# All Questions

332 views

### XOR cipher Pseudo-random key strength

When implementing a XOR cipher with a pseudo-random key equal in length to the plaintext, Is there a significant difference in potential key strength between keys drawn from a pool of either 1000 or ...
114 views

### What is the impact of the Goppa code distinguisher on the CFS and McEliece?

What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter ...
330 views

### Is $q(n)=1/n$ a negligible function?

By definition - $q(n)$ is a negligible function if for every positive integer $c>0$ there exist an integer $N_c$ such that for all $x>N_c$ : $q(n)<1/x^c$ So for the function $1/x$, if we ...
113 views

### What is the difference between a bijective random oracle and a random permutation?

Assume $S$ be a finite set $O$ be a random oracle from $S$ to $S$, such that $O$ is bijective $f$ be a random permutation of $S$ Is there any difference between $O$ and $f$? Does it makes any ...
774 views

### Is there a cryptographic method to add noise to a plaintext instead of actually encrypting it?

I'm looking for a cryptographic technique that instead of permuting a cleartext, would add noise to the cleartext to obfuscate the true text among a bunch of garbage. For example, a list of 10 ...
737 views

### KCV and compatibility with block cipher modes of operation

There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ...
874 views

### Can cryptocurrency mining devices be used for cryptanalysis?

In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies. These devices can perform SHA256 hashing at rates much higher than was seen in the past and are ...
153 views

### Is encrypting a public key with a symmetric key safe?

Assume the sender wants to share their ephemeral/long-term public key with intended receiver only and both share symmetric key. Is it secure to encrypt the (full/partial) public key (of RSA, ECC) ...
6k views

### How to obtain KCV from the key

Simple question: we have AES 128 encryption and a key. How can we calculate the key check value (KCV)? One example: key is 48C3B4286FF421A4A328E68AD9E542A4 and KCV should be 77DC84. I am trying it ...
132 views

### Creating a secure key

Imagine that your lecturer and the undergraduate office have conducted a key exchange protocol after which both of them hold the string $X$. Yet, it is possible that a curious student sitting next to ...
1k views

### How to put the hash of a PDF file in the PDF file? [duplicate]

I know it sounds strange.. but, are there any ways in practice to put the hash of a PDF file in the PDF file? And after geting the hash in the PDF file - if someone would do a hash check of the PDF ...
1k views

### Block Cipher vs Stream Cipher in Web Application [closed]

I'm doing research about "Cryptographic attack methods in Web Application" so I have some questions to ask you guys: Block Cipher vs Stream Cipher, which is more common used in Web Application? How ...
110 views

### OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
41 views

### Computing A, B given A+K and B+K [duplicate]

In his writeup of the Solitaire keystream generator algorithm, Bruce Schneier warns not to use the same key for two different messages: The first rule of an output-feedback mode stream cipher, any ...
328 views

### What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
351 views

### Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know ...
3k views

### How to break AES/CBC/PKCS5 when key and IV are reused?

I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
159 views

### Recovering the random number r

For a padded message, M, using the El Gamal encryption schema, how can we determine the random number $r$, when we are given $p$, the prime number, $g$ which is the primitive root of $p$, $b$ and $x$ ...
333 views

### Brute force attack expected running time

I am a bit confused about the expected running times of brute force attacks on different cryptosystems. So let's assume a key size of $2^n$ bits. Symmetric key cryptography: $E(brute)$ = ...
105 views

### What scheme will allow merging and splitting the result of a function?

I am wondering if it's possible to have a scheme as follows. Here is the scenario: we have a set of objects (e.g. strings) {O1, O2, ..., On} we have a set of users {U1, U2, ..., Um} each user asks ...
171 views

### Encoding multiple fields with same AES key and vector?

I'd like some advice on cryptography best practices. I need to store on my web app the users' credentials (login & password) for 3rd-party sites. I'm using AES-256 with random key and ...
148 views

### Hashing/encrypting an integer to produce an unique integer in the same range

I'm looking for a function or set of functions that can produce a pseudo-random permutation on an input set of arbitrary size. Given a set of $M$ values in range $0..M-1$, where $M$ is positive ...
201 views

### Homomorphic Encryption, LWE, and Practical Applications

I've been reading Brakerski and Vaikuntanathan's Efficient Fully Homomorphic Encryption from (Standard) LWE. When the authors discuss a small modulus p used for the transition from (n, log q) to (k, ...
143 views

### Private Information Retrieval with a pre-prepared database

Informally, Private Information Retrieval (PIR) is a protocol between a user $U$ and a Server $S$, that meets the following conditions: $U$ obtains enough information about a database hosted by $S$, ...
189 views

### Authentication of machine before installation (to stop piracy) [closed]

I have a web-software project which needs a bit of protection in form of authencitation… This web based software runs on an intranet. There is no access to the internet from these terminal machines. ...
93 views

