# All Questions

471 views

### Additive ElGamal cryptosystem using a finite field

I'm trying to implement a modified version of the ElGamal cryptosystem as specified by Cramer et al. in "A secure and optimally efficient multi-authority election scheme", which possesses additive ...
507 views

### Advanced Encryption Standard Algorithm Secret Key

just a follow up question with this question.. How does the key schedule of Rijndael looks for keysizes other than 128 bit? A 256-bit key can still encrypt a block of plaintext in 128 bit? but in ...
884 views

### X9.62 Multiplying an elliptic curve point by a number

I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number. As far as i understand X9.62 gives some recommendation for doing it but i ...
4k views

### How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
197 views

### Is a subset of a random set still random?

Suppose you have an infinite list of random bytes, and you select the first N bytes that correspond to printable ASCII characters. Is this list of N bytes still as secure (e.g. for the purpose of a ...
96 views

### Is the following scheme secure for different cipher

Let's say I have two keys K1 and K2. two messages M1 and M2 of the same length. Cipher (E,D) 3 ciphertexts: C11, C12,C22 where Cij = E(Ki, Mj) In situation ...
345 views

### What is the computational cost of a public key certificate signature verification?

What is the computational cost of a certificate signature verification in terms of exponentiation, multiplication and other computation operations?
806 views

### Is RSA of a random nonce with no padding safe?

Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
181 views

### Helper data authentication in PUFs

As I understand, PUFs work by using two procedures: generation and reproduction. Generation reads a value $w$ from a fuzzy source and generates a key $R$ and helper data $P$. Then, in the reproduction ...
264 views

### How safe is it to derive MAC key from a hashed password?

Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ...
143 views

### Is a using salt important when creating a hash data validator?

I am creating a service that will return an set of objects, which will be used by multiple systems. At the end of the process, one (or more) of the objects will be sent back to our system for ...
137 views

### What is sent on the initial communication with Kerberos?

When a user wants to communicate with another user (let's say Alice and Bob), what is sent over the network during the initial communication? Alice uses her Kerberos client and enters her password ...
74 views

### Are variable-length crypto hash functions still susceptible to collisions?

I just recently learned that the SHA-3 finalist Keccak allows for variable length output. As the only answer to this question states, "[it] need to have an output length at least equal to the input ...
164 views

### Attacking unuauthenticated RSA

In symmetric cryptography, a scheme is not considered secure if the data transmitted is only encrypted. The adversary will be able to modify messages to generate encrypted messages of his choice ...
51 views

### CBC-MAC key can be added to ciphertext?

I use AES both CBC and CBC-MAC to encrypt some stuff. I generate one key for CBC and one different key for CBC-MAC. Does the second key (for CBC-MAC) need to be secret? How to join such key with the ...
195 views

### Rely on NSA Suite B Cryptography?

NSA's Suite B Cryptography suggests some cryptographic algorithms for encryption, digital signatures, message digests and key agreements. The selected algorithms and their key size are suggested by ...
117 views

### AES256-GCM - can someone explain how to use it securely (ruby)

I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly ...
192 views

### RSA example-calculation: Public Key = Private Key (e = d)

I am a bit confused. I just calculated manually the single steps of RSA for an implementation with small numbers and suddenly $d$ was equal $e$. Please help me understand what I am doing wrong. ...
88 views

### Does $i^n=j^n$ for $i, j \in GF(2^q)$ and $i \neq j$ for some $n<2^q-1$

Let $i, j \in GF(2^q)$ and $i \neq j$ and $i,j\neq0$. Is that possible that $i^n=j^n$ for some $n$ such that $0 < n < 2^q-1$? I am looking for a proof if the answer is no, or for a method to ...
181 views

### What are the key differences between the draft SHA-3 standard and the Keccak submission?

I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014). Previously it ...
184 views

### Is a random oracle controled by the challenger?

When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger? What if the Hash is only used by the adversary?
183 views

### Is it meaningful to consider the leakage of master key of KGC?

In the Identity-based cryptography, the user's private key in the systems is delivered by the key generation center(KGC). My question is : Is it meaningful to consider the leakage of master key of ...
238 views

### Making my steganography code more hard to detect and crack

I'm doing a college project about digital image steganography on MATLAB. So far i've been able to get the help i needed from cool guys on stackoverflow but i now need to make my algorithm more hard to ...
101 views

### Choice of reduction polynomial in Whirlpool's internal cipher

Whirlpool is an interesting little hash function in the Miyaguchi-Preneel family. In my mind, it's most interesting feature is the design of internal cipher W, where the distinction between key and ...
271 views

### Breaking a PRNG Scheme

Assume the following scheme for a PRNG generating decimals in [0,100) Given a message and a key, compute tag := HMAC512(message, key). Take the first 5 hexadecimal characters of the tag. If the ...
100 views

