# All Questions

2answers
855 views

### What happens when a root CA has its private key compromised?

What happens when a root CA has its private key compromised? Then all children in the tree are compromised too? And then all certificates are compromised? What needs to happen then? Related: - How ...
1answer
157 views

### I've got my private key compromised. How does CRL work?

How does certificate revocation list (CRL) work? How can I send a request to the CA to add my current private key to the CRL, so no one except me can add my certificate to the CRL? Related: - How can ...
1answer
165 views

### How can we get CA's public key?

To get a public key of some organization or someone we want to send an encrypted message to, we need to make a request to CA asking that organization's public key. CA then returns X509 certificate. It ...
1answer
545 views

### Homomorphic (encrypted) comparison to an integer

When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted value of a comparison test to an integer value (I realise that an ...
2answers
327 views

### How should we interpret the cryptanalysis results of SIMON and SPECK?

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for ...
4answers
257 views

### Is there a proof for showing any cryptogram is crackable?

I commonly hear statements along the lines of "all cryptograms are crackable - it's only a matter of time". Is there a proof to show that any cryptogram is "crackable"? The proof may be of a more ...
1answer
169 views

### modfied man in the middle attack diffie hellman

I have been given a problem in preparation for my cryptography final that I'm not sure how to solve. It asks me to suppose a scenario where instead of where an attacker would intercept some message ...
2answers
597 views

Given two sets of plaintexts and their corresponding ciphertexts, how does one determine the key $K$? The ciphertexts are: $$C_1= (P_1 \oplus K_0) + K_1$$ and $$C_2= (P_2 \oplus K_0) + K_1$$ $K = ... 1answer 176 views ### Is there a cryptographic hash function that can be performed with pencil and paper? Imagine I'm signing up for the 99th new web site this month. I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into ... 2answers 86 views ### MD5 theoretical question Ok, so this is a very possible stupid question, but one of those things that has sat at the back of my mind for a while. We all know that MD5 has issues, and these have been known for about a decade. ... 1answer 90 views ### SHA-1 Keyed Hash Function I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is: How I will be able to formalize the ... 1answer 105 views ### How to store keys for a cascading encryption? What is the best way to implement a cascade encryption? I'm trying to figure out how to cipher a string (or message) using Serpent-Twofish-AES and then store the keys. I'll provide an explanation, ... 2answers 114 views ### How does secret sharing solve the partial exposure problem? I have been trying to understand how secret sharing methods like Shamir's secret sharing solve the problem of a share revealing information about the secret. I guess there are some random numbers ... 1answer 98 views ### Explicit Key SHA-1 I'm reading “Collision-Resistant Hashing? Towards Making UOWHFs Practical” and in the Section 2 it says: Hash functions like MD5 or SHA-1 have no explicit key. But no notion of ... 1answer 101 views ### Why is appending the key to a mesage and then hashing that insecure if the hash isn't weakly collision resistant? [duplicate] Suppose I have H(M|K) and that H is not weakly collision resistant. If I have a message mac pair (M,MAC), how is it possible to find another message mac pair (M2,MAC2)? My thinking for this problem is ... 1answer 232 views ### Can you explain partial private key extract algorithm in certificateless Public key cryptography? Related to the algorithms of certificate-less Signature approach of Al-Riyami and Paterson… Why is there a need for a "partial private key extract algorithm"? Why should it be needed when ... 2answers 215 views ### Can anyone give an example where (asymmetric) crypto can go wrong due to selection of wrong groups? Basically the title says it all. It would be great if someone could tell give an example using provable security. More information about groups can be found at: ... 0answers 68 views ### Are there public$p$and$q$numbers for use in DSA? There are many RFC documents giving large primes to use in Diffie-Hellman. However, I couldn't find standards on the$p$and$q$large primes used in the DSA signature scheme. This is proving to be a ... 1answer 134 views ### How do I cryptanalyze a password field? In a PostgreSQL database, I can see the following fields in a table (for a specific record): User = administrator Password = "ceMv9Me6go" Now the following are true: The password length is not ... 1answer 336 views ### Diffie-Hellman Secret Exponent Size and Shared Secret Usage [closed] I'm developing my own protocol and I'll use Diffie-Hellman to achieve PFS. It will work in this way: The symmetric encryption algorithm will be AES_256_CBC. The DH parameters will be: P: a 2048-bit ... 1answer 186 views ### Can two people with different one time pads securely exchange a message like this? Alice has a message, generates a one time pad, encrypts her message and sends it to Bob. Bob generates his own one time pad, encrypts the message again, and sends it back to Alice. Alice then decrypts ... 1answer 122 views ### How can two (or more) parties share and agree upon a common random seed? I really don't know how to call this simple problem: Two (or more) parties need to establish a common (non-secret) value to be used as a seed for a deterministic RNG. The only requirement is that each ... 2answers 171 views ### Why don't we use MACs to store passwords? These days, the best practice for storing passwords is to use a scheme like scrypt or bcrypt. The goal of these schemes is to make dictionary attack inefficient for an attacker but it also slows down ... 1answer 581 views ### Is it true for Java that the transformation mode and padding is ignored when using RSA? Consider GregS's comment to this question (more specific to bouncycastle's provider implementation): http://stackoverflow.com/questions/11717646/bouncycastle-rsa-key-size-and-padding The mode, ... 1answer 106 views ### No Birthday Attack to TCR I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” , which compared TCR (Target Collision Resistant) and ACR (Any collision Resistant). It says we wish to stress ... 1answer 57 views ### Weaker Notion of Target Collision Resistance I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: While it might be easy to find a collision$M,M'$in$F_K$by making both$M,M'$depend on$K$... 1answer 69 views ### Dependence on Keyed Hash Function I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: With an ACR hash function$F$the key$K$is announced and the adversary wins if she manages to ... 1answer 213 views ### Public-key cryptosystems without poly-time quantum attacks It's well-known that Shor's algorithm can solve integer factorization, discrete logarithm and discrete log over elliptic curves in cubic time. This implies that cryptosystems like RSA, ElGamal, and ... 1answer 1k views ### What does AES256-CTS-HMAC-SHA1-96 mean in relation to Kerberos? I'm not completely clueless as to what it means, but I'd like to understand it at a higher level. The highest encryption type used by Active Directory domain controllers for Kerberos authentication ... 1answer 112 views ### Decryption or attacking DES encrypted file I have a file that has been encrypted using DES and am looking to decrypt and find a secret message encoded. All I have is the file which is full of binary data. There is no key or anything else which ... 1answer 92 views ### Can Diffie-Hellman generate values in a specified range? Is there any way to generate values only between$0$and$255$with the Diffie-Hellman method? I need to create keys for communication algorithms with$32$and$16$numbers between that range. The ... 0answers 66 views ### Perfect Forward Secrecy in MTI/A0 Would the property of perfect forward secrecy still be achieved in MTI/A0 for a session key that was established between C and D when one LL-key aD is revealed so that both LL-keys aC and aD are ... 2answers 117 views ### PPT eavesdroper able to output$m_{0}$and$m_{1}\$ of different lengths

