# All Questions

128 views

### Why does the time complexity of RSA encryption and decryption depend on the size of the modulus?

I would think that the time complexity would depend on the exponent, not the number of bits in the modulus. For example, if the exponent were 5, using the "naive" method, we would perform 5 ...
113 views

### Is the RC4 keystream random or not?

I have cause to use the PRNG half of RC4, but am seriously confused as to the randomness of its output. (Only the PRNG half.) On the one hand, there is a large body of literature finding ever ...
70 views

### What is the difference between LCG and Affine cipher?

What is the difference between LCG and Affine cipher? More specific: What are they used for, and what are the structural differences between them?
139 views

### More rounds after AES related key attack?

In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
114 views

### Implementation specific differences between RDRAND and RDSEED

I've read Intel's The Difference Between RDRAND and RDSEED and Intel Digital Random Number Generator (DRNG) Software Implementation Guide, but I have some open questions that are specific to usage in ...
145 views

### S boxes in Blowfish

I know how the s-boxes in blowfish are initialized, but how is the output sorted, I mean which bit from the input goes where in the box ? and what do mean they have 256 entries if they are 32-bit S-...
122 views

### Big block cipher as memory-hard function

I'm wondering, if something like block cipher with big block size is a good memory-hard function? All memory-hard key derivation functions I've seen look more complex than that, which made me ...
579 views

### bank websites using AES_256_CBC vs AES_128_GCM/CBC [duplicate]

Hello i have just recently started learning about cryptography, so i was doing some little research on what kind of encryption techniques and modes that were used in bank web pages. I have noticed ...
116 views

### Muchomor cipher

I've been given a task to research and possibly implement so called 'Muchomor' cipher. Has anybody ever heard of this cipher? I've found only one article about it and it was in Russian. I'm quite ...
103 views

### RSA: must $d$ be an integer?

I am only taking baby steps in RSA. If $p=11$, $q=7$ and $e=3$, $$\phi(n) = 10*6 = 60$$ Then: $$d = (2 (\phi(n)) + 1 ) / 3 = 121/3$$ Should $d$ be kept as a non-integer or is such a $d$ invalid?
50 views

### Reusing same source for single-source randomness extractor

Let $ext$ be a single-source randomness extractor which takes a $d$-bit seed and a $n$-bit source as input and produces a $m$-bit output. Suppose we have a source $X$ with min-entropy $k$. Is it ...
83 views

### Rogue CA Certificate MD5 Collision Control

Papers from Marc Stevens et al show that X509 certificates that rely on MD5 signatures can break the assumed security model, that is, it allows for a forged certificate to have the same signature as a ...
217 views

### paradox on fully homomorphic equality checking

Imagine, a client encrypts a corpus of data (say documents of text) with the public key of a Fully Homomorphic Encryption scheme (FHE) and outsources the data to an untrusted server.Now the client ...
91 views

### Problem reproducing AES results

First of all, I just implemented AES because I wanted to understand how it works and as a challenge to see if I could do it and I won't use to encrypt anything important, ever. The (German) Wikipedia ...
109 views

### Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...
211 views

### RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...
101 views

### How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?

In both node.js and OpenSSL, I am seeing cipher "aes-256-gcm". However, in NIST Special Publication 800-38D, that defines GCM, I am reading: The underlying block cipher shall be approved, the ...
73 views

### Fully homomorphic encryption arbitrary functions formulation

I am currently studying the interesting field of homomorphic encryption. I read that from a fully homomorphic encryption function that supports both addition and multiplication you can perform any ...
82 views

### Which hash function is usually used in RSA?

I know there are several available, however I can't seem to find whether there is one standard one or not. I think I understand the process of digital signatures, just wondering which has function is ...
69 views

### Cryptographic hash with ability to ignore specific bits based on a hidden pattern?

I'm looking to use password-style hashing to validate an environment, where some parts may be irrelevant. For example: ...
110 views

### Multiple NTRU public keys for the same private key?

An NTRU public key is generated essentially by multiplying the inverse of a polynomial $f$ by a polynomial $g$. The polynomial $f$ is the private key; $g$ is discarded. My question is: Is it insecure ...
63 views

### StoredKey in Salted Challenge Response Mechanism (SCRAM)

In SCRAM (RFC5802, page 8) the client generates ClientKey to server, which is a derivation of the original password. This is communicated to the server in a secure ...
63 views

