# All Questions

67 views

### Storing encryption key

It's my first time using stackexchange! So, I am doing a password manager in Java. But now I am VERY confused because of the encryption. There will be the program login, where the user types its ...
99 views

### Modes of operation that allow padding oracle attacks

It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why? ...
25 views

### Test PFS / EC-DHE authentication support [closed]

Can someone give me examples of testing of a website for PFS/ECDHE authentication support? I was hoping I could do it with cURL first and then OpenSSL, but I am open to any cli tools. On one guys' ...
127 views

### How secure is using a pad (using xor) on a encrypted data, for the purpose of obfuscating/hiding the underlying encryption?

Edit: I know this isn't really a one time pad (as pointed out), though I don't really know what to call it aside from just a pad, I guess. I have been reading around (mostly various stackexchange ...
182 views

### Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?

As in the title, given $g$, $g^{ab}$ are big elements in a prime group $Z_p$ and $b$ in prime group $Z_r$ ($p > r$, $g$ is one generator of $Z_p$). $a$ is unknown and also in $Z_r$, is finding ...
20 views

### Are there any reasons for using SSL over IPSec? [migrated]

is it recommended to use both protocols together? In which situation?
59 views

### Generalized Merkle Signatures, SHA-3 and Sakura

Sakura specifies a tree hash mode for e.g. Keccak (SHA-3). Are there any reasons to use the Sakura tree hash mode in a Generalized Merkle Signature Scheme? It seems to me Sakura primarily solves a ...
585 views

### How long does it take to crack PBKDF2?

How much time will it take to crack PBKDF2 while using a 9 character password? I'm not specifying any specific system or platform. If a brute force attack is made using the best ever super computer ...
44 views

### How to find which padding method is used in Block cipher(AES) encyption?

I have a cipher text which is encrypted using AES128 Algorithm. I want to know the following things to decrypt the cipher. IV (Initialization Vector) Padding Method Encryption Key How do I find ...
33 views

### Does bad IV generation weaken CBC? [duplicate]

Let's say that I generate an IV like so: dd if=/dev/urandom of=iv.bin bs=16 count=1 Let's also say that /dev/urandom has been ...
220 views

### Can I crack an AES string if I have all these parameters?

This is for a challenge at followthewhiterabbit.trustpilot.com: We have a message for you. It’s 3ncryp73d and we want you to crack it. The decrypted message will contain further instructions. ...
78 views

### Using GMAC for Authentication without encrypting the message

I am pretty new to cryptography and have a sample of GCM mode of operation for AES. PFB the code ...
35 views

### Security Model of Group Key Transfer Protocols [closed]

I have read many papers about Group Key Transfer (GKT) Protocol. However, no security models are given in this papers. I want to know whether there is a security model for GKT, and how to prove the ...
759 views

### Does having a known plaintext prefix weaken AES256? [duplicate]

I plan on storing data, encrypted with AES256, where the first dozen bytes are known plaintext. ('Hello World!' for example.) Does having this known plaintext prefix weaken AES256? I do not care ...
74 views

### Collecting entropy: can I use timing of reading as a separate source from the reading itself?

I'm implementing an entropy gathering program. For that I collect 2 bits from two gpio-pins connected to a random source. I whiten this stream of bits using the von Neumann decorrelation algorithm. ...
98 views

### How to calculate complexity of ElGamal cryptosystem?

How to calculate time and space complexity of ElGamal encryption and decryption as there are two exponentiation operation during encryption and one during decryption? Here is my code for encryption: ...
59 views

### Decrypting an encrypted text out of order

Does there exist a cipher that can be encrypted twice with two different keys and then decrypted twice using either key first? For example: ...
130 views

### Ciphertext indistinguishability (IND-CPA) for symmetric cryptography

My understanding are these steps are necessary for symmetric cryptography to be IND-CPA: The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger. The challenger selects one of ...
123 views

### Attack on DSA modification with bad hash function

Given a (bad) modification of DSA where the hash function is the identity ($H(m)=m$), I am now supposed to design an attack. So $(m, (r,s))$ are given and I should be able to create a legit signature ...
64 views

### A question about elliptic curves and finite fields in bilinear pairings

Based on what mentioned in the paper "Pairings For Cryptographers" http://www.sciencedirect.com/science/article/pii/S0166218X08000449 the two inputs of a pairing map are two members of two additive ...
75 views

### Protocol: Coin Flipping over phone

Protocol: Coin Flipping over telephone Hypothesis: Alice and Bob have agreed: a one to one function $f$ which is easy to compute $f(x)$ from $x$ and while given any value $f(x)$ it is nearly ...
53 views

### How does AES-CCM work in BitLocker?

I'm studying this white-paper: http://jessekornblum.com/publications/di09.pdf The author says that using AES-CCM with the external key (highlighted in green at page 9, figure 4) and with the nonce at ...
127 views

### Decryption issue with self-coded AES-128

I have written my own AES-128bit implementation in Java, till yesterday I thought it would be alright. (I was working on the encryption) Now I’m trying to decrypt my encrypted cleartext, but this ...
68 views