### how to truncate a PRF on n bits to PRF on t bits where t < n? [closed]

Dan Boneh's courersa lecture on format preserving encryption at 5.50 mins , talks about truncating a PRF on $n$ bits to PRF on $t$ bits. The approach is by appending $(n-t)$ zeros to input $t$ bits ...
139 views

### Applying differential cryptanalysis to ciphers with addition mod $2^{32}$

I am studying differential analysis and have a question. Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ (Plaintext $m_1$ xor with key $K_1$, then result goes into an ...
264 views

### hill cipher encryption way 1x3 plaintext matrix

Can someone help me with a Hill cipher? When do I have to use: 1x3 plain text matrix (p1, p2, p3) * 3x3 key matrix 3x3 key matrix * 3x1 plain text matrix Or they are both correct? I tried to ...
164 views

### Is it possible to decrypt an RSA ciphertext with only $N$ and $e$?

Is it possible to perform RSA decryption if one only knows $N$ and $e$? Failing that, what is the maximum key length where brute-force is still practically feasible?
124 views

### How does the length of the plaintext affect the cipher strength?

Let the block length 64-bit, 256-bit key, cipher text accordingly - 64 bits. What is the strength of the block cipher, if any unknown attacks, which could reduce its strength. We can only brute force. ...
237 views

### Is the following symmetric design secure?

Assume: $O$ be a reversible random permutation oracle on a finite set and $O^{-1}$ the inverse permutation (pretty much equivalent to a random permutation: What is the difference between a bijective ...
192 views

### Merkle Tree High Tree

I'm reading Merkle tree signatures and I like know if the security of the that scheme depends, also, of the high of the tree or only depends that hash function is resistant to collision?
989 views

### When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position 2^254. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private key? ...
264 views

### How to prove this LFSR equation?

I am having difficulty solving part (ii) of Excercise 5.17 from Becker's Cipher Systems. Exercise 5.17 $\quad$If $f(x),g(x)$ are any two polynomials over $GF(2)$ with $f(0)=g(0)=1$ show that ...
595 views

### How can I implement the elliptic curve MOV attack myself?

I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves. ...
163 views

### Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which ...
142 views

### hybrid PKE scheme CCA2 insecurity

I'm reading "An Efficient CCA2-Secure Variant of the McEliece Cryptosystem in the standard model" by Rastaghi which states: As we know, in hybrid PKE schemes XOR alone cannot perfectly hide ...
146 views

### Perfect secrecy over Stirling numbers

For all $c_0\leftarrow m_0 \oplus k$ there exists a $k'$ such that $c_1 \leftarrow m_1 \oplus k'$, where $m_0 \neq m_1$ and $c_0 = c_1$. Assuming a truly random $k$, the first assignment is a ...
1k views

### Why does the crypto_box functionality in NaCl library exposes the nonce to the programmer

The idea of crypto_box API in NaCl library is to shield the programmer away from the technical details and provide easy to use functions for encrypting and encrypting messages. Given what I've just ...
751 views

### Is CBC mode encryption vulnerable to a reordering attack?

I know that, if CBC-MAC is used in such a way that the tag is the concatenation of all the blocks' outputs (and not just the last one), it's insecure under CPA for the simplest case of 2 blocks ...
87 views

### Is the following aggregation scheme private?

Is the following scheme private? By private i mean an untrusted aggregator (UA) cannot reveal anything other then an aggregate function output on plaintext data Each party holds a secret key $k_i$ ...
192 views

### Difference between computational and statistical indistinguishabilities

What is the difference between the two notions of computational and statistical indistinguishability?
511 views

### A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt

I want a key stretching system that's as strong as the stronger of scrypt and PBKDF2. The consensus now is that scrypt is by far the better system, but that might change if in the future, a weakness ...
82 views

### Why send a challenge with CHAP?

I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP). Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash ...
383 views

### Why not just generate random strings for one-time password (OTP)?

http://en.wikipedia.org/wiki/One-time_password#How_OTPs_are_generated_and_distributed Why have so many methods to generate OTPs, why not just use just random strings?
123 views

### Can we build authenticated encryption using Feistel Networks?

Most of the encryption modes of Feistel Networks especially the ones used to build fixed length block ciphers just provide confidentiality . Can we build authenticated encryption using Feistel ...
158 views

### Efficient parameters for group Diffie-Hellman

I want to implement a basic version of Diffie-Hellman key agreement for groups. So, my key is $K=g^{abc} \mod p$. Following this, the parameters I would need to transfer would be $K_a = g^{bc}$ etc. ...
104 views

### Biometric authentication [closed]

I see in some “Authentication schemes with biometric” papers that those authors wrote a phase as password and biometric update phase. My question is that why we may needs biometric update phase? Is ...