# All Questions

2k views

### Is there any strong enough pen-and-paper or mind cipher?

Some ciphers are talked about at “Is there a secure cryptosystem that can be performed mentally?”, but (at the time of writing) I don't see an answer. Are they strong enough, or are non-computer ...
360 views

### What's the difference between AES and earlier block ciphers?

Is there any difference except speed and key and block size from user's point of view? Or does AES have something that ideal block cipher doesn't have?
256 views

### Indistinguishability attack example

I want solve the next exercise. The author defined the experiment for the cryptosystem $\Pi$, the adversary $A$ and the security parameter $n$ as follows $\mathsf{PRIV_{EAV}}(\Pi,A,n)$ The ...
584 views

### How to derive two keys from one password

What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
2k views

### Is AES really used for Top Secret stuff?

I've read almost everywhere that AES-256 can be used for Top Secret material (in the US). Is it really used or is it some kind of decoy to hide the more advanced algorithm they might use ?
223 views

### Elliptic Curve is DH function or PKI?

can we reuse same ECC key on TLS for long terms or it must be used just once? (i mean can we use ECC like RSA?) is there patent free ECC implementation ?
280 views

### What length should the padding be when encrypting or signing with RSA?

I am wondering what length the padding should be when encrypting or signing with RSA. Does it matter what length the padding is, and if so — what length should it be? Another point: Should it be ...
990 views

### CBC-MAC , fixed length, all blocks returned

CBC-MAC, with fixed length message. Is it safe to return all ciphered blocks instead of the last? My intuition says it is less secure, since is gives an attacker more information. But how could one ...
614 views

### encrypt message with one digest 0-9 instead of 01-26

How much will the security of one-time pad decrease if I use one digit from 0-9 instead of 1-26? for example plaintext = "blue" and ...
2k views

### Encrypt a single file, chunk-by-chunk, each chunk using different key (AES)

Encrypt a single file, chunk-by-chunk, each chunk using different key. I am a security newbie (only took 2 security courses before) But currently I am using this encryption method for my Android ...
909 views

### Have I understood pedersen commitment correctly?

I want to do a one-sided integer commitment scheme. I.e. the whole process must be non-interactive where I at one point first publicly reveal some data and then at a later time reveal the committed ...
83 views

### Book Didactic Security Notions [closed]

I want study more about cryptography reading papers, but I have a problems to understand few concepts: security notions, random oracle model, IND-CCA, ... etc. I began study this concepts by internet: ...
438 views

### Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash?

$H(s,r)=d$ is a function that hashes the secret string $s$ with a salt $r$, and returns a digest $d$. $r$ may be arbitrarily chosen and each $r$ returns a different $d$. For any $d$, $r$ is known from ...
525 views

### Is it worth applying a MAC on data in a HSM?

I'm building a basic HSM out of an Arduino, and am using the following scheme to store data: Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction). Secondary ...
175 views

### How to compare two datasets „anonymously”?

Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation: There are 10 defined colors (blue, orange, yellow etc.) There are ...
712 views

### Padding of Original Message in MD5

what should I do if my original message is greater than 64 bits? what is the process of padding in MD5? As described in Internet Security: Cryptographic Principles, Algorithms and Protocols, page 138,...
310 views

### chaining rsa with ecies

In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric ...
677 views

3k views

### What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
150 views

### Certificate == signed public key

For primes p and q used to create a keypair, I understand that the following operation is used to create a signature: $M^d (\bmod\ N)$ where d and N have their usual meanings and M is the message. ...
960 views

### risk of attacker decrypting RSA ciphertext without public or private key

As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
586 views

### Counter Mode: static IV but different keys [duplicate]

Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ...
230 views

### standard way to authenticate parties with public keys without certificates

Is there some standard protocol for mutual authentication of two parties when there is possibility to use public key cryptography? The problem is that two parties can use public key cryptography but ...
832 views

### Adding and multiplication in jacobian coordinates

How can I derive formulas for adding 2 points and multiplication by a scalar in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
126 views

### Question about proof of knowledge defintion?

I am just reading the "soundness"-definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover $P$ and a verifier $V$. $P$ convinces $V$ to know a secret ...
270 views

### RSA - Ecrypting the same data with the same public key = same ciphertext?

If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow? The most obvious way is encrypting the guessed plaintext with my public key and the same parameters ...
2k views

### Secure encrypt-then-sign with RSA

I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt. However, I have encrypted data that I need to sign, to prove the author of ...
118 views

### Is OAEP reversible?

Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for ...
171 views

### implementing long term archive encryption

Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways: The ...
221 views

### How can a key pair be derived from an arbitrary hash?

If I correctly understand the concept of a "brain wallet" in BitCoin, you start with a passphrase, generate the hash of the passphrase, then somehow derive a public / private key from that to use as ...
125 views

### Algorithm digipass-like

I'm pretty sure there are famous algorithms for my problem, but I don't have enough knowledge in this field, so I need your lights. Here si the problem : Alice sends key X to Bob. Bob has an ...
4k views

### AES plaintext is smaller than 128 bits - how to expand?

We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
253 views

I'm looking for feedback on whether or not this is the proper way to approach password verification without transmitting the actual password. Are there any problems with this scheme. We are working ...
4k views

### repeating-key xor and hamming distance

I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
691 views

### Is this scheme a provably fair random number generation?

I have thought up a method for generating random numbers between a client and a server which I hope is fair: The client and server decide on a range in advance, $0$ trough $n-1$. The server ...
96 views

### What does “securely realize” mean?

I was wondering what "securely realizes" means. I see this in some cryptographic papers but I don't know what it means for a protocol to "securely realize" a function $F$. Is it just a fancy way of ...
231 views

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
2k views

### Is it possible to determine a PGP public key from encrypted data?

Is it possible to find out which public key was used to generate the message? Scenario is like this : I got data which is encrypted with a public key. Now a "bad guy" hast the encrypted data, and ...
1k views

### Tamper-proofing log files

Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ...
102 views

### What happen if a asymmetric crypto-system deals with only one key

Assume there is a crypto algorithm that deals with matrices to encrypt and decrypt. Regardless of the specification of such algorithm, what if the algorithm assumes that two parties can securely agree ...
796 views

### Are cryptographic hash functions perfect hash functions?

For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to ...
640 views

### Attacking historical ciphers methodology

It's more a theoretical question of how would you approach it. All you know about the ciphertext it's was generated with a historical cipher. The ciphertext appears to be random, BUT it's divided into ...
I am designing a simple and secure stream communication protocol. My idea was to build each message sent to the wire as: (message size || clear text || UHASH(message size || clear text)) $\oplus$ ...