# All Questions

194 views

### Generating non-repeating N-bit IVs, which are indistinguishable from randomness

I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
64 views

### Protocol to identify zone of potential agreement without revealing reservation prices and having to trust third parties?

A wants to buy a company from B. Before A and B enter negotiations, they want to make sure that there actually is a zone of potential agreement. Obviously, they don't want to communicate their ...
1k views

### Combining LFSRs for Stream Ciphers: Why do we need high non-linearity?

Linear Feedback Shift Registers (LFSRs) can be excellent (efficient, fast, and with good statistial properties) pseudo-random generators. Many stream ciphers are based on LFSRs and one of the possible ...
413 views

### One time pad: why is it useless in practice?

The symmetric cryptosystem One time pad (OTP) seems to be very beautiful since it is perfectly secret according to Shannon. Many books, however, point out that the main drawback is that one must ...
573 views

### Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?

For RSA cryptography, we know that the modulo $n$ is a product of two big prime numbers(say $p$ and $q$). However, in some documents I see an extension of $p=2p'+1$ and $q=2q'+1$ with $q'$ and $p'$ ...
390 views

### How can k3d3/ed25519-java's performance be improved?

I tried asking this on stackoverflow because I thought it might be a simple coding question and didn't want to clutter up this amazing stack, but I received no responses. CodesInChaos showed me that ...
644 views

### Why use a timestamp and how can someone know it's the correct one?

Let's say A wants to send a message, so everyone who gets the message, can be assured that it's from A. A then sends a message ...
2k views

### Cryptanalysis of Linear Feedback Shift Registers

It is well known that simple m-sequence linear feedback shift registers have a linear algebraic structure and therefore the generator seed can easily be deduced using the Berlekamp-Massey algorithm. ...
267 views

### Can anyone give an example where (asymmetric) crypto can go wrong due to selection of wrong groups?

Basically the title says it all. It would be great if someone could tell give an example using provable security. More information about groups can be found at: https://en.wikipedia.org/wiki/Group_(...
502 views

### Test Vectors for ciphers

While implementing ciphers (/hash functions, ...), I often face this problem: Where to find test vectors for it; so that I can guarantee my program is correct. It is generally a tedious job to find ...
204 views

### What authentication techniques can be used by QKD Systems?

As it is well known that QKD systems are prone to simple MITM attacks… what authentication techniques are being used in QKD to prevent those attacks in practice?
1k views

### Complexity of arithmetic in a finite field?

I am wondering what the complexities are of adding/subtracting and muliplying/dividing numbers in a finite field $\mathbb{F}_q$. I need it to understand an article I am reading. Thank you
403 views

### CTR mode nonce with aggressive key rotation policy

I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce. Normally ...
974 views

### Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
1k views

### Hash function in PBKDF2

From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
188 views

### When is an asymmetric scheme considered broken?

Does the following quote imply that valid encrypted data can be created and decrypted by someone other than the owner of a private key: An asymmetric encryption scheme is considered to be broken ...
196 views

### Strategy for random CTR initial counter values

Alice has a secret key which she uses to encrypt messages in CTR mode. CTR mode is critically vulnerable to counter reuse, and Alice has a problem: she has terrible memory and no pen to write anything ...
2k views

### Keeping IV secret for AES CFB mode

I'm developing a security/encryption software and I'm using AES CFB (block size: 16 and key size: 32 bytes). I want to know, if I also keep IV (32 bytes) secret like the key itself (32 bytes), would ...
247 views

### Is my identity exposed when publishing my public key or encrypting with PGP?

Let's say I create my PGP keys with my appropriate name and email address. Will these personal information be exposed if I publish my public key? When I encrypt a message for sending it to my ...
311 views

I want to encrypt data and protect its integrity and confidentiality. However, I cannot increase the length of the data. Are there any cipher modes of operation which provide confidentiality and ...
102 views

### Are there simpler FHE methods than Craig Gentry's original paper?

Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE. I was wondering though, are there any simpler methods that have been discovered since ...
641 views

### Implementations of Ntru TLS

Has anyone come across any implementations of Ntru TLS? I'm working a project for uni that does quantum secure encryption. It relies on a mix of Ntru & AES, but I can't find an implementation of ...
409 views

### Is asynchronous perfect forward secrecy possible?

DH key agreement protocols require the participation of both parties, so are only suitable for synchronous connections. Is it possible to implement PFS in a fashion usable for asynchronous protocols, ...
351 views

### Is there a cryptographic hash function that can be performed with pencil and paper?

Imagine I'm signing up for the 99th new web site this month. I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into ...
548 views

