# All Questions

231 views

### Do test vectors ensure a cipher is free of backdoors?

If a cipher implementation passes unit tests using test vectors from some trusted source (these for AES, for example), then can we say that it is fully conforming to the specification, and must have ...
187 views

### Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say ...
239 views

### How to Distribute the Shares using Secret Sharing for arbitrary Monotone Access Structures

Consider 4 people, $A$,$B$,$C$,$D$, & a secret $s\in\{0,1\}^k$. Construct a scheme which enables the following subsets of people to retrieve the secret $\{A,B\}$, $\{A,C\}$, $\{B,C,D\}$. I know ...
1k views

### RSA with modulus product of many primes

I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with ...
164 views

### Can I use the ChaCha core as a 256-bit to 256-bit one-way function?

I'm looking to implement Lamport signatures as a little fun project, and I need a fast one way function that maps $\{0,1\}^{256} \rightarrow \{0,1\}^{256}$. I was wondering whether I could safely use ...
388 views

### What is the difference between a 'cipher' and a 'mode of operation'?

What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)? Aren't these both terms for the encryption/decryption technique?
299 views

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
161 views

### Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
381 views

### Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
263 views

### How hard is it to generate a partial RSA fingerprint collision?

When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ...
137 views

### low-exponent RSA

I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$. Suppose further the messages are ...
586 views

### Hill-cipher, disordered alphabet

I am going to apply a simple substitution cipher to my input, then encrypt the result with a Hill cipher. How can this be broken, in a chosen-plaintext threat model? In other words, instead of the ...
1k views

### Would a “Triple AES” (in the sense of how Triple Des works) serve for a dramatic increase in safety?

The system requires to be as paranoid as possible regarding security. One of the few contemplated changes to the current design is to use multiple encryption. First proposal was to use Serpent on top ...
582 views

### Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
388 views

### Can I combine two PRNGs to make use of more seed data?

I have 320 bits of seed data (actually 512 bits of data with 320 bits of entropy, derived from a Diffie-Hellman shared secret and nonces). The PRNG I am using at the moment is the android version of ...
754 views

### What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
270 views

### A situation where security by obscurity might be the best solution - or am I wrong?

Imagine the following situation. There is an application for a microcontroller-driven system. The profits are made from manufacturing and selling the device itself. However, it is expected, that the ...
3k views

### Constructing RSA private key, given public key

As part of a puzzle I was given an RSA 256-bit public key and an encrypted message. The key itself is very weak, having exponent e = 65537 and modulus N = ...
629 views

### Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
3k views

### Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?

Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems? Is it believed to be secure and represent the state-of-the-art in RSA-based signatures? I understand that ...
705 views

### Is this a correctly formatted PGP session key packet?

RFC 4880 may be full of information, but it can be incredibly vague at times, so im looking for someone who actually knows the answer to this. Given this public key: ...
404 views

### Using a derived key for CMAC

Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication: Two keys are derived from the master key k (16 byte): ...
196 views

### Addition step in MD5 implementation

In MD5, there are four rounds. After every round, why do we need to add the computed $Q$ values to the initial values and then take this value as input to the next round. For example after the first ...
2k views

### What is the 'Version Incompatibility" Problem in TLS 1.1/1.2 and 1.0?

It's unclear to me if there are multiple problems, or a single one, (and just what that problem is) with servers incorrectly negotiating down from a client offering 1.1 or 1.2 to something they ...
568 views

### Differential cryptanalysis - breaking the last round of FEAL4?

I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful: http://theamazingking.com/crypto-feal.php So far I've been almost successful in breaking FEAL4 ...
388 views

### Provable Encryption

Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key? Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
722 views

### Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
947 views

### How does a key wrapping like RFC 3394 secure my cryptographic keys?

So I'm messing around in the BouncyCastle library with the RFC 3394 AES Key Wrap engine and I'm trying to understand the benefit of it. The problem I'm running into is how to store keys securely on a ...
88 views

### What is the difference between the standard representants of $\mathbb Z/q\mathbb Z$?

The symbol $\mathbb Z/q\mathbb Z$ (given that $q$ is prime) represents the prime field $\mathbb Z_q$. Basically, the elements of this field are represented by $\{0, 1, \dots, q-1\}$, let's call this ...
103 views

