# All Questions

34 views

### OTP same message encrypted twice (with different keys)

Lets say we have a message $m$ that we encrypt with two keys $k_1, k_2$ such that $k_1 \ne k_2$. This will produce two ciphertexts $c_1, c_2$ such that $c_1 = m \oplus k_1, c_2 = m \oplus k_2$. The ...
35 views

### How to build a secure cryptographic algorithm [closed]

I need some info about the building of a cryptographic system. I would like to know the flow to follow and if there is some books or paper that covers this topic, because I know to concatenate ...
952 views

### CKM_RSA_PKCS vs CKM_RSA_X_509 mechanisms in PKCS#11

What is the exact difference between the CKM_RSA_PKCS and CKM_RSA_X_509 mechanisms in the PKCS#11 v2.20 specification (Please ...
3k views

### Diffie-Hellman and man-in-the-middle attacks

See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman? How do we combat this? I have two questions: Is one solution for both Alice and Bob ...
38 views

### Why an upside down path on the evaluation of branching program on encrypted data?

Suggested by Ricky Demer in this post, I am reading the paper "Evaluating Branching Programs on Encrypted Data"(TCC 2007), which uses one-round strong OT protocol to implement homomorphic evaluation ...
60 views

### Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...
84 views

### Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
34 views

### Are there any encryption schemes that enable to permute homomorphically?

According to the Barrington's theorem, any circuit in NC1 can be converted to a branching program, whose main operation is the composition of permutations (along with the choosing of permutations ...
38 views

### Why the $IV$ used in Merkle-Damgard has to be fixed to a specific value?

I just can't figure out why on earth the $IV$ in Merkle-Damgard has to be fixed (that's what the Katz-Lindell book says)? Because even if you choose it randomly from say $\{{0,1}\}^n$ then the ...
2k views

### Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?

I understand the need for padding in MD5. But why do we append the message length to the padding? I heard it strengthens the hash but how? Please provide an example if possible and how it applies to ...
33 views

### Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?

I recentely asked "IND-CCA1 RSA padding?" about whether there is a IND-CCA1 secure variant of RSA. The original version of the question also allowed usage of ECC which would allow usage of ElGamal, ...
28 views

### Request for review: known plaintext mitigation by rotation and xor encoding

When using structured data inside a plaintext (such as gzip headers, xml, etc.) they generate known plaintext which may be useful in cracking the ciphertext. So I had these two ideas on how to make ...
28 views

### how to do AES decryption knowing the key (matasano) [closed]

I'm doing the challenge in matasano and I'm doing something wrong cause I don't understand what to do. All I want to do for now is to decrypt the first block (128 bits) and then I will code the rest ...
39 views

### El-Gamal signature with two messages

Alice uses an ElGamal signature with base the group $Z^*_{107}$ and parameter $g=3$ of order $q=53$.The private key of Alice is some $x \in \{0,1,.....,52\}$ and the public key of her is $y=10$. To ...
28 views

### Modular reduction for NIST prime P256— understanding the data

I am working on a project where I need to implement elliptic curve cryptography, I am struggling from a long time in order to understand the working and the process. Modular finite field arithmetic, ...
38 views

### Triple-DES DUKPT CBC PIN variant vs Data variant

Does any know the difference between triple des dukpt decryption algorithm with PIN variant and Data variant? I have done Triple DES DUKPT PIN variant, which generate session key from KSN and BDK. ...
4k views

### Is there a secure cryptosystem that can be performed mentally?

I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
70 views

### How to prove the hardness of Rabin's function?

I am unable to prove the following theorem: If for a $1/(\log(n))$ fraction of the quadratic residues $q\pmod n$ one could find a square root of $q$, then one could factor $n$ in random polynomial ...
39 views

### Probability of $D_k(a*k+b) =p$ for a PRP

I'm wondering what the probability of a PRP having numerous keys (say 3 or more) with the same simple idempotent, or near identity, function. For example, does there exist values of $p, a, b, x_1,$ ...
119 views

### Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
66 views

### P-Complete hashes, hashing to a larger set

Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
8 views

### Enhanced Security Services / CAdES for PKCS7 - multiple signers for SignerInfo's?

In RFC5652, Cryptographic Message Syntax (CMS), section 5.3. SignerInfo Type, there's a sid field that maps to this: ...
31 views

### OPE ON SYNONYM BASED RANKED KEYWORD SEARCH

I had already studied, order preserving encryption(ope) is suitable for ranked keyword search. But i want to use order preserving encryption(ope) for synonym based ranked keyword search. it this ...
59 views

### How can you produce visual cryptography?

I would like to be able to "code" images such as the one seen here on Wikipedia. Is this generally produced with software, or does this require complex programming? Ideally, I would love to be able ...
51 views

### Possible to determine equivalence of hash codes from different hashing functions?

Let $H_{1}(x)$, $H_{2}(x)$, ..., $H_{n}(x)$ be a list of $n$ secure one-way hash functions such that for a given input $x$ each $H_{i}(x) \neq H_{j}(x)$ when $i \neq j$. Give one hash function to ...
30 views

### Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
41 views

### Why should $a,b < N$ for Montgomery Reduction?

In Montgomery reduction, when calculating $a \times b \mod N$, it is required that $a \lt N$ and $b \lt N$. I think $0 \le T \lt N \times R$ is enough for the Montgomery Reduction. Rationale: Let ...
23 views

### RC4 via nonlinear mixer — sound?

We implemented a rc4 (ARC4) variant for creating a cryptographic stream - question is: Is this sound? (I'll give an example for 32 bit variant, though 64 bit/larger is possible) Algorithm is as ...
21 views

### For each of the following modifications to the Merkle-Damgard transform, determine whether the result is collision resistant or not

$(a)$ Modify the construction so that the input length is not included at all (i.e., output $z_B$ and not $z_{B+1}=h^s(z_B||L)$). $(b)$ Modify the construction so that instead of outputting ...
42 views

### Safety of AES ECB when used with openssl_seal function

I'm trying to use PHP to encrypt files with a public key. I'm using the function openssl_seal that "encrypts data by using RC4 with a randomly generated secret key." RC4 is considered unsafe so the ...
72 views

### How is wpa2 authentication structured

I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes. First, I am trying to ...
48 views

### Let $G$ be a PRG. Are the following $G'$ constructions based on $G$ necessarily PRGs?

$G$ is a PRG where $|G(s)| > 2 \cdot |s|$. $G'(s) = G(s0^{|s|})$. $G'(s) = G(s_1...s_{n/2})$, where $s = s_1...s_n$. My question here is whether my own proposed solutions are correct and do ...
49 views

### How to formally prove that a given hash construction is collision resistant or not?

Is there a precise procedure or strategy to follow in order to prove in a formal way the (not) collision-resistance of a certain given hash construction? I.e. let $H_1$ and $H_2$ be two hash ...
44 views

### Is there a standard for public key encrypting and signing short messages?

Some systems, that operate over flaky bearers, need to send signed, encrypted messages that are entirely self contained - i.e. send a single 300 byte UDP rather than have a 10Kb, two-way, certificate ...
36 views

### Question about OR operation in fully homomorphic encryption

This page (which won't let me post a comment, sadly!) describes how the original FHE paper by Craig Gentry describes FHE. (Other references to this stuff can be found on this question.) It mentions ...
72 views

### Combine two sha512 hashes to a single hash

Assume I have two data fragments: $Frag_1$ and $Frag_2$. I can build sha512 hashes the usual way with $SHA512(Frag_1)$ and $SHA512(Frag_2)$ and then hash the two fragments appended to each other: ...
22 views

### Diffie-Hellman in the wild

Say we have a public network and lots of peers. Each may need to communicate with another peer. Would there be any huge security issue to each peer making the the public part of their key openly ...
181 views

### zendo data size restrictions

zendo is a new mobile phone app which encrypts messages using a one-time pad: http://techcrunch.com/2015/03/24/one-time-pads-ride-again/ users have to meet in person and exchange a key via a qr ...
50 views

### Elligator-2 against curves over Fq, q mod 4 = 3

It appears that the conditions for applicability of Elligator-2 against many of the SaveCurves curves, where $q \mod 4 = 3$ will inevitably poke a hole in the bit-string set over $(0, 1, .. (q-1)/2)$. ...
32 views

### Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
546 views

### KCV and compatibility with block cipher modes of operation

There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ...
34 views

### Is a 256 bit HMAC-SHA256 key compromised if the tail is used for identification?

Using a truncated hash of a key seems to be a safe way to identify the key (i.e. key fingerprint), but what about truncating a key itself in the case of HMAC-SHA256? Example: ...
34 views

### Stern identification scheme to signature scheme

I'm trying to understand the comment in the page 103 of the book Postquantum Cryptography. about convert the identification Stern procedure for signing. Can you write an example of signature of this ...
46 views

### How does the birthday paradox apply to random keys?

I'm developing a web app where I wish to use pseudorandom keys for items, perhaps akin to Imgur. I was thinking about how many combinations I need to reduce the chance of someone guessing any random ...
47 views

### Determine if encryption is safe against CPA

The following encryption scheme encrypts each block of length $n$ of the plaintext separately: $c_i = k_1 \oplus F(k_2 \oplus p_i)$ Where $F$ is a strong pseudo-random permutation (i.e. it is easy ...
78 views

### Digital Signature Attack

In a typical digital signature scheme in which in order to sign we compute: hash of the message: $h(m)$ resulting hash signed with the private key $[h(m)](private key)$ If there were a collision ...
352 views

### Combining several symmetric ciphers using XOR

I have seen a talk by Rüdiger Weis, where he says that you can combine two symmetric ciphers using XOR. According to him, that has the effect that its sufficient if only one of the ciphers is secure. ...
270 views

### Compact digital signature for noisy data

The question asks for a signature scheme, with a public verification procedure, that is tolerant to minor alterations of the signed data during its transmission [possibly in analog form over some ...
I know the question is rather unusual, but let me clarify what I'm searching for: There is one person, lets call her $Alice$. $Alice$ has $n$ plaintexts $t_1..t_n$ and $n$ public keys $pk_1..pk_n$ of ...