# All Questions

3answers
179 views

Suppose $E_k$$(a, b, c) is encryption of values a, b and c with key k through encryption algorithm AES (AES-128) and each a, b and c are 300 bits integer values. Also Suppose this ... 1answer 139 views ### What is adaptive zero-knowledge? In this paper on pg. 1241 the authors discuss bullet point on Adaptive Zero-Knowledge : I am new to Zero-Knowledge and I am having trouble understanding what they are saying. I think they are ... 3answers 562 views ### Why use a timestamp and how can someone know it's the correct one? Let's say A wants to send a message, so everyone who gets the message, can be assured that it's from A. A then sends a message ... 1answer 269 views ### Flaw in the security definition of *Stateful* Authenticated Encryption? I'm in search of the correct definition of a stateful authenticated encryption scheme (sAE), and its related security notion. This has been treated several times in the academic literature, however, ... 1answer 271 views ### Is this new server API authentication protocol secure? I need a secure protocol to authenticate client side users with my server which has an API. I am devising something more secure particularly to resist active MITM attacks where an attacker may modify ... 1answer 66 views ### applying HKDF at both the client and the server I have two keys (K1 and K2) at both the client and the server. I hope to use HKDF in both client and server side to concatenate the keys. I will use the same salt value at both the client ad the ... 0answers 164 views ### Example of CL PKC I am trying to solve the example of algorithms of Certificateless Signature by manually and solving the mathematics of Algorithms but not succeed while doing mathematical calculations. Please ... 1answer 2k views ### Why does plain RSA not work with big messages (m>n)? [duplicate] From what I can remember, RSA is something like this: Generate 2 distinct prime numbers p and q that have similar bit length. Compute n=pq and \phi(n)=(p-1)(q-1) Compute e such that ... 1answer 289 views ### Bit commitment with 1-out-of-2 oblivious transfer I know a protocol for bit commitment using regular OT (Bob has 1/2 chance of learning the bit Alice transferred to him) which goes like this: COMMITMENT PHASE Alice chooses a bit b For ... 1answer 82 views ### Asymptotic Hash Function and Concrete Hash Function I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical, and they say that its formalization is non-asymptotic. Why is the formalization non-asymptotic? What is an example of hash ... 1answer 97 views ### How to pronounce RIPEMD 160? Do I pronounce it as a word or do I make it sound like "R-I-P-E-M-D" like by pronouncing each individual letter. 1answer 418 views ### Why is this MAC based on secure PRF with ordering and randomization insecure? Is this MAC secure: To authenticate a message m=m_1||\ldots||m_l where m_i \in \{0,1\}^{n/2}, choose r \leftarrow \{0,1\}^n at random, compute$$t:=F_k(r)\oplus F_k(\langle 1\rangle || ... 1answer 332 views ### XOR cipher Pseudo-random key strength When implementing a XOR cipher with a pseudo-random key equal in length to the plaintext, Is there a significant difference in potential key strength between keys drawn from a pool of either 1000 or ... 1answer 114 views ### What is the impact of the Goppa code distinguisher on the CFS and McEliece? What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter ... 1answer 330 views ### Is$q(n)=1/n$a negligible function? By definition -$q(n)$is a negligible function if for every positive integer$c>0$there exist an integer$N_c$such that for all$x>N_c$:$q(n)<1/x^c$So for the function$1/x$, if we ... 1answer 113 views ### What is the difference between a bijective random oracle and a random permutation? Assume$S$be a finite set$O$be a random oracle from$S$to$S$, such that$O$is bijective$f$be a random permutation of$S$Is there any difference between$O$and$f$? Does it makes any ... 3answers 774 views ### Is there a cryptographic method to add noise to a plaintext instead of actually encrypting it? I'm looking for a cryptographic technique that instead of permuting a cleartext, would add noise to the cleartext to obfuscate the true text among a bunch of garbage. For example, a list of 10 ... 2answers 736 views ### KCV and compatibility with block cipher modes of operation There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ... 1answer 874 views ### Can cryptocurrency mining devices be used for cryptanalysis? In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies. These devices can perform SHA256 hashing at rates much higher than was seen in the past and are ... 1answer 153 views ### Is encrypting a public key with a symmetric key safe? Assume the sender wants to share their ephemeral/long-term public key with intended receiver only and both share symmetric key. Is it secure to encrypt the (full/partial) public key (of RSA, ECC) ... 2answers 6k views ### How to obtain KCV from the key Simple question: we have AES 128 encryption and a key. How can we calculate the key check value (KCV)? One example: key is 48C3B4286FF421A4A328E68AD9E542A4 and KCV should be 77DC84. I am trying it ... 1answer 132 views ### Creating a secure key Imagine that your lecturer and the undergraduate office have conducted a key exchange protocol after which both of them hold the string$X$. Yet, it is possible that a curious student sitting next to ... 1answer 1k views ### How to put the hash of a PDF file in the PDF file? [duplicate] I know it sounds strange.. but, are there any ways in practice to put the hash of a PDF file in the PDF file? And after geting the hash in the PDF file - if someone would do a hash check of the PDF ... 3answers 1k views ### Block Cipher vs Stream Cipher in Web Application [closed] I'm doing research about "Cryptographic attack methods in Web Application" so I have some questions to ask you guys: Block Cipher vs Stream Cipher, which is more common used in Web Application? How ... 1answer 110 views ### OMAC : Padding on empty string I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ... 