# All Questions

1answer
204 views

### Security equivalent to Diffie–Hellman problem?

I've been doing the security proof for one of my Theorem. Basically, given $g^a$, $g^b$, $g^{cb}$, $g$ and $c$ as known values. Is the problem of computing $g^{acb^{-1}}$ equivalent to the Diffie ...
2answers
279 views

### Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
2answers
181 views

### Generate a unique 64 bit numeric database key from a string without collisions at $2^{32}$ birthday threshold?

What is the best way to generate a unique 64 bit numeric database key from a string? For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...
3answers
171 views

### Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
1answer
372 views

### ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, signature-based approach is used. After we've implemented it ...
1answer
161 views

### RSA and ECDSA performances

Signature algorithms with elliptic curves have small output sizes compared to RSA for the same level of security. What about the processing time to generate a signature ? I've seen figures giving ...
1answer
110 views

### Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?

If we assume the strength of RSA is based on the difficulty of factoring (which I know we can't guarantee) and we compose the modulus of some other quadratic ring that is a unique factorization domain ...
2answers
183 views

### security in the standard model → random oracle model?

Can a protocol proved secure in the standard model be considered secure in the random oracle model?
1answer
248 views

### Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
1answer
75 views

### Signing the hash of a key with the same key

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in ...
2answers
311 views

### Why is the discrete logarithm problem assumed to be hard?

This might be a quite stupid question: since a naive brute force algorithm to solve the discrete logarithm problem will only take O(n) time for a group G with order ...
2answers
161 views

### Cryptographically secure product keys

I am looking for a scheme to generate and validate cryptographically secure product keys. My requirements are: Unforgeable. It must be impossible (or at least very hard) for users to forge a product ...
1answer
203 views

### Maximal-length LFSR with $n$ bits when the factorization of $2^n-1$ is unavailable?

There's a classical method to efficiently test if a LFSR with $n$ bits is maximal-length (or equivalently, if the feedback polynomial is primitive), when the factorization of $2^n-1$ is available. Do ...
2answers
109 views

### What's the alternative should PKI collapse?

Premises - please check it and critique if necessary: If factoring the products of large numbers suddenly becomes simple, PKI goes up in smoke. Is this correct? If it is correct, it seems to me ...
3answers
148 views

### Can one use a Cryptographic Accumulator to efficiently store Lamport public keys without the need of a Merkle Tree?

One of the problems of one-time Lamport signatures is that public keys are disposed after use, so you must generate many keys and store them in a Merkle tree. The root is the "real" public key and ...
1answer
151 views

### counting points on elliptic curve

Given an elliptic curve with equation $y^2=x^3+ax+b$, and i want to find the number of points $(a,b)\in E(\mathbb{F}_p)$ where the polynomial has repeated roots, how do i do it? I have an intuition it ...
2answers
94 views

### Can we build authenticated encryption using Feistel Networks?

Most of the encryption modes of Feistel Networks especially the ones used to build fixed length block ciphers just provide confidentiality . Can we build authenticated encryption using Feistel ...
2answers
657 views

### Attacking 2DES efficiently

Meet in the middle on 2DES uses $2^{56}$ memory. Given the fact that the attacker has only $2^{45}$ memory. How can the attacker adjust the attack so even with this memory limit, it will still be more ...
1answer
311 views

### Subtracting a point in elliptic curve cryptography?

I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption: ...
2answers
230 views

### Does encrypting a hash of the message yield a secure MAC?

Is $mac = enc(hash(x))$ a secure MAC for hash = SHA256 and enc AES in CBC mode or ECB mode. Normally AES-CBC is malleable. But in this case I use a hash function for the one-way property. For ...
2answers
400 views

### Encoding information in packet lengths to actively sidestep encryption

If you've only got an encrypted data channel can you actively sidestep the encryption and communicate with an outside party who can see the data but cannot decrypt it? Yes - if you can find some ...
2answers
233 views

### bcrypt and pbkdf2 double hashing

If I want to protect myself from implementation of algorithm issues and inherent design flaws of algorithms in password hashing, what would be most secure way to combine two hashes? ...
4answers
2k views

### Initialization vector in symmetric-key encryption

Can we use symmetric-key algorithms without an initialization vector? I am making an app where both the sender and receiver share a key and there is no way to create an initialization vector for each ...
1answer
123 views

### Could using sequential plaintext uncover AES key?

I am encrypting a string in a format like this: ...
2answers
197 views

### How does an oblivious test of plaintext equality work?

Assume an ElGamal Cryptosystem. Assume a set of three players, $P_1$, $P_2$ and $P_3$. The private key $x$ is shared among the players. The player $P_1$ has a piece of the private key $x_1$, $P_2$ has ...
1answer
195 views

### Using same AES-GCM setup for multiple packets?

Most cryptographic libraries I've encountered uses some variant of processPlaintext(...) and then doFinal() to produce the ...
2answers
612 views

### Why does Shamir's Secret Sharing Scheme need a finite field?

I read ampersand's question "Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme", where he asked why Shamir's Secret Sharing Scheme uses arithmetic in a ...
3answers
208 views

### Construct a random permutation from a random function?

How can we construct a (pseudo) random permutation from a (pseudo) random function ? I've seen a method from Luby-Rackoff which allows to construct a PRP of length $2N$ from a PRF of input/output ...
4answers
390 views

2answers
902 views

### How can I break a Vigenère cipher with partial plain text?

I have an exercise to do regarding Vigenère encryption. I've got the cipher text: WNZTNVIEEGTJYKRRWYUELWNZTNV and a partial plain text: ...
1answer
906 views

### Can Elgamal be made additively homomorphic and how could it be used for E-voting?

Elgamal is a cryptosystem that is homomorphic over multiplication. How can I convert it to an additive homomorphic cryptosystem? How can I use this additive homomorphic Elgamal cryptosystem for ...
2answers
2k views

### Secure private key storage

I'm developing application in Java that has to store RSA keys in software for foreseeable future (that is, at least 10 years). The two most common standards of storing private keys are PKCS12 and JKS ...

15 30 50 per page