# All Questions

284 views

### correct usage of keys and nonce

I've being studying up on AES, GCM, CBC, HMAC and a lot of other primitives and am somewhat ( a little bit, perhaps) familiar with them however I am still a bit weary on the use of the keys and nonce. ...
144 views

### Why is a Feistel network not a type of substitution-permutation network?

I understand what substitution-permutation networks look like. I understand what Feistel networks and Feistel-like networks look like. A Feistel network or a Feistel-like network features substitution ...
155 views

### Salsa20-GCM composition secure?

AES-GCM seems to be used by everyone but I never seen even one post about Salsa20-GCM. Is it secure? Wikipedia mentions that GCM ...
121 views

### Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?

By my math, if you are inputting all possible 17 byte values, and the output is 16 bytes long, then there must always be 256 possible inputs that will result in each output hashsum. However, looking ...
309 views

### How to encypt/decrypt messages after ECDH key agreement

I am using Diffie-Helman key exchange to generate the shared secret. But how will can a message be encrypted using this shared key?
143 views

### Is computing roots moduli a composite $N$ a hard problem without knowing the factorization of $N$?

Suppose that we are given $\mathbb{Z}_{N}$ and an element $x^u \in \mathbb{Z}_{N}$ with $u \in (0,l]$ where $l$ is the bit-size of $N$. Is it difficult to recover $x$ by knowing $u$ without knowing ...
873 views

### What is the best hash for HMAC?

Long question but I am starting to lose sight of all the HASH algo's there are. I know SHAKE128 and 256 are part of the SHA-3 standard but is the SHA3 standard officially released yet? i can only ...
91 views

### Applying Trapdoor Function directly to plaintext

Suppose we have a secure trapdoor function defined on (G, F, F^-1) where G is a randomized algorithm outputs a key pair (pk, sk). Why would this trapdoor function become insecure if we apply F ...
421 views

### Why are twofish or other algorithms not NIST approved, are they still safe?

NIST has a total of 3 approved block ciphers on their website: AES, TDES and skipjack. I get why those are on there (though personally I find TDES a bit iffy) but from my understanding Twofish and ...
209 views

### Why is this a fix to Bleichenbacher's attack?

Looking at the excellent explaination of the attack here: Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5? I have one additional question: It says that: ""To prevent this attack, SSL ...
123 views

### Is the idea of a known plaintext attack really that new?

As you can probably guess, I just watched The Imitation Game, which hasn't really gotten points for historical accuracy... During World War II, Turing and his team fret that they can't know the ...
143 views

### How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

Note: This question was reposted from Bitcoin Stack Exchange, where it received alike answers. You can see a little background about this on this bitcointalk post by the late Hal Finney. $\beta$ ...
913 views

183 views

### Are ZKPPs possible with server-side hashed passwords?

A basic ZKPP (Zero Knowledge Password Proof) is based on the server being able to challenge the client, and the client can then prove it knows the password (in such a way that is verifiable to the ...
348 views

### What does it mean when two encrypted files, encrypted with the same method but with different keys, when xor'd together, produce a repeating pattern?

Let's say I have fileA and fileB, both encrypted somehow, but in the same method with different keys. If I xor them together, they will make a repeating pattern of 32 bytes length. What does that ...
Is ElGamal still unforgable if the adversary knows the value of $r$ that was calculated by $g^k$? When we do sign the message $msg$, we calculate $r = g^k$. As we know the regular ElGamal ...