# All Questions

68 views

### “proof of access” schemes

What is the state of the art way when implementing a scheme challenging a party to prove they have access to certain data? What I'm looking for something along the lines of Give them ...
112 views

am sorry, an a beginner, so please forgive me if i make mistakes, so here is what I understood: PBKDF2: uses HMAC, so, the message is the password, and the key that crypts the message is the salt? or ...
126 views

### How to compare two datasets „anonymously”?

Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation: There are 10 defined colors (blue, orange, yellow etc.) There are ...
153 views

### Is this OTP scheme safe?

I have a message $m_1$ and I want to encrypt it by XORing it with two keys $k_1$ and $k_2$: $$c_1 = m_1 \oplus k_1 \oplus k_2$$ So far so good. Now I was wondering if I could create a "fake" result ...
142 views

### Is symmetric key encrypted with server's public key secure

I'm trying to implement lightweight yet secure protocol for communicating two trusted parties with each other. Consider following scheme: Alice wants to establish secure two-sided channel with ...
69 views

I'm trying to reverse engineer key exchange protocol and faced with the following problem: Protocol is based on Diffie-Hellman key exchange method: g - generator m - modulus Alice: a - private key $A ... 2answers 199 views ### What does “message schedule” mean in SHA-256? I am trying to understand the sha-256 algorithm from FIPS 180-2. I understood the padding and parsing of the message string. However after that it states (page 15): For$i = 1$to$N$: { ... 3answers 225 views ### Block cipher fixed points A block cipher is a bijective map from the set of possible plaintexts to the set of ciphertexts, which are the same size and might as well be considered the same thing:$\theta: S\to S$. In this there ... 2answers 82 views ### Prepend information about encryption implementation to the stored data I want to preface this by saying i will not be using any of this code/information in a live project, this is only for learning/fun (so I welcome some speculation) I was looking at how the PHP crypt() ... 1answer 1k views ### Bcrypt VS Scrypt, Again? I found this article on SO, but the answer was short, and the subject was closed, What i don't understand, is: Which one of the two limits memory usage to avoid custom Hardware to break the password? ... 1answer 542 views ### What security authorities and standards reject$e=3$in RSA, when, and with what rationale? In RSA, some security authorities and/or standards allow the public exponent$e=3$, others require or recommend$e>2^{16}$(or perhaps some other minimum). I gathered the following: PKCS#1 allows ... 2answers 111 views ### Does collision resistance stay when extending a hash function to a set domain? Given a Cryptographic hash function$h$for element$x$, let's extend it to sets via$H(S)=\prod_{x\in{S}}{h(x)}$. I am asking if the new hash$H$(in domain of set) is still collision resistant? To ... 0answers 64 views ### Will D-Wave's quantum computers ruin classical encryption? [duplicate] D-Wave has commercially available 512-qbit quantum computers now. A lot of big names are taking it seriously. Google, NASA, and USRA have joined forces to start a quantum AI lab. How far are we ... 1answer 139 views ### In ECDSA, how many field operations are used for signature verification? I am wondering about the computational cost of ECDSA signature verification, in term of multiplications in the base field; and, as an aside, in term of (much cheaper) additions. To make things ... 1answer 180 views ### Why use$(r,s)$instead of$(r,s^{-1})$as DSA signature? A DSA signature consists of two scalars$(r,s)$. When signing$s$is generated as:$s=k^{-1}(H(m)+xr) \mod q$The signature is$(r,s)$When verifying$s$is only used to compute$w = s^{-1}$. So ... 1answer 263 views ### What do recent announcements about solving the DLP in$GF(2^{6120})$mean for RSA After just reading the post Do recent announcements about solving the DLP in$GF(2^{6120})$apply to schemes proposed for cryptographic use? I was a bit confused. DSA, ElGamal and others are based on ... 2answers 637 views ### Why are bitwise rotations used in cryptography? Any understanding I have of cryptography stops right around the cipher level. As such, I'm just curious as to why bit shifts and moreover circular bit shift are so prevalent in cryptography. 1answer 109 views ### How can I split a message in parts of similar size or smaller? I have a 130-160 characters message that I need to split in say, 3 parts, and be able to reconstruct it by recovering all 3 parts. I also need that these parts are type-able, meaning that they can't ... 1answer 367 views ### Why should I use an Initialization Vector (IV) when I have unique keys? I took a look at this question. My question is not the same. I've unique keys encrypting (in CBC mode, AES-256) each plaintext, i.e. I do not use a key to encrypt more than one plaintext. Is it ... 2answers 158 views ### IV Security Clarification After doing lots of reading on SO and other websites relating to AES cryptography, I am trying to understand the security issues surrounding IV's. There seems to be a lot of confusion and ... 1answer 205 views ### When making public key fingerprints - is a sha1 hash still a good idea? I'm thinking about trying to save some space (and readability) when referencing 2k and 4k public keys (millions of them) by storing the fingerprint in some places instead of the full public key. ... 3answers 366 views ### If RSA is limited to 117-200 bytes or so, is that a very limited use case? Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size? I have read that you can only encrypt a message of around 117 to 200 ... 2answers 213 views ### Are block ciphers used in public key crypto? I was reading about block ciphers and most articles state they are being used in symmetric key cryptography. Are they also being used in public key cryptography? if not, what alternative pkc use? ... 0answers 72 views ### Which version(s) of SRP are in ISO/IEC 11770-4:2006? I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password. This states that SRP is part of IEC 11770-4, ... 