I have a question which arised by analyzing the one-time pad cipher. I encrypt a binary sequence $a_1,a_2,..,a_N$ using a one-time pad with key sequence $k_1,k_2,k_3,...$, so I send $a_1+k_1, ... 1answer 131 views ### Password hashing in /etc/shadow Passwords hashed under Unix/Linux systems can use several hashing algorithms. ... 2answers 79 views ### Possible to check if$a \in \mathrm{QR}_n$? It is possible to check$a \in \mathrm{QR}_p \text{ iff } a^{(p-1)/2} \equiv 1\ (\bmod\ p)$if$p$is a prime.$n$is a large RSA modulus. Is it also possible to check if$a \in \mathrm{QR}_n$if the ... 1answer 98 views ### Logical OR operation in a homomorphic additive cryptosystem Suppose we have a cryptosystem homomorphic for addition (say Paillier's). Is there a way to perform a logical OR operation between two binary values (with a binary result). We can, of course, obtain ... 1answer 148 views ### How can Shamir's method for secret sharing work in the GF(256)? I have been reading about Shamir's secret sharing, and maybe i completely misunderstand something, but the field is meant to be a prime. However, when i look at the implementations of this algorithm, ... 2answers 131 views ### Merkle Tree High Tree I'm reading Merkle tree signatures and I like know if the security of the that scheme depends, also, of the high of the tree or only depends that hash function is resistant to collision? 1answer 122 views ### How can two (or more) parties share and agree upon a common random seed? I really don't know how to call this simple problem: Two (or more) parties need to establish a common (non-secret) value to be used as a seed for a deterministic RNG. The only requirement is that each ... 2answers 134 views ### Is there a name for this 'enhanced' caeser shift and if so, is it trivial to break? This cipher shifts the letter that it will shift to, after each shift... I used to play with this when I was a kid. I was thinking about it recently and realized that it wasn't as simple as I ... 1answer 195 views ### How to calculate entropy of a combined key I know how to calculate the entropy of a key that relates to its selection process. For example if the key space is$1000$, entropy of a randomly chosen key is$1000$. Suppose now you have two keys ... 2answers 549 views ### Attacking 2DES efficiently Meet in the middle on 2DES uses$2^{56}$memory. Given the fact that the attacker has only$2^{45}$memory. How can the attacker adjust the attack so even with this memory limit, it will still be more ... 1answer 204 views ### How does the IV or initial counter increase internally for each block in AES CTR mode? I am working on Intel AES-NI library and since the AES function is coded using low-level assembly instructions. I could not see how the IV or initial counter increases in CTR mode. In general, how ... 1answer 173 views ### Why is a simple hash into$G_2$for (certain) pairing based crypto not possible? In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve$E$over$\mathbb{F}_q$with embedding degree$k>1$and ... 2answers 259 views ### Definition of a CSPRNG I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ... 2answers 210 views ### Is there a companion algorithm for OTP to ensure integrity and/or authentication? One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved: Fast generation of independent and identically distributed random variables Perfect key ... 1answer 262 views ### Why does NaCl's crypto_secretbox for xsalsa20-poly1305 require the first 32 bytes to be zero? The NaCl web site says this is a requirement of the API, but its seems more than just an API issue. It means the first 32 bytes of the first salsa20 block are effectively ignored. I didn't see ... 2answers 248 views ### Decrypting without using the private key Let$g$be a generator of a multiplicative group$G$of order$q$,$x$be a private key, and$h=g^x$be a public key of an exponential ElGamal cryptosystem. Given a ciphertext$c$produced as the ... 1answer 155 views ### How does redundancy in a file effects performance and security of encryption? Does redundancy in a file or data effect performance and security of encryption? (for example for AES, if not for general case) Is it easier to encrypt something that has high redundancy or something ... 1answer 111 views ### Why are huge prime numbers important in cryptography? I read an article the other day about the search for prime numbers. According to the article and several online sources the biggest prime number is over 17 million digits! This made me wonder why ... 2answers 456 views ### Difference between salted hash and keyed hashing? A cryptographic salt is additional input other than message itself for a hash function so that it prevents attacker from launching dictionary attacks . Usually the salt is stored along with the hash ... 1answer 322 views ### Where is the S-Box generated in Rijandel/AES? It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ... 1answer 265 views ### Proof of correct construction of a private key in distributed cryptography In an exponential ElGamal encryption scheme where the key generation is done in a distributed way among$n$trustees we have that each trustee$i$(where$1 \leq i \leq n$): Selects a private key ... 1answer 130 views ### Can GCM be used in incremental mode? I want to sync blobs over the network and the most frequent change will be appending to blob. To minimize data amount sent I would prefer to encrypt appended data, send it over the network, append to ... 2answers 213 views ### Is it possible that two distinct RSA moduli share both of their prime factors? I am using an algorithm (can be found here1) that can compute efficiently the GCD of multiple RSA keys. It intended for RSA keys that were generated with low entropy and may have one of their primes ... 2answers 1k views ### Is a 1024-bit DSA key considered safe? I created my PGP key in 2000. I’ve revoked the older, weaker sub-keys in favor of a 4096-bit RSA one, but the primary key is 1024-bit DSA. I read on Wikipedia that… NIST 800-57 recommends lengths ... 2answers 199 views ### Efficiency of finding sub group order vs factorization Suppose you got a prime$p = 2\mathbb\Pi_{i=0}^{n-1}q_i+1$, where$2^{k-1} \lt q_i \lt 2^k$for some$k$and all$0 \le i \lt n$, and that you also got a generator$g\$ of one of the prime order sub ...

15 30 50 per page