# All Questions

132 views

### Authentication protocols for authenticating devices to a server

The requirement is to authenticate 1000s of devices to a server when the devices try to contact the server. The problem I face is that all authentication protocols require some kind of shared secret ...
2k views

### Is encrypting a single 128 bit block with AES ECB “safe”

I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
475 views

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ... 2answers 169 views ### Current Status of mixnets for voting I am currently doing some research on universally verifiable mixnets, but it seems to me that there are too few papers about them after 2006 or so and most of them come from the team of Douglas ... 1answer 1k views ### Should the secret key of Shamir's secret-sharing algorithm be interpreted byte by byte? Should the secret message of Shamir's secret-sharing algorithm be interpreted and processed byte by byte? Interpreting it byte by byte makes it easier to process, but in case one of the shareholders ... 1answer 443 views ### Question about why RSA is hard to attack I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ... 1answer 145 views ### Any implication of a Yale result to security of quantum cryptology? Quantum key distribution depends, if I don't err, on (irreversible) damages done by MITM's measurements on qbits. Now news.yale.edu/2013/01/11/new-qubit-control-bodes-well-future-quantum-computing ... 2answers 902 views ### Hill cipher, unknown letter value I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix$K$of size$n\times n$, one ... 1answer 263 views ### Why does Schnorr's Digital Signature scheme necessitate two prime numbers? One of the necessary components to the Schnorr Digital Signature scheme is a pair of prime numbers$p$and$q$such that$q$divides$p-1.$However, there is never a modular inverse taken of q so why ... 1answer 470 views ### Is this a good way to encrypt a file? I need to encrypt a file, distribute it over an insecure channel, and decrypt it later. Using a symmetric-key algorithm. Here's what I intend to do: Get a password P from the user. Generate a 16-byte ... 1answer 605 views ### Storage of Private Keys I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ... 1answer 3k views ### Padding methods for block ciphers - PKCS7 vs ANSI X.923 I was looking through block cipher padding methods, and found two good candidates: ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ... 1answer 283 views ### Safely use CryptSignAndEncryptMessage? I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ... 1answer 416 views ### Memory-hard operations in work-factor hash functions I'm playing around with work-factor hash functions, and I'm looking for a memory-hard operation to make it resistant to GPU / parallel hardware attacks. I considered a very large (i.e. 64K) s-box that ... 2answers 347 views ### Is my HMAC secure if I have a complete series of HMAC'd prefix strings Let's say I have a long sentence, like "The quick brown fox jumped over the lazy dog." Let's further say that I need to keep this string encrypted, so I use an HMAC. Let's further further say I want ... 1answer 253 views ### One-way hash on encrypted data, result hidden from hasher I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ... 1answer 1k views ### Is this authenticated one-way communication protocol secure? I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ... 1answer 410 views ### Can a digital money system exist, that's secure, anonymous and allows offline transactions? I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that ... 1answer 2k views ### Trouble with diffie-hellman groups Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is ... 1answer 678 views ### Families of public/private keys in elliptic curve cryptography I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ... 1answer 626 views ### How close is homomorphic encryption to handling regular expressions? Is there any reasonable homomorphic encryption protocol that supports some meaningful fragment of regular languages/expressions and/or edit distance bounds? I'm suspicious that homomorphic encryption ... 1answer 202 views ### Academic papers on ECDSA security What are the most authoritative papers on the security analysis of ECDSAs? I`m mainly looking for comparisons of how secure different curves are considered to be, what potential methods are there of ... 1answer 188 views ### Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption? I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer ... 1answer 355 views ### How can I store confident data with OpenID? I want to make a system that needs to store some confident user information in a database. I intend on using OpenID for user authentication. I would like encrypt the data in a way that it can only be ... 1answer 239 views ### Why isn't the IND-CCA property inherited when sending redundant ciphertext? Suppose that in order to avoid loss in transmission, a secret key encryption scheme$(Gen, Enc, Dec)$is modified to be$(Gen, Enc', Dec')$, such that the message m is encrypted independently ... 3answers 347 views ### Designing a key expander out of ciphers Is it possible to compose or combine$n$ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate$n$ciphertexts from the same key,$k$, and that recovering the key,$k$, from ... 1answer 68 views ### Are there any high level memory-hard PBKDF constructions? The PBKDF2 construction from PKCS #5 v2 has the convenient feature that it can be implemented using only standard interchangeable cryptographic primitives. Specifically, it only requires the ... 1answer 70 views ### How do Käsper and Schwabe's Bitsliced AES Mixcolumns work? The only way I see it possible to do the matrix-multiplication in the MixColumns operation of AES is by shifting the bits in the multiplied number, and then reduce with the polynomial if needed. ... 1answer 57 views ### Padding password before SHA-512 hashing to avoid info leak via timing I've noticed that SHA-512 password hashing leaks some information about the password length. There's a weak correlation between password length and time to hash. It's roughly linear, but in steps of ... 1answer 139 views ### Encryption scheme like RSA where encryption is the inverse of decryption In RSA, it is basically equivalent to use the private key$d$to encrypt as it is to use the public key$e$to encrypt. They are exactly inverses:$e=d^{-1}$. I need to know, are there other public ... 1answer 274 views ### Zero-Knowledge Proof of a polynomial I have two secret values$L_1$,$L_2$, and two Pedersen commitments$C_1 = C(L_1)$,$C_2=C(L_2)$. The commitments$C_1$,$C_2$are public. Given a challenge$c$, I want to output$d = c*L_1+L_2$and ... 1answer 79 views ### Choice of the one-way function (OWF) for Lamport signatures I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ... 1answer 258 views ### How long does it take to decrypt an RSA/ECB encrypted message? I am working on assignment where I have specific scenarios and I am little bit struggling with this one. Alice sends and email to Bob.For this e-mail, she uses the following method of encryption: ... 1answer 113 views ### Coin flipping with limited communication between participants Alice and Bob want to play a coin flipping game. Alice wins if the coin flips head. They choose to trust a independent third party that generates a random beacon (such as NIST). There is no ... 2answers 972 views ### What are the strenghts and weaknesses of Whirlpool Hashing Algorithm I want to find out if the Whirlpool hashing algorithm have any weaknesses. There are quite a bit of articles explaining the strengths of this algorithm, but for some reason I cannot find any on its ... 1answer 138 views ### Why is the whole initial state used in the final addition of Salsa20 and ChaCha? Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ... 1answer 191 views ### Secure content-defined chunking Intro For deduplication purposes, I need to split a stream of plaintext bytes into variable-sized chunks. The way this is traditionally done is using a rolling hash function defined over some window$...
830 views

It seems that merkle hash tree (MHT) traversals have been discussed somewhat in the literature, but there does not appear to be much written on inserting, deleting, and updating leaves. Is this lack ...
204 views

### At what point does passphrase strength match the strength of the cipher?

Let's say that I have an ordinary hard drive encrypted with VeraCrypt 1.0e full disk encryption and implementing: -AES -RIPEMD-160 Hash Algorithm Now let's say that for an arbitrary machine, the ...
319 views

### Hash or compression function in Merkle tree nodes?

Wikipedia says about a Merkle tree: Nodes further up in the tree are the hashes of their respective children. Usually, a cryptographic hash function such as SHA-2 or SHA-3 is used for the hashing. ...
890 views

### Paillier can add and multiply, why is it only partially homomorphic?

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme. I've read here in another answer ...
268 views

### Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
151 views

514 views

### What could “look for the constants that you might find in RC6” mean?

In this presentation at the 30c3 (long but extremely interesting and well-documented), Jacob Appelbaum gave this verbal advice (circa 43'30"): look for the constants that you might find in RC6 I'...
889 views

### Can cryptocurrency mining devices be used for cryptanalysis?

In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies. These devices can perform SHA256 hashing at rates much higher than was seen in the past and are ...
1k views

### How is digital signature different from a message authentication code (MAC)?

I know the definitions of both but can't specifically tell how they are different and if one is better than the other. Please help.
226 views

### How HOTP values are validated according to RFC 4226

In Section 7.2 "Validation of HOTP Values" of the HOTP spec (RFC 4226) it says, in part, The HOTP client (hardware or software token) increments its counter and then calculates the next HOTP ...