### Turning a 64 bit block cipher into a 128 bit block cipher

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical. ...
102 views

### Is it ever unsafe to compress an EC point?

I am working with a library that outputs EC points in uncompressed form. To save space, I'm considering modifying said library to use compressed EC points. Assuming that I keep track of the sign bit ...
611 views

From Wikipedia: Second pre-image resistance Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = ... 1answer 94 views ### Secure multiparty computation of conjunction Suppose Alice and Bob each have bits a and b, respectively. How can Alice and Bob compute the function ... 1answer 221 views ### Decrypt all RSA ciphertexts if you can break 1% of them I was given a cryptography question during an interview the other day. Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is able to decrypt 1% of the messages ... 1answer 198 views ### Are there some problems to use pseudo-random number generator in Smart Card? A Smart Card is a kind of secure device, with limited storage capacity and computational resource. If we use a Pseudo-Random Number Generator to generate random numbers in a Smart Card, then is there ... 2answers 390 views ### AES-ECB as an authentication mechanism ECB is considered to be insecure when used for confidentiality because identical plaintext result with identical ciphertext. But what if we use ECB for authentication? Assume A wants to transmit an ... 1answer 120 views ### Partial hash code protocol for security tokens providing signatures I've read the following two sentences within a beta protocol specification, which references ISO/IEC 7816-8 for PSO:HASH which already contains notions of a "partial hash". The off-card entity is ... 2answers 320 views ### Security issues of a MAC-then-Encrypt-then-MAC approach? Encrypt-then-MAC does provide ciphertext integrity, but no plaintext integrity. With MAC-then-Encrypt it’s the other way around: Plaintext integrity but no ciphertext integrity. What comes to mind is ... 3answers 295 views ### How feasible is word-level frequency analysis over English (or any language)? Say I have some black box which, given any English word, deterministically outputs a token for that word. Assume our black box is implemented using strong cryptography, i.e. the hardness of reversing ... 1answer 423 views ### True Random Number Generator by milliseconds per keystroke (TRNG-Kms) The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ... 2answers 226 views ### Using PBKDF2 twice with different argument order I'm pretty sure this is a really bad approach (in theory), but one of my clients is doing this and I was wondering… How bad it is to perform pbkdf-2 in this way (with 2000 iterations)? ... 1answer 291 views ### What differences between Menezes–Vanstone ECC and ElGamal ECC? After researching ECC encryption, I found that we can use ElGamal cryptosystem with elliptic curve and can we use Menezes-Vanstone cryptosystem with elliptic curve. What is the essential difference ... 1answer 197 views ### When is it safe to not use authenticated encryption? I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ... 0answers 192 views ### Is there a flaw in this ECC blind signature scheme? Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ... 1answer 89 views ### Does$i^n=j^n$for$i, j \in GF(2^q)$and$i \neq j$for some$n<2^q-1$Let$i, j \in GF(2^q)$and$i \neq j$and$i,j\neq0$. Is that possible that$i^n=j^n$for some$n$such that$0 < n < 2^q-1$? I am looking for a proof if the answer is no, or for a method to ... 1answer 2k views ### Why is Serpent faster than AES in this benchmark? I have a laptop without the AES-NI CPU instructions but with SSE4.1. I'm using Linux and tried the (in-memory) cryptsetup benchmark to get the rough tendency which returned: ... 1answer 309 views ### Rfc2898DeriveBytes - password length Trying to find related answer for a long time, but not convinced yet. What I am trying is to encrypt using RijndaelManaged. To create Key, I am passing password, ... 1answer 226 views ### How to attack this authentication protocol from “Cryptography: An introduction” Consider the following protocol (from the book "Cryptography: An introduction", by Nigel Smart): ... 2answers 408 views ### Two-timing a one-time pad [duplicate] Is a one-time pad still breakable on a depth of 2+ if the plaintext is completely random? I'm assuming this idea is wrong, mostly because it occurred to me, but let me walk you through my logic so ... 2answers 493 views ### Advantages of bilinear map Consider the pairing$e: G_1*G_2 \to G_t$. Why we are mapping element from group$G_1$and group$G_2$to an element in$G_t\$. How are they used in cryptography? What advantages do they provide?

15 30 50 per page