# All Questions

107 views

### Historic Authentication Schemes Before Computers

The Bulletin of the Atomic Scientists recently ran an article about an alleged near miss with rockets in 1962, which raises some interesting cryptographic questions: ...
80 views

### Is my pin algorithm secure?

I'm a hobby programmer and very new to this field. I opened a bank account recently and got two pins. One for the girocard and the other for a creditcard. And I needed two more pins for the online ...
80 views

### Lattice attacks against Multilinear Maps [CLT13]

I am currently studying an article on a construction of Multilinear maps. There are some attacks on the scheme presented by the authors and I got stuck at the one in section 5.1. I will try to ...
47 views

### Cost of attack on DSA with attack on DLP

Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm. Are there any optimized ...
175 views

### How much entropy is generated by 'random' human keystrokes?

I'm wondering about using human input as an entropy generator. We all know humans are terrible at making up random numbers or keys or passwords. But what if we let a user 'randomly' type in some ...
23 views

### 802.1X Radius WLAN protected by certificate 1024-bit key

I want to ask you a question. I have WPA-2 (enterprise) network. Also called as 802.1x. I use the Linux Zeroshell distribution, which is optimized for these services. Linux Zeroshell is provides a ...
66 views

### How to compute projective cordinate Z in elliptic curve cryptography?

I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided Can ...
32 views

### Why is it that in DSA, the order of the subgroup, $q$, is chosen such that it divides $p - 1$?

Consider the DSA key generation: A large prime $p$ is chosen; A smaller modulus $q$ is chosen such that $p - 1$ is a multiple of $q$; A generator $g$ s.t. $\operatorname{ord}_p(g) = q$ is chosen. ...
32 views

### What do you mean by Ciphertext indistinguishability [duplicate]

Wiki definition : A cryptosystem is considered secure in terms of indistinguishability if no adversary, given an encryption of a message randomly chosen from a two-element message space ...
67 views

### Security guarantees of Shamir's secret sharing when some co-efficients are zero

Shamir secret sharing techniques rely on polynomials for splitting and reconstructing. It's security properties are very good, i.e. it is impossible to reconstruct the secret when $t-1$ shares are ...
61 views

### How is the ciphertext labeled with a set of attributes in Key-Policy Attribute-based Encryption (KP-ABE)

My question is about Key-Policy ABE (KP-ABE). What does it mean when a "Ciphertext is Labeled with set of attribute"? How is it labeled?
43 views

### How does darkmail (DIME) work to hide email metadata?

While Email encryption can protect the content of an email, the metadata are still readable and can be used to gather important information about the sender and the receiver. There were several news ...
48 views

### What are the negative consequences for choosing 8 S-boxes for DES vs 1 S-box for AES?

DES has 8 different S-boxes, and AES has only 1. What are the negative consequences of such choices?
44 views

### Blake2: truncate 512-bit hash is safer than 256-bit by Config?

I need to calculate 256-bit hash in my code, using BLAKE2. I know I can set BLAKE2 to generate itself a 256-bits hash for any data but I´m curious to know what can be safer and faster: 1- Create the ...
77 views

### Are HTTPS web sessions non-repudiable?

(This is probably a basic question, and may be a duplicate; if so, just let me know.) Suppose there are two clients A and B, ...
32 views

### NTRUSign Hashing

I have some trouble understanding the inner workings of NTRUSign. So what I have understood so far is, that when Alice wants to sign a message she does the following steps Convert Alice's message ...
86 views

### Attack on textbook RSA with small messages

We learned in class that if Alice wants to send a small message $m$, such that $m < N^{\frac{1}{e}}$, so we can break the system using $e$-th square of $m^e$. But what if Alice knows this flaw and ...
59 views

### What is a good algorithm to scramble data in a 2-D grid

I want to know if there exists an algorithm i can use where the input is a string of data and the output is a scrambled version of the same but in a 2 D array ie given something like: |1 2 3 4 5 6 ...
162 views

### Modular Arithmetic in RSA

Consider the following the following RSA public key $pk = (N, e) = (1457, 1307)$. (a) Knowing that $187^2 \equiv 1 \pmod {1457}$ find the factorization of $N$. (b) Given the factorization of $N$ ...
32 views

### Is it possible to re-generate ECPublic key from raw private key and curve params?

As per my understanding, in Elliptical curve cryptography, the EC PrivateKey is nothing but a bigInteger value. If you know the curve specs and you have this private BigInteger value (which I am ...
54 views

