# All Questions

205 views

### Best way to get 32 bytes from PBKDF2

Use the PBKDF2 output as an HMAC key, hashing two different inputs - once for 20 bytes and once for 12 : ...
136 views

### How to protect against ephemeral key reuse in some signature schemes?

Given that some signature schemes (for instance Elgamal) use an ephemeral key that cannot be reused ever. How do people usually protect against this? I'll elaborate more: if you reuse the ephemeral ...
196 views

### TLS: Is Integrity assured when using NULL cipher

In specific implementation we're using TLS 1.0, open ssl 0.9.8 but i'm referring to RFC 5246. For performance reasons, I'm being asked if we can use TLS without encryption. The hope is that the ...
952 views

### ASCII to same-length ASCII encryption?

I need to encrypt an ASCII string [a-zA-Z0-9:] to an ASCII [a-zA-Z0-9] string of the same length. It doesn't have to be unbreakable, it's sufficient that it won't be readable at the first sight. The ...
181 views

### Is differential calculus related to RSA?

I'm writing a high school math paper on RSA and I'm wondering if it's possible to relate calculus to RSA. Is calculus used for any part of RSA? It can be for proving equations/theorems, for generating ...
172 views

### How to attack this authentication protocol from “Cryptography: An introduction”

Consider the following protocol (from the book "Cryptography: An introduction", by Nigel Smart): ...
122 views

### How would using only one s-box affect security of Blowfish?

Schneier says: Fewer and smaller S-boxes. It may be possible to reduce the number of S-boxes from four to one. Additionally, it may be possible to overlap entries in a single S-box: entry 0 ...
107 views

### Combining two hashing functions

I have been working on a Bloom Filter implementation recently and after a discussion with a co-worker about how many hashing functions to use I told him I was limited with using hashing functions that ...
126 views

### Is there a general method to crack this type of fractionating cipher?

I've seen a few puzzles based on a type of cipher in which letters in the plaintext are substituted with groups of characters in the ciphertext. The ciphertext only uses a handful of unique ...
131 views

### What is the GnuPG process for going from a passphrase to a symmetric key?

Suppose I use GnuPG to symmetrically encrypt a file like so: gpg --no-options -c --cipher-algo AES256 --no-random-seed-file -o my.out my.file I then provide a ...
113 views

### What is a Message Transmission Scheme?

I've been given as an exercise to show an encryption scheme that is CCA-secure but is not a secure message transmission scheme. What is a message transmission scheme, and how does it differ from a ...
122 views

### What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
236 views

According to this document the padded message has the following structure: $EM \;= \; 0x00 \; || \; 0x02 \; || \; PS \; || \; 0x00 \; || \; M$ What is the purpose of this null byte at the beginning ...
204 views

### What is 'key agility' in relation to symmetric-key encryption?

I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
91 views

### OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
447 views

### Elliptic Curve Encryption Ciphertext Size

I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal)
210 views

### Is there a cryptographic hash function that can be performed with pencil and paper?

Imagine I'm signing up for the 99th new web site this month. I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into ...
182 views

### What does this Authentication protocol achieve and what information is shared?

I'm having trouble with the following question from my class: "What is the purpose of the protocol, and how does it achieve this purpose and what shared information does A and B end up after ...
503 views

### OpenPGP/X.509 bridge: how to verify public key?

I'd like to use OpenPGP authentication over TLS, but lack of implementations made me use a temporary solution: an OpenPGP/X.509 bridge certificate. The approach is very similar to the approach used ...
157 views

### Generator for Group $QR_{N}$

Let $N=PQ$, where $P=2p+1$ and $Q=2q+1$. $P,Q,p,q$ are prime numbers. $QR_{N}$ is the set of quadratic residues modulo $N$. Please help me to prove $QR_{N}$ is a cyclic group. Note: $QR_{P}$ and ...
635 views

### Are there any Javascript CSPRNGs? [closed]

I'm writing some software that requires the use of a CSPRNG with javascript for use in the browser and I'm wondering what libraries are available. Crypto-js doesn't seem to have a CSPRNG I can ...
163 views

### Feasibility of using a base 26 LFSR for cryptography by hand

I have been playing with base 26 LFSRs (i.e. using the alphabet) and noticed that the XOR operation for base 26 is just the tabula recta and so can be done very quickly. This made me wonder whether a ...
1k views

### RSA square and multiply

If an RSA encryption uses a modulus $n$ of 15000 bits and $e = 3$ or $e = 2^{16} + 1$, how many squarings and multiplications will we need for encryption, and for decryption? Could you please explain ...
266 views

### understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
150 views

### Stream vs Block cipher: Synchronising and the receiver

I am learning cryptography at school and I was wondering: How are the blocks/streams after decryption synchronized at the receiver to form one long meaningful message? Am I right by saying that ...
72 views

### Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?

Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every ...
711 views

### RSA key pair generation using PRNG with same seed

I see a lot of Q/A where persons are trying to generate a specific key pair using static data such as a password. Now say we use a known PRNG (dangerous assumption), seeded with a the data as a static ...
270 views

### Hamming Distance vs. Index of Coincidence

When analyzing a repeating-key xor cipher to find the key length, I've read about two key methods (assuming there aren't just repeating chunks of ciphertext for Kasiski's method), for some assumed key ...
425 views

### Generating an IV for ESP 3DES-CBC

I have an application written in C, running in Linux. It uses IPsec (ESP) (manually putting the IPSec packet together) to send certain packets. The algorithm used ...
196 views

### Does impersonating an SRP server give you enough information for an off-line dictionary attack?

In a comment to an answer I wrote to another question, CodesInChaos wrote that: "Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search." ...
216 views

### Parallel-resistant proof-of-work scheme?

I am looking for a proof-of-work scheme which cannot be effectively parallelized. For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function $f()$, a target ...
238 views

### Quantum resistance of Lamport signatures

The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?
468 views

### Formal definition of (perfect) forward security/secrecy

In recent weeks the concept of (perfect) forward security/secrecy has been mentioned a lot, primarily in the context of the shocking revelations about NSA eavesdropping. As far as I'm aware, this ...
647 views

### Security of authenticated encryption modes gcm & ccm

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
303 views

### Is it possible to anonymize web traffic so that the IP Address cannot be determined while still being able to determine distinct IPs?

I'd like to find a way to anonymize IP addresses in web logs to ensure user privacy given the following requirements: If given an IP address, there is no way to look up which requests came from the ...
449 views

### What does “message schedule” mean in SHA-256?

I am trying to understand the sha-256 algorithm from FIPS 180-2. I understood the padding and parsing of the message string. However after that it states (page 15): For $i = 1$ to $N$: { ...
180 views

### Is this OTP scheme safe?

I have a message $m_1$ and I want to encrypt it by XORing it with two keys $k_1$ and $k_2$: $$c_1 = m_1 \oplus k_1 \oplus k_2$$ So far so good. Now I was wondering if I could create a "fake" result ...
223 views

### In ECDSA, how many field operations are used for signature verification?

I am wondering about the computational cost of ECDSA signature verification, in term of multiplications in the base field; and, as an aside, in term of (much cheaper) additions. To make things ...
150 views

### implementing long term archive encryption

Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways: The ...
258 views

### Addition with Shamir secret sharing

When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$. I believe this would be the correct solution (correct me if I'm wrong): Each party ...
903 views

### Triple-DES Brute Force

Shannon's paper states: A system is pure if all keys are equally likely and if for any three transformations, $T_i$, $T_j$, $T_k$ in the set, the product $T_iT_j^{-1}T_k$ is also a ...
418 views

### What is the best way to store sensitive information on the client?

I am very inexperienced with cryptography and would like some advice on how to store some sensitive information on client machines. I have some information stored in a central database on my server. ...
157 views

### Chosen ciphertext insecurity in an ElGamal variant

I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...
270 views

### DSA signatures with related k and unknown payloads

Suppose that we are given DSA parameters $p$, $q$, $g$, a public key $y = g^x$, and two signatures $(r_1,s_1)$ and $(r_2,s_2)$. We are told that $(r_1,s_1)$ and $(r_2,s_2)$ were produced by related ...
336 views

### Understanding a Blowfish cryptanalysis

I'm reading a cryptanalysis on Blowfish, and I've come across something that I don't quite get. Let's denote $$\delta = a \oplus a'$$ where a and a' are bytes that cause a collision in some S-box ...
224 views

### Anonymity in end-to-end encryption

Considering a scenario of anonymous data transfer between seller and buyer using proxies. If we consider that there are three proxies that are being selected by the buyer to obtain data from different ...
367 views

### Understanding Feldman's VSS with a simple example

I'm trying to understand Feldman's VSS Scheme. The basic idea of that scheme is that one uses Shamir secret sharing to share a secret and commitments of the coefficients of the polynomial to allow the ...
318 views

### While generating a random Elliptic curve what are the conditions i have to considerd?

I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy? For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a ...