# All Questions

1answer
102 views

### Convert m-Sequence into a de Bruijn Sequence

In his paper Alternating Step Generator Controlled by de Bruijn Sequence, C.G. Günther states on page three that a de Bruijn sequence (..) can easily be obtained from an m-sequence (maximal length ...
1answer
41 views

### What's wrong with this “order-preserving MAC” function?

Please note: this is purely a thought experiment and not intended for any real-world usage! I came up with a simple function $\mathrm{OPF}$ to map the integers $[0,C)$ (where $C$ is the "ChunkSize") ...
1answer
87 views

### What benefit is there to using AES over my custom cipher for secure storage? [closed]

A lot is written about the security of AES but who needs such a high level of security and what kinds of messages are they enciphering? In these real-life situations, how are users managing the ...
0answers
2k views

### How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work? [migrated]

I've been hearing more about the OpenSSL Heartbleed attack, which exploits some flaw in the heartbeat step of TLS. If you haven't heard of it, it allows people to: Steal OpenSSL private keys Steal ...
0answers
52 views

### Is this base64 encoding ? Help with decoding [closed]

I am looking at some data and it looks very much like base64 encoding. It has been suggested to me that this may be base64 encoding and then mathematical shifting. I tried decoding using an online ...
1answer
50 views

### Multi cipher CTR

What is your opinion on this scheme: 1)get IV from CSPRNG 2)set 3 encryption keys k1,k2,k3 (3*key_lenght) (KDF/PBKDF) 3)Use 3 ciphers in CTR mode like this: The initial IV is encrypted using ...
0answers
42 views

### Is Chaocipher a secure cipher under ciphertext-only attack?

Chaocipher was invented by John F. Byrne in 1919. The algorithm was recently revealed -- see Moshe Rubin's Chaocipher Revealed, the Algorithm While a known plaintext attack successfully finds the ...
2answers
215 views

### Is it possible to create a “proof-of-upload” system for BitTorrent ratio tracking?

One issue that private BitTorrent trackers that track users' share ratios often run into is how to keep track of people who are screwing with their upload statistics, something known as ...
0answers
40 views

### Is there a malleable pubkey digital signature scheme?

I'm trying to find a special kind of Digital Signature Scheme. The scheme should allow me to transform a signature s=sign(sk,m) (for a private key sk and a message m) into a signature s'=sign(x,m) ...
2answers
123 views

### Randomness test question from FIPS 140-1 and comparison with 140-2

In FIPS 140-1 there are 4 statistical random number generator tests (The Monobit Test, The Poker Test, The Runs Test and The Long Runs Test. Then FIPS 140-2 came along and supposedly tightened the ...
1answer
155 views

### Secure AES Key Generation via Salsa20?

I am not creating my own cryptography or anything, but to learn about the Dos and Donts of cryptography, I am looking into AES encryption and ways to generate keys for that. As far as I've ...
1answer
55 views

### Compression step of PGP

We do compression in PGP. Does this step increase/decrease or either have any effect regarding the authentication of a message?
1answer
42 views

### multiparty computation using homomorphic encryption [closed]

I am aware that there is a multiparty computation scheme using somewhat homomorphic encryption . What are the problems in the proposed scheme?
1answer
93 views

### Can I use Shamir's secret sharing scheme for multiplicative homomorphism for secure multiparty computation?

I would like to perform a dot product operation among $m$ parties using Shamir's $(m,m)$ secret sharing that is used for Secure Multiparty Computation. I am aware that Shamir's $(m,m)$ scheme is ...
2answers
112 views

### How could Fully Homomorphic Encryption support power operations?

Fully Homomorphic Encryption (FHE) enables arbitrary functions computed on encrypted data, because it supports both addition and multiplication. But I wonder if FHE supports power operations. For ...
4answers
139 views

### What is the difference between authenticate a document and sign a document?

Is it a kind of same? Authenticate means it is from sender. Also sign is done by the sender. Can someone please give a clear view about their relationship?
1answer
85 views

### Is it possible to determine or estimate the period for Blum-Micali PRG?

The Blum-Micali is a cryptographically secure pseudorandom number generator. The construction (from wikipedia): Let $p$ be an odd prime, and let $g$ be a primitive root modulo $p$. Let $x_0$ be a ...
1answer
98 views

### SHA-256 Partial Collision of initial 36 bits and more

I was lucky enough to, by brute force, have found two different messages, whose SHA-256 hashes collide in the first 9 hexadecimal characters, which are 36 bits, ...
1answer
84 views

### What's the difference between RSA, ECDSA & Merkle signatures [closed]

My question is rather self-explanatory. I would like to know more about the differences between these three algorithms, and their relative advantages and disadvantages. What kind of simulators should ...
2answers
136 views

0answers
59 views

### How to compare different signature scheme's performance?

I am interested in comparing the computational performance of two signature schemes. However, I am unsure how to do that. My candidates are RSA and Shamir's ID Based Signature scheme. To get a fair ...
0answers
58 views

### Homomorphic Encryption - Smart Vercauteren Batching

I'm going through Smart and Vercauteren's paper "Fully Homomorphic SIMD operations" and had a question about some notation used in the paper. In section 2 of the above it is stated that for each ...
0answers
46 views

