# All Questions

128 views

### Cryptanalysis of AES on SSD with TRIM enabled

Attack scenario: SSD physically retrieved from a computer that is turned off. The entire disk is encrypted with AES 256-bit (GNU/Linux, LUKS). The SSD has had TRIM enabled for several years and the ...
176 views

### Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say ...
390 views

### RSA least significant bit oracle attack

I have been reading up on RSA attacks and came across one that could be called a least-significant-bit (LSB) oracle attack. For the sake of clarity lets define RSA primes $(p, q)$, private key $d$ ...
346 views

### What is the definition of “security beyond the birthday paradox”?

I'm reading a paper about MACs and I would like to be sure about the meaning of a security beyond the birthday paradox. Is there a definition?
99 views

### What security do digital signatures provide (like used when signing PDFs)?

I want to ask you one question about digital signatures as they are (for example) used when digitally signing PDFs. We know that if our document has a digital signature, we can detect if the original ...
229 views

### How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
143 views

### Can a PRNG with a fixed amount of entropy always be detected?

Given a fixed seed (i.e. no ongoing source on entropy), is there (practically or theoretically) any PRNG algorithm that can generate an infinite sequence of random numbers such that an observer cannot ...
588 views

### What is it meant by a “hybrid argument”?

Can anyone explain (or point to a reference for) what a hybrid argument is in a security proof, and when it's convenient or preferable to use it? Among some of the places where I've seen it ...
274 views

### How Were secp*k1 elliptic curve generators chosen?

The Koblitz elliptic curves specified in the SEC2 document https://docs.google.com/viewer?url=http%3A%2F%2Fwww.secg.org%2Fcollateral%2Fsec2_final.pdf all have the nice feature that the parameters are ...
695 views

### Why elgamal is still discussed

As I understand, if two users have a shared key, it is possible to encrypt a message using symmetric key encryption. So when a secret key is shared through Diffie-Hellman asymmetric key exchange, it ...
138 views

### Is my identity exposed when publishing my public key or encrypting with PGP?

Let's say I create my PGP keys with my appropriate name and email address. Will these personal information be exposed if I publish my public key? When I encrypt a message for sending it to my ...
150 views

### Does any public key crypto support and/or allow a 3rd party “control-key”?

My question is based on the following situation: Bob and Alice work for a company that expects them to exchange data encrypted. They could do so using regular public-key cryptography, but Joe (their ...
210 views

### Secret sharing scheme with possibility to change the secret

Here's a scenario I want to handle with a secret sharing scheme: Alice wants to share the secret $S$ with Bob, Charlie and Dave. Alice generates private shares based on $S$ for Bob, Charlie and ...
498 views

### Decrypting files with an unknown method but a known result

I am assuming there is a very simple way of working this out by brute force, but I am not sure if there is a better way. I have a file of data that I wish to get (my data, generated by a machine). ...
155 views

### How do you find the inverse degree of a hash function?

I am trying to learn cryptanalysis on the Keccak hash function. One of the papers on zero sum distinguishers talks about Keccak having inverse degree of 3. I am unable to figure this out: how do you ...
409 views

### Can two cipher letters per plaintext letter easily defeat character frequency analysis?

For a class 5 years ago I wrote a paper about "defeating character frequency analysis by using two cipher letters per plaintext letter" ...
166 views

### How hard is it to generate a partial RSA fingerprint collision?

When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ...
122 views

### low-exponent RSA

I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$. Suppose further the messages are ...
174 views

### Questions about the ideal cipher model

I've read that we can study the security of modes of operation by assuming the use of an ideal block cipher. I've also seen a paper suggesting that the ideal cipher model could be something else than ...
347 views

### Trying to better understand the failure of the Index Calculus for ECDLP

So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong). So basically the index calculus for the ...
176 views

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
579 views

Let's say Alice and Bob are playing a game where Bob is trying to guess a number Alice has chosen. Alice chooses a key $K$ and a number $N$ at random and performs $C=Commit(K, N)$ where $Commit(K, ... 1answer 519 views ### What are the constraints for an IV using AES in CBC mode? I'm designing a protocol for use into a VPN software. The VPN frames are encapsulated into AES-256 CBC encrypted frames. I understand that IVs must be uniquely used for each message encrypted with ... 1answer 235 views ### Key collision in scrypt and hkdf I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ... 2answers 449 views ### Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ... 1answer 535 views ### Should the secret key of Shamir's secret-sharing algorithm be interpreted byte by byte? Should the secret message of Shamir's secret-sharing algorithm be interpreted and processed byte by byte? Interpreting it byte by byte makes it easier to process, but in case one of the shareholders ... 1answer 264 views ### Question about why RSA is hard to attack I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ... 1answer 114 views ### Any implication of a Yale result to security of quantum cryptology? Quantum key distribution depends, if I don't err, on (irreversible) damages done by MITM's measurements on qbits. Now news.yale.edu/2013/01/11/new-qubit-control-bodes-well-future-quantum-computing ... 2answers 494 views ### Hill cipher, unknown letter value I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix$K$of size$n\times n$, one ... 1answer 229 views ### Questions about William's p+1 First off, if you're doing William's p+1 test, then also doing Pollard's p-1 is redundant, since the p+1 test covers both cases, right? Second, why is the recurrence$V_{n+1} = aV_n - V_{n-1}$used? ... 1answer 378 views ### Is there a security analysis of CryptDB? Its interesting to see critical thinking being applied to cryptDB in contrast to all the hoopla around it here . cryptDB is not a major theoretical breakthrough but potpourri of technologies to make ... 1answer 129 views ### Safety of a pre-keyed DH-Key Exchange Asuming this scenario: Bob and Alice each have the public key of the other party for a D-H function and want to exchange data. Now, if they each generate their shared secret, is it safe to assume ... 1answer 342 views ### Is this a good way to encrypt a file? I need to encrypt a file, distribute it over an insecure channel, and decrypt it later. Using a symmetric-key algorithm. Here's what I intend to do: Get a password P from the user. Generate a 16-byte ... 1answer 711 views ### How to securely use Elgamal encryption in libgcrypt? How secure is libgcrypt's Elgamal implementation of encryption (how different it is from textbook Elgamal), and how can I tweak padding and other preprocessing actions? For example, I know that usign ... 2answers 520 views ### Is this a correctly formatted PGP session key packet? RFC 4880 may be full of information, but it can be incredibly vague at times, so im looking for someone who actually knows the answer to this. Given this public key: ... 1answer 1k views ### Padding methods for block ciphers - PKCS7 vs ANSI X.923 I was looking through block cipher padding methods, and found two good candidates: ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ... 1answer 286 views ### Using a derived key for CMAC Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication: Two keys are derived from the master key k (16 byte): ... 2answers 220 views ### Does a hash function in chaining mode or in counter mode make a better pseudo-random number generator? I have two pseudorandom generators:$f_1$takes a random seed$l_0||r_0\in \{0,1\}^{160}$as input and outputs$r_1||r_2|| \dots ||r_k$, where$l_i||r_i = \operatorname{SHA-1}(l_{i-1}||r_{i-1})$... 1answer 525 views ### Is this authenticated one-way communication protocol secure? I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ... 1answer 88 views ### In a lattice, how can one define a good basis and a bad basis? When it comes to lattice based cryptographic systems, all the literature talks about, good bases and bad bases. How does one define what a good basis is and what a bad basis is? 1answer 1k views ### What is the 'Version Incompatibility" Problem in TLS 1.1/1.2 and 1.0? It's unclear to me if there are multiple problems, or a single one, (and just what that problem is) with servers incorrectly negotiating down from a client offering 1.1 or 1.2 to something they ... 1answer 432 views ### Families of public/private keys in elliptic curve cryptography I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ... 1answer 150 views ### Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption? I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer ... 3answers 311 views ### Endless PRNG from PRNG with specific stretch? Every definition of pseudorandom generator that I've seen says it takes n-bit strings and gives poly(n)-bit strings. Is there a proof that if there is such a pseudorandom generator then there is a ... 2answers 159 views ### Generating non-repeating N-bit IVs, which are indistinguishable from randomness I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ... 1answer 84 views ### Clarification of the terms “brute force” and “guess” In the answer to the question “What exactly is a negligible (and non-negligible) function?” There is a part in the explanation that – as far as my knowledge goes – is conflicting: But instead of ... 1answer 75 views ### McEliece and cryptanalysis What is the computational time to break McEliece on a quantum computer? I've seen that polynomial time algorithms exist, but for special conditions. What about the general case? 1answer 132 views ### Elliptic Curve Crypto, is a distributed signing method possible using Shamir's Secret Sharing? Note: A distributed signature scheme exists for RSA: Practical Threshold Signatures, Victor Shoup. Is it possible to adapt such scheme for ECC? A centralized signing machine is vulnerable to ... 2answers 89 views ### Is it possible to construct a secure block cipher of size$2n$given a secure block cipher of size$n\$?

Given, say, the Blowfish block cipher, which is considered secure but only has a 64-bit block size, can we construct a secure block cipher of 128-bit block size? Say we run the key through two KDFs, ...