# All Questions

270 views

### what is the state of the art algorithm to encrypt credit card data

We have a business requirement to keep credit card data. What is today's (Nov 2013) state of the art algorithm to encrypt credit card data that will be saved on disk? Additionally, I'd appreciate ...
323 views

### Elliptic Curve Encryption Ciphertext Size

I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal)
53 views

### order between adversaries and type of resources given

We have a game $G0$ for which an adversary $A$ has access to a certain amount of ressources. Let us suppose that the maximum advantage for the adversary to win this game is $Adv_{G0}$. If we modify ...
87 views

### Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...
120 views

### Any real world implementation using message recovery?

During my master thesis I came across RSA-PSS-R which is in my opinion a quite elegant way of saving bandwidth and space using digital signature. But I didn't find any information about any real world ...
172 views

228 views

### Blinding twice in RSA

I understand that if you have a message $m$, you can blind it by selecting a random $r$ and then multiplying $r^e\times m \pmod{n}$ Someone else then signs it with $d$, raising to the power of $d$: ...
62 views

### Why do the outputs of parties in an MPC protocol have to be indistinguishable from the ideal / real world (as opposed to inputs)?

In this paper at the bottom of pg. 1235 and beginning of pg. 1236 it says: An MPC protocol is said to be secure, if for every real world leakage adversary A there exists an ideal world ...
357 views

### Has threefish successfully been attacked (practically or theoretically)?

Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating: Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a ...
80 views

### Why have 4th and 5th steps in Needham-Schroeder Protocol?

Why have 4th and 5th steps in Needham-Schroeder Protocol? It is said "These steps assure B that the original message it received (step 3) was not a replay.". But what is a replay here? And I don't ...
142 views

### Why routers don't just use Diffie-Hellman protocol?

Routers could just use Diffie-Hellman protocol with any computer who tries to connect to that router. Then it would be impossible to eavesdrop for anyone. Only router and computer would know the ...
746 views

### What happens when a root CA has its private key compromised?

What happens when a root CA has its private key compromised? Then all children in the tree are compromised too? And then all certificates are compromised? What needs to happen then? Related: - How ...
152 views

### I've got my private key compromised. How does CRL work?

How does certificate revocation list (CRL) work? How can I send a request to the CA to add my current private key to the CRL, so no one except me can add my certificate to the CRL? Related: - How can ...
154 views

### How can we get CA's public key?

To get a public key of some organization or someone we want to send an encrypted message to, we need to make a request to CA asking that organization's public key. CA then returns X509 certificate. It ...
463 views

### Homomorphic (encrypted) comparison to an integer

When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted value of a comparison test to an integer value (I realise that an ...
293 views

### How should we interpret the cryptanalysis results of SIMON and SPECK?

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for ...
245 views

### Is there a proof for showing any cryptogram is crackable?

I commonly hear statements along the lines of "all cryptograms are crackable - it's only a matter of time". Is there a proof to show that any cryptogram is "crackable"? The proof may be of a more ...
159 views

### modfied man in the middle attack diffie hellman

I have been given a problem in preparation for my cryptography final that I'm not sure how to solve. It asks me to suppose a scenario where instead of where an attacker would intercept some message ...
536 views