### Are there some problems to use pseudo-random number generator in Smart Card?

A Smart Card is a kind of secure device, with limited storage capacity and computational resource. If we use a Pseudo-Random Number Generator to generate random numbers in a Smart Card, then is there ...
184 views

I am just reading the DAA paper (http://eprint.iacr.org/2004/205.pdf, Appendix A). A party $\mathcal{I}$ generates two group elements $g' \in \mathrm{QR}_n$ and $h = g'^r \bmod n$ with $r \in_R \left| ... 1answer 145 views ### Length-preserving all-or-nothing transform Is there any known way to construct a length-preserving all-or-nothing transform? In other words, a secure all-or-nothing transform where the length of the output is the same as the length of the ... 0answers 415 views ### Consequences of AES without any one of its operations Suppose AES-$128$. There are$4$operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey. Question: If I remove one of the following opearations, what will happen to ... 2answers 124 views ### Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography? I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the ... 2answers 190 views ### Can S/MIME be still considered secure? Previoulsy I had asked this question at http://stackoverflow.com/questions/18235983/can-s-mime-be-still-considered-secure but I feel this forum is topic-wise the right place. Recently there has been ... 1answer 394 views ### A discrete-log-like problem, with matrices: given$A^k x$, find$k$Let$p$be a large prime; we will work in$GF(p)$. Let$A$be a$n\times n$matrix. Also, let$x$be a$n$-vector and$k$a positive integer. Suppose we are given$p$,$A$,$x$, and$y$. The goal ... 1answer 14k views ### How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard I have a question about RCON here is my illustration... this is the 128 bit key.. [2b] [28] [ab] [09] [7e] [ae] [f7] [cf] [15] [d2] [15] [4f] [16] [a6] [88] [3c] ... 2answers 761 views ### What does “Worst-case hardness” mean in lattice-based cryptography? In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ... 1answer 251 views ### Modular exponentiation on calculator for textbook RSA How do you encrypt$51$with public key$(n,e) = (91,23)$I understand that$c = 51^{23} \bmod 91$. How can I calculate the result on a calculator? 3answers 479 views ### SHA256 output to 0-99 number range? Is it mathematically possible to take a SHA256 hash and turn it into a 0-99 number where each number in 0-99 range is equally likely to be picked? As a 256 bit hash means the highest value possible ... 2answers 154 views ### Why verify padding at all? Whenever a ciphertext is decrypted using a block-cypher, we need to remove the padding. There are different ways to add padding, but they usually set the last byte of the last block to the number of ... 1answer 880 views ### Why is asymmetric encryption IND-CPA? According to Wikipedia, the IND-CPA game is: The challenger generates a key pair PK, SK based on some security parameter k (e.g., a key size in bits), and publishes PK to the adversary. The ... 1answer 170 views ### How to generate a bilinear group of prime order p for key generation I am trying to implement an IEEE Paper In Cryptography. I read many reference regarding an RSA key generation. But i am confused with above statement. Please someone explain me What it says with ... 1answer 172 views ### Does security under ROM imply exactly what? I'm not sure I understand really the implications of proofs of security in the random oracle model. Does a proof of security in ROM translate to a reduction of security of the crypto-system to the ... 0answers 246 views ### Is there a flaw in this ECC blind signature scheme? Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ... 1answer 1k views ### Subtracting a point in elliptic curve cryptography? I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption: ... 4answers 2k views ### Pseudocode for constant time modular exponentiation I'm looking to implement modular exponentiation (for RSA) in constant time, but most of the examples I've found are more mathematical descriptions of the operations. Are there any references with ... 2answers 75 views ### Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security? I recentely asked "IND-CCA1 RSA padding?" about whether there is a IND-CCA1 secure variant of RSA. The original version of the question also allowed usage of ECC which would allow usage of ElGamal, ... 2answers 160 views ### CSPRNG that cannot be used as random extractor Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any ... 1answer 371 views ### How safe is it to derive MAC key from a hashed password? Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ... 1answer 2k views ### What are the advantages of CBC over ECB? From this question I understand that, for a block cipher, using CBC is better than ECB. It seems that if one only has part of the cipher text, then decryption is difficult because the decryption ... 1answer 264 views ### Using chi square for distinguishing between compressed and random data I am trying to find some measurement for identifying and distinguishing between compressed and random data. I tried this first by computing the entropy of such data, the entropy value is extremely ... 1answer 194 views ### Rijndael S-boxes: Where do the$\mu$and$\nu\$ polynomial ring elements come from?

I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions. I did some lines of code to ...