# All Questions

457 views

### Families of public/private keys in elliptic curve cryptography

I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
2k views

I'm working on implementing a cryptographic system and I'm trying to understand the Zero Knowledge Password Proof concept. So here's some background: To generate a secret key I am: Doing an ECDH ...
1k views

### Brute forcing CRC-32

I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad ...
345 views

### How can two different passphrases unlock the same content?

I have heard that in enterprises it is common that the IT admin has a master passphrase that can unlock any content that an employee encrypts. It would be temping to think, that the IT admin's ...
249 views

In RSA, the $p$ and $q$ should be randomly generated, and they are the same size. The difference between $p$ and $q$ should not be small. Suppose that $u=|p-q|<20$ and $p \times q ... 1answer 220 views ### How to calculate inverse affine transform in AES from forward affine transform? In AES the forward affine tranformation matrix is defined as: $$\begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& ... 1answer 188 views ### Should HMAC or NMAC or plain Keccak be used for a secure MAC? After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ... 1answer 4k views ### HMAC-SHA1 vs HMAC-SHA256 I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough ... 1answer 330 views ### LFSR get output from characteristic polynomial? Say you have a characteristic polynomial of an LFSR:$$f(X) = X^4 + X^3 + 1$$How can I use this function f to get the output of the LFSR, given some initial state? Obviously I can create the LFSR ... 1answer 170 views ### Difference between lightweight, online and low memory Authenticated Encryption schemes What is the basic difference between the following types of Authenticated Encryption (AE) schemes? Lightweight Authenticated encryption Online Authenticated Encryption Authenticated Encryption for ... 1answer 212 views ### How can k3d3/ed25519-java's performance be improved? I tried asking this on stackoverflow because I thought it might be a simple coding question and didn't want to clutter up this amazing stack, but I received no responses. CodesInChaos showed me that ... 1answer 394 views ### Elliptic Curve Encryption Ciphertext Size I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal) 1answer 192 views ### Is there a cryptographic hash function that can be performed with pencil and paper? Imagine I'm signing up for the 99th new web site this month. I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into ... 1answer 271 views ### Why is the discrete log problem easy when the exponent comes from a binomial distribution? I read in http://epubs.surrey.ac.uk/7219/2/esorics06.pdf that in exponential El Gamal the discrete log problem for recovering$m$from$g^m$can be made tractable when$m$is drawn from a binomial ... 1answer 340 views ### Attacking historical ciphers methodology It's more a theoretical question of how would you approach it. All you know about the ciphertext it's was generated with a historical cipher. The ciphertext appears to be random, BUT it's divided into ... 2answers 260 views ### Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA? Can hash trees provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key? 2answers 137 views ### iterated discrete log problem Consider the following problem: given$g_1 \ldots g_i,h_1 \ldots h_i \in G$,$\forall i$find$x_i$such that$g_i^{x_i}=h_i$For$i=1$this is the discrete log problem and is assumed to to have ... 2answers 1k views ### Cryptanalysis of Linear Feedback Shift Registers It is well known that simple m-sequence linear feedback shift registers have a linear algebraic structure and therefore the generator seed can easily be deduced using the Berlekamp-Massey algorithm. ... 2answers 8k views ### FIPS 140-2 Compliant Algorithms Is there any reference to check the list of encryption & signing algorithms which are compliant to FIPS 140-2. After an exhaustive search I could find only "AES". Any suggestions would be much ... 3answers 780 views ### Is it possible to pick your Ed25519 public key? Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ... 1answer 252 views ### What is the name of this kind of protocol There is a communication protocol that I believe creates the equivalent of a one time pad, with the downside that the secret message must be transferred multiple times. The protocol is so simple that ... 2answers 364 views ### Can I build a secure tweakable block cipher from a normal one by adding key and tweak? Let (E,D) be a secure block cipher. Consider the following tweakable block cipher: ... 2answers 1k views ### Difficulty of breaking RSA for a given key size Is it true that breaking a 1024-bit RSA key is as difficult as breaking a 128 bit symmetric key (e.g. AES)? I know that breaking a RSA key is equivalent to factoring the modulus$N$. To factor it, you ... 2answers 535 views ### are CFB and OFB really meant for streaming? CFB, OFB and other modes are meant for streaming and don't require padding. Are there still limitations such as the text needs to be greater than key length? 