# All Questions

138 views

### Verifying Without Knowing Key

Say user Bob sends an encrypted message to a server. People can download the message from this server and later get the key directly from Bob. Is it possible for the server to somehow verify that ...
37 views

### On the security definition of password-authenticated key exchange

I found in all PAKE papers, the security is defined as something like this: Let $Succ(A)$ be the probability that an attacker $A$ successfully distinguished the session key from a random string. Then ...
18 views

### Man-in-the-middle-Attack three Parties [duplicate]

How does this work in Diffie Hellman ? I'm working for days on this but i'm a little bit Confused. If Oscar changes only the last key (for example Kabc ) is this enough ?
23 views

### Using a round function intended for an SP network in a Feistel network?

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher? My thought is "yes" because: it already has ...
34 views

### Why are {0,1}-matrices almost-MDS only when n is 2, 3, or 4?

In this paper authors claim that {0,1}-matrices are almost-MDS (have branch number n - 1) on when n is 2, 3, or 4. For example, how can this two matrices have the same branch number? ...
272 views

### What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
185 views

### State recovery of Micalli-Schnorr random number generator modulo a prime

Let $p$ be a public prime of $n$ bits. Define the sequence $x_i=z_{i-1}^e \bmod p$, where $z_i$ is the $k$ high-order bits of $x_i$, and $r_i$ the remaining $n-k$ bits of $x_i$ (thus ...
15 views

### Chosen Ciphertext Attack on the Public Key in PGP

In Secrets & Lies (2000), Schneier describes a chosen ciphertext attack on the public key under PGP: "Since RSA and ElGamal are malleable, known changes can be made to the symmetric key that ...
307 views

### What does 0…0 and 1…1 mean

I am very new to cryptography but can someone explain what exactly does 0...0 and 1...1 mean in general term. Is it that 1st and ...
19 views

### Can a compressed checksum be considered unique

I'm kind of guessing that the answer may be no. Since the compression is trying to reduce the output size using various optimization methods, this may cancel the properties of a hash algorithm. But ...
51 views

### How to create and validate potential grids when attacking a Playfair cipher?

First up: I am not asking you to decypher anything. This question is about attacking a Playfair cipher; more specifically – how to create potential grids when doing so. I'm currently working on a ...
1k views

### NIST Diffie-Hellman prime: how was it picked? Where did it come from?

According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ...
207 views

### Is the “New Hope” Lattice Key Exchange vulnerable to a lattice analog of the Bernstein BADA55 Attack?

In the paper, "Post Quantum Key Exhange - A New Hope," the authors present a lattice-based key exchange based on the work of Chris Peikert. In this "New Hope" key exchange the authors try to gain ...
76 views

### XTS and 256-bit data blocks

I am developer of an application that uses XTS with ciphers which use 128-bit blocks (AES, Serpent and Twofish). I now want to use XTS with a cipher which uses 256-bit blocks (Shacal-2). AFAIK, I ...
261 views

### Which elliptic curves are quantum resistant? [closed]

If I want to learn about quantum resistant crytography what are the best resources? Which type of elliptic curves should I be studying?
63 views

### Can I use a block cipher in CTR mode to generate keys from a master key?

Suppose I have an AEAD mode based on a block cipher that requires two or more keys. In some cases, there is a complex proof that one key suffices. But finding such a proof is hard. An alternative ...
24 views

### How to know the size of an encrypted key that is encrypted using public key

I encrypted a key with a size of 32 bytes. I encrypted it using a public key. How will I know how big is the encrypted key(ciph)? My code: ...
44 views

### What does Video Encryption Algorithm really do? [closed]

So I read some paper suggesting video encryption algorithm (VEA) for encrypting video like MPEG, but when I google it, it only shows how it works in general, no mention about how it gets the key to ...
57 views

### Is ElGamal encryption still secure if the randomness is known to be even?

In ElGamal encryption $(g^r, g^mg^{kr})$, if the randomness $r$ is always chosen from even numbers, and the attacker knows about this, is it still provable secure?
42 views

### How long should a HMAC cryptographic key be?

In the top answer to this question the answerer says 'with a sufficently long key'. I am using a SHA1-HMAC (may switch to SHA256-HMAC) algorithm to verify cookies sent to clients as authentication ...
41 views

### Can the attack in https://eprint.iacr.org/2008/469.pdf be parallelized?

Can this attack be parallelized? It is a $2^{57}$ complexity collision attack on SHA-1 based on disturbance vectors. If it is practical it is easy on a GPU ($\approx1.1$ GPU-days). If it is ...
28 views

### How does Feistel cipher create diffusion between blocks?

From what I've read about Feistel ciphers, I can understand that within each block, there is both confusion and diffusion. But it is unclear to me how a Feistel cipher permutates among blocks of data. ...
38 views

### Creating ECDH using OpenSSL

For academic reasons, I'm playing around with OpennSSL 1.0.2g. I tested RSA encryption/decryption. I created key exchange with DHKE. But I'm struggling to find a way, to create ECDH, using only ...
94 views

