# All Questions

60 views

### Which precautions to protect against side-channel attacks on ARX ciphers?

In recent crypto there has been a trend to design ciphers using only the ARX set of instructions - i.e. additions (modulo $2^{32}$ or $2^{64}$), rotations (by a fixed constant) and XORs, examples ...
63 views

### MD5 Hash outputs not produced

Are there any hash outputs not produced by the MD5 hash function? I need to use it as a placeholder for an empty hash while comparing two hashes.
52 views

### How many Hashes to find a digest of 2^{n−k}?

Given an n-bit cryptographic hash function $H$, how many messages should we expect to hash before finding a message $x$ such that $H(x) < 2^{n−k}$ for some integer k? My take: Shouldn't it simply ...
342 views

### Prevent replay attack without storage

I am designing a set of low-power sensing motes. Each mote will communicate to a central base over RF. I want the mote to be able to authenticate itself with the base, and send its data without being ...
78 views

### Where can I get the correct and precise algorithms for elliptic curve cryptography?

I have been asked to implement cryptographic operations using elliptic curves. I would like to get precise algorithms for various processes like key generation, digital signature and verification. I ...
69 views

### If PRF is non invertible, why does Ctr-mode work?

I am currently taking Dan Boneh's Cryptography I course online. I have just finished the segment discussing the Cipher Block Chaining and Counter-Mode. I am having difficulty understanding why ...
84 views

### How can one protect against a Man In The Middle attack during key exchange without using certificates?

Besides using a certificate to defend against a man in the middle attack during a key exchange, what methods can be used?
78 views

### Private and public keys, how do they relate mathematically? [closed]

Assuming everyone here knows the basics of a public private key, then you know the keys are mathematically related. My question is, what is the math? I really would like an in detail algorithm of the ...
96 views

### Why is RSA encryption version 1.0 not specified in an RFC?

I saw that there are three RSA encryption versions, as follows: RSA encryption version 1.5 (RFC 2313) RSA cryptography specification version 2.0 (RFC 2347) RSA cryptography specification version 2.1 ...
41 views

### What is the DK function when generating an AES key for Kerberos 5?

I'm trying to understand RFC3962. So far I understood everything, except for the last part: generating the derived key from the PBKDF2 output. To generate an encryption key from a pass phrase and ...
21 views

### Proving for a single input vs several inputs. Is there any difference?

I am working on a new protocol for pattern matching. While defining the ideal functionality, it is possible to say: Alice sends $p$ and Bob sends $T$ to the ideal functionality. i.e. searching for ...
45 views

### Is it possible to have self-authenticated message?

Consider a text with $n$ words which $m$ words of it can be replaced with an equivalent word. Therefore we have $2^m$ different texts with the same meaning. For example "You are {so/very} ...
69 views

### Is a nonce considered 'secret' enough for HMAC?

We're implementing a mobile application which communicates with a web service, and on first install the user sends its deviceid to the web service (over TLS, unauthenticated at this point) - which ...
78 views

### Easy hash function collision

I'm designing a cryptography-breaking assignment for a college-level introductory security course, and I'm looking for a hash function which is reasonably easy (but not too easy) to generate ...
75 views

### TLS RSA Certificate with Elliptic Curve Negotiation

When I look at Google's Public Key in Firefox I get PKCS #1 SHA-256 With RSA Encryption Yet according to SSL Labs Google has EC 256 bits / SHA256withRSA and supports ...
26 views

### How do I check if the secret key polynomial of the ATV-FHE (NTRU based) scheme is invertible?

I want to implement the ATV-FHE scheme as described here https://eprint.iacr.org/2014/039.pdf. To generate the secret key polynomial I compute f = 2*u + 1 , with scheme parameters chosen such that ...
18 views

### Encrypted vs unencrypted digital signatures [duplicate]

Is there a difference in terms of security between An encrypted stream of bits obtained by encrypting a plaintext concatenated with it's signature $C = E_k(plaintext||\sigma)$ where $E$ is a ...
100 views

### A “one time pad” can be thought of a Vigenere cipher with

A "One Time Pad" can be thought of a Vigenere cipher with... An infinitely long key A secure symmetric key Multiple ciphertext alphabets A columnar transposition I had this question come up ...
195 views

### Hash email address with a non-random salt for moderate security?

Crypto noob here. I have an application that has only moderate security requirements (internal use, limited audience). I want to send a unique url with a token in it to each user. If anyone has the ...
4k views

### Why can't I reverse a hash to a possible input?

I'm going to provide “proof” why a hash function can be reversed, and I hope you can tell my why I'm wrong So, a hash function can be implemented as a series of logic gates. All logic gates can be ...
87 views

### When would you use KP-ABE over CP-ABE?

When would you use KP-ABE over CP-ABE or vice versa? I started this question as I am having problems abstracting the pros and cons between KPABE and CPABE. This is not an assignment question. I have ...
29 views

### References for combining LFSRs with different lengths and taps?

I started learning streams ciphers with the use of LFSRs. Therefore, I tried to simulate what I am learning in a C sourcecode, which combines three registers and ...
51 views

### How to sign an elliptic curve point using an ECC signature scheme?

In Schnorr based ECC signature scheme, a message $M$ is signed with the private key $\mathit{sk}$ as $$s=\mathit{sk}\cdot h(M,R)+k$$ where $R=k\cdot P$ and $P$ is a base point. If $M$ is a point ...
8 views

