# All Questions

535 views

### Hill cipher key space

Key space is the set of all possible keys that can be used to generate a key. We using the number of valid key to describe it. I've given a hill cipher of block size $k$ over alphabet of size $p$, ...
99 views

### Is there a malleable pubkey digital signature scheme?

I'm trying to find a special kind of Digital Signature Scheme. The scheme should allow me to transform a signature $s=\text{sign}(sk,m)$ (for a private key $sk$ and a message $m$) into a signature ...
79 views

### Definition of a Statistical Test

In Professor Boneh's online Cryptography course at Coursera, I am a little puzzled by his definition of a statistical test where he writes: A(x) = iff |#0(x) - #1(x)| <= 10.√n Now, if – as ...
59 views

### Is timestamping possible without publishing?

The Wikipedia article Trusted Timestamping states that we can timestamp data by publishing it's hash. Publishing can be done either independently or via a third-party publisher, as explained by ...
101 views

### How to compare different signature scheme's performance?

I am interested in comparing the computational performance of two signature schemes. However, I am unsure how to do that. My candidates are RSA and Shamir's ID Based Signature scheme. To get a fair ...
63 views

### Expand 1-n Oblivious Transfer to retreave only an item I, for which permissions exist

To my understanding in a 1-n Oblivious Transfer the Sender has some Values $X_1...X_N$ and the receiver wants to retreave some $X_I$, with $1 \le I \le N$. Can one now somehow guarantee, that the ...
137 views

### Challenge–response authentication which can be done in head?

Say we have door where you have to say a password to pass. If theres someone standing nearby he would hear the password and could also use it. So therefore the doorman gives you a different number ...
41 views

### Distributed authentication in low trust environment

I would like to inquire if there is any Method to achieve the following: There is a list $L$ of $n$ entities that are allowed to perform a certain action. $L$ is cryptographically signed by some ...
55 views

### 1-1 trapdoor function mapping the set of $n$-bit numbers to themselves

I am looking for a trapdoor one-to-one function $f : \{0,1\}^n \rightarrow \{0,1\}^n$ (that is, mapping the set of $n$ bit numbers 1-1 onto itself [any $n$ is OK]). I was considering the use of ...
66 views

### Client puzzle using hash

When a server is under attack, it send the client the following data: Nonce - a byte array of Y length Hash - the hash digest of the puzzle solution The client has to find X such as ...
112 views

### RSA timing attack

Given an RSA implementation that uses Montgomery multiplications and CIOS exp algo, but NOT CRT. Given a decryption1 oracle that takes chosen cipher text and responds the plain text and the time it ...
123 views

### What is the idea behind hashing the QueryString in OAuth?

In OAuth 1.0a and 2.0 using MAC Authorization, I need to generate a hash of all the QueryString Parameters, which requires normalization (alphabetical ordering) of them. I'm trying to understand what ...
85 views

### Public-key based on roots of polynomial

In general it's hard to calculate the roots of a given polynomial P(x). But the other way back calculating the coefficients is much easier (Vieta's formulas). If this is a one-way function, is it ...
99 views

### Does a dynamic accumulator exist yet? [closed]

I’m looking for a one-way accumulator which can safely add new members (deletion is not necessary) and does not rely on a trusted party in any way. I’ve been looking for one, I need it for this ...
241 views

### Is this a secure (and correct) sign-then-encrypt technique for transferring messages?

After reading some information on the way iMessage works I have been working on writing some code to try my hand at securely transferring messages in a similar manner and I wanted to confirm that the ...
120 views

### Problem implementing MixBytes functionality in Groestl

Disclaimer: School work. I am trying to implement Groestl through Java, and have got stuck on the MixBytes section which can be found here section 3.4.5 page 11. As per the description of matrix ...
137 views

### Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password

I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has ...
122 views

### counter to indicate hotp count

I was trying to figure out how HOTP kept from wrapping over, when I saw this explanation of how it works, by Thomas Pornin [source]: The intended scenario is the following: the client has a ...
26 views

### Is there a flaw in whole disk encryption vs volume or folder encryption? [duplicate]

My company just implemented whole disk encryption on all laptops (Symantec) and the concept seems flawed. Please correct me if I'm wrong, but if I have known file in plain text and that same file in ...
266 views

### Rainbow tables and blowfish

I'm thinking of implementing rainbow tables for a specific blowfish problem, but I have trouble thinking of the proper way to apply the original paper (and its application to hash functions) to ...
83 views

