# All Questions

52 views

### What procedure to use to verify a raw public key (TLS ECDHE_EDCSA ciphersuite)?

Contrary of verifying a certificate which is a well-known procedure, I am wondering what the procedure is to verify a raw public key 'certificate' (https://tools.ietf.org/html/rfc7250). This ...
164 views

### How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
83 views

### have a question in the book “introduction to modern cryptography”

"introduction to modern cryptography. 2ed" in page 254 "By obtaining sufficiently many estimates and letting $x_{i}$ be the majority value, $A{'}$can ensure that $x_{i}$ is equal to $gl(x, e^{i})$ ...
69 views

### Hashing entropy with only 128 bits of internal state

I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher. As the key size is ...
56 views

### Most Secure Exchange of Keys [closed]

Given both Alice and Bob must exchange IP addresses to perform such an operation, what is the most secure way Alice and Bob can exchange public keys between two mobile devices without having to rely ...
124 views

### CBC-MAC just to verify integrity

I have a message and I want to verify its integrity and authenticity. I have a shared secret (key) that is not used for other encryption. Is it safe to send a plaintext message containing all the ...
70 views

### Where is Signaturevalue in Certificate?

Where is the Digital Signature value in my certificate? I can find Signature Algorithm and Signature Hash algorithm. Also why there are two fields specifying the Signature's Hash? With Signature ...
63 views

### Finding Galois LFSR and its initial configuration

Suppose recursion for output of Galois LFSR is $u_1=u_3=u_4=0$ What kind of taps are here, and initial state? How to uncover this information?
51 views

### Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...
72 views

### Use of the IV for the CBC Block Cipher in TLS1.2

I'm struggling to understand at what point a message is encrypted when looking at RFC 5246. The spec gives the generic block cipher in section 6.2.3.2 as: ...
211 views

### Why can ssh-keygen export a public key in PEM PKCS8 format?

In the documentation of ssh-keygen (man ssh-keygen) it says for the option -m that an export ...
125 views

### How much processing power should you assume an attacker has?

The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers Is that a single attacker ...
29 views

### TLS Cipher Suite definitions

Based off the various cipher suites available for TLS (which I am looking at here:https://www.thesprawl.org/research/tls-and-ssl-cipher-suites/), can anyone clarify if when the suite contains 'SHA', ...
269 views

### How to determine the order of an elliptic curve group from its parameters?

Let $\quad E:\; y^2 = x^3 + ax + b \quad$ be an elliptic curve defined over a finite field $\mathbb F_q$ where $q = p^n$, $a,b \in \mathbb F_q$ and $p \neq 2, 3$. By Hasse's theorem we know that the ...
59 views

### Test vectors for TLS PRF function

Does anyone know where I might be able to find test vectors for the PRF function in TLS? (either 1.0 or newer). I'm trying to implement a client and I am getting the BAD Record MAC return after ...
16 views

### Fibonacci LFSR, recovering previous bits

Suppose somewhere is Fibonacci LFSR, we know that it has 7 cells and feedback taps are cell 2 and 7. We intercepted part of a stream, and part intercepted is 1010101. Is it possible to recover ...
71 views

### Could eVoting on the bitcoin blockchain be done?

I'm basically a crypto noob (and not an english native), so please be indulgent :) I thought about if you could realize an eVoting system with bitcoin. I see 2 major requirements: each citizen ...
43 views

### pairing parameters in PBC library

I would like to know what are the pairing parameters of PBC library and what are they used for? Here an example where they are used. I noticed that we can give any file in the param subdirectory. Is ...
99 views

### Verify a RSA signature using only RSA encryption

I'm trying to verify a RSA signed message, however, the API that I have access to in that environment only has encrypt and decrypt. I think I understand that verification and encryption with public ...
79 views

### qkd - Does BB84 rely on a prearranged code?

First of all, sorry if the title is not that clear, I'll provide an in-depth explanation behind my question. So, basically I was reading about quantum cryptography and came across BB84. The protocol ...
53 views

### What are coding schemes for timing channels

I know we can hide information in the inter-packet delays, e.g. we can generate a code-book that each code-word corresponds to a message and is generated by realization of a specific random process. ...
123 views

### OpenSSL ECDH key exchange mechanism

I am using FIPS based OpenSSL module for encryption of sensitive data for my desktop socket server and client applications. I am using ECDH for key agreement.The keys public and private pair is ...
38 views

### Confusion regarding computing Multiplicative Inverse Modulo P?

May be a silly doubt, please rectify my confusion regarding below problem: For concreteness assume $g=2, p=11, a=6$ and $x=9$ $$A = g^a \bmod p = 2^6 \bmod 11 = 9$$ X = g^x \bmod p = 2^9 \bmod 11 ...
24 views

