only answer to this question states, "[it] need to have an output length at least equal to the input ...
176 views

### Is hashing a list of hashes safe?

I have an arbitrary long list of hashes (e.g. git tree hashes), and I'm wondering by how much I am increasing the risk of hash collisions by condensing them into a single hash, like so: ...
245 views

### PBKDF2 Salt and Password Ordering

I am currently reading about PBKDF2, and understand that the salt is used only once, while the password is used multiple times in the computation of the final key (see this question). How would the ...
520 views

### Possible CPA or CCA attack when using AES-CBC mode under the following situation?

Both client and server know a shared key in advance. Both sides us EVP_BytesToKey() derive a pair of same key and same IV. Then, client and server start transferring data encrypted by AES-CBC mode ...
338 views

### What's the point of a Meet In The Middle attack using i.e. double AES with throw-away keys?

What's the point of a Meet In The Middle attack while using, for example, a double AES encryption and using one time keys? You can recover the keys for a secret message already known and you can't use ...
148 views

### Partial hash code protocol for security tokens providing signatures

I've read the following two sentences within a beta protocol specification, which references ISO/IEC 7816-8 for PSO:HASH which already contains notions of a "partial hash". The off-card entity is ...
231 views

### Comparing Difference Distribution Tables

I have been studying the Diff. Cryptanalysis and finding it hard to do a problem. The problem is I have calculated the tables programmatically and found that the second table has a max value of 6 ...
236 views

I recently came across an interesting paper detailing the use of hardened session cookies. Each cookie includes a preimage of the password hash, and the preimage is hashed once more and compared to ...
24k views

328 views

### EAX: OMAC and CMAC

OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2? If it is OMAC1, does that mean it ...
174 views

### Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). So,...
183 views

### Proving Non-Existence of ECC Backdoors

In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...
209 views

### Attacking unuauthenticated RSA

In symmetric cryptography, a scheme is not considered secure if the data transmitted is only encrypted. The adversary will be able to modify messages to generate encrypted messages of his choice ...
154 views

### understanding the proof of knowledge

Recently I've been reading the paper “A New Family of Implicitly Authenticated Diffie-Hellman Protocols”. It's very hard for me to go further. Especially when it comes to the proof of knowledge. ...
125 views

### Construct block cipher from a smaller one with mixing function

I read about the AEZ encryption scheme as presented at the CAESAR competition. To me it seems like a construction of an arbitrary length block cipher from a smaller one. The key component is the ...
94 views

### Which causes longer “break” time (in general)?

In general (if possible to determine) which would make an output harder to turn into plain text with a computer? Extreme Length (minor complexity change) Extreme algorithmic complexity (minor length ...
1k views

### Entropy of two concatenated random values

In this Intel blog posting, the author claims: The amount of work required to brute-force predict a random value that has n bits of entropy is $O(2^n)$. If you concatenate two values together, the ...
163 views

### Proof of Communication

I desire an algorithm in which Alice sends a block of data $X$ to Bob, with proof that the data was both sent and received. Ideally this would take the form of a public-key signature of the block $X$ ...
21k views

### What are the advantages of TOTP over HOTP?

HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What ...
199 views

### One Way function and Merkle Damgård

Is it possible keep the "one wayness property" of certain one way function in Merkle-Damgård construction? I'm asking this question because according to Collision-Resistant hashing: Towards making ...
316 views

### Can all asymmetric key pairs be reversed?

After reading about public/private key cryptography, there are still a few points I don't really understand. Based on the way (I understand) challenges work, the public key is used to encrypt a ...
156 views

### Deterministic Rand function for Winternitz One Time Signatures

Suppose you are implementing a Generalized Merkle Signature Scheme, using the Winternitz One-Time Signature Scheme for the node signatures. Furthermore, suppose the implementation is to be stateless (...
123 views

### Counter Mode: how to choose the nonce part of the counter? [duplicate]

Suppose: The "counter field" is about: NONCE || CTR-VALUE. I have multiples messages $M_a, M_b, M_c, \dots$ Each message can be divided into x-bits blocks ($M_{a1}, M_{a2}, M_{a3}, \dots$). Each ...
319 views

### Simple proof that shows AES is not a uniform permutation on any n-bit string?

Is there a simple proof that shows AES is not a uniform permutation on any $n$-bit string? Since I'm just starting with crypto, I'd like to see a simple yet elegant proof for the said property. ...
119 views

### Efficiently map $2^n$ unique 64-bit vectors to $2^n$ $n$-bit vectors where $n < 64$? [closed]

Is there an efficient way to map $2^n$ unique 64-bit vectors to $2^n$ $n$-bit vectors where $n < 64$?
824 views

### Is it secure to derive an AES key from a MAC?

I'm working on a project where we need to encrypt a large number of files and store them on the cloud. And I'm wondering if the following process would be secure (we have a “Hardware Security Module” ...
158 views

### What's the consequence of having a short IV? Is one mode better in that case?

I've read lots about null-length IVs being bad for most modes. In a scenario where passing a 128-bit IV along with each message isn't feasible, how would generating the IV from a smaller passed-along ...
272 views

### Seemingly simple decryption question

Forgive the very novice question, but... Given an algorithm which, upon inputting an unchanging 4-character string, generates a variable 6-character string, but having no idea what the algorithm is ...
497 views

### How does compression before encryption leak info about the input?

Apparently current best practices recommend that you do not compress before you encrypt. For example in this blog entry (*): http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ It ...
2k views

### Why does DES use exactly 16 rounds?

Why does DES use exactly 16 rounds and not more or less than 16? What is the significance of using 16 rounds?
943 views

### Why are MACs in general deterministic, whereas digital signature constructions are randomized?

The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital ...
360 views

### How are secure hashing and encryption algorithms proven?

Given that: You should always use proven secure hashing and encryption algorithms, rather than attempting to write your own. What's the process for criteria for an algorithm being proven? Is ...
465 views

### Maximum password length in PBKDF2

Haven't found any clear cut answer in Google so its up to you guys: DK = PBKDF2(PRF, Password, Salt, c, dkLen) Here, what is the upper limit of password length? ...
218 views

### Convergent Encryption: integrity and authenticity

I have one question about convergent encryption. Suppose I use AES-256 in CBC mode. I need a 256 bits key and a 128 bits IV. If I use SHA-256 to hash one file, then I can use directly that hash as ...
199 views

### CBC-MAC key can be added to ciphertext?

I use AES both CBC and CBC-MAC to encrypt some stuff. I generate one key for CBC and one different key for CBC-MAC. Does the second key (for CBC-MAC) need to be secret? How to join such key with the ...
2k views

### Cryptography vs Security

This may sound a little bit of basic but here it goes… Which of the following is correct? “Cryptography is under the security field”, or “Security is under the cryptography field?” Cryptography ...
138 views

### Is this a plausible PBKDF?

Background: Hello, I'm working on a hobby project in which I might want to implement a key derivation function within a somewhat resource limited embedded system. For standard crypto functions, I ...
28k views

### What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?

AES has several different variants: AES-128 AES-192 AES-256 But why would someone prefer use one over another?
97 views

### Variants of AES? [closed]

Would variants of AES provide the same level of security as AES, say by just replacing the S-box with another one, MDS matrix of Mixcolumn, etc.?
132 views

### ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know. I am trying to set up a system where a user can receive a temporary license key over the phone, put it into ...
381 views

### Diffie–Hellman Ephemerality Nomenclature

Below is a short excerpt of available DH cipher suites available on a machine. I understand EDH is ephemeral DH, and that ECDH is for Elliptic-Curve DH which is computationally faster. ECDHE is both ...
96 views

### Private Key - Memory Lifecycle

I often heard about private key storage, but rarely about key life cycle in memory. For example, when SSL is used from one peer, the private key is used to sign messages or decrypt other peers' ...
In the ElGamal signature scheme we calculate a signature for a (hashed) message $m$ as $r \equiv_p g^k$, $s \equiv_{p-1} (m - xr) k^{-1}$ and verify it by checking $g^m \equiv_p y^r r^s$. Here $r$...