# All Questions

1answer
281 views

### What is an oracle adversary?

I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
1answer
197 views

### Messages of different lengths and one-time computationally-secret

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. Let $\Pi=(Gen,Enc,Dec)$ be an efficient secret-key encryption scheme that is not fixed-length. That is, for any $n$ ...
1answer
366 views

### Increase number of rounds for SPN and Feistel ciphers

Read a post on Schneiers blog (and again 2011) about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. ...
2answers
692 views

### Avalanche noise RNG for one-time pad use

I came across this little HRNG widget and was really intrigued as I have been looking for a decent but afordable source for truly random bits to use in a one-time pad. The question is, would a HRNG ...
1answer
366 views

### implications of SSH server key compromission when authenticating users against a public key

Friday we had a disagreement with a colleague of mine about the implications of SSH server key compromission The question was stated as this : What could a hacker do while provided with the SSH ...
1answer
556 views

### Is there another resource for Carter-Wegman-style message authentication?

I'm wondering if there are other resources that cover Carter-Wegman style message authentication, besides the sources themselves. Is there an online text or a book that covers their ideas? I'd ...
2answers
611 views

### Can I make a cipher (ex: Vigenère) harder to break?

The Vigenère cipher can relatively easy be broken when the key size is small compared to the size of the message. One first finds the length of the key, and then uses frequency analysis to actually ...
4answers
712 views

### What is the actual difference between security through obscurity and true encryption?

In an abstract sense, aren't both the same? Don't their definitions boil down to the following? security through obscurity: trying to make sure some information cannot be obtained without knowing ...
1answer
441 views

### Generating a cryptographically secure, many-time use, symmetric encryption key

I need to generate a 256 bit encryption key described by the adjectives in the title. Currently I intend to create the key using this RNG. Is this a secure manner of creating the key, given that it ...
1answer
464 views

### Several questions about Paillier cryptosystem

I have several questions concerning the original Paillier cryptosystem as described in Paillier, Pascal (1999). "Public-Key Cryptosystems Based on Composite Degree Residuosity Classes". EUROCRYPT. ...
0answers
230 views

### How to properly format a PGP Message Block?

As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I ...
2answers
899 views

### Capacity of Advanced Encryption Standard in terms of File Encryption

what is the capacity of AES in terms of File Encryption? is it really good to encrypt a large files in AES? ex. I am encrypting a 8GB of File... is it still good to used AES? is it still good to used ...
4answers
1k views

### Is my pseudo-random initialization vector secure?

How can I know if I am generating a secure pseudorandom initialization vector? Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure ...
1answer
10k views

### How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
3answers
580 views

### reverse of md5sum

This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size N whose md5sum is X? For example, ...
1answer
511 views

### Offline anonymous electronic money systems and their cryptographical base

What anonymous offline electronic money systems exist and what are they based on? I know only one currently - eCash, based on RSA blind signatures.
4answers
355 views

### Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list

I have a scenario similar to the one described in Wikipedia: hash list, but with a twist. I'm looking for a cryptographically secure hash function that would create the same root hash for the same ...
2answers
113 views

### What are the required security properties for salts?

I was recently thinking about password hashing (maybe caused by the PHC progression). I started to think a little more about it and got stuck at this question: What security properties do ...
0answers
20 views

### Proving an encrypted message contains (but does not 100% consist of) a plain-text message? [duplicate]

I have keypair (u,r), and two pieces of data, X and Y. I reveal X publicly but keep Y secret. Y has high entropy. I then combine X and Y, into c(X,Y) = Z. I encrypt Z, into "encrypt(Z,u) = Q". r ...
1answer
31 views

### How to encrypt/decrypt data in an SPI BIOS FLASH

I need some info/suggestions about the cryptographic algorithm that make me sure that the executed bios by the CPU is an authenticated bios. The check has to be performed by a FPGA. I have SPI Flash ...
0answers
54 views

### ElGamal signatures systems

Let $p$ prime number $q/p-1$ prime and $g\in (Z/pZ)^*$ element of order $q$.Also $a\in \{1,...,q-1\}$ the private key and $y\equiv g^a\pmod p$ the correspoding public key.For each of the following ...
1answer
74 views

### Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
0answers
25 views

### IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
2answers
116 views

### Severity of Cooking NIST P Curve Constants

Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
1answer
37 views

### Could this alternative hash based MAC construction be as, or even more secure than an HMAC?

Begin hashing (Key||Message) Encrypt the hash state (or some part of it, such as the first 128 or 256 bits), with the key. Add the encrypted hash state to the ...
3answers
130 views

### Is what i'm trying to do safe?

What both parties have: Server Master Secret (MS) Server supported versions (Svers) Agreed upon version (ver) Client Master Secret (MS) Client supported versions (Cvers) Agreed upon version (Ver) ...
1answer
210 views

### Where can I learn the basics of AES?

I was tasked with making an expo about AES and its steps, but I still can't grasp it, especially when it comes to "key schedule". Does anyone know some good material to start learning? Or can someone ...
1answer
61 views

