# All Questions

900 views

### Using bad generator in ElGamal Encryption

Suppose Alice chooses a random Prime $p$ and a random private Key $a \in \mathbb{Z}^*_p$. By accident, she also chooses a random number $g \in \mathbb{Z}^*_p$, which is not a generator of ...
988 views

### Partial collisions for md5

Let $h$ be a bitstring and let $P(h, n)$ be the n-bit prefix of $h$. A partial collision of length $n$, for a hash function $H$ is a pair $(x,y)$, such that $P(H(x),n)=P(H(y),n)$. What is known about ...
264 views

### Is this streamable combination of encryption and MAC secure?

I want to combine encryption and MAC. For encryption I use AES-256 with CBC and PKCS5Padding. For MAC I use HmacSHA512. I use the Encrypt-then-Mac approach (calculate MAC over the ciphertext and ...
1k views

### Are there any MGF1 and OS2IP functions available in C?

I need MGF1 and OS2IP functions, as defined in the PKCS #1 v2.1: RSA Cryptography Standard. Is there anything available in OpenSSL, or any other open C library?
454 views

### Checking a key before actually using it

I have a block of data crypted using twofish with a key of 128 bit. The data must be accessed from a GUI, the user gives the key, the block is decoded and the real data is accessed. Problem is that ...
136 views

### If plaintext is random, how does it affect my choice of encryption algorithm?

I want to encrypt a key file, which is assumed to be truly random (generated with hardware RNG, for instance). Given that there are no patterns in the plaintext, what implications are there for my ...
14k views

### Calculating private keys in the RSA cryptosystem

The number $43733$ was chosen as base for an implementation of the RSA system. $M=19985$ is the message, that was encrypted with help of a public key $K=53$. What is the plaintext text? What is the ...
335 views

### How are trapdoor functions developed/found and where can I find existing ones?

Trapdoor functions are a fundamental part of public key cryptography. An example of the most common trapdoor is Prime Factorization, used in cryptosystems such as RSA How are these trapdoor ...
188 views

### Generating non-repeating N-bit IVs, which are indistinguishable from randomness

I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
694 views

### What is the best method to determine the language used in a monoalphabetic substitution cipher?

Working on a cipher (which I assume to be a mono-alphabetic substitution cipher due to the letter frequency) I struggle with the fact that I don't know which language the plain text is written in. ...
281 views

### If a cryptanalytic breakthrough is made, what process should be followed?

If a researcher manages to make a cryptanalytic breakthrough on a cryptographic algorithm or protocol that is in use, what should they do? Has this ever happened before? What are the implications for ...
161 views

### Proof that Alternating Step Generator and modifed ASG' have equivalent security?

The Alternating Step Generator (ASG) is a PRNG combining 3 LFSRs. Output of the ASG is the XOR of the output of two clock-gated LFSRs. At each step, a single one of these LFSRs is clocked, according ...
419 views

### Sites to find crypto intermediate values

Does anyone know of any sites where intermediate values of multiple crypto algorithms (not just the famous ones), including hashes, can be found? I don't just mean intermediate values of encrypting. ...
70 views

### How does the split mask countermeasure work on AES?

I am trying to understand the split mask countermeasure which is a masking method to avoid side channel attacks. Let's first describe the principle and then try to apply it to AES. I found this paper ...
104 views

### Fixed-prefix IV in CBC mode

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV? I have multiple devices with poor entropy sharing the same key and I want to ...
398 views

### Applicability of birthday attack to AES brute force

Is the following snippet from a recently published cryptography book correct? EDIT: Expand the snippet from the book to make the context (symmetric key search) more clear. You can apply this to ...
116 views

### Can somebody help me understand RC4 Spritz? (Three Questions)

So ever since I first took a stab at understanding stream Ciphers, not one stood out more than RC4, because it's so fantastically simple. As most people reading this will know, with its fantastic ...
60 views

### Question about lower bound and upper bound key collision

I'm reading this article and I have a doubt in the page 7. First I going to describe the required definitions and next I formulate my question. Let be F(n)=\{f_k: \{0,1\}^n\rightarrow \{0,1\}^n| ...
59 views

### Symmetric encryption algorithms with large IVs and authentication?

Most modern symmetric ciphers require a nonce/IV. If the nonce is reused, security is lost. If the nonce is large enough, it can be generated securely by using a CSPRNG. This avoids needing to keep ...
166 views

### Security game oracle queries

Concerning private key (symmetric) IND-CPA game definition: Attacker $A$ queries the encryption oracle polynomial number of times. $A$ sends the challenger $C$ a message pair $m_0$ and $m_1$. $C$ ...
72 views

### Designing Secure Multi-Party Computation Sub-Protocols Based on Homomorphic Encryption

When designing SMPC protocols using secret-sharing, it is a common approach to compose a protocol from several sub-protocols (each proven secure under the formal definition of security w.r.t. ...
90 views