1answer 44 views ### Distributing blocks with validation and non-dependant list generation Problem Suppose I have a system of nodes that can communicate with a parent node, but not among each other. Suppose then a file on the parent node is split up into blocks and divided among the ... 1answer 152 views ### How is text converted to a number for RSA? [duplicate] According to http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Key_generation the key length is the number of bits in n. So how can a message of many megabytes (millions of bits) be modded by a 1024 ... 1answer 168 views ### Encrypt-then-MAC paradigm I read that the Encrypt-then-MAC paradigm is provably secure. From what I understand, when using for example AES for encryption and HMAC_SHA256 for MAC generation (and the keys$K_1 \neq K_2$), this ... 2answers 188 views ### HMAC and assumptions on the cryptographic hash According to Wikipedia, a cryptographic hash function has the following properties: Pre-image resistance: Given$h$, it's difficult to find any message$m$such that$h = H(m)$. Second pre-image ... 1answer 140 views ### ECC Point Multiplication of Product I can calculate$Q = a\,b\,G$in several ways:$Q = a \, (b \, G)$or$Q = b \, (a \, G)$. These give the same result, as expected. But if I do$c = (a \, b) \bmod n$where$a \, b$is much greater ... 3answers 529 views ### Why crypto hash functions must be collision resistant and how to find resistant? Why cryptographic hash functions must be collision-free and is there any methods to evaluate whether a function is not resistant to collision? Thanks, 2answers 180 views ### Is entropy affected by time? I'm quite new to cryptographic systems, and today we discussed entropy at work. Since entropy is used to ensure the difficulty for an attacker to break in, I was wondering if the more time the high ... 1answer 55 views ### Why does the server in S/KEY authentication only store a single password? I've been reading about the S/KEY One-Time Password system on wikipedia here and was wondering why the server only stores a single password and not the list of one-time passwords like the client does. ... 1answer 258 views ### With HMAC, can an attacker recover the key, given many known plaintext/tag pairs? Given many pairs of$(m, t)$, can the attacker compute the key$k$satisfying$\text{HMAC}(k,m) = t$? (Assume that$k$was chosen at random.) 2answers 94 views ### A substitution based on a matrix vector product I choose at random an invertible square matrix A of size 128 in GF(2). I want to use this matrix as a substitution box. Is this a non linear transformation ? I've seen that substitution boxes are ... 1answer 204 views ### How insecure in practice? I am in attempt to understand relative insecurity of certain encryption schemes. Particularly of interest is DES and RC2. I know AES is better and should be used to encrypt. But practically, if ... 1answer 183 views ### Can somebody explain the major contributions of the tenants of the Gödel Prize 2013? As you may know, the Gödel Prize 2013 will be awarded this year to cryptographers (see this ACM press release). The people awarded are Antoine Joux, the team of Dan Boneh and Matthew K. Franklin. Can ... 1answer 208 views ### Can i modify data “protected” by a CRC16? There are 100 bytes with a CRC16. However I only know the first 50. I want to change byte 5 from a known value X to another value Y, and fix up the CRC16 to be valid - without knowing bytes 50-100. ... 1answer 136 views ### Which keys are necessary to decrypt Application data in a SSL connection? I'm debugging an application which communicates between client and server using a SSL/TLS connection, and want to capture and analyze the sent data. Are the client write keys and server write keys ... 2answers 138 views ### HMAC collision probability bounds Could someone point to results or proofs about the probability of HMAC(k, m1) = HMAC (k, m2), assuming the underlying hash function is SHA-256? Would those probabilities be higher/lower if m1 and m2 ... 1answer 498 views ### The exact difference between a permutation and a substitution I've noticed confusing definitions about permutation and substitution, preventing to make the difference. A permutation changes the order of distincts elements of a set, but this can be writen as a ... 3answers 490 views ### What is a definition of a nonce? Sometimes I read that nonce have to be a random number but imho it's wrong, nonce just should not repeat itself. You could increase in by 1 every time if you are sure it would never repeat. 2answers 123 views ### The security of the AES secret itself I am writing an application, running on a server, where multiple users access data from a database which is AES encrypted with a master secret. The master secret itself is initially randomly ... 2answers 195 views ### Pen-and-paper one-way function for externally-anonymous survey When conducting surveys, an Administrator might send an Enumerator to survey a Respondent. For "sensitive" questions (e.g. about embarrassing behavior), the Respondent may be fine with the truth being ... 0answers 103 views ### Complex Numbers on Elliptic Curves & Usage in Tate Pairing I'm working with understanding the internals of the Tate Pairing. I was going through an example of the curve$E: y^2 = x^3 + 3x$over$\mathbb{F_{11}}$. The author is showing the computation of ... 2answers 421 views ### Reversing SHA1 (don't know the correct term) Given sha1(pad(A) || pad(B)), where B is known, can I calculate sha1(pad(A))? pad(A) means its length is exactly 1 block (64 bytes for SHA-1) If yes, for which other hash functions it will work too? ... 1answer 123 views ### Linkable ring signature scheme I need an implementation of linkable ring signature, a ring signature which allows identifying whether two signatures belong to the same signer. It has important privacy-related applications, like ... 3answers 1k views ### How robust is discrete logarithm in$GF(2^n)\$?

"Normal" discrete logarithm based cryptosystems (DSA, Diffie-Hellman, ElGamal) work in the finite field of integers modulo a big prime p. However, there exist other finite fields out there, in ...
261 views

### How to test if a number is a primitive root?

How to test if a number is a primitive root, assuming the modulus is a prime? And if not? Is it not enough if the number is relatively prime to the modulus or prime?