2answers 1k views ### How can I break REDSHIRT / REDSHIRT2 encryption? Recently, a user on Gaming.SE asked a question about whether the user password in the video game Uplink could be modified after being initially set. The game does not contain an option to change the ... 2answers 249 views ### How is de-synchronisation of HOTP solved? From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ... 0answers 70 views ### Consequences of AES without any one of its operations Suppose AES-$128$. There are$4$operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey. Question: If I remove one of the following opearations, what will happen to ... 1answer 140 views ### Message lengths with AES CTR mode? Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ... 1answer 193 views ### SSL-like protocol with public-key hard-coded in the client Imagine a SSL-like protocol that instead of using certificates signed by a trusted CA, has the server's public key hard-coded in the client. My question is: what happens if the server's private key is ... 1answer 255 views ### Non-standard signature security definition conforming ed25519 malleability According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ... 3answers 512 views ### How do I test my encryption? (absolute amateur) I am a hobby programmer with a background in biology and have developed an encryption program based on DNA. I tried to make it hard to crack, but it's essentially a substitution cipher and uses the ... 1answer 86 views ### secret sharing of product of 2 numbers Does evaluating the products of shares$a_jb_j$give a secret sharing of$ab$? I think it's a no, but I am not sure on how to prove it. 2answers 247 views ### Is OTP useful in modern electronic communication? I have seen from time to time questions about various OTP schemes and "OTP" (i.e. stream cipher) schemes. The most common OTP troubles appear to be: How to extend size of previously generated key or ... 2answers 529 views ### definition and meaning of semantic security I'm taking coursera cryptography course. The definition of semantic security is hard to understand. I tried to slightly restate it (the word "efficient" was in the original definition). Do I get it ... 2answers 3k views ### AES+CTR+HMAC Encryption and Authentication on an Arduino In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel. We have chosen AES in CTR ... 1answer 344 views ### Decryption a chunk of file with AES We are having a requirement to store large files (~1GB) encrypted and decrypt them when reading. We are looking to use AES-CTR or AES-GCM mode to encrypt the data. There are scenarios where we want to ... 1answer 345 views ### Break double encryption Let$E_k$: {0,1}$^l$be a block cipher encryption function with block-size$l$and key-length$n$. In class, we saw that a double encryption with two independent keys$E{}'_{k_1k_2}(x)$= ... 1answer 289 views ### Why are protocols often proven secure under the random oracle model instead of a hash assumption? Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol$P$using a function$H$, and ... 1answer 1k views ### How can I use eulers totient and the chinese remainder theorem for modular exponentiation? I'm trying to implement modular exponentiation in Java using Lagrange and the Chinese remainder theorem. The example we've been given is: Let$N = 55 = 5 · 11$and suppose we want to compute ... 1answer 860 views ### One-time pad and zero key I'm doing some exercises before my exam, and I am stuck with task number 4 in this file: http://www.cs.umd.edu/~jkatz/crypto/f10/hw1.pdf Could you help me with this task? When using the one-time ... 3answers 1k views ### Malleability attacks against encryption without authentication Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block: ... 2answers 328 views ### Encryption with private key? we normally always encrypt by public key and decrypt with private key. If i encrypt with private key, then its still secure as normal PKI ? i mean known-plain-text will not take private key on the ... 2answers 296 views ### Is the Blum Blum Shub PRNG suitable to create initialization vectors? Is it a good idea to use a Blum Blum Shub Generator to create my initialization Vector (IV) in AES-OFB (Output Feedback Mode)? 1answer 370 views ### Padding for the TEA Sorry if this is a noob questions, but I finally figured out how to implement the Tiny Encryption Algorithm in C++. My question is what to do about padding the key and the plaintext? I know that ... 1answer 338 views ### DGK Cryptosystem Encryption Speedup Following @poncho's nice clarification of the RSA speedup here, let's see if I'm able to do the same in the case of the DGK cryptosystem: We have pk = (n, g, h, u), sk = (p, q,$v_p$,$v_q$) which ... 2answers 4k views ### Cipher Feedback Mode I can't understand what CFB really is. It said in Wikipedia that CFB is same as CBC, but I find that CFB is more difficult than CBC. Can someone explain to me how CFB works. Such as how ... 3answers 461 views ### RSA finding the inverse of the public exponent I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq$p \cdot q = N\$) Now, ...
241 views

My question is related to PBKDF2. I am unsure how to validate user entered password with already existing hashes and salts. I have heard of the so called "length-constant" comparison which basically ...