### How to exctract ECDH parameters from an OpenSSL-generated $G$?

I'm using ECDH for generating ECDH public parameters (p,a,b,G,n), I try to get this values using openssl ecparam -in cert.pem -text -noout For ...
64 views

### Comparing two definitions of one-way function

I'm reading Rafael Pass's lecture notes on one-way function and came across two definitions. The first one is: A function $f$ is one-way if $f$ can be computed in P.P.T. and there exists no ...
151 views

### Is EncFS good for online storage services?

Conclusion from an EncFS audit: EncFS is probably safe as long as the adversary only gets one copy of the ciphertext and nothing more. EncFS is not safe if the adversary has the ...
283 views

### When is the Random Oracle model (not) necessary?

Hash functions are often used in cryptographic schemes and protocols, and that doesn't necessarily mean that their proofs are on the Random Oracle model. That leads to the following question: What is ...
681 views

### How to verify the integrity of RSA encrypted messages?

I need to encrypt messages using PublicKeyCrypto and send it to the server, where the message should be decrypted. I'm aware of the Padding Oracle Attack and want to apply a server side integrity ...
196 views

### EdDSA Signature Algorithm - hash of secret key

Why does EdDSA use the (SHA512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient and I can't see how it adds any extra ...
207 views

### How to generate own secure elliptic curves?

I know that the algorithm used to generate the Brainpool curves and the NIST curves is published. The algorithm should be this one (RFC5639 Appendix A). From what it looks like it's rather slow to ...
118 views

### Which attacks are possible against raw/textbook elliptic curve?

A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages. For EC the story is something else. For signatures we have ...
121 views

### Secure multiparty computation of conjunction

Suppose Alice and Bob each have bits a and b, respectively. How can Alice and Bob compute the function ...
385 views

### Does Ed25519 support cryptographic threshold signatures?

This is a loaded question so I'll list the concerns, not all of which need to be satisfied. Does there exist a threshold-signature scheme for Ed25519 that... Does not require a trusted dealer to ...
769 views

### Security analysis of Spritz?

Recently, a new cipher called Spritz has been released by Ronald L. Rivest and Jacob Schuldt. It should be a "drop-in replacement" for RC4. There are many differences to RC4, Spritz is "spongy" and ...
298 views

### Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
126 views

### Streaming mode of operation that is more resistant against nonce reuse

Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality? In this question it would be allowed for the streaming mode to leak if ciphertexts ...
164 views

### How to construct a next bit predictor from a distinguisher

I read the claim, without proof, that it is possible to construct a next bit predictor for any PRNG given an oracle distinguisher for that PRNG and vice versa. How do I prove that? A distinguisher ...
506 views

### Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
345 views

### Does salt size affect password hash security?

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ...
462 views

### Proof of storage scheme

I'm familiar with client puzzles, where the client performs some work and there is a way to prove to the server that the client has done so. Is there a way to do this, but where the client's resource ...
3k views

### Using ECDSA keys for encryption

I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too. I have ECDSA SSH public keys and I wonder if I can use them to ...
129 views

### Has a Two Key TDES encryption ever been successfully attacked?

Is there any known instance of a Two Key TDES ever being successfully attacked (in real life), when the key is used to encrypt less than $2^{20}$ words?
2k views

### Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD ...
491 views

### Help with linear cryptanalysis

I am new to linear cryptanalysis, so I decided to try to break a toy cipher that was designed to be vulnerable to linear cryptanalysis. Unfortunately, I can't get it to work no matter how hard I try. ...
1k views

### How is digital signature different from a message authentication code (MAC)?

I know the definitions of both but can't specifically tell how they are different and if one is better than the other. Please help.
500 views

### Initialization Vector Properties

This is a multi-layer problem, and I want to take you through the whole thing rather than just asking about IVs. Bear with me. Also, all code below is in Common Lisp because that's what I'm using, but ...
116 views

### Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?

I'm basically looking at this construction to turn a tweakable blockcipher $E_c(x)$ taking a key $k$, nonce $n$, counter $c$ (forming tweak $t = c||n$) and an input $x$ into a PRF on an ...
320 views

### How can I take advantage of repeated patterns in non random RSA prime factors?

I am researching vulnerable RSA moduli which are composed of primes generated with poor entropy. Having a list of these primes I searched for variable sized repeated patterns among them and I noticed ...
130 views

### Authentication protocols for authenticating devices to a server

The requirement is to authenticate 1000s of devices to a server when the devices try to contact the server. The problem I face is that all authentication protocols require some kind of shared secret ...
1k views

### Security of authenticated encryption modes GCM & CCM

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with \$M\mapsto C=M^e\bmod ...