# All Questions

246 views

### Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
423 views

### What is the limit of plaintext required to break the Vigenère encryption?

A theoretical question about the Vigenère cipher: Without any knowledge about the key (not even it's length) can we tell how much known or chosen plaintext is needed for the adversary to completely ...
111 views

### How can we define division operation by using Fully homomorphic encryption

Last fews months, I'm working with homomorphic encryption. Now I am dealing with some computational problems with integers or real-numbers (like arithmetic mean, standard deviation) where division is ...
1k views

### LFSR get output from characteristic polynomial?

Say you have a characteristic polynomial of an LFSR: $$f(X) = X^4 + X^3 + 1$$ How can I use this function f to get the output of the LFSR, given some initial state? Obviously I can create the LFSR ...
564 views

326 views

### What is the name of this kind of protocol

There is a communication protocol that I believe creates the equivalent of a one time pad, with the downside that the secret message must be transferred multiple times. The protocol is so simple that ...
159 views

### Is a strong block cipher usable as a strong sponge function?

From the literature, it looks like the security proofs of sponge functions depend on how well they approximate a random permutation, Since a block cipher also ideally behaves like a random permutation ...
430 views

### Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?

I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
395 views

### Statistical properties of hash functions when calculating modulo

When using SHA-1 to hash an input, the result is a pseudo-random number in the numeric ID space $\{0\dots2^{160}-1\}$. Do I loose any statistical property in the result if I use modulo to restrict the ...
112 views

### Differential Cryptanalysis for Hash functions

How is differential cryptanalysis used to attack hash functions? I've been struggling through a couple academic papers and thesis's on the subject but they all sound like greek to me. Does anyone know ...
663 views

### AES block cipher modes of operation

have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ...
525 views

### Is symmetric encryption vulnerable to plain-text-attacks?

Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob ...
585 views

### Is it possible to figure out the public key from encrypted text?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
652 views

### What is the purpose of pre master secret in SSL/TLS?

I studied about SSL/TLS and learned that client and server must share keys below. common key for encryption common key for generating message authentication code Then, in SSL/TLS, a client doesn't ...
223 views

### When is it safe to not use authenticated encryption?

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ...
198 views

### Which public key encryption scheme is re-randomizable? How can I re-randomize an encryption scheme?

Which public key encryption scheme is re-randomizable? Is there any library for re-randomizable encryption scheme? If not, how can I re-randomize a given public key encryption scheme? I cannot find ...
430 views

### Construct an encryption algorithm using hash function [duplicate]

We know that Cryptographic hash function is generally a one-way function where we can't retrieve the original message. On the other hand, encryption is a two-way-function where we get the original ...
1k views

### If RSA is limited to 117-200 bytes or so, is that a very limited use case?

Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size? I have read that you can only encrypt a message of around 117 to 200 ...
324 views

### If Bob steals Alice's private key, how exactly would he read her encrypted documents?

So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files? What I am reading is that no he does not need it but as far ...
148 views

### Is there any alternative for extended euclidean algorithm to perform modulo division?

I'm implementing point addition and point doubling operations for elliptic curve cryptography. I have implemented extended euclidean algorithm to perform modulo division. It appears the that ...
2k views

### How to test if a number is a primitive root?

How to test if a number is a primitive root, assuming the modulus is a prime? And if not? Is it not enough if the number is relatively prime to the modulus or prime?
306 views

### understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
293 views

### No IV for one off symmetric file encryption

My question is (hopefully, for somebody) a simple one; but my project is holding as I'm not sure. I read on SO that generating encryption keys without an IV is a bad idea, so is using a constant IV ...
3k views

### SHA256 HMAC brute force with chosen plaintext attacks

This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ...
137 views

### Are there MD5 collisions for inputs of different length?

There are many examples of MD5 collisions (some of them can be found here Are there two known strings which have the same MD5 hash value?). But as far as I know two inputs should have the same length ...
90 views

### For which RSA moduli, precisely, is $e=d$ for all $e$?

This question shows that there are at least two valid RSA moduli $n$, namely $35$ and $91$, such that for any $e$ coprime to $\lambda(n)$, $$e^2\equiv1\mod\lambda(n)\text.$$ Reading the linked ...
162 views

### How to find the value of a vector modulo a basis in lattice-based cryptography

In Gentry's paper on fully homomorphic encryption using ideal lattices, he finds the values of vectors modulo a certain basis. For instance: $\psi \leftarrow \psi' \mod B$ Taken from page 69 of ...
534 views

### Whitening and randomness extraction

The Von Neumann randomness extractor is explicitly mentioned in the randomness extractor page of Wikipedia, but strangely enough that page does not contain any reference to whitening the results of an ...
195 views

### Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions. I did some lines of code to ...
585 views

### Why is the discrete log problem easy when the exponent comes from a binomial distribution?

I read in http://epubs.surrey.ac.uk/7219/2/esorics06.pdf that in exponential El Gamal the discrete log problem for recovering $m$ from $g^m$ can be made tractable when $m$ is drawn from a binomial ...
2k views

### One-time pad and zero key

I'm doing some exercises before my exam, and I am stuck with task number 4 in this file: http://www.cs.umd.edu/~jkatz/crypto/f10/hw1.pdf Could you help me with this task? When using the one-time ...
905 views

### How to calculate inverse affine transform in AES from forward affine transform?

In AES the forward affine tranformation matrix is defined as:  \begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& 1&...
565 views

### Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
429 views

### Can I build a secure tweakable block cipher from a normal one by adding key and tweak?

Let (E,D) be a secure block cipher. Consider the following tweakable block cipher: ...
700 views

### Cracking an RSA with no padding and very small e

I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
267 views

### Difference between lightweight, online and low memory Authenticated Encryption schemes

What is the basic difference between the following types of Authenticated Encryption (AE) schemes? Lightweight Authenticated encryption Online Authenticated Encryption Authenticated Encryption for ...
121 views

### Counting points on elliptic curve over binary field

How to count number of rational points on elliptic curve over binary field?
681 views