# All Questions

318 views

### Berlekamp-Massey algorithm: case when sequence length is less than double the length of the LFSR

Suppose that we have a sequence of $N$ digits which is produced by a Linear Feedback Shift Register (LFSR) and the shortest such LFSR is of length $L$. A very important tool in cryptanalysis of stream ...
599 views

### what kind of hash function can provide a short hash and be collision resistant?

When you try to connect via SSH, you see a signature which is short but I heard it is even stronger than sha256. It is perhaps stronger because it uses more rounds. Is there a hash function or a ...
199 views

### What are the differences between proofs based on simulation and proofs based on games?

what are the main pros and cons of proving the "security" of a crypto scheme under simulation proofs instead of game based proofs?
111 views

### Non-cryptographic hash function as MAC for stream ciphers

I understand that for a stream cipher to be useful, there must be a way to verify that the message was not tampered with (bits were flipped by an attacker). So, instead of using some cryptographic ...
403 views

### Which categories of cipher are semantically secure under a chosen-plaintext attack?

I am trying to get my head around the circumstances under which a cipher is (or is not) semantically secure under a chosen-plaintext attack. I can't seem to find a good reference explaining this. I ...
399 views

### Do known-plaintext attacks exist for public key encryption?

In asymmetric ciphers we publish the public key for anyone, which means an attacker can encrypt any message they want and compare the ciphertext and plaintext without communicating with the owner of ...
900 views

### Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
354 views

### Randomized algorithms and the one time pad

The way I understand it, an algorithm is said to be randomized if it uses randomness as part of its logic (quoting Wikipedia). Now, in the case of encryption algorithms, I assume this means that for ...
325 views

### Proving that a scheme is not IND-CPA-secure

Suppose I want to prove that a given symmetric encryption scheme is not IND-CPA secure. The first thing I do is to define a specific adversary that attacks the scheme. How can I proof neatly, (using ...
165 views

### Increase number of rounds for SPN and Feistel ciphers

Read a post on Schneiers blog (and again 2011) about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. ...
229 views

### What is the strength of unpadded RSA?

I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling. How many bits of security does unpadded RSA have, in relation to its key ...
389 views

### Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm?

For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to increase security? Note: I just want more secure output and CPU cycles does not ...
488 views

### Can Elgamal be made additively homomorphic and how could it be used for E-voting?

Elgamal is a cryptosystem that is homomorphic over multiplication. How can I convert it to an additive homomorphic cryptosystem? How can I use this additive homomorphic Elgamal cryptosystem for ...
2k views

### How do I store encrypted files on a web server and decrypt them locally?

I want to store files (images) on a public webserver and let users see them if they know a password. The server shouldn't have the unecrypted files and the server can only serve files, not perform ...
163 views

### Aes encryption -The relevance of static matrix in mixcolumns operation

Can someone explain to me the relevance of the static matrix used for the mixcolumns operation in aes encryption.i.e the relevance of why the byte is multiplied by 2 + next byte multiplied by 3 + next ...
130 views

### What are the dangers of predictable (repeated) plaintext structures?

When using a "good", modern cipher (specifically one that provides ciphertext indistinguishability), is it a problem at all if there is some well-known structure in all plaintexts? For example, ...
330 views

### Poor man's SSL - is this method as safe as SSL/TLS?

I need to send data between two applications. I've got requirement that says that data should be transmitted using secure protocol such as SSL/TLS. Data is sent using TCP sockets and I don't have ...
994 views

### Digital Signatures, Standard Hash Functions and MACs

I'm studying Hash functions and Digital Signatures in sequence, and came up with some doubts about their usage. First of all: What is the difference between hashing a document and signing it? And ...
234 views

Sorry if this is a noob questions, but I finally figured out how to implement the Tiny Encryption Algorithm in C++. My question is what to do about padding the key and the plaintext? I know that ...
132 views

### How does DJB's nistp224 manage to fit compressed points into 224 bits?

DJB's nistp224 program purports to be an implementation of elliptic curve Diffie-Hellman relative to the standard NIST P-224 elliptic curve. To the best of my ...
162 views

### Using compression to test encryption

Is the uncompressibility of encrypted data a necessary property for a good cryptographic algorithm? To make a crude experiment, I encrypted an 8K file with all 'A' and then compressed both the ...
91 views

### Is the following scheme secure for different cipher

Let's say I have two keys K1 and K2. two messages M1 and M2 of the same length. Cipher (E,D) 3 ciphertexts: C11, C12,C22 where Cij = E(Ki, Mj) In situation ...
393 views

### If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
484 views

### Finding CRC collisions for specific divisor

My current textbook (Information Security: Principles and Practice by Mark Stamp) discusses how to determine the CRC of data via long-division, using XOR instead of subtraction to determine the ...
140 views

