# All Questions

124 views

### Is the Couvreur et al. polynomial time attack on McEliece practical?

There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan: ...
75 views

### Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
173 views

### Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?

In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
198 views

### Is the inverse of a secure PRP, also a secure PRP?

If a block cipher is a secure PRP, is it's inverse a secure PRP as well? My intuition says yes but I'm not exactly sure. On a related note, if a block cipher is a secure sPRP, is it's inverse a ...
70 views

### For $e(g, d) = c$, can we compute $d$, given others

Given $$e(g, d) = c$$ where, $e$ is bilinear pairing function chosen by the user/attacker, the values of $g$ and $c$ are known $g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$ can we somehow ...
202 views

### Known vs. Chosen (plaintext and ciphertext) and RSA

I want to know whether I can break RSA (textbook) with known plaintext/ciphertext attacks. Known plain-text Let $c$ be the ciphertext and $m$ the plaintext. $$c = m^a \mod n$$ Since all I have is ...
78 views

### Do both client and server need to implement OpenSSL protections to protect from CBC attacks

In regards to the protections implemented in OpenSSL 0.9.6d (described in section 2. http://www.openssl.org/~bodo/tls-cbc.txt). My understanding is that the mechanism prepends an empty record when ...
119 views

### Homomorphic Encryption Notation Question

What does the following notation mean in a homomorphic encryption scheme? ENC(x;r) What does x and ...
208 views

### Practical (and secure) PRGs

Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, ...
300 views

### Securely send public key from client to server in RSA?

I have a client and a server communicating with messages encrypted using RSA. Initially, the client knows server's public key, but the server does not know the client's public key. Is it possible to ...
108 views

### Is this EAX extension weakening the (provable) security of EAX?

I would like to insert a key deriving function into EAX mode, in order to hamper brute-force attacks for a key-size restricted cipher (56 bits). The modification inserts an identical multi-block ...
176 views

### Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
188 views

### Can padding length, and thus plaintext length, be considered public information when using aes-cbc?

Right now I'm using a simple padding system that takes the plaintext, hashes it with SHA512, and appends $x$ bytes of the hash as padding where $x$ is the delta between the plaintext and nearest ...
57 views

### Protocol/algorithms based on a variable-length input PRF

Are the proofs based on a PRF assumption still valid when using a variable-length input PRF ? The answer might be obvious, but I have a doubt.
105 views

### No Birthday Attack to TCR

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” , which compared TCR (Target Collision Resistant) and ACR (Any collision Resistant). It says we wish to stress ...
209 views

### How good is the RandomPool generator in Crypto++ library?

How good is the RandomPool generator in Crypto++ library? I never heard of it before… I wonder if there is a Fortuna C implementation that I could use in an Objective-C project. Also: How secure is ...
331 views

### Security of Pohlig-Hellman exponentation cipher?

I am looking into implementing Pohlig-Hellman exponentation cipher and I would like to know how secure that algorithm is? I am guessing it's security relates greatly to the prime number used in it. ...
114 views

### How would using only one s-box affect security of Blowfish?

Schneier says: Fewer and smaller S-boxes. It may be possible to reduce the number of S-boxes from four to one. Additionally, it may be possible to overlap entries in a single S-box: entry 0 ...
105 views

### On the Definition of a PRG and a CSPRG

I've been looking at the definition of a PRG, here. This is a broader notion than a cryptographically secure PRG ("CSPRG"), which is described here. I am realizing that I am very confused by this ...
56 views

### Bicliques for permutations

So I'm trying to understand the complexity of the biclique attack on Grostl and I have some questions: 1) The paper introduces sliced bicliques where on Grostl one constructs a biclique of dimension ...
80 views

### Why does a one-time-pad key have to be at least as long as a message? [closed]

I am studying one time pad and find it hard to understand. What happens if the key is one bit or 100 bits shorter than the message?
46 views

### Key change and key derivation

there are two ways for key change: Key update and re-keying. Which of this methods use KDF (Key Derivation Function) for getting new keys.
117 views

### Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
118 views

### Ideal system for an encryption scheme

What is the ideal system for an encryption scheme? For a pseudorandom permutation the ideal one is a random permutation, for a pseudorandom function the ideal one is a random function. For an ...
120 views

### Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?

