# All Questions

183 views

### Timestamping services authorities, utilizing Linked, hybrid and other than PKI schemes

What are well respected Cryptographic Timestamping authorities utilizing more sophisticated than just PKI (RFC 3161) schemes, like Linked, Linked and signed, distributed hash trees (maybe P2P?), ...
515 views

### Complexity of ECB and OFB

What is the complexity of ECB in terms of Time and Memory? and also in OFB? I can't find it in the internet, so I decided to ask it in here.
121 views

### Combining a block cipher with a (pseudo) OTP

One of the drawbacks of OTP is that it can require an inconveniently long key. Besides that, it doesn’t provide data authentication. Therefore, I have been working on an algorithm idea, which I hope ...
141 views

### 1024 RSA Hash Signature attack. Forge a valid signature

I have an RSA signature of 1024 bit where i know the following: Public modulus N Public exponent (0x03) Cypher message Summary: An MD5 hash is calculated from a collection of byte and is used as ...
139 views

### Simple example to describe Bilinear mapping

Notation : $\mathbb{G}$ is an additive group and $\mathbb{G}_T$ is multiplicative group of prime order $q$. Bilinear mapping $e: \mathbb{G} \times \mathbb{G} \rightarrow \mathbb{G}_T$ has to satisfy ...
70 views

### What is the benefit of applying the tweak a second time using XTS?

I tried to understand the inner working of XTS. What I understood is that it is applying the tweak two times: once on the plaintext and once on the output. What is the benefit of applying the tweak ...
287 views

### what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?

So normally if you do encrypt('a') twice in a row you'll get the same result. But sometimes (as is the case in SSH) this is not desirable. You want encrypt('a') + encrypt('a') == encrypt('aa'). What ...
149 views

### How does chosen ciphertext attack on Elgamal work?

Can it be proven that attacker can obtain the full message if he knows some plain-ciphertext pairs?
764 views

### Pi Message Encryption [duplicate]

I created a simple yet efficient message encrypting page that will encrypt messages using Pi. Though not being an expert in this area, I am nowhere near sure how secure this is and how easy it would ...
601 views

### Understanding multiplication in the AES specification

I am reading through the AES specification and am not able to wrap my head around the multiplication definition (section 4.2). Sorry to refer to a spec but AES is the holy grail in crypto so I hope ...
89 views

### Question Error Correcting Codes

Let $C$ be a code over the finite field $GF(2)$ with generator matrix $G$ and parity matrix $H$. Let $e+C=C'$ be a coset of code $C$. Let $S$ be a non-singular matrix and $H'=H\times S$. Finally, let ...
702 views

### Brute-force attacking One Time Pads feasible?

I have a ciphertext encoded with One Time Pad. I do not know the key. How can I find the possible keys which when decoded, will result in a meaningful plain text?
1k views

### How to implement order preserving encryption or order preserving hashing [closed]

Does anybody know any free implementation of either order preserving encryption or order preserving hashing? I've found some codes like CMPH but I need to dynamically add new DATA and that's why most ...
12k views

### Decrypt files with original file CTB-Locker [closed]

I have problem called CTB-Locker. It encrypted all of my files on computer and since I have lot of documents that are very important I am in problems! As I read online CTB-Locker uses "elliptical ...
3k views

### How can I find the prime numbers used in RSA?

I got this question in a local hacking event, but I couldn't solve it. Problem Statement ---- Continuing their snooping habit, NSA kept bugging Alice's communication. Resorting to the age old ...
387 views

### How do I choose the best 3*3 s-boxes?

I've read about 20 papers about the criteria for choosing best $n \times n$ s-boxes. Now, I've got two problems: How to generate $2^{24}$ s-boxes, and how to test them considering the criteria. ...
519 views

### Is (AES-)GCM parallelizable?

I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
3k views

### Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
505 views

### Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
245 views

### Logjam on Elliptic Curves?

I think we're all aware of the Logjam attack. From now on we know that re-using primes for DH is a bad idea. But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
1k views

### Why was the winner of the AES competition not a Feistel cipher?

The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question. However, most many of the AES candidates, and all 3 out ...
438 views

### Can one efficiently iterate valid bcrypt hash output values?

bcrypt is an intentionally slow hash algorithm. In my last protocol idea, I wanted to use it to expand a password and then only transfer the bcrypt-hashed password. An efficient attack on this would ...
1k views

### What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
8k views

### How does a birthday attack on a hashing algorithm work?

A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits. That means it takes about ...
757 views