### Adequate DH secret size [duplicate]

What's the adequate secret size for Diffie-Hellman when using a 2048 bits safe prime as modp value? KeyLength.com recommends 224 bit but I don't understand a thing: if the security is "bounded" by the ...
1answer
80 views

### Side-channel attacks against ECDH for Weierstrass normal form curves

I hear a lot about why Montgomery curves are used in ECC, and one reason is that the same algorithm can be used to do both point addition and doubling (this is not true for the Weierstrass normal ...
0answers
51 views

### Definition of a Statistical Test

In Professor Boneh's online Cryptography course at Coursera, I am a little puzzled by his definition of a statistical test where he writes: A(x) = iff |#0(x) - #1(x)| <= 10.√n Now, if – as ...
2answers
91 views

### Wrong Test Vector for HKDF with HMAC-SHA256 [closed]

I have implemented HKDF by myself and it seems to work good. I managed to replicate all the test vectors listed here but... except this one: ...
1answer
123 views

### How to obtain a one-value share in Shamir's secret sharing

This is a trivial question, but I had to ask: since each generated share in a Shamir's secret sharing scheme initially consists of a pair of values (representing the coordinates of a point on the ...
1answer
2k views

### How can I convert a DER ECDSA signature to ASN.1?

I having trouble verifying an ECDSA signature signed using client side javascript with Java/BouncyCastle. The javascript signing function source: ...
2answers
700 views

### Random oracle model proofs and programmability

Proving the security of a scheme with the random oracle model (ROM) involves two steps: first you prove that the scheme is secure in an idealized world where a random oracle exists, and then you ...
0answers
26 views

### Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
0answers
44 views

### Is timestamping possible without publishing?

The Wikipedia article Trusted Timestamping states that we can timestamp data by publishing it's hash. Publishing can be done either independently or via a third-party publisher, as explained by ...
1answer
54 views

### encrypting data signals using the time variations between two independent coupling functions [closed]

There was a recent article about a new encryption technique that encrypts "using the time variations between two independent coupling functions". What is this technique they are referring to?
1answer
44 views

### Prefixing data before encryption for passphrase confirmation?

I'm encrypting data with AES, using CryptoJS. CryptoJS returns an empty string in case the data couldn't be encrypted with the given passphrase. I'm not sure if this is intended, or happens in all ...
6answers
14k views

### Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
0answers
77 views

### For a one-time pad, which MAC method is information-theoretically secure?

In the the main post about MAC methods it mentions a few methods: Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
2answers
202 views

### Can anyone give an example where (asymmetric) crypto can go wrong due to selection of wrong groups?

Basically the title says it all. It would be great if someone could tell give an example using provable security. More information about groups can be found at: ...
1answer
72 views

### What are alternatives to number theory based crypto? [closed]

Quantum crypto,lattice based crypto, Neurocryptography and cellular automata based cryptography are alternatives to number theory based crypto. I need to know what are the other hard problems like ...
3answers
144 views

### The meaning of “scheme”

This question is a bit different from other questions here, but I think it is suitable to correctly understand the terminology of cryptography. Consider the following two sets of terms: Encryption ...
0answers
67 views

### Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
0answers
68 views

### Use cases for “online” authenticated encryption?

What is the the point of an "online" mode for an authenticated cipher? I understand what "online" means in this context. However, I have trouble coming up with applications that would benefit from ...
2answers
232 views

### Elliptic Curves of different forms

Looking at http://safecurves.cr.yp.to/ to find a safe curve, I find that most curves described here are of a different form from that generally used. In Bouncy Caslte, for example, ...
1answer
154 views

### Insecurity in Needham and Schroeder protocol?

I've been studying specifically the authentication algorithm Needham and Shroeder, and understand the idea in general of the message exchange. But, researching on the subject, I found a question that ...
1answer
137 views

### Why is “multiplying” $g^x$ and $g^y$ not possible?

The computational Diffie-Hellman problem states that for a cyclic group $G$ of order $p$ and a generator $g$, it is hard to find the value $g^{xy}$ given only $g^x$ and $g^y$ (but easy if either $x$ ...
2answers
116 views

### Is that possible to use encryption higher than 256-bit?

When browsing websites with Chrome sometimes I can see a green lock and encryption info inside. It says the connection with this website is 128-bit or 256-bit encrypted with TLS1.2. So I'm wondering ...
2answers
213 views

### How do I create a short signature? (e.g. less than 100 bytes)

I want to put information into a QR code and have it signed so that the authenticity of the information can be verified. But QR codes have limited storage capacity and when I used e.g. gpg I get ...
1answer
99 views

### Thoughts on secure hashing and the “mds” algorithm

Almost a decade ago Raymond Chen blogged [1] about the "hash reset attack" cautioning developers to record the content length in addition to the message digest. Recently I came up with a variation on ...
1answer
97 views

### HMAC-SHA1 vs HMAC-SHA256

I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough ...
3answers
167 views

### A specific way for deniable encryption

I read the summary of deniable encryption on wikipedia: https://en.wikipedia.org/wiki/Deniable_encryption Then I read a question, by doom123 on security.SE: ...

15 30 50 per page