### Can an adversary distinguish a private key from a pseudo-random string of the same length?

Apologies if this is a dumb question but allow me to describe the dilemma I have: Suppose that I am protecting a private key on a device using a password & PBKDF2. The obvious attack would be an ...
205 views

### How are calculated numbers in AES S-box?

I have a problem calculating the 0x02 value of the AES S-Box. I followed the steps descibed in “How are the AES S-Boxes calculated?”, but my answer is not correct. ...
30 views

### How do Galios fields work in AES? [duplicate]

I am trying to learn how AES functions but I keep hanging at the subject of Galios fields. I am reading a lot about them but I just can not find an understandable explaination in how they work. Could ...
639 views

### Calculate the RSA private exponent from the CRT parameters

I am trying to make the RSA structure of Openssl manually, knowing the public key ($n$, $e$) and the CRT parameters $p$, $q$, $d_P$, $d_Q$, and $u = q^{-1} \mod p$. That is, I want to get the $d$ ...
40 views

### tweakable block cipher and ideal block cipher

Can the set of block ciphers obtained from a tweakable block cipher (using distinct tweaks) be considered as the set of ideal block ciphers ?
45 views

### Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures ...
39 views

### Is a chosen ciphertext attack on PGP still possible?

In a paper from 2002 (pdf), Jallad et al describe a chosen ciphertext attack on PGP by taking advantage of the CFB mode that the block ciphers use under PGP. It's quite a devastating attack. Is this ...
13k views

### How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use? The original cracking was significantly helped by operator ...
47 views

### The role of the dealer in visual cryptography

In visual cryptography schemes (VCS), there is special person called dealer. The dealer sets up the system, and the only one who knows about secret image. After encryption, the dealer distributes the ...
41 views

### Appropriate scrypt parameters when generating an scrypt hash

What values for CPU, memory and parallel difficulty should be used when generating an scrypt hash? i.e. ...
32 views

### how a MITM attack works against tripartite in DH? [closed]

Must Oscar change only the Key $K_{abc}$ (Alice, Bob and Charlie) or does he have one key for everyone of them ?
592 views

### How does blocksize affect security?

I have recently read about how blockciphers and how stream ciphers work, and although I think I finally got everything right, I'm still wondering how increasing blocksize increases security.
4k views

### What is a “freestart collision”?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
97 views

### RSA 3072 is 65,536 more difficult to factor than 2048?

If RSA 3072 is equal to 128 bit symmetric and 2048 is equal to 112 bit symmetric then 128-112= 16 and 2^16= 65,536. In that case wouldn't this make 3072 more future proof against quantum computers or ...
20 views

### Having trouble with a double encoded keyword sypher [closed]

IIYFATKOHRFDQLRTUKFOLDTIQLTFAZLGZFUNCKYCEFUCUQUGCWWOGYSOCZTXGZPNHYPMPQDOLNONAZOEQLUSEYELNUDEPQDOKPTIPQTYCZUZQQORUFANHQRGHIUJUQOEQQUWKEURLYHCSLUCUUUFKLUNAYLRUFAZQZONKYIGBKYITDOEAWGDPIKOOTRCUJLIGZWNSZGC ...
50 views

### Randomness of a Key in a One Time Pad

The keys used in an One Time Pad are required to be randomly generated from a keyspace $\mathcal{K}$, we require 256 bit random keys, i.e. $\mathcal{K}=\{0,1\}^{256}.$ Suppose we randomly select an ...
53 views

### Key Hierarchy and key Encryption

If i have two 56-bit DES keys, and I use these two key to encrypt a 256-bit AES key. Like this $K_{AT}$ encrypts $K_{BT}$ and $K_{BT}$ encrypts $K$ What is the effective security of key $K$? Is it ...
199 views

### Finding the subgroup in isogeny-based cryptography

Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem: Elliptic curves ...
37 views

### McEliece variants that support signatures

Besides the Niederreiter cryptosystem, are there any other variants that support digital signatures? Can any of them sign arbitrary signatures unlike the Niederreiter cryptosystem? What are the key ...
47 views

### Expire signature

I am looking for a way to have a 'did it expired' key. There's a similar question here, but I have to prevent reusing of the 'did it expired' signature . A possible solution would be a two one-way ...
73 views

### How to break a 32 bit block cipher without key?

From what I know Skip32 is the only 32 bit block cipher and I heard its not secure. What do I do or which tool do I use to break a 32-bit block cipher? I did search for this but all I find is attacks ...
11k views

### What makes RSA secure by using prime numbers?

I am just learning about the RSA algorithm. Looking at the first two steps: Choose two distinct prime numbers $p$ and $q$. Compute $n = pq$. I have some probably stupid questions: Why do $p$ ...
55 views

### What does $\langle A, B\rangle$ mean?

I'm reading about CL-PKC and in Al-Riyami's FullIndent, I find some notations I must be sure to understand, to well explain it ...
230 views

### Formal verification in cryptography

I have seen in some places that people use formal verification and/or computer-aided verification for cryptography (tools like ProVerif, CryptoVerif, etc.). How do these approaches work?
46 views

### Motivation for the definition of statistical distance

Statistical distance is a widely used measure in cryptography for comparing two distributions. One can define various other measures for capturing the differences between two distributions, but why do ...