### Rabin-Williams, blinding and size of Integer r?

I was reading the paper Breaking the Rabin-Williams digital signature system implementation in the Crypto++ library. The library uses blinding, but it was not enough to stop key recovery. But my ...
1answer
75 views

### SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)

The hashing scheme SHA-256 (for instance) is based on Merkle-Damgard construction with the underlying compression function based on the block cipher SHACAL-2 configured in Davies Meyer mode. SHACAL-2 ...
2answers
129 views

### Is computing roots moduli a composite $N$ a hard problem without knowing the factorization of $N$?

Suppose that we are given $\mathbb{Z}_{N}$ and an element $x^u \in \mathbb{Z}_{N}$ with $u \in (0,l]$ where $l$ is the bit-size of $N$. Is it difficult to recover $x$ by knowing $u$ without knowing ...
1answer
102 views

### Regarding NTRU homomorphic properties

NTRU has some homomorphic properties modulo q, supporting both addition and multiplication. Due to its nature, it cannot support many of them. My main focus currently is in the addition, so the ...
1answer
68 views

### Why are modes of operation used, what attacks do they prevent?

I know you always need to use a mode of operation when using a block cipher, AES for example, and Wikipedia has a good explanation for what modes of operation are Now I know if i do not use a mode of ...
1answer
125 views

### Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?

I am looking at the Koblitz method for encoding a message as an elliptic curve point. The first step given in the paper I'm reading is: "Choose an elliptic curve and its associated auxiliary base ...
1answer
111 views

### How does ccrypt work?

On many Linux/GNU distributions CCrypt (ccrypt) by Peter Selinger is available as a command line utility to encrypt files. How does the protocol work and is it ...
1answer
227 views

### ccrypt and its security

I would like to know how secure is ccrypt to encrypt files (like images, videos and other non-plain text data) using single password of 20+ chars length. It uses Rijndael with 256-bit block size and ...
1answer
324 views

### What is the difference between a hash function and a pseudorandom function? [duplicate]

Read the title. I've seen in RFCs that some MAC functions are called "pseudorandom functions". What are those? How are they different than hash functions? Why can't a hash function be used instead?
3answers
263 views

4answers
159 views

### Difference between Pseudorandom Function vs randomly chosen function

I am currently going through a course in cryptography. In this, I stumbled upon Pseudorandom Functions. I got a little idea of Pseudorandom Generators which map an input string (key) to an extended ...
3answers
239 views

### Point decompression on an elliptic curve

I'm programming an elliptic curve cryptosystem and I'm having difficulty with decompressing points. The following information is from my project specification as to my understanding: Given a point ...
0answers
181 views

Can an adversary who haven't seen the message before forge the signature of that message? The adversary has seen $σ_1 = (m_1)^d \bmod N$ and $σ_2 = (m_2)^d \bmod N$ He forges $m' = m_1\cdot m_2$ $σ' ... 1answer 436 views ### BruteForcer XOR (bfxor.exe) to attack 64-bit keys and longer First of all, this is not a beginner's question since I already know a good deal about encryption and brute-force attacks. This is also no question on how to code programs for brute-force attacks ... 1answer 156 views ### How can CBC-MAC be secure when message length is fixed? I was doing some self-initiated knowledge gathering about digests, signatures and hmacs and I ran across the fact that you can use CBC as a MAC, but if the message size is not fixed; then it is not ... 2answers 271 views ### RSA Decryption given n, e, and phi(n) my cryptography professor gave us this problem for extra credit a while back and I attempted it but I didn't get it correct. I have gone back to it, but I'm even more lost now than I was the first ... 1answer 66 views ### Is equal length of primes in Paillier cryptosystem is mandate for security reasons? In continuation to this question about length of primes , I am in doubt about the restriction on length of primes itself . In Paillier cryptosystem , equal length of primes are used . My doubt is ... 1answer 209 views ### Security of chameleon hash functions With the knowledge of the trapdoor, we are able to compute the same digest for differents messages. I've read that given two messages$m$,$m'$and two numbers$r$,$r'$such that ... 2answers 233 views ### How do RSA and ElGamal key sizes compare? I have a rather silly question regarding the comparison of RSA with ElGamal over integers. If you want to compare their performance in the same level of security, does the modulus of both of them need ... 1answer 237 views ### Message encrypted with a LFSR based stream cipher I am learning about LFSR sequence and I came across this question: A 16-bit message consists of two ASCII characters. This message was encrypted with a one-time pad, and the key for the one-time pad ... 1answer 169 views ### Roots of polynomial in Shamir secret sharing I need to know whether one can obtain any roots of the polynomial in Shamir secret sharing if he possesses less than threshold shares. For instance in (t,n) if he has t-1 shares can he obtain any ... 1answer 187 views ### Equal length of primes in paillier cryptosystem In the key generation step of paillier cryptosystem , In order to satisfy$\gcd(pq,(p-1)(q-1))=1$, we can take equal length primes. Instead of taking(length as parameter to generate$p,q\$) equal ...

15 30 50 per page