### Galois field step in XEX mode

I'm reading through the XEX mode spec, and I want to make sure I've understood the $\alpha^j$ step correctly: $X = E_K(I) \oplus \alpha^j$ $C = E_K(M \oplus X) \oplus X$ where: $M$ is the ...
75 views

### Could I use an hashing function for Symmetric encryption? [duplicate]

I know there are way better and more tested encryption methods, but I was wondering if the following code could be use for symmetric encryption? ...
49 views

### mixing two asymmetrical random number generator streams

Knuth describes in "the art of computer programming part 2" an algorithm called "M" for mixing two streams of random numbers. This can be used to mix random number streams giving the assurance that ...
81 views

### What is the motivation behind Key-policy Attribute-based Encryption?

What is Attribute Based Encryption? has a nice explanation what both forms (Ciphertext-policy Attribute-based Encryption and Key-policy Attribute-based Encryption) are. My question is: what is the ...
87 views

### Can astronomical radio sources be used as a verifiable randomness beacon? [closed]

A randomness beacon is a source of random data that is broadcast to multiple parties. Users listening to the beacon receive the same sequence of random strings and no one can predict the values in ...
105 views

### What is the entropy per Diceware word if a random symbol is inserted into a random position in the word?

On the Diceware page is this little gem: For extra security without adding another word, insert one special character or digit chosen at random into your passphrase... Inserting a letter at ...
73 views

### How to construct a next bit predictor from a distinguisher

I read the claim, without proof, that it is possible to construct a next bit predictor for any PRNG given an oracle distinguisher for that PRNG and vice versa. How do I prove that? A distinguisher ...
119 views

### pairing-based schemes

some authors claimed that computational performance of a pairing-fee scheme (based on scalar multiplication over an elliptic curve group) is about 1000% more efficient than a pairing based one I would ...
84 views

### Clarification of the terms “brute force” and “guess”

In the answer to the question “What exactly is a negligible (and non-negligible) function?” There is a part in the explanation that – as far as my knowledge goes – is conflicting: But instead of ...
139 views

### Does CCA security imply authenticated encryption?

Does CCA security imply authenticated encryption?
101 views

### How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature (R,S). Please explain me how this works.
140 views

### Effective security of block cipher – equal the key size, or half the key size?

The Wikipedia “Key Size” article states: The security of an algorithm cannot exceed its key length (since any algorithm can be cracked by brute force), but it can be smaller. … … … Most ...
45 views

### Is jacobian to projective conversion unique?

I am doing a small project in ECC. I have used the following equation for converting Projective to Jacobian coordinates: $$D = AC\\ E = BC^{2}\\ F = C$$ and also the following equation to convert ...
66 views

### Is there any _true_ anonymous cryptocurrencies? [migrated]

I've been looking into Bitcoin recently and stumbled upon numerous notes how Bitcoin is not anonymous at all, or how it's only partially anonymous and you can easily trace your funds. So, this ...
69 views

### If I add a stream of true and pseudo random numbers, do I get another stream of true random numbers? [duplicate]

I am thinking of buying a USB hardware advertised as producing a stream of 'high quality' random numbers which I take to mean they are indistinguishable from a stream of 'true' random numbers. If I ...
55 views

### Determining if a stream of bits is statistically random [duplicate]

Suppose I would like to build a hardware RNG. The details aren't important but let's say I've found a way to generate theoretically random bits, and I want to test to see if they are in fact "random ...
159 views

### In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

In openSSL – during RSA key generation – if $q$ is bigger than $p$, they exchange them. Why is that?
57 views

### What is a proof of data possession that accounts for fake mirrors?

Alice pays Bob \$5/month to host a gigantic file for her. She wants to occasionally verify that Bob is actually hosting the file. To do this, she selects random blocks from the file, and ...
29 views

### Calculating IHVs from known message and hash output

Here is a somewhat silly and atypical problem I am currently facing. Usually, when it comes to hashes, one is bothered with finding collisions and preimages. My problem is, I need to find the IHV used ...
11 views

### Could remailers achieve their goals under conditions of ubiquitous (total) surveillance? [migrated]

I am not certain but I am afraid that the answer to the question would be negative, if the following arguments couldn't be clearly refuted: A sender of a message has to choose a (first) node of the ...
157 views

### How can a Vigenère cipher be broken if the message is short?

I was watching a Stanford lecture on Vigenère cipher and in it the professor said that – to break the cipher – we assume the length of the key is known. We then break the cipher into groups of this ...
81 views

### Is there a practical upper limit for password rehashing?

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security? Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, ...
58 views

### RSA Key and RSA Security

Is there any relationship between the RSA keypair standard and RSA security? Keypair: http://en.wikipedia.org/wiki/RSA_(cryptosystem) Security: http://en.wikipedia.org/wiki/RSA_Security If not, ...
253 views

### Random Number Generator based on AES CTR

I've just about done tinkering with an open source DRBG, and I sure would appreciate a bit of advice from this community. Here's the link to the project, hosted at codeproject.com. It is written in ...
39 views

### Trapdoor permutation / hardcore predicate [closed]

I'm trying to understand the basic scheme of deniable encryption based on the “Deniable Encryption” paper by Ran Canetti, Cynthia Dwork, Moni Naor and Rafail Ostrovsky (1997). Is there any source ...