### User revocation in Identity Based Encryption

I read several papers about user revocation in IBE recently. A common point is that when a user is revoked, some other valid users should also update their private keys. Does this mean that one ...
168 views

### Help understanding basic Franklin-Reiter related message attack

I am trying to understand this attack at the most basic level. I set up the following basic scenario: Let the public encryption exponent, e = 3. Let p, be some arbitrary but known (to the ...
32 views

### Edwards / Montgomery ECC over binary extension fields

I recentely had a discussion about the redesign of our ECC code for the library I'm collaborating on and the person I was discussing with came up with Edwards and Montgomery curves over binary ...
71 views

### Multi-Party Encryption for a Shared Document

Is there an encryption algorithm/protocol where any of a pre-defined set of keys/passwords will succeed in decrypting a document? The number of keys can be fixed, say, 10 or 20 possible passwords. ...
86 views

### Lattice attacks against Multilinear Maps [CLT13]

I am currently studying an article on a construction of Multilinear maps. There are some attacks on the scheme presented by the authors and I got stuck at the one in section 5.1. I will try to ...
178 views

### Backdoorable hash function in password database

I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
88 views

### Deletion in RSA Accumulator

I am studying RSA Dynamic Accumulator and I have a question: why is simpler to calculate the new accumulator value after a deletion if is known the secret ϕ(n)? Is possible to calculate the deletion ...
200 views

### How can I use the whole potential of DES?

I have recently programmed the DES algorithm. Right now it works just with integers (or better to say chars) in the range <0;255>. How can I use its whole potential - using just ASCII would be a ...
39 views

### Should I authenticate memory data which was loaded from authenticated disk file?

Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to ...
60 views

### Reversible hash function

I met the following 'reversible hash' function applied on a data $d$ consisting of $d_1, \ldots, d_n$ words: $h_0(d) = 0, h_i(d) = c ∗ (d_i + h_{i−1}(d))$, for $0 < i \leq n$. $c$ is a small, odd ...
79 views

### How to check if a function is significant or not?

f(n) = 1 / ( log n ) ^ 1/2 I know that this function is not negligible because it will never converge to zero even for large values of n. Now my question is, how ...
425 views

### ECC keys vulnerable to brute force attack?

I have started learning about Elliptic curve cryptography. Since the key size required in ECC is relatively lesser than the key size in RSA to provide the same amount of strong encryptions, I wonder ...
94 views

### Does the RSA algorithm use repeated squaring?

Simple question: in order to reduce such huge exponents in modular arithmetic, is repeated squaring used in RSA or is there a better way to implement it?
70 views

### Memory hardness of key derivation function through XOR-ring multiple matrix values

For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function ...
37 views

### How to force non-negative int64_t output for blowfish encryption with int32_t input?

I would like to encrypt a series of small integers one by one. The range of them is about 0~10^8. The output must be non-negative int64_t integers. Since Blowfish is 64-bit cipher, I prefer to use it ...
68 views

### Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in $\mathbb{G}_1$...
91 views

### Find plaintext of RSA by solving extended euclidean algorith for two encrptions with two different exponents for same plaintext

This is my homework question (but I am not asking the answer to it): Suppose two users Alice and Bob have the same RSA modulus n and suppose that their encryption exponents eA and eB are ...
81 views

### Is this MAC scheme secure?

Say we have a computationally secure Message Authentication Code scheme (Gen, Tag, Ver). Let $Tag'_k(m):=$ first half bits of $Tag_k(m)$. Let's assume the range of tags is $n$bits. Is (Gen, Tag', ...
32 views

### Checking for factor base

In algorithms like Dixon's factorization a factor base is used, which contains all primes below a bound. Then calculates $x^2 \mod n$, and then checks it is in factor base or not. Suppose $P$ is ...
55 views

615 views

### Why do stream ciphers use a nonce?

My question maybe will be stupid, but my problem is that I do not understand why stream ciphers need a key and also a nonce. As far as I understand, the keystream is generated with the nonce. The same ...
135 views

### Will entropy be lost by using a DRBG?

Lets assume we have a DRGB (deterministic random bit generator) which is seeded by a good true RBG (random bit generator). Before any bit has been read from the DRBG, the entropy is clearly the number ...