# All Questions

932 views

### Is the random data at the end of my decrypted message supposed to be there?

This is my PKCS#5 & AES/ECB Python 3.3 code: ...
509 views

### One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on proof-...
671 views

### Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?

I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines: Consider routine 2.2.7 of http://...
169 views

### How to determine which type of crypto is used in a text file? [closed]

is there a tool or a way to determine which type of crypto is used in this type of text: ...
227 views

### Prove preimage resistance property

Let $f : \{0,1\}^* \rightarrow \{0,1\}^n$ and $g : \{0,1\}^* \rightarrow \{0,1\}^m$. $h$ is created by concatenate f and g: $h : \{0,1\}^* \to \{0,1\}^{n+m}$ with $h(x) = f(x) || g(x)$. How do I ...
137 views

### AES CBC encoding of decomposable OAuth2 tokens

We're building a stateless RESTful API that relies on the content of OAuth2 tokens to identify users and what they have access to. Users authenticate with other means and are given a token, which they ...
243 views

### Unique, anonymous online authentication

Is there a way to authenticate users online without knowing their real identity yet preventing them from registering twice? If not, what is the least amount of information you would need? If it helps, ...
89 views

### Collecting entropy from a stream to a file

I have a potentially infinite stream of data originating in some physical phenomena that may expose random behavior (due to quantum effects, thermal noise, the butterfly effect in chaotic dynamical ...
309 views

### Generating Diffie-Hellman parameters efficiently

I am working on an Android project for school and I am supposed to do a DHKE (Diffie Hellman Key Exchange). Everything works well. The problem is that it takes a lot of time (really a lot) to ...
456 views

### What are some restrictions when converting Montgomery Curves into Weierstrass Curves?

I want to represent a Montgomery Curve (curve25519) in Weierstrass form as a personal exercise. After doing some math and referencing the conversion equation at http://en.wikipedia.org/wiki/...
135 views

307 views

### Practical (and secure) PRGs

Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, Micali-Schnorr,...
65 views

### Bicliques for permutations

So I'm trying to understand the complexity of the biclique attack on Grostl and I have some questions: 1) The paper introduces sliced bicliques where on Grostl one constructs a biclique of dimension ...
194 views

604 views

### Importance of block size in CBC mode

Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
2k views

### Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
170 views

### On the Definition of a PRG and a CSPRG

I've been looking at the definition of a PRG, here. This is a broader notion than a cryptographically secure PRG ("CSPRG"), which is described here. I am realizing that I am very confused by this ...
84 views

### Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
96 views

### Signing the hash of a key with the same key

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in ...
220 views

### Public-Key Deterministic Encryption : Why does not provide perfect security?

I've got a question about an assignment . The question is "Why a Public-Key Deterministic Encryption Algorithm does not provide perfect security ?" . I suppose it means according to Shannon . Any ...
428 views

### Can passwords be stored securely so that a similarity comparison can be made?

On the Pro Webmasters StackExchange site, someone asked a question about a webapp (in this case cPanel) that refused to allow a password change because it was too similar to a previous password. I ...
1k views

### Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
3k views

### Is 80 bits of key size considered safe against brute force attacks?

I came across KATAN Family of Ciphers for small domain input blocks . They cipher arbitrary block lengths 32,48,64 but their key size 80 bits only. Is 80 bits of key size considered safe with ...
765 views

### What does “Worst-case hardness” mean in lattice-based cryptography?

In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ...
574 views

### Proof for exponentiation in modular arithemtic

If $e$ is a natural number, then this is true: $$m^e \bmod\ n = (m\bmod\ n)^e\bmod\ n$$ This is often used when encrypting, especially with RSA, since one can avoid directly calculating $m^e$, ...
149 views

### Going Blind, Group or Ring?

I have several problems approaching the following problem: Let's assume that we have Alice, Bob and Cathy. Alice wants to present a message to Cathy, showing her that someone else has signed it (Bob), ...
5k views

### The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
132 views

### DES-encrypted cipher

Suppose that you knew that a plaintext was encrypted with DES and consisted only of 16-bit Unicode letters, numerals, and punctuation marks available on a standard English-language QWERTY keyboard. ...
379 views

### Encryption of a number with RSA bigger than $n$

I'm having trouble understanding why encrypting a number $m$, which is larger than $n=p\cdot q$. I've looked into the following threads: Why RSA can't handle numbers above 76? Why does plain RSA ...
169 views

### Reason for difference in assumptions for practical private-key and public-key crypto

Theoretical cryptography tells us that everything in the world of private-key cryptography (CCA-secure symmetric encryption, message authentication codes, etc.) can be built from one-way functions and ...
352 views

### Why is CBC based on AES malleable in blocks other than the first block?

Perhaps I don't understand the answers to Malleability attacks against encryption without authentication, so trying to be more concrete... please be patient. If I want to change the first block and I ...
182 views

### Cracking Stream Cipher

I need to crack a stream cipher. I have a set of plain text and encrypted text pairs. The hint to the question asks me to use entropy analysis and look at the hex dump of the encrypted text. However, ...
528 views

### Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...
185 views

### Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?

In one of the exercises in [KL] Book I need to tell whether an encryption scheme is secure under an eavesdropper of only one message. Given a PRG $G: \{0,1\}^n \rightarrow \{0,1\}^{n+1}$. The ...
273 views

### Homomorphic encryption for vector addition

Building on the question and answer from Addition-only PHE in F# which ponders homomorphic cryptosystems to navigate, relatively, a single dimension without revealing absolute position (an encrypted ...
946 views

### Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
309 views

### Why does a perfect secrecy can be achieved when decryption correctness is not totally required?

By Shanon theorem, a perfect secrecy encryption scheme must use a key space of equal size as the message space. But when the correctness requirement is weakened such that $Pr[Dec_k(Enc_k(m))=m]=1/2$ ...