# All Questions

9k views

### What are preimage resistance and collision resistance, and how can the lack thereof be exploited?

What is "preimage resistance", and how can the lack thereof be exploited? How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?
22k views

### Best way to reduce chance of hash collisions: Multiple hashes, or larger hash?

I would like to maintain a list of unique data blocks (up to 1MiB in size), using the SHA-256 hash of the block as the key in the index. Obviously there is a chance of hash collisions, so what is the ...
1k views

### Linear Cryptanalysis

What is the principle of linear cryptanalysis, as applied to a block cipher ? For instance, this page gives the rough outline of differential cryptanalysis.
7k views

### Avalanche effect in DES

I couldn't understand the avalanche effect in DES. Could someone explain how avalanche effect happens in DES
653 views

### How does one provide a secure and authentic communication channel?

Let assume two participants Alice and Bob who perform a given protocol which is a sequence of messages exchange between them. My question is: How can I provide a secure and authentic communication ...
666 views

### Is it reasonable to assure that p-1 and q-1 aren't smooth?

I came across the requirement that, in RSA, $p-1$ and $q-1$ shouldn't be smooth, shouldn't consist of lots of small factors. Therefore my question: How complicated is it to check whether $p-1$ is ...
4k views

### Encrypting and obscuring data between site/user without SSL

Im trying to figure out what the best way to encrypt data sent between a webpage and the user(both ways) is, when hosted in an environment that doesn't support SSL. The purpose of encryption would be ...
22k views

### How much would it cost in U.S. dollars to brute force a 256 bit key in a year?

I am often told that any key can be broken and that it is only a matter of time and resources for any key to be broken. I know that this it technically true. However, I think that there is probably a ...
1k views

### Encrypting (CBC) identical files with same key and different iv, is it less secure?

I would like to learn more about cryptography. Let's say you encrypt multiple files with CBC encryption using the same key, but each file has unique (and pseudo random) iv. Does this weakens the ...
3k views

### How key materials are generated in SSL V3 from master secret

The generation of key materials is given by ...
6k views

### What is the purpose of four different secrets shared by client and server in SSL/TLS?

I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including client write mac secret, server write mac secret, server write key, client ...
586 views

### How to choose constants in a cryptographic function?

A number of cryptographic functions have constants built in. For example, the constants used in RFC 2104 for HMAC, or the constants used in s-boxes (e.g., DES and AES), or MD5. In general, how are ...
7k views

### Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is it?...
202 views

### Academic papers on ECDSA security

What are the most authoritative papers on the security analysis of ECDSAs? I`m mainly looking for comparisons of how secure different curves are considered to be, what potential methods are there of ...
119 views

### How does one measure the decrease in security, if any, of RC4 when mapping to a specific range of values?

For a project using RC4, the output is to be mapped to values of 0 to 35. Thus, only 36 unique output values representing the letters A to Z and 0 to 9. To avoid bias, the RC4 byte output (with a ...
308 views

### Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about b),...
606 views

### Threshold Secret sharing - How to create a shared secret from pre existing secret parts?

In usual $(t, n)$ secret sharing schemes, a secret $S$ is split into $n$ parts so that any $t$ out of $n$ parts reconstruct the original secret. So, suppose that there is a group of $n$ participants ...
192 views

### Is there a secret sharing scheme which allows sharing of a secret (one-out-of-n)

Is there a secret sharing scheme where the knowledge of just one share is sufficient to find the secret, in other words a (one-out-of-n) sharing scheme ? Plz I need to know if it is possible to make ...
5k views

### Why do we need special key-wrap algorithms?

Wikipedia says: Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material. We are using these algorithms to encrypt (...
1k views

### How does a key wrapping like RFC 3394 secure my cryptographic keys?

So I'm messing around in the BouncyCastle library with the RFC 3394 AES Key Wrap engine and I'm trying to understand the benefit of it. The problem I'm running into is how to store keys securely on a ...
8k views

### Is Blowfish strong enough for VPN encryption?

I'm looking at an OpenVPN connection between two sites configured to use 128 bit Blowfish in CBC mode, and trying to figure out how to assess the strength, but I just don't know enough of the maths. ...
2k views

### Decrypting DES with decrypted and encrypted data [duplicate]

I got two 8-byte strings. One which is decrypted is: FF FF FF FF FF FF FF FF and one which is encrypted is: ...
839 views

### If the PSK is known, is it possible to decrypt traffic from other clients in a WPA2 wlan network?

If in a public WLAN WPA2-PSK is used, but the PSK is more or less publicly available, does this mean that an attacker with that PSK can easily decrypt wlan traffic from/to other clients of that WLAN? ...
1k views

### What is a hard-core predicate?

I read this article on Wikipedia: Hard-core predicate. Still I don't understand what exactly is a hard-core predicate. Is it possible to put this in simple English terminology, and perhaps with a ...
917 views

### How to deduce enigma settings given a partial plaintext?

Assuming some large block of text is encrypted with an enigma machine and I only know a small subset of letters before and after encryption, how do I go about figuring out the enigma settings from ...
393 views

### Why would you expect to find a collision in a hash function after approximately $\sqrt{n}$ hashes?

I can't get an intuitive understanding of why it's $2^{(\frac{n}{2})}$ and not $2^n$, where $n$ is the number of bits of which the key consists.
15k views

### How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
5k views

### Why is H(k||x) not a secure MAC construction?

If H(m) is a secure hash function, can't we implement a MAC using H(k||m)? However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash functions for ...
649 views

### Does the XML Encryption flaw affect SSL/TLS?

A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated: XML Encryption Flaw Leaves Web Services Vulnerable. Does this weakness of CBC-mode which is used here also ...
594 views

### How can I encrypt more than 64 bit with the Data Encryption Standard?

The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key. If my data is more than 64 bits, (suppose 66 or 67 bits), will ...
2k views

### How can rainbow tables be used for a dictionary attack?

I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ...
187 views

### Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption?

I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer ...
1k views

### How to require two keyholders to decrypt a document?

I want to create a system to encrypt a document and store it with a 3rd party, but not have the 3rd party be able to decrypt it until some unspecified later date. It seems like the solution would be ...
397 views

### Endless PRNG from PRNG with specific stretch?

Every definition of pseudorandom generator that I've seen says it takes n-bit strings and gives poly(n)-bit strings. Is there a proof that if there is such a pseudorandom generator then there is a ...
1k views

### Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?

The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ...
4k views

224 views

### Getting the encryption method and key from the encrypted data and the raw data

I have some pairs of plaintext and ciphertext data, from which I need to be able to decrypt the other passwords stored in the database. The password field typically contains something like ...
590 views

### How can one break a monoalphbetic substitution chipher at pseudorandom text?

Does anybody know how to break monoalphbetic substitution cipher, if it is applied to some pseudorandom text (for example to some surrogate key filed in a database)? Let us assume that we have only ...
1k views

### Is there a hash function with 2048bit output?

Is there a publicly available cryptographic hashing algorithm with 2048 bit output? The standard ones are "only" up to 512 bit (SHA-512, WHIRLPOOL). (2048 bits are 256 bytes, so it would be useful ...
2k views

### How can I encrypt + authenticate short strings into similar short ciphertexts?

I wish to manipulate short ASCII strings (namely unpredictable domain names) into a form which cryptographically assures authenticity and confidentiality, for use in the local part of email addresses. ...