# All Questions

0answers
47 views

### What is the canonical way of creating merkle tree branches?

I'm currently looking into creating some compact merkle tree branches to prove that a given hash was included in a given merkle root. My initial thought was to list the leaf, the merkle root and all ...
1answer
53 views

### 1 bit shannon entropy CPU instructions?

It has been proved, that the xor operator is suitable for entropy accumulation, due to its theoretical shannon entropy of 1 bit. There are six truth tables with ...
1answer
60 views

### Does a “commutative” asymmetric system exist?

Completely crypto noob here. I'm looking for a cryptosystem made of a func f + key1 + key2 such that they satisfy: g(f(msg, key1),key2)=msg g(f(msg, key2),key1)=msg key1 != key2 Does such a ...
0answers
48 views

### Security parameter p =O(n)

In many homomorphic encryption scheme, a security parameter is calculated as p =O(n). How to use the complexity order as values? Is there any specific method with an appropriate example?
1answer
158 views

### Is finding collisions in a part-hash not often enough a bad problem?

My situation: I've been working now for a couple of months on my own unique hash function, I've changed it many times and had two main versions but I won't bore anyone with the details of my work; at ...
2answers
94 views

### Homomorphic encryption diagram and trouble about a paper

I'm reading a paper based on Homomorphic Encryption: “Fully Homomorphic Encryption over the Integers: From Theory to Practice” (PDF). Now, I need a diagram of this algorithm if possible with all the ...
1answer
304 views

### Periodic One Way Function

Is there any notion of a periodic OWF? I.e. an OWF $f$ that on every input $x$ in its domain it holds that $f(f(f\ldots f(x))\ldots )=x$ when $f$ applied many times, each time on the previous output....
2answers
229 views

### Scrypt not “old enough” to be safe?

I just check all the questions with scrypt tag about that and usually it's said that scrypt is nice in theory and theoretically better than bcrypt and PKDF2, but it's too young to be "completely safe"....
0answers
99 views

### Performance of ECDSA, ECKCDSA and ECGDSA

It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ...
0answers
89 views

### PBC library: group of composite order for pairing operation

How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order. I want ...
1answer
71 views

### Is the length limit of AES-GCM per key or per (key, nonce) pair?

AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt ...
1answer
86 views

### Why is CBC-MAC with length appended not secure?

I've just read about CBC-MAC for the authentication of arbitrary length messages. In particular I cannot figure out why appending the message length before computing the MAC yields a non-secure MAC. I'...
1answer
479 views

### To understand a fact related to padding in MD5

I'm trying to understand to padding process of MD5 from the link: http://www.ietf.org/rfc/rfc1321.txt In this link I have found the following description of padding: The message is "padded" (...
2answers
145 views

### Collision free one way function

I was playing with a function that I think is collision free and uninvertible assuming the hardness of integer factorization. I am unfortunately not as skilled at math as I would like to be, and do ...
1answer
56 views

### Can homomorphic operations on many different ciphertexts be multiplied by a same constant?

Assume Alice encrypts messages $m_1$,...,$m_n$ using secret keys $k_1$,...,$k_n$ on a homomorphic encryption scheme (BHHO), so she would get $c_1=Enc_{k_1}(m_1)$,...,$c_n=Enc_{k_n}(m_n)$. Then Alice ...
0answers
57 views

### compact rsa private key format

As shown in Why does my SSH private key still work after changing some bytes in the file? a typical RSA private key file contains. The public modulus $n$ and exponent $e$; The private ...
0answers
64 views

### Encryption used in a commercial software product [closed]

I found (through some reverse-engineering) that the following encryption scheme is used in a commercial software that is quite widely used in Germany (Security by obscurity at its best). I have the ...
0answers
81 views

### Why is AES-SIV not used, but AESKW, AKW1?

I'm trying to investigate different key wrapping algorithms for my implementation. I've noticed that AES-SIV is very rarely implemented by most of open source libraries. Most of them implements key ...
1answer
41 views

### Elliptic ElGamal Public Key Cryptosystem doubt

I need an example of Elliptic ElGamal Public Key Cryptosystem. I have been trying with some values but I don't get the right solution. I have $p=13$, the elliptic curve $E:y^2=x^3+11x+7$ and a point ...
2answers
426 views

### Need for salt with IV

I have mainly referred to this question. Definitely in case of using a salt, IV has a use of adding randomisation to each and every key. But isn't it redundant in case of using an IV to use a salt? (...
1answer
75 views

### Proven secure scheme under random oracle

Currently I am trying to understand random oracle model in order to make a small presentation about it but I seem to be very confused about it. Since it's an hypothetical model without a real life ...
1answer
67 views

### How to test an implementation of a homomorphic scheme?

I want to implement the following homomorphic encryption scheme from On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption by Lopez-Alt et al. I use C++ and I want ...
1answer
67 views

