# All Questions

5k views

### Is HMAC-MD5 considered secure for authenticating encrypted data?

I've read something to the effect that the HMAC construct is able to lessen the problem of collisions in the underlying hash. Does that mean that something like HMAC-MD5 still might be considered ...
I was reading upon Biham and Shamir's paper and a fact has been presented over there: if $P_1 = \bar P_2$ and I choose a key $K_1 = \bar K_2$ then in that case $$T_1 = DES(P_1, K_1)$$ $$T_2 = ... 2answers 616 views ### Can I use HMAC-SHA1 in counter mode to make a stream cipher? Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ... 2answers 4k views ### Strength of multiple hash iterations? Is it correct that increasing the iteration possibly decreases the cipher strength but increases the amount of time it would take to find the original hash values if using brute-force on a given hash? ... 2answers 1k views ### Why is h(m||k) insecure? Here is the post that explains the failure for doing h(k||m) and I understand it. But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain? 5answers 2k views ### Software implementation of a commutative cipher? I've got an application (detailed below) that calls for the use of a cipher that is commutative. I've been doing some googling & reading, and there are two algorithms that seem to get mentioned ... 1answer 820 views ### PRF and hash functions Is there a difference between PRF and a hash function? For example: Creation of a secret key is using PRF and creating a secret key is using hash function. 2answers 3k views ### AES Key Length vs Block Length This answer points out that certain key and block lengths were a requirement for the AES submissions: The candidate algorithm shall be capable of supporting key-block combinations with sizes of ... 3answers 1k views ### A simple block cipher based on the SHA-256 hash function [duplicate] I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ... 2answers 2k views ### Is RSA in a ECB-like-mode safe for bulk encryption? Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA. (Note: I do realize that in practice this is done through an intermediate symmetric key, but ... 4answers 57k views ### Why is elliptic curve cryptography not widely used, compared to RSA? I recently ran across elliptic curve crypto-systems: An Introduction to the Theory of Elliptic Curves (Brown University) Elliptic Curve Cryptography (Wikipedia) Performance analysis of identity ... 4answers 34k views ### How can I generate large prime numbers for RSA? What is the currently industry-standard algorithm used to generate large prime numbers to be used in RSA encryption? I'm aware that I can find any number of articles on the Internet that explain how ... 5answers 19k views ### Is AES-256 weaker than 192 and 128 bit versions? From a paper via Schneier on Security's Another AES Attack (emphasis mine): In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ... 1answer 5k views ### Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1? I am from a web development background (I don't know an awful lot about cryptography or how the algorithms themselves work), so I am asking this question in simple terms. Consider a hash of the word ... 5answers 6k views ### Galois fields in cryptography I don't really understand Galois fields, but I've noticed they're used a lot in crypto. I tried to read into them, but quickly got lost in the mess of heiroglyphs and alien terms. I understand they're ... 4answers 5k views ### Why is it important that phi(n) is kept a secret, in RSA? Why is it important that \phi(n) is kept a secret, in RSA? 3answers 8k views ### What are the benefits of the two permutation tables in DES? Why do we use a permutation table in the first step of DES algorithm and one at the end of the algorithm? 3answers 11k views ### Why shouldn't I use ECB encryption? I'm using Java to generate encrypted strings, and I get this warning at build time: ECB encryption mode should not be used So I'm wondering why I shouldn't use ECB and what I can use instead? 1answer 1k views ### Why choose an authenticated encryption mode instead of a separate MAC? What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ... 2answers 2k views ### Deriving Keys for Symmetric Encryption and Authentication So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ... 3answers 2k views ### Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize? Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ... 2answers 560 views ### How to derive two keys from one password What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this? 2answers 14k views ### How can Cipher Block Chaining (CBC) in SSL be attacked? I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ... 1answer 4k views ### The difference between these 4 breaking Cipher techniques? I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ... 2answers 4k views ### Is TrueCrypt's multiple/cascading encryption safe? Is TrueCrypt use of cascading encryption safe? Is it useful? TrueCrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very ... 2answers 4k views ### Why is CBC with predictable IV considered insecure against CPA I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that is uses, the attacker can ... 4answers 4k views ### Is it possible to validate a Public Key in RSA? If I have a 1024-bit number, and someone is telling me that it is in fact a valid RSA public key, is there any way I can quickly validate that it is indeed so (without cracking RSA)? (I suppose I am ... 