Given two sets of plaintexts and their corresponding ciphertexts, how does one determine the key $K$? The ciphertexts are: $$C_1= (P_1 \oplus K_0) + K_1$$ and $$C_2= (P_2 \oplus K_0) + K_1$$ $K = ... 1answer 160 views ### Is there a cryptographic hash function that can be performed with pencil and paper? Imagine I'm signing up for the 99th new web site this month. I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into ... 2answers 85 views ### MD5 theoretical question Ok, so this is a very possible stupid question, but one of those things that has sat at the back of my mind for a while. We all know that MD5 has issues, and these have been known for about a decade. ... 1answer 89 views ### SHA-1 Keyed Hash Function I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is: How I will be able to formalize the ... 1answer 93 views ### How to store keys for a cascading encryption? What is the best way to implement a cascade encryption? I'm trying to figure out how to cipher a string (or message) using Serpent-Twofish-AES and then store the keys. I'll provide an explanation, ... 2answers 113 views ### How does secret sharing solve the partial exposure problem? I have been trying to understand how secret sharing methods like Shamir's secret sharing solve the problem of a share revealing information about the secret. I guess there are some random numbers ... 1answer 94 views ### Explicit Key SHA-1 I'm reading “Collision-Resistant Hashing? Towards Making UOWHFs Practical” and in the Section 2 it says: Hash functions like MD5 or SHA-1 have no explicit key. But no notion of ... 1answer 99 views ### Why is appending the key to a mesage and then hashing that insecure if the hash isn't weakly collision resistant? [duplicate] Suppose I have H(M|K) and that H is not weakly collision resistant. If I have a message mac pair (M,MAC), how is it possible to find another message mac pair (M2,MAC2)? My thinking for this problem is ... 1answer 214 views ### Can you explain partial private key extract algorithm in certificateless Public key cryptography? Related to the algorithms of certificate-less Signature approach of Al-Riyami and Paterson… Why is there a need for a "partial private key extract algorithm"? Why should it be needed when ... 2answers 213 views ### Can anyone give an example where (asymmetric) crypto can go wrong due to selection of wrong groups? Basically the title says it all. It would be great if someone could tell give an example using provable security. More information about groups can be found at: ... 0answers 66 views ### Are there public$p$and$q$numbers for use in DSA? There are many RFC documents giving large primes to use in Diffie-Hellman. However, I couldn't find standards on the$p$and$q$large primes used in the DSA signature scheme. This is proving to be a ... 1answer 134 views ### How do I cryptanalyze a password field? In a PostgreSQL database, I can see the following fields in a table (for a specific record): User = administrator Password = "ceMv9Me6go" Now the following are true: The password length is not ... 1answer 290 views ### Diffie-Hellman Secret Exponent Size and Shared Secret Usage [closed] I'm developing my own protocol and I'll use Diffie-Hellman to achieve PFS. It will work in this way: The symmetric encryption algorithm will be AES_256_CBC. The DH parameters will be: P: a 2048-bit ... 1answer 176 views ### Can two people with different one time pads securely exchange a message like this? Alice has a message, generates a one time pad, encrypts her message and sends it to Bob. Bob generates his own one time pad, encrypts the message again, and sends it back to Alice. Alice then decrypts ... 1answer 120 views ### How can two (or more) parties share and agree upon a common random seed? I really don't know how to call this simple problem: Two (or more) parties need to establish a common (non-secret) value to be used as a seed for a deterministic RNG. The only requirement is that each ... 2answers 166 views ### Why don't we use MACs to store passwords? These days, the best practice for storing passwords is to use a scheme like scrypt or bcrypt. The goal of these schemes is to make dictionary attack inefficient for an attacker but it also slows down ... 1answer 486 views ### Is it true for Java that the transformation mode and padding is ignored when using RSA? Consider GregS's comment to this question (more specific to bouncycastle's provider implementation): http://stackoverflow.com/questions/11717646/bouncycastle-rsa-key-size-and-padding The mode, ... 1answer 104 views ### No Birthday Attack to TCR I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” , which compared TCR (Target Collision Resistant) and ACR (Any collision Resistant). It says we wish to stress ... 1answer 54 views ### Weaker Notion of Target Collision Resistance I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: While it might be easy to find a collision$M,M'$in$F_K$by making both$M,M'$depend on$K$... 1answer 69 views ### Dependence on Keyed Hash Function I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: With an ACR hash function$F$the key$K$is announced and the adversary wins if she manages to ... 1answer 184 views ### Public-key cryptosystems without poly-time quantum attacks It's well-known that Shor's algorithm can solve integer factorization, discrete logarithm and discrete log over elliptic curves in cubic time. This implies that cryptosystems like RSA, ElGamal, and ... 1answer 851 views ### What does AES256-CTS-HMAC-SHA1-96 mean in relation to Kerberos? I'm not completely clueless as to what it means, but I'd like to understand it at a higher level. The highest encryption type used by Active Directory domain controllers for Kerberos authentication ... 1answer 104 views ### Decryption or attacking DES encrypted file I have a file that has been encrypted using DES and am looking to decrypt and find a secret message encoded. All I have is the file which is full of binary data. There is no key or anything else which ... 1answer 91 views ### Can Diffie-Hellman generate values in a specified range? Is there any way to generate values only between$0$and$255$with the Diffie-Hellman method? I need to create keys for communication algorithms with$32$and$16$numbers between that range. The ... 0answers 62 views ### Perfect Forward Secrecy in MTI/A0 Would the property of perfect forward secrecy still be achieved in MTI/A0 for a session key that was established between C and D when one LL-key aD is revealed so that both LL-keys aC and aD are ... 2answers 115 views ### PPT eavesdroper able to output$m_{0}$and$m_{1}\$ of different lengths

I've read the following two questions and their answers: Messages of different lengths and one-time computationally-secret Why is a non fixed-length encryption scheme worse than a fixed-length one? ...
91 views

### Security based on PRF

I've seen that there is several kinds of PRF, and sometimes people speak about strong PRFs. When proofs of a protocol or algorithm are given based on the assumption of the use of a PRF, are they ...
61 views

### Is there a relation between security of rounds of DES and Luby Rackoff rounds?

DES uses 16 rounds of feistel networks but not considered secure . Where Luby Rackoff constructions which are inspired by DES its proven by Patarin that 7 rounds is secure . Is there a relation ...
119 views

### Why is an IV used in Merkle-Damgard transform?

In Merkle-Damgard transform, a fixed vector IV is chosen at the beginning, and it is hashed together with the first block x1. I wonder why we don't use x1 straightforward, i.e. hash x1 and the next ...