# All Questions

58 views

### setting the MGF hash to a different value other than the regular hash with openssl for PSS signatures

In PKCS1's Probabilistic Signature Mode you have the Hash and the MGF Hash. Both appear to be, by default, sha1, with the OpenSSL CLI client, however, I can change it to sha256 with the following: ...
60 views

### PBEWithMD5AndDES Cipher does not check for integrity first?

I am running FindBugs with findsecbugs plugin to scan java code for security issues. I am getting "Cipher With No Integrity" error for a Cipher function implemented with "PBEWithMD5AndDES". The legend ...
132 views

### Theoretical decryption of RSA

I am currently looking into RSA and have some questions. I am interested in theoretical answers, assuming there is infinite time for decryption. Is it necessary to work out the private-key exponent ...
120 views

### Why is Paillier Cryptosystem called probabilistic?

The definition of Paillier Cryptosystem says that it is a probabilistic asymmetric key algorithm for public key cryptography. Can some body explain why it is called "probabilistic"?
63 views

### Is that simple additive homomorphic scheme secure?

I am doing a little cryptography research and stuck with question. Suppose $\bar m$ is a vector of 64-bit numbers. And i want to have an additive homomorphic encryption over them. I choose large ...
75 views

### Transforming SHA-512 into SHA-512/256?

Based on my skimming over FIPS 180-4 it looks like the only difference between SHA-512 and SHA-512/256 is the initial hash value and the fact that the final output is truncated to 256 bits. My ...
2k views

### Signal vs Telegram in terms of protocols?

Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective ...
89 views

64 views

### Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
30 views

### What is the shortest fingerprint of a Curve25519 public key that is secure [duplicate]

My clients have to exchange public keys. To ensure security they are exchanging fingerprints and typing them into the computer by hands. I want the fingerprints to be as short as possible. I am ...
96 views

### Decisional Diffie-Hellman: compute Legendre symbol of $g^{ab}$ from $g^a$ and $g^b$?

From https://en.wikipedia.org/wiki/Decisional_Diffie%E2%80%93Hellman_assumption: Importantly, the DDH assumption does not hold in the multiplicative group $\mathbb {Z} _{p}^{*}$, where $p$ is ...
53 views

### Is (1 bit HW signal) XOR (8 bits PRNG output) sufficient for a HWRNG?

This is really a follow up question to a comment made regarding How to roll a HWRNG In the situation of whitening a hardware generated random bit stream, "XORing the two bitstreams should be fine ...
84 views

### What are the relative merits of padding algorithms pkcs7, iso7816, and x923?

I am assuming none of these padding algorithms are "the best"... But what are the advantages and disadvantages of using them? PKCS7 is certainly the most commonly used one, but I am interested in ...
60 views

### HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
72 views

### Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
68 views

### Can I store the initialisation vector (IV) in the filename?

I'm encrypting a file and I'm using an initialisation vector. Given that the IV doesn't need to be a secret, is it secure if I add it to the encrypted file's name?
383 views

### What do numbers in a crypto algorithm stand for? Is there a convention?

What do the numbers stand for in the names of cryptographic functions, for example AES-256, RSA-1024 or ...
55 views

### Clarification regarding multiple modular exponentiation

If the base is same and exponents are different, for example: $R_1=b^x\bmod{p}$; $R_2=b^y\bmod{p}$; $R_3=b^z\bmod{p}$; ($p$ is large prime (2048 bit); $x$, $y$ and $z$ - 160 bit integers)) To ...
121 views

### What is the difference between RCCA and CCA2?

Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2. What is the difference?
26 views

### Secure Multiparty Computation with Secret Output

Is there any MPC scheme that allows a function with several secret inputs to be computed, while the output can only become known to one specific party? If not, is this even possible?
117 views

### Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
103 views

### Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?

I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the ...
50 views

### Why SIVP Is Worst Case Problem?

I just started to study lattice cryptography. I'm now studying worst-case to average-case reduction for SIS. In previous question, "worst means any and average means random". And I wonder why ...
85 views

### What is the purpose of Pseudorandom Function Families (PRFs)?

I'm currently in a course in Cryptography, and was wondering why pseudorandom function families exist at all. If there existed one pseudorandom function f(x), based on its definition, could that not ...
59 views

### Symmetric encryption algorithms with large IVs and authentication?

Most modern symmetric ciphers require a nonce/IV. If the nonce is reused, security is lost. If the nonce is large enough, it can be generated securely by using a CSPRNG. This avoids needing to keep ...
120 views

### Combining a block cipher with a (pseudo) OTP

One of the drawbacks of OTP is that it can require an inconveniently long key. Besides that, it doesn’t provide data authentication. Therefore, I have been working on an algorithm idea, which I hope ...
70 views

### How can I study the math behind cryptography? [closed]

I am a junior in high school and I am currently studying algebra 2. Where can I go to learn about the mathematics behind cryptography? I have a very basic knowledge of cryptography, but I am really ...
103 views

### Would SHA-1 be safe for certificates with short validity?

There are articles floating around the topic of SHA-1 deprecation. The gist of it is that in (mostly) developing countries, people are still using mobile/computing devices that are 5 years old (or ...
228 views

### Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
67 views

Suppose a client (Alice) goes to an HTTPS website (Bob) over TLS 1.2. Alice sends Client Hello with some random number $r_a$. Bob sends Server Hello with another random number $r_b$. Suppose they ...
142 views

### AES-256 add round key how

Can anyone explain to me (or send a link to somewhere) how round keys are added in AES-256? I understand that the round keys is added to the state matrix for each round and how XOR works. But since ...
170 views

### Provable security of cryptographic hash functions

I am working on the following exercise question: Consider the following construction of a “keyed” hash function from Katz & Lindell (ex. 7.22 (1st ed.)/ 8.21(2nd ed.)). Gen : On input ...
98 views

### RSA and difference between factors

As I understand, for RSA $n = p \cdot q$. For the key to be safe enough from getting factored, $p$ and $q$ have to be far from each other. How far do they have to be? For example, if I have two ...
102 views

### Implementation of ECC over binary field

I am supposed to implement ECC over binary field (in C++) for equations of the type - $y^2 + xy = x^3 + ax + b$, as my project. I wish to include the following features : The user will enter a prime ...
47 views

### Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
111 views

### How “hard” it is to take an e'th root mod p?

I know it's hard to find the $e$th root of a number mod $n=p_1*p_2$, and if it would be possible we could break RSA. But how hard it is to take an $e$th root mod $p$ where $p$ is a prime and ...
173 views

### Given a pseudorandom function F, is $(F_k(r) \; | \; F_k(r + 1))$ also a PRF?

Given: F is a pseudorandom function, G is a pseudorandom generator with $l(n) = n+1$. The following schemes should be classified as being insecure, IND-COA secure, IND-CPA secure. To encrypt \$m \in ...
62 views

### Are there AES128 keys such that first round key equals last round key?

I am looking for AES128 keys such that the last round key is exactly the first round key (which is simply the key). Any pointer to a proof that they exist or that they don't would be welcome. In the ...