I've read the following two questions and their answers: Messages of different lengths and one-time computationally-secret Why is a non fixed-length encryption scheme worse than a fixed-length one? ...
1answer
98 views

### Security based on PRF

I've seen that there is several kinds of PRF, and sometimes people speak about strong PRFs. When proofs of a protocol or algorithm are given based on the assumption of the use of a PRF, are they ...
1answer
63 views

### Is there a relation between security of rounds of DES and Luby Rackoff rounds?

DES uses 16 rounds of feistel networks but not considered secure . Where Luby Rackoff constructions which are inspired by DES its proven by Patarin that 7 rounds is secure . Is there a relation ...
1answer
125 views

### Why is an IV used in Merkle-Damgard transform?

In Merkle-Damgard transform, a fixed vector IV is chosen at the beginning, and it is hashed together with the first block x1. I wonder why we don't use x1 straightforward, i.e. hash x1 and the next ...
3answers
454 views

### How do I test my encryption? (absolute amateur)

I am a hobby programmer with a background in biology and have developed an encryption program based on DNA. I tried to make it hard to crack, but it's essentially a substitution cipher and uses the ...
1answer
185 views

### How can an encryption scheme be indistinguishable with multiple messages but vulnerable to an adaptive chosen-plaintext attack?

In order to be indistinguishable with respect to multiple messages, wouldn't the scheme need to be nondeterministic? How would this then possibly be vulnerable to an adaptive CPA?
1answer
279 views

### In elliptic curve cryptography, how is “A dot A” computed?

I was just reading Ars Technica's primer on ECC. Somewhere near the middle of the second page, the author introduces the "dot" operation that takes an elliptic curve and two other known points, giving ...
1answer
131 views

### What does this Authentication protocol achieve and what information is shared?

I'm having trouble with the following question from my class: "What is the purpose of the protocol, and how does it achieve this purpose and what shared information does A and B end up after ...
1answer
117 views

### What is the difference between various modes in FPE?

Format preserving encryption has three modes FE1( FFX) , FE2(VAES) , FE3(BPS) . All of them are based on Feistel Networks .Can somebody explain how they differ from each other ?
1answer
172 views

### How do I sign data that's been encrypted using public key? (RSA)

I've received a public key to encrypt my data for the other end to decrypt using their private key. Now, they want us to sign the data as well to ensure non-repudiation. I thought that I should only ...
1answer
66 views

### How to pass an arbitrary signature to a certificate

I am trying to sign certificate (X509) using secret sharing. That is shareholders combine their signatures to produce the final signature which will be in this case the signed certificate. However ...
1answer
169 views

### Are there any protocols that are truly secure from active and passive MITM attacks?

Are there are any cryptographic protocols or algorithms that can prevent active MITM attacks or interference when initiating a new connection to a server or someone you have not exchange keys with ...
1answer
207 views

### Why is it important to generate a pseudorandom permutation from a pseudorandom function?

Most of the papers on block cipher constructions, especially the ones which discuss constructing block ciphers of arbitrary lengths or small domains, the techniques are designed based on building a ...
2answers
326 views

### Is encrypting credit card numbers one by one with rsautl secure?

I wish to encrypt credit card numbers one by one using asymmetric encryption on the command line. My current approach is this… Encrypt: ...
2answers
448 views

### Certificateless cryptography

While reading "Certificateless Public Key Cryptography" by Author Sattam S. Al-Riyami and Kenneth G. Paterson, they have considered generation of private keys by a Key Generation Center (KGC). If the ...
1answer
411 views

### OpenPGP/X.509 bridge: how to verify public key?

I'd like to use OpenPGP authentication over TLS, but lack of implementations made me use a temporary solution: an OpenPGP/X.509 bridge certificate. The approach is very similar to the approach used ...
1answer
201 views

### Verification of identity by certification authority

I have question about how a user's identity is verified by a Certification Authority. As I understand it, the process works as follows: User generates his private key and (with the help of private ...
0answers
140 views

### About Elliptic Curve ElGamal, 3 simple problems I have trouble with

In Elliptic Curve ElGamal, why are a=b=1 always legal for primes whose lengths are no shorter than 11(2) bits long? Is there any reason why the Point at Infinity can always be encoded as (0,0)? ...

15 30 50 per page