1answer 3k views ### What is a tweakable block cipher? Pretty simple question - but I can't seem to find much information about it. What exactly is a tweakable block cipher? How do they differ from traditional block ciphers? What is the 'tweak'? Is it ... 2answers 6k views ### Why is asymmetric cryptography bad for huge data? I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length. Why is this? I know about hybrid encryption, which uses symmetric encryption to ... 4answers 15k views ### Why is padding used for RSA encryption given that it is not a block cipher? In AES we use some padded bytes at end of message to fit 128/256 byte blocks. But as RSA is not a block cipher why is padding used? Can the message size be any byte length (is the encrypting agent ... 2answers 541 views ### Why does key generation take an input 1^k, and how do I represent it in practice? In my lecture, the lecturer said: Let K be the key generation algorithm. Given a security parameter represented in unary, 1^k, K(1^k) will output a keypair (pk; sk), known as the public ... 3answers 2k views ### Desirable S-box properties What desirable properties should an S-box have? My current standard selection process is to just pick them at random and verify that they fit the following criteria: The probability that any random ... 2answers 1k views ### Are there any practical implementation of a homomorphic hashing or signature scheme? A homomorphic hash function is a function H : A \to B between two sets with some algebraic structure (A, *) and (B, \star) such that H is collision resistant, i.e. it is hard to find x \neq ... 2answers 1k views ### Can a computationally unbounded adversary break any public-key encryption scheme? Assume there is a public-key encryption scheme (KeyGen, Enc, Dec) with perfect correctness (i.e., for all messages M and valid key-pairs (PK,SK), we have Dec_{SK}(Enc_{PK}(M))=M). Will there ... 2answers 1k views ### Why does Shamir's Secret Sharing Scheme need a finite field? I read ampersand's question "Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme", where he asked why Shamir's Secret Sharing Scheme uses arithmetic in a ... 3answers 1k views ### Converting a stream cipher into a block cipher The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ... 3answers 3k views ### How to attack a classical cipher using known partial plaintext? I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext. What are the cryptanalysis approaches for ... 3answers 1k views ### Theoretical pi-based stream cipher Let's pretend that all digits of pi are known and arbitrarily long sequences of digits are trivial to get. Further, some mathematician proves that there are no patterns in pi. We could create a stream ... 2answers 733 views ### Is RSA encryption of a cryptographic hash with a private key the same as signature generation? It is often said that RSA encryption with a private key is the same as signing (signature generation). Will RSA encryption with a private key over a cryptographic hash give the same result as ... 1answer 1k views ### Why doesn't preimage resistance imply the second preimage resistance? Let the preimage resistance be defined as »given a hash value h, it is hard to find any message m such that \operatorname{hash}(m)=h«, and let the second preimage resistance be defined as »given ... 1answer 882 views ### Why can ECC key sizes be smaller than RSA keys for similar security? I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ... 2answers 1k views ### DES — Can I recover the key when I have both ciphertext and the plaintext? Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data? 2answers 2k views ### Why can't the IV be predictable when its said it doesn't need to be a secret? I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should ... 1answer 3k views ### Why must IV/key-pairs not be reused in CTR mode? Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation ... 1answer 396 views ### Is knowing the private key of RSA equivalent to the factorization of N? Given the RSA modulus N the fastest method to factor it is of sub-exponent order. But, now if I know the private key d of RSA, does that mean I can factor N efficiently?. It intuitively seems ... 2answers 814 views ### Is there a length-preserving encryption scheme? Is there a length-preserving encryption scheme, that preserves the lengths of input sizes such that the length of the input plain text is same as length of the output cipher text ? 2answers 279 views ### Algorithm Design for only Mutual Information Sharing Bob and Alice each have a bit string they want to keep private. They each want to know what the bitwise AND of their two strings would be without telling the other or anyone else listening to their ... 1answer 5k views ### RSA cracking: The same message is sent to two different people problem Suppose we have two people: Smith and Jones. Smith public key is e=9, n=179 and Jones public key is e=13, n=179. Bob sends to ... 1answer 3k views ### Why is Triple DES not vulnerable to meet in the middle attacks? Consider the Triple DES encryption calculated as:$$C= E_{K_1}(D_{K_2}(E_{K_1}(P))). For a chosen plaintext attack, given plaintext $P$, we compute the result of $D_{K_2}(E_{K_1}(P))$ and store ...
I'm going to encrypt the characters Zhu, and decrypt them using RSA. I'm using the public key $\{e, n\}$ and private key $\{d, n\}$. The values of $e$, $d$ and $p$ ...