# All Questions

169 views

### How to compare two datasets „anonymously”?

Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation: There are 10 defined colors (blue, orange, yellow etc.) There are ...
650 views

### Padding of Original Message in MD5

what should I do if my original message is greater than 64 bits? what is the process of padding in MD5? As described in Internet Security: Cryptographic Principles, Algorithms and Protocols, page ...
296 views

### chaining rsa with ecies

In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric ...
625 views

### Proof that padded RSA is CPA-secure

I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA: ${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
94 views

I am read this paragraph and I have a doubt. "An adversary to PKC $\Pi$ is given by two probabilistic polynomial time algorithms, $A = (A1; A2)$. In the first stage, the "find" stage, the ...
499 views

### Why does key generation take an input $1^k$, and how do I represent it in practice?

In my lecture, the lecturer said: Let $K$ be the key generation algorithm. Given a security parameter represented in unary, $1^k$, $K(1^k)$ will output a keypair $(pk; sk)$, known as the public ...
98 views

### Sematically Secure McEliece

I am read the Lemma 2 (pp13) in the paper "Kazukuni Kobara and Hideki Imai: Semantically Secure McEliece Public-Key Cryptosystems –Conversions for McEliece PKC– (PKC 2001)". Related to the question ...
627 views

### Toy hash algorithm that can be broken

I'm looking for a toy hash function, where the idea is to have high school students break (i.e. find a collision) a hash function by hand, in order to teach them how one way functions and hashing ...
1k views

### Custom crypto library in C

I will be making (in the near future) an app that will contain some pretty heavy crypto. As it is possible that my app will be ported to different devices (initially it will be iOs only, but Mac, ...
1k views