In one of the exercises in [KL] Book I need to tell whether an encryption scheme is secure under an eavesdropper of only one message. Given a PRG $G: \{0,1\}^n \rightarrow \{0,1\}^{n+1}$. The ...
180 views

### How can I break this encryption scheme?

Let $p$ be a large public prime. Alice holds a private key $(e_1,d_1) \in Z_{p-1}^*$ such that $e_1 d_1 = 1 \mod {p-1}$. Bob also holds a different private key $(e_2,d_2)$ with the same property. ...
499 views

### Hill cipher, unknown letter value

I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix $K$ of size $n\times n$, one ...
755 views

### Is the number of creatable torrents limited?

Currently, a magnet link containing a 40-digits long SHA-hash value, is assigned to every torrent which is created. Therefore, this hash should be unique to identify a torrent and send the right bytes ...
164 views

### Brute force attack expected running time

I am a bit confused about the expected running times of brute force attacks on different cryptosystems. So let's assume a key size of $2^n$ bits. Symmetric key cryptography: $E(brute)$ = ...
158 views

### Generating bilinear pairing parameters - running time of finding member of p-torsion group

Update: Question completely rephrased. I want to create the parameters for a bilinear pairing (the Tate pairing in this case). In case you're interested I'm following this thesis, specifically the ...
541 views

### How long would the 100 Year Cryptography Project have secured its data had it been started 100 years ago?

The goal of the Tahoe-LAFS 100 Year Cryptography project is to "enhance Tahoe-LAFS's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 ...
159 views

### Concerns about using a hash to determine if specific input data has already been encrypted

A system is used to securely store account numbers. When an account number is added to the system it is securely encrypted and stored in a database along with the IV and a reference to the encrypted ...
537 views

### Initialize a PRNG with a password

Let's assume that we have a secure PRNG. Is it "safe" to initialize it with password, or seed based on a password like SHA256(password)? If yes, is it "safe" to generate an RSA or DSA key from it? ...
472 views

### Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?

Is combining digests (created using a hash function) using arithmetic addition, and then hashing and publishing the result, less secure than publishing the set of digests? Does the answer change if ...
4k views

### c# Correct Triple Des Block Encryption Usage

I found the below code online, but in its original state, the encryption was not using any padding (Padding.None), and was encrypting in blocks of 8. I wasn't able to get this code to properly encrypt ...
137 views

### What is sent on the initial communication with Kerberos?

When a user wants to communicate with another user (let's say Alice and Bob), what is sent over the network during the initial communication? Alice uses her Kerberos client and enters her password ...
759 views

### Why do we append the length of the message in SHA-1 pre-processing?

As we know, SHA-1 is irreversible, so why do we append the length of the message to the preimage?
55 views

### Weaker Notion of Target Collision Resistance

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: While it might be easy to find a collision $M,M'$ in $F_K$ by making both $M,M'$ depend on $K$ ...
162 views

### Random numbers for Rabin-Miller primality tests

I've implemented a Rabin-Miller primality test fuction following Wikipedia and the book Applied Cryptography. Now I'm using it for generating primes with a string seed. The book suggests the following ...
149 views

### Importance of block size in CBC mode

Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
1k views

### Why are the constants so simple in Keccak?

Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF) The initial values of the state in Keccak is ...
298 views

### Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
156 views

### How do you find the inverse degree of a hash function?

I am trying to learn cryptanalysis on the Keccak hash function. One of the papers on zero sum distinguishers talks about Keccak having inverse degree of 3. I am unable to figure this out: how do you ...
270 views

### Breaking a PRNG Scheme

Assume the following scheme for a PRNG generating decimals in [0,100) Given a message and a key, compute tag := HMAC512(message, key). Take the first 5 hexadecimal characters of the tag. If the ...
75 views

### Signing the hash of a key with the same key

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in ...
91 views

### Public-Key Deterministic Encryption : Why does not provide perfect security?

I've got a question about an assignment . The question is "Why a Public-Key Deterministic Encryption Algorithm does not provide perfect security ?" . I suppose it means according to Shannon . Any ...
134 views

### Reason for difference in assumptions for practical private-key and public-key crypto

Theoretical cryptography tells us that everything in the world of private-key cryptography (CCA-secure symmetric encryption, message authentication codes, etc.) can be built from one-way functions and ...
153 views

### Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
### Encryption of a number with RSA bigger than $n$
I'm having trouble understanding why encrypting a number $m$, which is larger than $n=p\cdot q$. I've looked into the following threads: Why RSA can't handle numbers above 76? Why does plain RSA ...