### Parallel-resistant proof-of-work scheme without hidden knowledge

Follow-up to: Parallel-resistant proof-of-work scheme? Is there a proof-of-work scheme that: can only be solved serially; given the solution, can be verified in minimal time; deterministically ...
72 views

### Using a hash with a constant key to create easily verifiable codes

I'll keep my question short. If I keep handing out different codes generated by this function, will it be trivial to figure out the secret key? ...
98 views

### Does “use of SHA-256 in cryptography” imply use of SHA-256 both in HMAC and DH key exchange, assuming these are the only uses of hash in system? [closed]

I am beginner to Cryptography. And recently I came across the requirement like "use of SHA-256 in cryptography". Does "use of SHA-256 in cryptography" imply use of SHA-256 both in HMAC and DH key ...
199 views

### Weil pairing implementation - low level programming language

I'm just started to studying elliptic curve cryptosystems. My one month-goal is to write a simple signature system based on the Weil-pairing. Some parts of it can be written without deeper ...
182 views

### Which hardware-accelerated AES-GCM implementations support encryption in-place? [closed]

By encrypt in place I mean the following. Suppose I have an input plaintext of length L and I have also allocated an extra E bytes at the start and/or end of the buffer, with E << L. So the ...
93 views

### Is MITM possible after key exchange phase done successfully in RSA?

Is MITM attack theoretically possible after public/private key pair exchange is done successfully. Say Alice and Bob have genuine public keys of each other. Is MITM possible further during ...
76 views

### Random numbers for Master Key and Key_block

Exploration through RFCs concludes that random numbers used in the creation of Master Key and Key Block(Key material for Encryption Key and Mac Secret) are from ServerHello.random and ...
345 views

### Tweakable encryption algorithms vs Key wrapping

I have read many articles about Key wrapping and tweakable cipher modes. However, I don't understand the main difference between them? What you recommend for Key storage and Key Archive.
71 views

### Why don't we use H(m||k) as a MAC? [duplicate]

HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work. Is there some other obvious attack?
127 views

### Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
501 views

### Using RSA key pair for file encryption

I'm looking for a way to perform encrypted nightly backups of a server I administer, without storing the decryption key on the server. A form of PK encryption seems ideal for this, as I can store the ...
101 views

### Determine the iteration times using Pollard's rho Method for factoring

Let's say, we have a large number $n=181937053$ and $f(x)=x^2+1$. And also we know that $n=12391 \times 14683$. The problem is that ,using Pollard rho method, can we find the algorithm iteration ...
96 views

### Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
43 views

### Retrieve cryptographic key knowing cyphertext and plaintext [duplicate]

I was curious about cryptography so I started to learn about symmetric encryption. From what I understand a symmetric encryption works as follow: PlainText -> (Encrypt)K -> Cipher text -> ...
164 views

### What RC4 key value will completely invert $S$ after initial permutation?

What RC4 key value will completely invert $S$ after the initial permutation, so that $S[0] = 255, S[1] = 254, …, S[254] = 1, S[255] = 0$?
144 views

### Attacking hashed password by timing attack and other means

This question is inspired by this recent one, which raises a point that need to be made quantitative to be meaningfully discussed. I chose an unusual approach: a new question worded as homework that ...
207 views

### How does converting character set affect hash entropy?

Does mapping a large character-set hash onto a small character-set hash lower entropy for a fixed size substring? I'm writing a python app that involves generating passwords for websites. During the ...
439 views

### Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
145 views

### Safe and computationally efficient way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which ...
151 views

### Hash function that is efficient on GPU and poorly suited to ASIC

I have such requirements to the hash function in my project: operating on 32-bit data, not mathematically breakable (built on existing hashes known to be secure), free of branching, as much as ...
60 views

### What does the notation $1^n$ stand for? [duplicate]

I'm seeing this all over my Katz and Lindell book and I don't see where they introduced it.
81 views

### Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
46 views

### ElGamal Homomorphic Encryption Formula Question [duplicate]

With Pubic Key $(G, q, g, h)$ where $G$ is a group, $q$ prime, $g$ a generator of $G$, Am I right in thinking that: $$\mathrm{Enc}(m;r) := (g^r, h^r \cdot g^m)$$
61 views

### How to specify last $t$ bits are only sent when a signature is sent?

I have read that in cases where there is a limit on the amount of data sent over the network, one idea is to sent only $t$ bits of data rather than sending all the bits. For example, in the Schnorr ...