Is there a construction of an order preserving hash function that keeps the preimage property of a crypto hash function? By order preserving hash function (OPHF) i mean for $x<y$ then $OPHF(x) < ... 2answers 3k views ### What is the difference between Scrypt and PBKDF2? After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ... 1answer 143 views ### Certificate == signed public key For primes p and q used to create a keypair, I understand that the following operation is used to create a signature:$M^d (\bmod\ N)$where d and N have their usual meanings and M is the message. ... 2answers 904 views ### risk of attacker decrypting RSA ciphertext without public or private key As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ... 1answer 524 views ### Counter Mode: static IV but different keys [duplicate] Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ... 2answers 217 views ### standard way to authenticate parties with public keys without certificates Is there some standard protocol for mutual authentication of two parties when there is possibility to use public key cryptography? The problem is that two parties can use public key cryptography but ... 1answer 724 views ### Adding and multiplication in jacobian coordinates How can I derive formulas for adding 2 points and multiplication by a scalar in Jacobian coordinates$(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$over an elliptic curve? 0answers 118 views ### Question about proof of knowledge defintion? I am just reading the "soundness"-definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover$P$and a verifier$V$.$P$convinces$V$to know a secret ... 1answer 223 views ### RSA - Ecrypting the same data with the same public key = same ciphertext? If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow? The most obvious way is encrypting the guessed plaintext with my public key and the same parameters ... 1answer 2k views ### Secure encrypt-then-sign with RSA I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt. However, I have encrypted data that I need to sign, to prove the author of ... 0answers 116 views ### Is OAEP reversible? Given nothing more than some integer$m =$OAEP($M$), is it possible to recover the original plaintext$M$? In other words, without being given the hash functions or the random string used for ... 1answer 165 views ### implementing long term archive encryption Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways: The ... 1answer 206 views ### How can a key pair be derived from an arbitrary hash? If I correctly understand the concept of a "brain wallet" in BitCoin, you start with a passphrase, generate the hash of the passphrase, then somehow derive a public / private key from that to use as ... 0answers 119 views ### Algorithm digipass-like I'm pretty sure there are famous algorithms for my problem, but I don't have enough knowledge in this field, so I need your lights. Here si the problem : Alice sends key X to Bob. Bob has an ... 2answers 4k views ### AES plaintext is smaller than 128 bits - how to expand? We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ... 1answer 246 views ### Password verification I'm looking for feedback on whether or not this is the proper way to approach password verification without transmitting the actual password. Are there any problems with this scheme. We are working ... 1answer 4k views ### repeating-key xor and hamming distance I read that to break repeating-key xor you can do the following: try a keysize$n$and compute the hamming distance between the first$n$bits of the encrypted string and the bits$n+1$to$2n$of the ... 1answer 584 views ### Is this scheme a provably fair random number generation? I have thought up a method for generating random numbers between a client and a server which I hope is fair: The client and server decide on a range in advance,$0$trough$n-1$. The server ... 1answer 85 views ### What does “securely realize” mean? I was wondering what "securely realizes" means. I see this in some cryptographic papers but I don't know what it means for a protocol to "securely realize" a function$F$. Is it just a fancy way of ... 1answer 215 views ### Combining AEAD with RSA 'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ... 1answer 1k views ### Is it possible to determine a PGP public key from encrypted data? Is it possible to find out which public key was used to generate the message? Scenario is like this : I got data which is encrypted with a public key. Now a "bad guy" hast the encrypted data, and ... 4answers 1k views ### Tamper-proofing log files Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ... 1answer 101 views ### What happen if a asymmetric crypto-system deals with only one key Assume there is a crypto algorithm that deals with matrices to encrypt and decrypt. Regardless of the specification of such algorithm, what if the algorithm assumes that two parties can securely agree ... 2answers 688 views ### Are cryptographic hash functions perfect hash functions? For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to ... 1answer 574 views ### Attacking historical ciphers methodology It's more a theoretical question of how would you approach it. All you know about the ciphertext it's was generated with a historical cipher. The ciphertext appears to be random, BUT it's divided into ... 4answers 390 views ### Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data? I am designing a simple and secure stream communication protocol. My idea was to build each message sent to the wire as: (message size || clear text || UHASH(message size || clear text))$\oplus$... 1answer 2k views ### SHA256 HMAC brute force with chosen plaintext attacks This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ... 1answer 2k views ### Quality of randomness on a Linux system with haveged Has anyone checked if using haveged, a Linux daemon which uses the HAVEGE algorithm, changes the non-deterministic properties of the random data from ... 2answers 5k views ### Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme? Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ... 3answers 355 views ### Is it possible to work out the hash algorithm from a list of known message-hash pairs? For example, in my situation I know hash(20) = 486e9638177faf1f34e49910491b77af. I also know the hashes for all values from 0 to 20. Is it possible to work out the ... 0answers 295 views ### LT codes with Homomorphic hashing I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and ... 3answers 511 views ### The utility of elliptic curve cryptography Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve ... 1answer 159 views ### Connections between Instance Hiding and Fully Homomorphic Encryption Another approach taken by researchers for carrying out computations over encrypted data is Instance Hiding. In brief, If a user wants to outsource the computation of a function for a particular input ... 3answers 400 views ### Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system. So we have Bob -- The person who sends the message (and knows it's recipients) ... 1answer 479 views ### Prove that textbook RSA is susceptible to a chosen ciphertext attack Given a ciphertext$y$, describe how to choose a ciphertext$\hat{y} \neq y$, such that knowledge of the plaintext$\hat{x}=d_K(\hat{y})$allows$x=d_k(y)$to be computed. So I use the fact that the ... 1answer 356 views ### Addition with Shamir secret sharing When performing Shamir secret sharing I'm trying to find$z_i$, such that$z = x + y$. Where$n = 6$and$t = 3$. I believe this would be the correct solution (correct me if I'm wrong): Each party ... 1answer 1k views ### Triple-DES Brute Force Shannon's paper states: A system is pure if all keys are equally likely and if for any three transformations,$T_i$,$T_j$,$T_k$in the set, the product$T_iT_j^{-1}T_k$is also a ... 2answers 469 views ### A lower bound on the insecurity of CipherCloud? CipherCloud claims to support , among other things, searchable encryption. A bunch of speculation seems to suggest they did this via some breathtakingly incompetent means( unfortunately such ... 2answers 345 views ### Chain several RSA encryptions without increasing the message size I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time. In other words, I have some data$D_0$which I want to encrypt with RSA:$D_1 = ...
Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing ...