# All Questions

65 views

### A bijective hash function

Suppose: $H: \{0,1\}^{n} \rightarrow \{0,1\}^{n}$. $H$ is bijective. It is difficult to derive $x$ from $H(x)$. Is this type of function possible? What would the strength of it be? I realize that ...
76 views

### Reducing the probability that a password will be guessed

In a file users' password hashes are stored. There are 2 approaches to reduce the probability that the password is guessed. Increase the size of the salt from 12 bits to 24 bits. Increase the length ...
32 views

### Encryption strength when using a PBKDF

Suppose: $m$ is a positive integer. $n=2 \times m$. $H: \{0,1\}^{*} \rightarrow \{0,1\}^n$. $p$ is a password. $s$ is a salt. $K=\{0,1\}^n$ is the derived key. $PBKDF(p,s)$ derives a key from $p$ ...
62 views

### Does XChaCha20 exist with similar properties to XSalsa20?

Does XChaCha20 (built from ChaCha20 just like XSalsa20 is built from Salsa20) exist and have XSalsa20's desirable properties?
83 views

### How to prove hardness of approximate-GCD problem?

I am trying to prove the security of my system using the hardness assumption of the approximate-GCD problem using contradiction, i.e. If the attacker is able to break in our scheme, then attacker ...
59 views

### Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
70 views

### Format Preserving Encryption FF1 Samples

NIST published methods for Format-Preserving Encryption and there is a link in the document giving examples for FF1 methods. I am confused by the value of R given in the examples. $R$ is the output ...
173 views

### Is there a way to create an encrypted email with no third party application

I would like to send and receive emails between group of people. Is there a way to create it with no need to use some other 3rd party application. Is there a way just to transfer files between 2 ...
76 views

### How to use AES-CBC to password-encrypt a small block of stored data

I have a small block of data (16 bytes) that I am required to encrypt, store (in an unsecure, visible location). Later I have to retrieve and decrypt it. I must use AES-CBC and a user-entered ...
1k views

### Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
324 views

### Security of a simple AEAD construction

Introduction I want securely communicate with a small 8-bit device which has a very limited program program memory (Arduino Uno - 32K). My goal is to minimize code size and RAM usage. There are ...
286 views

### How does Microsoft's BitLocker Recovery Code work?

I don't trust Microsoft BitLocker because it is closed source, which makes it so people can't audit it. But now I'm really interested in how its recovery code works. In my own knowledge, encrypted ...
128 views

### Time taken for a brute force attack on a key size of 64-bits

You can do $2^{30}$ encryptions per second and the key size is 64 bits. $2^{64}/2^{30}$ should give me the time taken for a brute force attack? What if you double the key size? How can I calculate ...
94 views

### Beavers Triple Vs BGW Multiplication on MPC

Typically MPC protocols that are secure against semi-honest adversaries recommend the use of the revised GMW multiplication protocol by Gennaro et al. This is not the case against Active adversaries ...
58 views

### AES encryption time difference for same data [duplicate]

When encrypting same data with AES, encryption time for the first encryption is longer than the second one. In the same program, I have written encrypt() function ...
71 views

### Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
115 views

### Top notation as exponent

In cryptography, what does the Top notation mean? It resembles a capital T: T In particular, I saw it in the follwing context: $c = (c_1,c_2)^\top$ where $c_1$ and $c_2$ are homomorphic ciphertexts
80 views

### What is necessary for generating an elliptic curve?

Let's say I want to generate my own elliptic curve with an order whose bit length is $n$ (specifically 2048, 4096, and/or 8192)? How would I do this? What needs to be done? What software can do this? ...
44 views

### Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

I've been hearing a lot of scare talk about PKCS1 padding attacks. Is PKCS1 v1.5 safe in signatures as it is practically transporting only message digest? I'm using it in one of my applications so i'...
12 views

### Do eCryptfs encrypt same source files into same retulsing encrypted files?

Can I assume that for given eCryptfs mount, files with byte-by-byte same content will map into byte-by-byte same encrypted files in underlying filesystem (i.e. after umount) ? (i.e. if resulting ...
546 views

### How to reverse this hash function?

I have a function that takes an $m$ byte inputs $x_i$ and maps it a 32 byte outputs $y_j$. The hash function is defined as: $$y_j = \sum_{i=1}^{m} (x_i)^{i-1} \pmod {127}$$ The input is restricted ...
29 views

### WPA-PSK authentication without password [closed]

Suppose I have a service in which I allow users to share their WiFi connection. When sharing their connection, users provide their WPA PSK password to my service. Now if somebody wants to use this ...
101 views

### Confusion about definition of homomorphic encryption

I am trying to better understand homomorphic encryption, but I feel like I keep getting inconsistent information in the papers that I am reading. One of the papers I am reading says the following: ...
57 views

### How does Hash with random cryptography work?

I am new in this world of cryptography and while reading some articles I got stuck into something that I did not understand correctly: the use of hash based on random cryptography. On my knowledge, ...
735 views

### Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties?

Consider the situation of a nation state (Blue) at war with another nation state (Red). Blue wants to deploy a secure cipher that blue currently can not break, but they are considered that Red could ...
64 views

### Majority encryption algorithm?

Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense: For some fixed $k < n$ every sub-...
82 views

### Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
120 views

### Understanding Hash function notations

I am implementing a Certificateless Cryptography Algorithm by referencing the paper An Efficient Certificateless Encryption for Secure Data Sharing in Public Clouds. In this paper on page no. 4 during ...
60 views

### Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
106 views

### What is the strength and attack vectors of this simple scheme?

Let's say that Alice wants to communicate some secret value $S$ to Bob through a public channel in a way that other people don't know what the value was. To do this, Alice publishes that secret value ...
87 views

### Why is 128-bit considered “medium term” security?

Why is 128-bit encryption considered good enough for medium term security only? How is expected to be eventually broken? Quantum computing or brute force attack?
367 views

### Does salt size affect password hash security?

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ...
27 views

### Weaknesses of RSA for $e_A\neq e_B: \gcd(e_A,e_B)=1$ [duplicate]

If two people, A and B, are using a common RSA modulus N, and they select distinct exponents $e_A$ and $e_B$, such that they are coprime, why does this mean that someone can decrypt (in polynomial ...
32 views

### Increase in security with increase in size of salt [duplicate]

Does increasing or doubling the size of salt result in improved security? It will require some extra time to brute force the passwords, but any added advantage?
100 views

### ElGamal - What if the Decisional Diffie-Hellmann problem could be solved?

I have read that if the DDH problem could be efficiently solved, the IND-CPA would not hold for ElGamal. I don't see why it makes ElGamal less secure if you have $g^a$, $g^b$ and $g^c$
72 views

### Inverting RSA using an oracle

Say you are given an efficient deterministic algorithm 'I' that can invert the RSA function on 1% of the points in $Z^*_{N}$. That is to say that if y $\in$ $Z^*_{N}$ is a "good" point for 'I', then ...
43 views

42 views

### Calculating characters from the sum of ASCII pairs

I have a series of messages (limited to only a-z and A-Z) that are encoded such that the sum is taken of every two ASCII values and concatenated. For instance, the message ...