### Why restricting SHA3 to have only two possible capacities?

I just read the presentation slides of John M. Kesley (from NIST) for his invited talk at CHES 2013 about SHA-3 and learned that NIST is going to standardize Keccak with a possibly modified padding ...
397 views

### Given enough RSA signature values, is it possible to determine the public key value?

Given enough RSA signature values, is it possible to determine which public key is required to verify the values? Could there be enough information to establish which key is required? Is there ...
115 views

### Can RSA be securely used for “blind decryption”?

Assume we have the following setup: A client with trusted storage and computing capabilities (e.g. a smartcard) A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
211 views

### Is deniable error-correction possible?

This question came up as I tried to answer an earlier question I asked: cryptographic data structure wanted: sparse array without membership test. I still have not resolved that question to my ...
423 views

### Security of a security protocol for key exchange, using symmetric-key cryptography

This is an exam question: $A \to B$: Alice, $nonce_A$ $B \to A$: $nonce_B$, $E_{k_{AB}}(nonce_A \| k_1)$ $A \to B$: $E_{k_{AB}}(nonce_B \| k_2)$ Alice and Bob both compute $k_s$ = $k_1$ xor $k_2$ ...
520 views

### What does “Inverting the RSA function is as hard as factoring” mean (a rigorous explanation or intuitive will do)?

I was reading that a current open problem is if inverting the RSA function is as hard as factoring. Does this mean that, its an open problem whether, if given a subroutine that computes in ...
248 views

### Is there any research on the problem of making a number more memorable to humans?

Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that ...
2k views

### Why programming languages don't provide simple encryption methods?

In c#, there is a namespace called System.Security.Cryptography and there are many classes in this namespace, which help developers encrypt and decrypt data. ...
405 views

### Given enough RSA ciphertext, is it possible to determine which key was used?

Given enough RSA ciphertext, is it possible to determine which public key was used to generate the ciphertext? Presume an unknown public key that was used to generate RSA ciphertext, and we have ...
235 views

### Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
244 views

### Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...
1k views

### Why is the complexity of RSA-1024 80 bit and not 86 bit?

Why is the complexity of RSA-1024 80 bit and not 86.76611925028119 bit? Here is the complexity for the GNFS (pulled from the linked Wikipedia article): \exp\left( ...
3k views

### What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
499 views

### OpenPGP Signature Packet hashed data

RFC 4880 describes the version 4 signature packet, tag 2, as ...
1k views

### How to better generate large primes: sieving and then random picking or random picking and then checking?

I'm writing an RSA algorithm, and am wondering what is the best and/or usual way to choose the initial prime numbers (p and q). I know of two methods to achieve this, one based on a prime number ...
1k views

### How much can we compress RSA public keys?

I am wondering to what degree we can define an RSA variant, with a security argument that it is as safe as regular RSA with a given modulus size $m$ (e.g. $m=2048$), in which the public key has a ...
223 views

### Is there any general description language for block ciphers?

In page 9 (16 in the PDF) of Final report of European project IST-1999-12324 (NESSIE), it is mentioned that: The NESSIE project is also developing a new generic tool to analyze block ciphers ...
87 views

### Possible problems in using a hash algorithm to construct a stream cipher

I'll define an example hash-based stream cipher as such: $H: \{0,1\}^* \rightarrow \{0,1\}^{256}$ is the hash function. $K=\{0,1\}^{256}$ is the secret key. $N=\{0,1\}^{128}$ is the nonce. ...
82 views

### Purpose of DES parity bits

DES has a 64-bit key size, but only 56 of those are used during encryption. The other 8 are "parity bits". What was the intended purpose of the party bits, and why are they no longer used in modern ...
553 views

### HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
195 views

### Is there an upper bound to the private exponent in RSA?

In the RSA algorithm, we choose $p$ and $q$ as prime numbers and we select a value $e$ which is coprime to $\varphi(pq)=(p-1)(q-1)$. Then we calculate $d:=e^{-1}\bmod\varphi(pq)$. My question is: ...
211 views

### Is full Homomorphic encryption quantum resistant?

Since most of our asymmetric encryption algorithms are going to be out-of-date in a couple of year due to Shor's algorithm, I was wondering about the future of FHE schemes. I have found this paper, ...
328 views

### What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...
327 views

### Is the HMAC construction really neccessary for a fixed length message?

The HMAC Construction is defined as: Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) ) This was designed because a simpler construction such as: ...
I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...