The goal is to combine the RSA encryption system with the LSB steganography system in a BMP image. Since every pixel of the image is an integer between 0 and 255, if we choose $p$ and $q$ such that $N ... 0answers 43 views ### Recover secret$x$when$c\equiv m^x \pmod p$with public$p$(modified) Given an encryption system where$c\equiv m^x \pmod p$,$p$is a known prime, 1. Is it possible to recover$x$with a known plaintext attack? Given$(p,\text{factorization of }\varphi(p),m,c)$2. Is ... 2answers 65 views ### (Non-) Perfect Secrecy of Vernam Cipher Using$E(m) = m \oplus k \oplus \operatorname{rev}(k)$Given the cipher $$E(k, m) = m \oplus k \oplus \operatorname{rev}(k)$$ where$\operatorname{rev}(k)$is the reversed binary of$k$, how would one prove that the cipher is not perfectly secret. I ... 1answer 3k views ### Why does my SSH private key still work after changing some bytes in the file? I (for a test) just randomly altered a private RSA key by opening it up in Vim and changing a few bytes. It is the private part of an SSH key pair used for logging in on a remote system. Puzzlingly, ... 1answer 69 views ### Which values are used for an elgamal cryptosystem public key? I know that – within the elgamal cryptosystem – the values of$a$and$b$are public. But which values are used to create public keys? 4answers 594 views ### Why can’t the public key exponent in RSA be negative? I am looking at why certain public keys in RSA can't be used, such as: 2 and all other even numbers (since$\gcd(\phi,e)$must equal 1) 1 (since the cipher text would equal the message) 0 (since the ... 3answers 439 views ### Plain text size limits for AES-GCM mode just 64GB? Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ... 0answers 69 views ### What can I do to improve my encyption method [closed] I'm new to cryptography and I want to learn more. For me, the best way to learn about something that I have no experience with is to experiment and I've coded a very basic approach to a simple ... 1answer 110 views ### A general definition for cryptocurrencies I am trying to find the definitions to several terms related to digital currencies. Unfortunately, I am always ending up on Bitcoin-oriented pages and websites which only take Bitcoin itself into ... 3answers 706 views ### What is the advantage of digital signatures over message authentication codes? Studying for CISSP these choices seemed limited: What is the advantage of digital signatures over message authentication codes? Digital Signature provides integrity verification while ... 1answer 72 views ### Is it secure to use hexadecimal data for IV instead of raw binary? Is it safe and secure to use a function like bin2hex (which converts binary data to hexadecimal) on the binary output of functions like ... 2answers 122 views ### RSA: Proving that$p+q-1 < 3 \sqrt{N}$, where N = pq and p,q are prime? I'm doing some research into attacks on the RSA cryptosystem and have stumbled across Wiener's attack. Within the proof there exists the statement "$p+q-1 < 3\sqrt{N}$". No proof is given for this,... 1answer 38 views ### Creating a custom 2 way encryption class [closed] I am trying to make a simple 2 way encryption function that currently uses a substitute cipher for the encryption and an inverse substitution for the decryption. I want to move away from this ... 1answer 38 views ### What is PCT_SSL_CIPHER_TYPE_1ST_HALF? I'm writing a tool to do security posture assessments of SSL/TLS services, and ran into an interesting result. I ran through all defined cipher suites to test which could be negotiated (like sslscan ... 1answer 62 views ### How to calculate d in RSA for my number with this [duplicate] I took the p&q value as 61 & 53 and n=3233 e=17 d=? How to find it? Plz help me... 2answers 99 views ### Do we have anyway of knowing if avoiding self-permutation in RC4 makes it any stronger? OK, so lots of questions get asked about RC4 but I want to make mine specific and hopefully answerable. RC4 Design as I'm sure anyone reading this knows, uses self permutation in stage 1 of the KSA. ... 0answers 43 views ### Choise enother scheme to basises of lattice cryptosystem In the lattice cryptosystem to find a good or bad basis we apply "hadamard Ratio". But in high dimension computing of this ratio is hard. dose any other scheme exist to solve this problem? 1answer 113 views ### What is an impure NIST true random number generator? I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components: The entropy rate provided shall be ... 1answer 80 views ### Is frequency analysis the only attack on a simple substitution cipher? I understand that "anagramming" is often used after frequency analysis of a traditional substitution cipher, but anagramming requires prior frequency analysis to provide a starting point. Is there any ... 2answers 132 views ### Why IV does not have to be secret yet has to be random [duplicate] The IV used in schemes such as CBC has to be random and unpredictable. But at the same time it does not have to be kept secret. If the IV does not have to be secret, why does it have to be random ... 1answer 116 views ### Rule 30 Cellular Automaton for Cryptography Steven Wolfram of Mathematica uses a pseudorandom number generator based on Rule 30 for applications in Mathematica software but I would like to know if a pseudorandom generator based on Rule 30 is ... 1answer 88 views ### What is the difference between MACTripleDES and TripleDES? I was asked to encrypt/decrypt a string using MACTripleDES. Is there any difference between MACTripleDES and TripleDES? If, where exactly is the difference between both? 1answer 82 views ### Permutation of keys that guarantees different hashes Suppose I have two values to be hashed,$x$and$y$. Is there a hash function$H$with the following properties?$H(x) = H(y), \; H(m(x)) \neq H(m(y))$Where$m$is a permutation function that may ... 0answers 52 views ### What is th purpose of m and q in elliptic curve cryptography protocols? In crypto protocols that contains calculus on elliptic curves I can often see$\dfrac{m}{q}$$Q where m stands for order of EC points group and q is the order of corresponding subgroup of m. Q \... 0answers 41 views ### how to change math.random() implemented in javascript to securerandom [closed] In Javscript code in one of our application,I am trying to change Math.random to secure random.I am not sure ,how to change.can anybody help? 1answer 111 views ### Should I be concerned about padding oracle attacks if the lifespan of my key is ~1 minute? I'm using 4096-bit RSA to encrypt a 256-bit AES key generated client-side. The RSA ciphertext is then sent to the server, and the server decrypts the RSA ciphertext to acquire the AES key. ... 1answer 34 views ### What does CMS standard mean by “initial input to the message digest” I'm really grinding my teeth against digest calculation explanation in the CMS standard. Let's consider the case when the signedAttrs are present. The first ... 1answer 66 views ### Question about lower bound and upper bound key collision I'm reading this article and I have a doubt in the page 7. First I going to describe the required definitions and next I formulate my question. Let be$$F(n)=\{f_k: \{0,1\}^n\rightarrow \{0,1\}^n| k\...

15 30 50 per page