# All Questions

158 views

### Key Confirmation Attack [Key Distribution Center (KDC)]

Okay this is how I understood it according to this: Alice $A$ establishes a connection to $KDC$ and prepares for session key Exchange $k_{ses}$ $A$ encrypts the request with her key $k_A(A, B)$ ...
107 views

### chaining multiple key derivation functions together

I was looking at PBKDF2, bcrypt and scrypt as options for key derivation; and would like to try using them all together in order to get the cryptographic strength of the strongest one (which seems to ...
122 views

### Is it safe to prefix the a key with a known value?

Almost every encryption algorithm is based on a secret key. I wonder when the algorithm is considered safe, does that also imply that I can prefix (or suffix) the key with a known value, as long as ...
41 views

### Determining nonce between unsynced systems

It's my first venture into cryptography, and I'm struggling with how to use a nonce in an encryption standard between two digital radios. The two radios support AES encryption, only requiring a ...
169 views

### Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22?

I need to use NIST SP 800-22 approved software / hardware to generate RSA key pair. Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22? And how is the SP ...
1k views

### decrypt a saml 2.0 response having aes 128 and rsa [closed]

I need to decrypt a saml 2.0 response. But, the response object has reference to aes 128 and rsa algorithms, and I am having hard time in finding a way to decrypt. Below is the structure of the ...
206 views

### Problem with testing MD5 collisions

I am trying to test MD5 collisions presented in “Collisions for Hash Functions MD4, MD5, HAVA” (PDF) by Xiaoyun Wang, Dengguo Feng, Xuejia Lai, Hongbo Yu; 2004. I wrote a PHP script to test it, but ...
71 views

### How to choose the integer m in the general number field sieve (GNFS)?

Given an integer you want to factor $N$, GNFS starts by selecting a monic irreducible polynomial $f \in \mathbb{Z}[X]$ and an integer $m$ such that $f(m) \equiv 0 \text{ mod } N$. In practice, if $m$ ...
232 views

### How does knowing the factorization of N help to obtain the secret?

Assuming $x=a^2 \pmod n$ and knowing $x$, $p$, $q$ how is it possible to obtain $a$?
105 views

### Send an encrypted question and return answer without decryption

Oke bear with me for a minute. Once upon a time someone mentioned a hypothetical way where you would send an encrypted question to Google and Google would return an answer without decrypting it. As ...
72 views

### Hill Cipher the point of a known plaintext attack question

Is the point of a known plaintext attack on a Hill Cipher to get the matrix key?
203 views

### IV's for different AES encryption modes

I wanted to know if my understanding is correct! I have been reading up on aes encryption and modes(specifically CTR and CBC) and it took me sometime to understand the concept of IV. If the IV is ...
84 views

### How to store and use a Cryptographic Seed in a database [closed]

Companies such as Barclays use cryptographic seeds (for their PINsentry system), RSA do the same for RSA SecurID, but how do they safely secure the seeds in the database. With passwords you just hash ...
56 views

### How does the attacker include input before compression and encryption in CRIME?

I have read this article about the CRIME attack against TLS and SPDY. The article says that: What is not yet clear is how the attacker is including their input in the source material before it ...
104 views

### Hashing - Digital Signing and Trivial Stretching

Two very basic questions: 1. Digital Signing Why is it not possible to just simply replace the hash value from the request? Examples: ...
245 views

### Symmetric mutual authentication with client using a derived secret

I'm attempting to find a client/server authentication protocol that allows the client and server to authenticate each other when the client doesn't know the server secret but does have a sensitive key ...
94 views

### Pseudorandom function library [closed]

I'm wondering if there is any library supporting pseudo-random function, so I can specify the key length and output domain. Is it correct that I need to use a block cipher for this purpose? Any ...
56 views

### Can a tree hash with leaf-size of 1 byte support verification of content with elided ranges, at a cost of at most 2 supplied internal-node hashes?

Perhaps someone can confirm my intuition: A tree hash with leaves of size 1 (for example Blake2 in a tree-hash mode) would of course not be very efficient. But it seems that it might be a suitable ...
212 views

### Diffie-Hellman Application

Alice and Bob want to perform a Diffie-Hellman key exchange using the group $G$, a primitive root $g$, Alice’s secret key $k_A$ and Bob’s secret key $k_B$. In each case below compute the element of ...
633 views

### CBC-MAC: is it secure to authenticate a fixed length ciphertext?

Suppose I have a fixed-length arbitrary ciphertext. To authenticate such ciphertext: I generate a random AES Key $K_{auth}$. Then I compute the CBC-MAC Tag of the ciphertext with $K_{auth}$. ...
85 views

### Can you exchange a shared key without any hardness assumptions?

Imagine that P=NP, and one way functions don't exist. Can two people end up with a random shared key of arbitrary length, if every exchange is public? They have true RNGs, and know who they are ...
51 views

### Automatic generation of secure passwords with the least inconvenience for a user

I'm working on a web site for a private company that should allow them to upload files, which will be later retrieved by their affiliates. The site will be available from a public Internet using ...
117 views

### How do I communicate the value of the initialization vector to the end user? Should it be part of the encrypted message?

I am taking a cryptography class and our first homework is to implement a 32-bit block cipher. I implemented a simple block-cipher that uses CBC. Currently, my implementation reads both the 32-bit IV ...
145 views

### ElGamal and Schnorr groups

As I gather, a normal practice for choosing a cyclic group for ElGamal key generation is to find a safe prime $p$ and use a multiplicative cyclic group with modulus $p$ and order $q = (p-1)/2$. ...
249 views

### Simple message authentication code

I used to figure that message authentication codes function like digital signatures: a hash of a message is calculated and then encrypted with a secret key. To verify the authenticity of a message, ...
981 views

### Is it an example of bilinear pairing?

Consider a bilinear pairing $e: G_1 \times G_2 \rightarrow G_T$. Let's assume, $G_1 = G_2 = G_T = (\mathbb{Z}_n,+)$, i.e. additive group of integer modulo $n$ and $e(x,y) = xy$ mod $n$. Isn't it an ...
202 views

### How does bitmessage encryption work?

I have been reading around protocol specification and there is either too much technical detail or too bad articles on various sites. I need you to explain in simple words how encryption in ...
212 views

### open source whitebox-crypto implementation

I am trying to code a simple WBC situation to help my understanding about white-box cryptography. Details: I have 2 programs, a "server" and a "client", the server utilises caesar cipher (key = 2) ...
321 views

### What is the importance of adding round key in AES

I know this may not be the place to ask this but I have found it difficult to find an answer to this question. I know the steps of the AES encryption algorithm but I am finding it difficult to ...
732 views

### What is the algorithm behind PasswordDeriveBytes?

Microsoft has created an implementation of PBKDF1 in the PasswordDeriveBytes class. It can however generate more bytes than PBKDF1, which is limited to the number ...
155 views

### Luby-Rackoff on Feistel ciphers [closed]

On page 46 of these lecture notes, it seems to say that if we have a Feistel cipher, and plaintexts $(L_0, R_0)$ and $(L_0^*, R_0^*)$ with corresponding encryptions, then we can determine the key? But ...
272 views

### test vectors for 3DES seem to in fact be testing DES - not 3DES

NIST SP 800-20 Appendix A has what presumably are supposed to be test vectors for 3DES except almost all of the test vectors utilize 8-byte keys and not the 24-byte keys that 3DES is supposed to have. ...
177 views

### Modular Reduction of polynomials in GF(2^m)

Hello I am having trouble understanding the algorithm implementation in hardware of the reduction process over galois fields of F(2^163) In the following process it ...
68 views

I figured that a really secure password would be an AES 128 key. If this key were to be base 64 encoded, I could replace 4 random bytes in it in order to make it unusable unless you know which bytes ...
105 views

### Perfect secrecy of a crypto system

Suppose we have the following crypto system: $P = C = K = \{0, 1, . . . , n − 1\}$, $E_k(x) = (x + k) \bmod n$ and $D_k(y) = (y − k) \bmod n$. Prove that the crytosystem has perfect secrecy. Perfect ...
109 views

### RSA Protocol behind Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
212 views

### Why do we have fixed output length in the algorithm SHA1

Why do we have fixed output length in the algorithm SHA1 . is there any explanation about that
160 views

### RSA-blind signatures vs. DSA-blind signatures

I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to ...
97 views

### Reduced message expansion in NTRU

In the original NTRU proposal from 1998, it says on page 16: It may be worth mentioning, though, that there is a simple. masking technique that can be used to significantly reduce message ...
87 views

94 views

### What is the functional role of CKY-I and CKY-R in ISAKMP (IKEv1)?

According to RFC 2409: CKY-I and CKY-R are the Initiator's cookie and the Responder's cookie, respectively, from the ISAKMP header. Each CKY is a 64 bit value that is included in each ISAKMP ...
145 views

### Retrieve timestamp from TOTP value

TOTP (Time-based One-Time Password) as I understand is an algorithm that uses the current time as a variable along with a shared key to generate a secured token. Wiki page for reference: ...
147 views

### Why is proving “parties' views are simulatable” enough in semi-honest model?

To prove a protocol is secure in semi-honest model, we have to prove: the view of each party, on each possible pair of inputs, can be efficiently simulated based solely on its own input and and ...
188 views

### Requirement for the length of a HMAC tag?

I've seen NIST requirements about key length. What about the output lengths ? Is 112 bits enough for the HMAC output length ? Can we truncate the tag to keep only 112 bits ? Thank you
174 views

### Building a pad for OTP on-the-fly with Diffie-Hellman

Through repeated DH attempts, could Alice and Bob build a large random key for use as a one-time pad? My intuition is that this protocol would be as hard as breaking DH (discrete logarithm).
773 views

### Java: How to handle authenticated encryption for big files

First I need to mention that I can't use BouncyCastle to implement this solution. I have to encrypt files into the file system. Those files are not going to be tranfered over the wire to any other ...
265 views

### fully homomorphic encryption (FHE)

Please, I would like to find some hints or solution to my following problem, I would appreciate your assistance to walk with me throughout the solution Given fully homomorphic encryption (FHE) ...