# All Questions

133 views

### Why can't NORX produce intermediate auth tags like Keyak can?

Why can't NORX produce intermediate auth tags like Keyak can? Keyak appears quite attractive because of this, but seems to be slow in the absence of hardware acceleration.
70 views

### Is ChaCha12 considered 256-bit secure?

ChaCha20 is considered 256-bit secure (no attack faster than brute force). However, the best known cryptanalysis that I know of is on ChaCha7. That gives ChaCha20 a rather large security margin (...
370 views

### Is authenticated encryption unnecessary if the message is digitally signed?

Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?
30 views

### NIST SP800-108 KDF modes comparison

According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used,...
57 views

### Difference between HMAC-SHA1(key, msg) vs SHA1(key + msg) [duplicate]

Is there any practical difference from using HMAC-SHA1(key, msg) vs SHA1(key + msg) as a way to verify the authenticity/...
287 views

### Is it possible to decrypt cryptowall-encrypted files? [duplicate]

I am writing regarding a certain ransomware program called cryptowall (prop 4.0). I have lost many documents to this, and as it so happens, I have a few file duplicates before and after they were ...
28 views

### Generally accepted algorithm for two-pass, misuse-resistant AEAD that is efficient in software

I would like to know what the standard is for two-pass, nonce-misuse-resistant AEAD that is efficient in software. Thus, AES-SIV is excluded; modes based on a stream cipher like ChaCha20 are ...
74 views

### Is the identity function a one-way function?

The definition of the one way function says: it must be verifiable in polynomial time probability of inverting it less or equal to negligible Now, I am not sure I fully understand one way ...
50 views

### How to convert roots of Weber polynomial to Hilbert class polynomial over modulo prime?

Using any non square root discriminant $D$, we should be able to find the Weber class polynomial. How can I convert the roots of a Weber polynomial to a Hilbert class polynomial over modulo prime?
3k views

### Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
82 views

### Secure entropy extractor for thermal noise collected from camera input?

I have read this paper (pdf) which talks about measuring the entropy of thermal noise collected from camera input. They estimate the minimum entropy at about 4 bits per pixel. Probably estimating 1 ...
116 views

### DIY over-encryption with a related key

I know next to nothing about cryptography, which is bad because I'm a programmer. I was exploring some code the other day and the encryption part of it seemed a little strange to me. I'd like the name/...
34 views

### Explanation of protocol secure under random oracle but insecure with any hash fuction

It is known that there is a protocol that is secure in the random oracle model, but where any real hash function makes the protocol insecure. The proof is constructive, but I could not understand the ...
79 views

### Misuse-resistant authenticated encryption based on SHA-3/Blake2b and AES-CTR/ChaCha20

I am wondering if the following is a useful misuse-resistant authenticated encryption scheme: Parameters (shared by many users): Choose a hash function $H$, such as Blake2 or Keccak. SHA2 could ...
117 views

### Example of a PRP that is not a strong PRP

The exact definition of security for a pseudorandom permutation is straightforward - for some encryption scheme $E\,\colon\,\mathcal{K}\times\mathcal{D}\rightarrow\mathcal{D}$, it must be the case ...
40 views

### Considerations on using a single long-term key for file encryption

I'm thinking about designing my own container file format that allows me to store a file in it along with, say, a thumbnail or other metadata. Some of these files are confidential and therefore must ...
33 views

### Can I get an explanation of HDCP's key exchange protocol?

I'm talking about HDCP v1.x. The specification is a too dense for me and easy-to-understand information about it on the net is scarce. What I've gathered is: that there is a master key that is a 40-...
123 views

42 views

### Terminology for secret sharing

To my understanding, there are two "approaches" to t out of n threshold encryption. In both of them, n shares are given to different shareholders, and at least t of them must agree to "proceed". "...
19 views

### What will browser show when a user access website and website present certificate of some other domain with same top level domain [closed]

For example, User tries to access a.example.com and server presents abc.example.com with a.example.com not in SANs list. Will it be just a warning or an error?
50 views

### Usage of 3DES for single block

I have a device, HASP, which has functionality to encrypt 8 byte data using 3DES in ECB mode, with three different keys, I am interested how secure is this? I know it might not be most secure, but how ...
201 views

### PHP AES 256 CBC faster than AES 128 CBC? Or am I doing something wrong?

for last couple of days I'm learning a bit about encrypting data in PHP, as I need a good encryption/decryption function for storing user's passwords in DB. I use ...
90 views

### Can RSA with padding detect all errors in ciphertext?

I'm new in cryptography and there are a couple of things that i'm not sure if i understand correctly. First, when using padding (PKCS or OAEP), if the chiphertext has errors in transmission we'll we ...
46 views

### Attacks on MICKEY 2.0 Stream Cipher

I would like to know if there are any known attacks, besides from side-channel attacks (differential fault attack, correlation power analysis, template attack), against MICKEY 2.0 or MICKEY-128 2.0. ...
127 views

### Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
49 views

### Effect of the birthday bound on AES-GCM

What is the effect of the birthday bound on the security of AES-GCM, when a very large number of messages are encrypted? I am looking for attacks that are useful in obtaining information about the ...
114 views

### Choosing which is public vs private key

When I calculate two RSA keys, what if anything, would make any difference which I call the public vs which I call the private key?
43 views

### Why does Rabin cryptosystem split the message into key blocks?

Why does Rabin cryptosystem split the message into key blocks and not into plain text blocks like in Merkle Damgard Construction? Is it because it acts in a way similar to IV? Probably not, it doesn'...
70 views

### How to calculate secret key size of a CP-ABE scheme

How can I calculate the real size of key in a CP-ABE scheme. For example, I have this GSWV scheme: Fuchun Guo, Willy Susilo, Duncan Wong, Vijay Varadharajan: CP-ABE with constant-size keys for ...
61 views

### Is there any more asymetric-time permutation than x^3 (mod p)?

I've been using "asymetric-time bijective functions (or permutations)" for several practical uses. I've applied them to solve problems in software-attestation and proof of unique blockchain storage. ...
81 views

### Is it ok to store the plaintext hash of encrypted data

Is it ok to create and store the hash (unkeyed hash function) of a plaintext before encryption or does it lead to vulnerabilities? If it is ok are there requirements for the used hash function and ...
25 views

### How is the usual way of using PKCS5/7 when a weird data is given?

PKCS5/7 pads the remaining data elements with a binary representation of how many space requires padding. This is useful and compact but what should I do in the following sample scenario below ? ...
11k views

### Why does the FBI ask Apple for help to decrypt an iPhone?

The current debate of the FBI trying to get Apple to assist in decrypting an iPhone made me wonder: Normally, upon turning on an iPhone, everything is decrypted using a 4-digit pin (or actually, a ...
84 views

### Step by step conceptual implementation of AUTHENTICATED Diffie-Hellman?

I'm already doing classic DH with pre-shared key in my setup, and it prevents people knowing the same password from eavesdropping on others' traffic. But it doesn't cover situations where a third ...
59 views

### Creating a message authentication scheme

I have such situation. I have a device like dongle. But it has certain limitations. For example, it can only have implemented encryption and decryption functionality. The availability of ciphers ...