### Deriving message from signature (RSA) [duplicate]

Usually signatures are used for verification, and this requires that you pass both the message and the signature. I was wondering; if the message holds to a certain format (for example, valid json ...
758 views

### AES decryption vs encryption speed

Let's consider the CTR mode. For a faster encryption/decryption, is it preferable to use the decryption operation of AES, or its encryption ?
50 views

### Anonymous messaging using blind signatures

I want to implement a message relay server that knows nothing about who has sent a message but at the same time maintains a message quota per user. While searching for ways to do that on the internet ...
319 views

### What is the state of cryptographic obfuscation in 2015?

Cryptographic Obfuscation is a technique that allows one to obfuscate source code in a secure way (as opposed to insecurely mangling it into spaghetti code.) For example, here is a way to protect a ...
189 views

### Why Curve25519 for encryption but Ed25519 for signatures?

NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
128 views

### What is the impact of a server not fully verifying the data in the Client Finished packet of a TLS connection?

F5 BIG-IP devices suffer from a vulnerability in which not all bytes of the Finished packet in a TLS connection are validated. The sort-of technical description can be found here. F5 don't consider it ...
221 views

### Using a hash (like SHA-256) vs AES as the source for pseudo-random values in Feistel network?

This question is in relation to Wikipedia article on Format Preserving Encryption It says the following It is also possible to make a FPE algorithm using a Feistel network. A Feistel network ...
40 views

### Attribute Based Encryption [duplicate]

Could someone explain the main differences between Key Policy Attribute Based Encryption (KP-ABE) and Ciphertext Policy Attribute Based Encryption using an example? I know that KP-ABE depends on the ...
217 views

### POODLE attack on TLS 1.2

The POODLE attack uses the way block ciphers in CBC mode are decrypted in combination with the packet's padding to determine some byte's value. From what I understand, even TLS 1.1 can be vulnerable ...
32 views

### Hash-values's length in identification schemes

I am trying to understand the impact of applying a hash function in an identification scheme. It makes reference to the publication "On the length of cryptographic hash-values used in identification ...
155 views

### What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...
138 views

### How do I create a PKCS#7 or CMS SignedData in python? [closed]

There doesn't appear to be PKCS#7 or CMS support in pyCrypto. I'd appreciate a recommendation on a Python library wth CMS / PKCS#7 support. Ideally, there will be a call that will create return ...
150 views

### What are the roles of the simulator in simulation based proofs

I'm trying to better understand simulation based proofs in the UC model - but the guidelines to construct a simulator confuse me. To my understanding, the simulator is activated in two ways: ...
180 views

### Edwards / Montgomery ECC with Weierstrass Implementation?

So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required. But the problem is, ...
28 views

### Open source code about the basic Quisquater-Piret DFA of AES-128 [closed]

Where can i find open source code about the basic Quisquater-Piret DFA of AES-128? Are there any websites sharing the code about such physical attacks?
53 views

### Can a block cipher encrypt the message to itself (plaintext equal to ciphertext) [duplicate]

The result of the cipher should be indistinguishable from random, but can it happen that cipher produces the ciphertext that is equal to the plaintext as it also lies in the corresponding space? I ...
29 views

### In HMAC-MD5 Implementation, why “i_key_pad” and “o_key_pad” if They Are Public and Constant? [duplicate]

Please Consider: English is My Second Language This Wikipedia article on HMACs shows a part of a HMAC-MD5 implementation making use of i_key_pad and ...
87 views

### Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...
107 views

### How to break this PRNG encryption scheme? [closed]

Suppose we have the following symmetric algorithm: key = random bits G = PRNG(seed: key) input = [0,1,1,0,1,0,0,0, 0,1,1,0,1,0,0,1] // "hi" in ascii The key can ...
82 views

### Chosen plain text and chosen ciphertext definitions clarification

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that ...
214 views

### Using same modulus for RSA

I know that there exist some attack when using same modulus. Can two different pairs of RSA key have the same modulus? RSA cracking: The same message is sent to two different people problem But ...
142 views

### What are the required security properties for salts?

I was recently thinking about password hashing (maybe caused by the PHC progression). I started to think a little more about it and got stuck at this question: What security properties do ...
176 views

### Is it okay to include relative time for true random number generation?

Similar questions have been asked regarding use of time in true random number generation, but I'd like to consider using time as just one source of entropy, complementing others. True random number ...
39 views

### Given occasional LFSR samples can the next sample be computed?

Suppose I have access to an LFSR generator output used in a radio communications system, with the LFSR being used to authenticate devices. The system cycles an internal unknown length LFSR (greater ...
76 views

### How strong can multiple encryption be?

Suppose I encrypted a homophonic substitution cipher at the level of syllables, trigrams, digraphs, and individual letter with a Vigenere cipher using the keyword cryptography. I would then encrypt ...