0answers 41 views ### Computing A, B given A+K and B+K [duplicate] In his writeup of the Solitaire keystream generator algorithm, Bruce Schneier warns not to use the same key for two different messages: The first rule of an output-feedback mode stream cipher, any ... 1answer 328 views ### What is a Trapdoor in Merkle Signature? Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the$g(Y_i)$where$Y_i$is the verification key ... 1answer 349 views ### Generating a valid signature on El-Gamal without knowing the private key Suppose we are given$p$, the large prime,$g$which is the primitive root for$p$,$b$which is calculated as$b=g^x$mod$p$where$x$is the private key and$0<x<p-1$. Also suppose we know ... 3answers 3k views ### How to break AES/CBC/PKCS5 when key and IV are reused? I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ... 1answer 159 views ### Recovering the random number r For a padded message, M, using the El Gamal encryption schema, how can we determine the random number$r$, when we are given$p$, the prime number,$g$which is the primitive root of$p$,$b$and$x$... 1answer 333 views ### Brute force attack expected running time I am a bit confused about the expected running times of brute force attacks on different cryptosystems. So let's assume a key size of$2^n$bits. Symmetric key cryptography:$E(brute)$= ... 0answers 105 views ### What scheme will allow merging and splitting the result of a function? I am wondering if it's possible to have a scheme as follows. Here is the scenario: we have a set of objects (e.g. strings) {O1, O2, ..., On} we have a set of users {U1, U2, ..., Um} each user asks ... 2answers 171 views ### Encoding multiple fields with same AES key and vector? I'd like some advice on cryptography best practices. I need to store on my web app the users' credentials (login & password) for 3rd-party sites. I'm using AES-256 with random key and ... 1answer 148 views ### Hashing/encrypting an integer to produce an unique integer in the same range I'm looking for a function or set of functions that can produce a pseudo-random permutation on an input set of arbitrary size. Given a set of$M$values in range$0..M-1$, where$M$is positive ... 1answer 201 views ### Homomorphic Encryption, LWE, and Practical Applications I've been reading Brakerski and Vaikuntanathan's Efficient Fully Homomorphic Encryption from (Standard) LWE. When the authors discuss a small modulus p used for the transition from (n, log q) to (k, ... 1answer 142 views ### Private Information Retrieval with a pre-prepared database Informally, Private Information Retrieval (PIR) is a protocol between a user$U$and a Server$S$, that meets the following conditions:$U$obtains enough information about a database hosted by$S$, ... 1answer 189 views ### Authentication of machine before installation (to stop piracy) [closed] I have a web-software project which needs a bit of protection in form of authencitation… This web based software runs on an intranet. There is no access to the internet from these terminal machines. ... 0answers 93 views ### how to truncate a PRF on n bits to PRF on t bits where t < n? [closed] Dan Boneh's courersa lecture on format preserving encryption at 5.50 mins , talks about truncating a PRF on$n$bits to PRF on$t$bits. The approach is by appending$(n-t)$zeros to input$t$bits ... 1answer 139 views ### Applying differential cryptanalysis to ciphers with addition mod$2^{32}$I am studying differential analysis and have a question. Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ (Plaintext$m_1$xor with key$K_1$, then result goes into an ... 2answers 263 views ### hill cipher encryption way 1x3 plaintext matrix Can someone help me with a Hill cipher? When do I have to use: 1x3 plain text matrix (p1, p2, p3) * 3x3 key matrix 3x3 key matrix * 3x1 plain text matrix Or they are both correct? I tried to ... 1answer 162 views ### Is it possible to decrypt an RSA ciphertext with only$N$and$e$? Is it possible to perform RSA decryption if one only knows$N$and$e$? Failing that, what is the maximum key length where brute-force is still practically feasible? 1answer 124 views ### How does the length of the plaintext affect the cipher strength? Let the block length 64-bit, 256-bit key, cipher text accordingly - 64 bits. What is the strength of the block cipher, if any unknown attacks, which could reduce its strength. We can only brute force. ... 2answers 237 views ### Is the following symmetric design secure? Assume:$O$be a reversible random permutation oracle on a finite set and$O^{-1}$the inverse permutation (pretty much equivalent to a random permutation: What is the difference between a bijective ... 2answers 191 views ### Merkle Tree High Tree I'm reading Merkle tree signatures and I like know if the security of the that scheme depends, also, of the high of the tree or only depends that hash function is resistant to collision? 2answers 989 views ### When using Curve25519, why does the private key always have a fixed bit at 2^254? When using Curve25519, the private key always seems to have a fixed bit set at position 2^254. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private key? ... 1answer 264 views ### How to prove this LFSR equation? I am having difficulty solving part (ii) of Excercise 5.17 from Becker's Cipher Systems. Exercise 5.17$\quad$If$f(x),g(x)$are any two polynomials over$GF(2)$with$f(0)=g(0)=1$show that ... 2answers 592 views ### How can I implement the elliptic curve MOV attack myself? I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves. ... 1answer 163 views ### Secure function evaluation Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold$a, b, c \in \{0, 1\}$respectively. Show how construct a scheme with which ... 1answer 142 views ### hybrid PKE scheme CCA2 insecurity I'm reading "An Efficient CCA2-Secure Variant of the McEliece Cryptosystem in the standard model" by Rastaghi which states: As we know, in hybrid PKE schemes XOR alone cannot perfectly hide ... 1answer 146 views ### Perfect secrecy over Stirling numbers For all$c_0\leftarrow m_0 \oplus k$there exists a$k'$such that$c_1 \leftarrow m_1 \oplus k'$, where$m_0 \neq m_1$and$c_0 = c_1$. Assuming a truly random$k\$, the first assignment is a ...

15 30 50 per page