# All Questions

948 views

### ElGamal signature without calculating the inverse

I stumbled upon this question in some textbook. Propose a variant of ElGamal signature scheme such that there is no need to calculate the inverse $k^{-1}$ as it is usually done using the EEA. ...
2k views

### Any good file format alternative to PGP for encrypting data at rest?

I'd like to create an encrypted file that: Can be decrypted on a variety of platforms (mainly Windows, OS X, and Linux) with knowledge of the key. Can be decrypted with existing tools (perhaps ...
33 views

### In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given: Hash MGF Appendix B.2.1 of the same document states that MGF1 is based on a hash function. Is MGF1 based on the ...
135 views

### How can I instantiate a generalized hash function?

I've come across a bunch of "strange" hash function notations, such as the following ones and now I don't know how to choose / instantiate them. Can you please explain me what this notation means and ...
60 views

### Is ElGamal encryption still secure if the randomness is known to be even?

In ElGamal encryption $(g^r, g^mg^{kr})$, if the randomness $r$ is always chosen from even numbers, and the attacker knows about this, is it still provable secure?
158 views

### Key size for HMAC-SHA256 [duplicate]

After reading a bunch of past stack exchange posts like this one and RFCs 5869, 2104, and 4868 I felt comfortable that a 32-byte key was sufficient for HMAC-SHA256. However, I am implementing my code ...
61 views

247 views

### Is there an algorithm to check if an elliptic curve is secure?

As I understand it elliptic curves are of the form $y^2 = x^3 + ax + b$ Where $a$ and $b$ are the curve parameters. However not all parameters will give a curve suitable for crypto purposes. Is there ...
161 views

### How can I find the order of the group that an elliptic curve is defined over?

I have a Weierstrass elliptic curve ($y^2=x^3+a \times x+b \mod p$) How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] ...
216 views

### What functions allow for practical indistinguishability obfuscation?

Recently, there has been a major theoretical breakthrough in program obfuscation, in the area of indistinguishability obfuscation. Background: Indistinguishability obfuscation is a form of program ...
702 views

### I need a 64-bit cryptographic hash for 96 bits of data

I have a situation in which I need to combine a 32-bit datum, G, and a 64-bit datum, I, to produce a 64-bit datum. No two ...
83 views

What is significance of recovering the chaining value of a compression function, when the message and its output are known? in other words, if a compression function $CF$ takes a chaining value $h_{in}... 1answer 133 views ### Has a Two Key TDES encryption ever been successfully attacked? Is there any known instance of a Two Key TDES ever being successfully attacked (in real life), when the key is used to encrypt less than$2^{20}$words? 1answer 396 views ### Brute Force on 3DES with Reduced Keyspace and Unknown IV I'm trying to brute force a 3DES problem given a reduced keyspace (ie I know the first half of the key) but with an unknown IV. The code decrypts to plaintext. My first thought was that I could set ... 1answer 445 views ### FHE - Brakerski's “Scale Invariant” Scheme I thought the current state of the art for fully homomorphic encryption was Brakerski, Gentry and Vaikuntanathan's scheme (BGV) based on standard/ring LWE employing modulus switching for noise ... 1answer 228 views ### MARS and RC6 in CUDA I am working on a project where I am benchmarking the 5 AES finalists (Rijndael, Twofish, Serpent, MARS and RC6) on CUDA Hardware. My problem is that I am no experienced CUDA programmer. My approach ... 2answers 942 views ### Camellia or AES - which should I use? [closed] Imagine I am a software developer. I want a block cipher, and I have the choice of using AES or Camellia. Which should I use? Which makes more sense from a technical perspective, and why? I need ... 2answers 1k views ### Storing Credentials for a Third Party (Originally posted to SOF, but I got no answers) I am designing a small application for use inside my company. My application needs to connect to a third party website on behalf of my application ... 1answer 834 views ### Authenticated encryption mode for stream cipher? E. g. block ciphers have GCM or OCB, that take single cryptographic primitive (block cipher) and provide both authentication and encryption. Are there similar constructs for stream ciphers, which ... 1answer 1k views ### AES-SIV security I am invesigating the AES-SIV (rfc 5297) based block cipher. The construction of the S2V is lying on the AES-CMAC and dbl and XOR operation. Given a AAD the size of L and in the 128bit block ... 2answers 2k views ### Why is SRP not widely used? SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations? I tried to ... 1answer 784 views ### Client and server using same SSL certificate - any issues? I'm working on software where multiple components will communicate with each other using SSL. There would be one central component acting as a server, which would also require the clients to present ... 1answer 332 views ### Key collision in scrypt and hkdf I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ... 1answer 713 views ### Understanding Feldman's VSS with a simple example I'm trying to understand Feldman's VSS Scheme. The basic idea of that scheme is that one uses Shamir secret sharing to share a secret and commitments of the coefficients of the polynomial to allow the ... 1answer 296 views ### Does Grover's algorithm effect block size or only key size? We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security). I heard somewhere ... 1answer 299 views ### How to communicate authentication tag for GCM? I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag? 2answers 947 views ### Using bad generator in ElGamal Encryption Suppose Alice chooses a random Prime$p$and a random private Key$a \in \mathbb{Z}^*_p$. By accident, she also chooses a random number$g \in \mathbb{Z}^*_p$, which is not a generator of$\mathbb{Z}^*...
Let $h$ be a bitstring and let $P(h, n)$ be the n-bit prefix of $h$. A partial collision of length $n$, for a hash function $H$ is a pair $(x,y)$, such that $P(H(x),n)=P(H(y),n)$. What is known about ...