### With AES-GCM, can the encrypted and non-encrypted parts be hashed separately? [duplicate]

The hash function in AES-GCM takes encrypted and unencrypted parts. Can the two parts be provided in either order? I'm wondering whether there is any fun with $GF(2^{128})$ that can be done to ...
140 views

### Is it true that 7zip doesn't use any salt with its KDF?

This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679 If that's true, wouldn't that mean you can crack multiple ...
39 views

### Modular arithmetics in diffie-hellman

Studying the basics of Diffie-Hellman key exchange, I'm stuck at a basic operation used in the end of the key exchange (where you show that both computations actually are the same). Can someone ...
15 views

### IV re-use for Salsa20 [duplicate]

Are their any specific requirements for the IV when using Salsa20? Is it for example allowed to re-use the same IV when encrypting with the same session key? Should the IV be random? etc I tried to ...
111 views

### Are there key collisions in AES-192, AES-256?

Suppose we have a single, fixed plaintext block $p$ of 128 bits. Call the set of all possible 128 bit blocks $B$. We could define fixed plaintext AES-128 as a function $f(k) \to B$ that takes a 128 ...
72 views

### Find a constant $C$ in $O(Cn^2)$?

I am writing a paper on RSA, and I am calculating some encryption running times. I have been told that the encryption running time is $O(n^2)$ where $n$ is the modulus. I have also been told that ...
87 views

### How many polynomials are used in Secure Multiparty Computation?

Secure Multiparty Computation based on Samir Secret sharing methods rely on Polynomials. Imagine corpus of data should be outsourced to bunch of untrusted servers for any computations. Now the data ...
136 views

### Private and Public Keys

I have a very basic understanding of encryption and the encapsulation process, but for the life of me I can't grasp how public keys and private keys work, how they're made, and how they're exchanged. ...
106 views

### Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?

I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed: ...
144 views

61 views

### Can several run of a semi-honest protocol be used to infer malicious security?

In the ideal world, $A$ sends several inputs $x_1,...,x_\lambda$ to the functionality and $B$ sends input $y$. Functionality sends $f(x_1,y),...,f(x_\lambda,y)$ to $A$ and nothing to $B$. Suppose ...
83 views

### What is the difference between “securely realizes” and “securely implements”?

In some security proofs it is stated that "a protocol securely realizes an ideal functionality" while in some others "a protocol securely implements an ideal functionality". Is there a meaningful ...
81 views

### Is there a standardized tree hash?

SHA-1, SHA-2, and the standardized version of SHA-3 are all sequential. This is impractical for hashing very large files distributed across machines. Any sequential hash can be straightforwardly ...
170 views

### Hardware Random Numbers - How to convert Voltage signal into binary?

I have a physical unit, e.g. a resistor. I bias it with current and measure the voltage. Let us assume that the fluctuations ($\Delta V=V-<V>$) of this voltage signal are random. Now, $\Delta V$ ...
16 views

### Remotely Verify File Timestamp

I'm working for a professor to build a platform for students to take midterms and finals online. The student downloads the test during class (when the professor makes the test available on the server ...
55 views

### Is it possible for a simulator to always abort?

In this paper of J. Baron, et al. (PDF), simulator always aborts the ideal functionality before client outputs its pattern-matching result obtained from the ideal functionality. (See bottom of page ...
65 views

### Why is the XOR of plaintexts equal to the XOR of ciphertexts with a two time pad?

I have been working in the vulnerabilities of the Two Time Pad. So i found in a lot of places, StackExchange included saying, that if two plain texts are encrypted (using XOR) with the same key the ...
77 views

### Diffie-Hellman using a different modulus on both sides

For Diffie-Hellman Key Exchange, the used modulus is the same throughout the process. Is it possible to use 2 different for both sides? For example, $A \gets M^{d_1} \pmod{n_1}$ \$B\gets M^{d_2} ...
103 views

### Cracking a hash which descends to a single value after repeated hashes

Assume I have a hash function (such as the one below) and a cipher, and I know that if I repeatedly hash any string over and over again, it will eventually descend to one unique value. Is there any ...
20 views

### Is using same key pair for both encryption and signing secure in RSA [duplicate]

In GPG, we can use same key pair for encryption and signing. Can't/Shouldn't we do this in RSA. I am using RSAES-OAEP and RSASSA-PSS, not raw RSA btw.
31 views

### PathORAM with read path eviction

I am currently trying to implement the pathORAM algorithm as describe in this paper: https://eprint.iacr.org/2013/280.pdf The paper states that with high probability, the stash size will be bounded ...
27 views

### what is the difference between one way function and hard core predicate?

Does anyone know what the difference between a one way function is and a hard core predicate? Are they related to each other or different?
23 views

### Difference between SHA1 and SHA1HMAC? [duplicate]

Can anyone let me know the difference between SHA1 and SHA1HMAC algo?
62 views

### Alter plaintext in block cipher AES in CBC mode

How can I alter the plaintext before decryption by changing the IV? I know what the value of the plaintext should be. I also know the value of the IV (initial vector). The IV and the AES block are ...
88 views

### Is it interesting to design stream ciphers parametrized by a CSPRNG?

Would it be interesting to have new stream ciphers whose design is parametrized by a CSPRNG? I.e. to instantiate the stream cipher, you just have to select and plug in any CSPRNG of your choice.