### How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?

I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this... I want another entity, lets call them the Auditor, to ...
318 views

### Is it possible to figure out the public key from encrypted text?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
284 views

### What algorithm does PGP use to encrypt email?

I know it uses RSA/DSA to create keys, but does it use that same algorithm for the actual cipher?
126 views

### How to collect, process, and transmit data securely?

In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
97 views

### Publicly exposed hash of private key

Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an ...
57 views

### How can Shamir's method for secret sharing work in the GF(256)?

I have been reading about Shamir's secret sharing, and maybe i completely misunderstand something, but the field is meant to be a prime. However, when i look at the implementations of this algorithm, ...
68 views

### Why is it important to generate a pseudorandom permutation from a pseudorandom function?

Most of the papers on block cipher constructions, especially the ones which discuss constructing block ciphers of arbitrary lengths or small domains, the techniques are designed based on building a ...
103 views

### How does the IV or initial counter increase internally for each block in AES CTR mode?

I am working on Intel AES-NI library and since the AES function is coded using low-level assembly instructions. I could not see how the IV or initial counter increases in CTR mode. In general, how ...
77 views

### How does SSL secure the initial handshake?

I'm reading the SSL specs, and it seems that the initial handshake has no authenticity protection at all. What is to prevent, say, an attacker from overwriting the "available ciphers" list with one ...
157 views

### Is there a companion algorithm for OTP to ensure integrity and/or authentication?

One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved: Fast generation of independent and identically distributed random variables Perfect key ...
87 views

### Having 4096 bit keys and short (< 256 byte) messages, can I simply use the key as OTP?

Assumptions: Alice and Bob use (cryptographically secure, hardware-rng generated) 4096 bit keys. Each message is encrypted using a new key; meaning: once a key is used, it's destroyed. Alice and Bob ...
93 views

### Security considerations on “expand 32-byte k”-magic number in the Salsa20 famility of stream ciphers?

I'm currently examining the NaCl library written by Daniel J. Bernstein and I noticed that the library hard codes the sigma: ...
146 views

### How much is slower GCM AES-128 than one of the stream chipher eSTREAM?

Evaluate the speed of the algorithm GCM AES-128 and compare it whith speed of one of the stream chipher in eSTREAM. Can someone give such an assessment?
181 views

### Which stream cipher can we replace the RC4 in the SSL?

In cryptography, the Fluhrer, Mantin and Shamir attack is a particular stream cipher attack, a dedicated form of cryptanalysis for attacking the widely-used stream cipher RC4. The attack allows an ...
147 views

### Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus ...
157 views

### How does one use AES block cipher modes of operation?

This is the sequel to my previous question about AES block cipher modes of operation. (See: AES block cipher modes of operation) Now, here is my real problem. I have to use a block cipher with 8 bit ...
121 views

### Three-way hash collision

According to the birthday paradox we need approx. $O(|T|^{1/2})$ samples from the tag-space to find a collision for a hash function $h:K\times M \to T$. But hoe many samples are needed to find a ...
128 views

### Difference between salted hash and keyed hashing?

A cryptographic salt is additional input other than message itself for a hash function so that it prevents attacker from launching dictionary attacks . Usually the salt is stored along with the hash ...
157 views

### bcrypt and pbkdf2 double hashing

If I want to protect myself from implementation of algorithm issues and inherent design flaws of algorithms in password hashing, what would be most secure way to combine two hashes? ...
186 views

### Meet-in-the-middle with checking complexity

In regards to meet in the middle type attacks, I have been considering the amount of operations in order to successfully find a key given two sets of plaintext / ciphertext pairs. All of the sources I ...
76 views

### Do any (non-hardware) RNGs exist which could be used to create an OTP for crypto purposes?

I've stumbled (jobwise) over a system where small messages (512 Bytes or less) are encrypted and decrypted using a simple XOR using a OTP. That OTP is created using a seed based on the individual user ...
98 views

### Does CBC encryption of a hash provide authenticity?

Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other ...
312 views

### Am I insecurely implementing AES in Python? [closed]

My name is Pat, I'm a rising high school senior interested in Comp Sci. I've taken interest in cryptography following the NSA scandal. Since this is the first time I've ever implemented encryption ...
98 views

I'm writing a client application that wants to store some secret information with a storage service. The client has to authenticate the user with the service and the service should not be able to ...
Assume an ElGamal Cryptosystem. Assume a set of three players, $P_1$, $P_2$ and $P_3$. The private key $x$ is shared among the players. The player $P_1$ has a piece of the private key $x_1$, $P_2$ has ...