### Randomness and increment of nonce in GCM

2 questions about nonce usage in GCM: Is it safe to use non-random nonce in GCM? Say I use 0x1 for m1, 0x2 for m2, so on. How much should a nonce increased for a file? Say I use 0x1000 as a nonce to ...
143 views

### Why does GPG ciphertext length differ with fixed plaintext length?

Thank you for your reply. Based on your inputs. I was investigated further, find details below Step 1) Input string for encryption is UUID format Input data = c0c6f311-a793-4d65-9374-1c0e45f5382c ...
77 views

### Chosen-Ciphertext Attack on Rabin: Factorize n

At the end of this Wikipedia section, you can see that $$\gcd(|r-s|,n)=q$$ or $$\gcd(|r-s|,n)=p$$ holds. I don't understand why.
70 views

### Profile Complexity LFSR

I try to understand how Complexity of an LSFR calculated. For example I have a bit sequence 110101 and it's profile 1 1 2 2 3 3. Is there any easy way in order to produce the profile?
38 views

### Diffie-Hellman over several non-secured HTTP requests - will it work?

This problem is about setting up cryptographic keys on an IoT device. I don't want my devices to be set up with any cryptographic keys pre-baked, but actual communication have to be based on TLS. Now ...
83 views

### What type of encryption scheme can prevent cheating in this coin flip protocol? [duplicate]

Consider the following protocol for two parties to flip a fair coin: Trusted party $T$ publishes her public key $p_k$ A chooses a random bit $b_A$, encrypts it under $p_k$, and announces the ...
167 views

### Is it bad design to reuse an AES key?

The company I work for needs to develop a simple system where, for each client, we encrypt a token on our server, which is then transmitted to the client. The decryption is performed by the server ...
68 views

### Fast Forward Hash Signatures

As a follow up to the Q/A session: Small Quantum Signatures - Reality check needed I have implemented the discussed idea for a new short-quantum-safe signature system using fast-forwarding hash. It ...
75 views

### How to perfrom modular division while numerator is lesser than the denominator?

I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the ...
110 views

### Are parts of a pseudorandom string also a pseudorandom string?

I am working on an exercise that encrypts a message using only the first $n$ bits of a pseudorandom generator's output $G(k)$, i.e. $F_k(m) := G(k)_{0...n−1} \oplus m$. $k$ is chosen uniformly at ...
4k views

### Is python a secure programming language for cryptography?

I know Python is a powerful programming language but is it secure for cryptography? I mean is it possible to reverse engineer the program (written in python) and discover the algorithm of cryptography ...
47 views

### authentication protocol questions/security

Disclaimer: I am the only person that uses my software. This is just experimental fun. I previously wrote a server/client that used the secure remote password protocol authentication. I had an idea ...
54 views

### bcrypt collision probabilities assuming same password and work factor?

What is the likelihood of 2 bcrypt hashes colliding if they use the same work-factor and input? Are bcrypt's salts large enough to prevent this from happening?
294 views

### Maximum steganographic embedding rate not detectable by steganalysis?

When using advanced steganographic methods (like F5) what is the approximate maximum embedding rate when advanced Steganalysis (like a machine learning approach) can no longer reliably detect it? I ...
67 views

### MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
97 views

### Limit the length of AES encoded output to certain value

First let me be clear upfront that am not Crypto expert. I'm having a problem where I will have to use NFC card. Now given the limitation of NFC cards memory sizes, I will need to constraint my system ...
48 views

### How to store keypair generated by RSA in a textfile?

I'm trying to write an encryption decryption program using Openssl-RSA. There are only two operations. User stores the data and retrieves it whenever he needs. To decrypt something, we need the ...
53 views

### AES-GCM Hash sub key parameter in Intel's IPsec library

I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here). ...
160 views

### Santa Claus' secret permutation

This December, $N$ friends play secret santa: they select a random permutation $\sigma$ of $N$ (without fixed point). For Santa Claus, everyone has to bring a gift to the next person in the ...
24 views

### What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
92 views

### How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original ...
231 views

### RSA enc/decryption with multiple prime modulus using CRT

Every information I found on internet about RSA-CRT encryption/decryption uses only two primes. I'm interested in my project in doing that using multiple (up to 8) primes. The general idea is to ...
Multi-prime RSA is now a well known technique (described here): it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed ...