# All Questions

1answer
6k views

### No SHA-1 collision? Yet SHA-1 is broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no than how can SHA-1 be considered broken?
3answers
2k views

### How practical are side-channel attacks and how much of a concern are they?

I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
3answers
1k views

### Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?

Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
2answers
4k views

### How does order-preserving encryption work?

Order-preserving encryption (OPE) is, apparently, a method of encrypting data so that it's possible to make efficient inequality comparisons on the encrypted items without decrypting them. I've been ...
2answers
440 views

### How to derive two keys from one password

What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
1answer
7k views

### Chinese Remainder Theorem and RSA

Wikipedia has a nice section regarding the speedup of the RSA decryption using the Chinese Remainder Theorem here. I need to understand the implementation of a similar speedup for the encryption ...
1answer
1k views

### The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
3answers
426 views

### Is it possible to match encrypted documents using user-defined search terms?

Suppose I am storing a number of encrypted documents in a database. I would like to make it possible to identify the subset of documents whose contents match user-specified search terms without a) ...
2answers
9k views

### How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
3answers
2k views

### How will Cryptography be changed by Quantum Computing?

I realise this isn't a 'yes or no' question, and I apologise for asking something that could be seen as a discussion thread, but I had to ask. I'm currently doing an EPQ in CS (specifically how QC ...
1answer
1k views

### Is a second preimage attack on MD5 feasible?

What's the practical status of MD5 w.r.t. second-preimage? Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
5answers
683 views

### How to prove the security of the PRNG?

Are there any realties tests or criterias that prove the security of the PRNG? What kind of tests or criteria?
3answers
1k views

### Using a Non-Random IV with modes other than CBC

The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ...
1answer
610 views

### Correct way to map random number to defined range?

Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX. What is the best way to map this random number to a ...
3answers
5k views

### Is it possible to derive the encryption method from encrypted text?

Is it possible to identify the encryption method, or at least rule out some of them, by looking at the encrypted text? For example, if you have 3 encrypted strings where the first 10 characters are ...
9answers
2k views

### Why not the one-time pad with pseudo-number generator

I am very new to cryptography (so be kind), but I have a question that may seem silly. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one ...
8answers
3k views

### RSA with small exponents?

Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
3answers
3k views

### Why hash or salt when signing? [duplicate]

I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV. Why is that needed?
3answers
779 views

### Converting a stream cipher into a block cipher

The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
3answers
18k views

### Possible ways to crack simple substitution ciphers

We had a quiz in class today where we had to break the ciphertext with the key given, but not the algorithm. Suffice to say that I wasn't able to decrypt it within the alloted time of 12 mins and will ...
1answer
389 views

### how to use common modulus attack?

I am struck with the following problem: Let Alice, Bob, Chris and Eve communicate over a public network. They encrypt all messages they send using RSA system. Bob and Chris have the RSA modulus ...
2answers
294 views

In RSA, the $p$ and $q$ should be randomly generated, and they are the same size. The difference between $p$ and $q$ should not be small. Suppose that $u=|p-q|<20$ and $p \times q ... 2answers 395 views ### Can I use HMAC-SHA1 in counter mode to make a stream cipher? Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ... 2answers 950 views ### Can I select a large random prime using this procedure? Say I want a random 1024-bit prime$p$. The obviously-correct way to do this is select a random 1024-bit number and test its primality with the usual well-known tests. But suppose instead that I do ... 3answers 377 views ### Building a hard to factor number without knowing its factorization It is possible to find an efficient algorithm for constructing a provably hard to factor number$N$, together with a witness that shows that it is indeed hard to factor. EDIT, since it was not clear: ... 4answers 9k views ### Why is padding used for RSA encryption given that it is not a block cipher? In AES we use some padded bytes at end of message to fit 128/256 byte blocks. But as RSA is not a block cipher why is padding used? Can the message size be any byte length (is the encrypting agent ... 3answers 1k views ### Is RSA padding needed for single recipient, one-time, unique random message? I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ... 3answers 1k views ### Would the ability to efficiently find Discrete Logs have any impact on the security of RSA? This answer makes the claim that the Discrete Log problem and RSA are independent from a security perspective. RSA labs makes a similar statement: The discrete logarithm problem bears the same ... 1answer 1k views ### Can Elgamal be made additively homomorphic and how could it be used for E-voting? Elgamal is a cryptosystem that is homomorphic over multiplication. How can I convert it to an additive homomorphic cryptosystem? How can I use this additive homomorphic Elgamal cryptosystem for ... 1answer 354 views ### Mixing Entropy Sources by XOR? Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG). Can I mix them ... 2answers 247 views ### Algorithm Design for only Mutual Information Sharing Bob and Alice each have a bit string they want to keep private. They each want to know what the bitwise AND of their two strings would be without telling the other or anyone else listening to their ... 4answers 969 views ### Why are RSA key sizes almost always a power of two? I know that other bit sizes are possible, e.g. this HTTPS server seems to have a 9000 bit key https://www.ssllabs.com/ssltest/analyze.html?d=qqq.gg, but it's very rare that one sees a key not of size ... 2answers 670 views ### Hill cipher, unknown letter value I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix$K$of size$n\times n$, one ... 5answers 1k views ### Approach towards anonymous e-voting I want to implement an internet-based e-voting system. Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy ... 1answer 848 views ### Hill cipher cryptanalysis - known plaintext known key size Hello I want to know how to go about this problem I know the plaintext "abcdef" and the ciphertext. The key size is 2. I really can't figure out how to find the key for decrypting and encrypting. 2answers 495 views ### Certificateless cryptography While reading "Certificateless Public Key Cryptography" by Author Sattam S. Al-Riyami and Kenneth G. Paterson, they have considered generation of private keys by a Key Generation Center (KGC). If the ... 1answer 247 views ### Proof of correctness of a homomorphic ElGamal sum Let's suppose we are using the exponential ElGamal as a public-key encryption scheme, so that we encrypt$g^m$instead of$m$, for some generator$g$. Let$x$be the private key, and$h=g^x$be the ... 1answer 362 views ### What does the expression$1^n$mean as a function argument? In a paper about predicate encryption or attribute based encryption, the setup function is mentioned with the$setup(1^n)$or$setup(1^l)$. I want to know what is meant here. Is it multiples of ones ... 2answers 263 views ### Attacks against El Gamal private key El Gamal encryption involves picking$(p,g,b)$which is our public key. We compute$b=a^xmodp$. Here,$x$is the private key which we don't know. What are some efficient and strong algorithms ... 1answer 229 views ### Does CBC encryption of a hash provide authenticity? Given a message$M$and a cryptographic hash function$H$, let$f(M) = E_K(M || H(M))$where$E_K$is AES-128-CBC encryption with PKCS#5 padding. Take$H = \textrm{SHA-256}$if it matters. In other ... 2answers 150 views ### Factors of RSA modulus In the article A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ... 1answer 328 views ### DES with the bitwise complement of a key I was reading upon Biham and Shamir's paper and a fact has been presented over there: if$ P_1 = \bar P_2$and I choose a key$K_1 = \bar K_2$then in that case $$T_1 = DES(P_1, K_1)$$$$T_2 = ... 3answers 24k views ### Should we trust the NIST-recommended ECC parameters? Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ... 3answers 15k views ### How should I calculate the entropy of a password? If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ... 5answers 9k views ### Is Convergent Encryption really secure? Recently a company called Bitcasa demonstrated a product of cloud storage. they indicated that they would use "Convergent Encryption" to secure your data and de-duplicate, essentially one copy of the ... 4answers 14k views ### Can you help me understand what a cryptographic “salt” is? I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can anyone offer me a ... 1answer 3k views ### Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1? I am from a web development background (I don't know an awful lot about cryptography or how the algorithms themselves work), so I am asking this question in simple terms. Consider a hash of the word ... 3answers 3k views ### How are primes generated for RSA? As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. ... 1answer 16k views ### What is the difference between PKCS#5 padding and PKCS#7 padding One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ... 1answer 745 views ### Mapping points between elliptic curves and the integers My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to$\mathbb{Z}^*_q$where$q\$ is the ...

15 30 50 per page