# All Questions

98 views

63 views

### Is equal length of primes in Paillier cryptosystem is mandate for security reasons?

In continuation to this question about length of primes , I am in doubt about the restriction on length of primes itself . In Paillier cryptosystem , equal length of primes are used . My doubt is ...
59 views

### Low exponent attack against RSA

According to this: http://www.cims.nyu.edu/~regev/teaching/lattices_fall_2004/ln/rsa.pdf One can calculate the message m, if there was no padding scheme involved. My question: is it possible to find ...
26 views

### Help in uderstanding NIZKPoK notation (and how to code it) needed

Hello fellow cryptographers I have a rather silly question for you; I am aware of how Schnorrs NIZKPoK / SoK works when someone must prove knowledge about DL: y = g^x; (and how to code it) RFC ...
47 views

### DLOG in $\mathbb{F}_{p^n}^*$?

Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
75 views

### Public key encryption without ciphertext expansion

Say I have a database column that is defined as VARCHAR(255) that stores names. I can assume that names can be up to 255 chars. I need a public key encryption so that I can replace names with their ...
49 views

How bad is the following strategy for a password manager on a local machine? The user wants to sign up for somesite.com where he needs a password. The user has previously generated a secret key ...
59 views

### Direct sum of Binary numbers In Mixcolumns

I have just started learning cryptography and I am trying to make sense of the direct sum on some binary numbers. I am trying to find a column of a state space after a Mixcolumns operation has been ...
117 views

### Encrypting twice with same key gives back plain text

I read in the answer here that when encrypting twice the plain text with same key could result in plain text as shown below $encrypt_{key}((encrypt_{key}(plain)) = plain$ Which block-cipher ...
257 views

### Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
230 views

### How do you test randomness?

Suppose I receive a list of 1 million coinflips, and I want to know how likely it is that the list was randomly generated. My first thought would be to count the number of heads and tails, which ...
264 views

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ... 0answers 30 views ### Elliptic Curves Readdition I found the term re-addition in https://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html and I cannot figure out what it is. It has actually same complexity of addition and I dont see the ... 1answer 445 views ### Why does openssl use SHA1 in ECC when I use secp384r1 curve I need a small clarification that why openssl using SHA1 in ECC when I am using secp384r1 curve, but in rfc they are saying we should use SHA2. Thing here is am using nanoECC in my DTLS, nanoECC ... 1answer 140 views ### Why does NTRUEncrypt lack a formal security proof? Is there any particular reason why NTRUEncrypt lacks a formal security proof? That is, a demonstration that it achieves certain security notion (e.g. IND-CPA). I know there is a provable-secure ... 1answer 204 views ### A simple attack on DESX in time$2^{120}$[duplicate] Let$\mathcal{M}$be our message space and$\mathcal{K}$our key space. Now, let$\mathrm{E} : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$be a block cipher. Define the block cipher ... 1answer 120 views ### Is there any probabilistic version of RSA? I have now studying the RSA, but I think that is it possible to have some probabilistic version like a random bit string "r" XORed with the key? Is there any probabilistic version of RSA? Thak you ... 2answers 72 views ### public key certificate on TLS/SSL Currently I am working on a public key certificate. I got a question: Why is a public key certificate needed for TLS/SSL? Wouldn't TLS/SSL itself is enough? What is the role of the certificate? 4answers 2k views ### Why is the IV passed in the clear when it can be easily encrypted? The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ... 2answers 105 views ### RSA prove$a^{\varphi(n)/g} \equiv 1 \pmod{n}$I should prove that$a^{\varphi(n)/g} \equiv 1 \pmod{n}$, so I thought I would prove it with primitive roots but I got stuck. Here is the assignment: Let$p, q$be primes such that$p \ne q$. ... 2answers 202 views ### What is a q-type assumption? I've seen the term "$q$-type assumption" used in a few papers without a definition. A google search doesn't seem to come up with anything useful either (except the same papers without a definition). ... 1answer 69 views ### Are there any many to one encryption frameworks available? I am reasonably new to the cryptography. For my use-case I need a method where in I would need a receiver to accept encrypted messages from a range of senders (each having their own, say, public key). ... 1answer 65 views ### Client-server communication The base scenario goes as follows: A program stores some user's confidential data encrypted on their disk. The user is most probably clueless and the disk might get stolen, but these are the classical ... 1answer 174 views ### How to encrypt letters less than block n using Hill Cipher I am learning about Hill Cipher and know that it is a block cipher where each block of n letters (considered as an$n$-component vector) is multiplied by an invertible$n \times n$matrix, again ... 1answer 233 views ### Frequency analysis of Vigenere Cipher For Vigenere cipher, I understand Find period first (say we have p = 6) Find highest frequency of letter in each group (from 1 to 6) and assume it is "e" in plaintext What if we have more than ... 1answer 182 views ### Equal length of primes in paillier cryptosystem In the key generation step of paillier cryptosystem , In order to satisfy$\gcd(pq,(p-1)(q-1))=1$, we can take equal length primes. Instead of taking(length as parameter to generate$p,q$) equal ... 1answer 96 views ### A one way Function provably reversible at N applications with the same seed? I'm looking for a function that is generally one way from some secret$F(s, A) \rightarrow Y$, where$A$is known,$Y$is produced (also known), and$s$is kept secret. But whose repeated application ... 2answers 119 views ### Is it safe to salt a MAC? Say that I define a scheme where the salt is public and is MAC-ed with the message:$k = KDF(password, salt)tag = MAC_k(salt || message)$Is it safe to salt the MAC this way? Assume that the salt ... 1answer 115 views ### Number of keys for a monoalphabetic cipher My teacher stated that… The number of possible keys (E) in a monoalphabetic cipher is$26$! My thinking: Every letter in the alphabet can be$25$different letters hence it the number of ... 2answers 110 views ### Are password salts equivalent to keystream? I was reading up on keystream when I came upon the definition of it: A keystream is a stream of random or pseudorandom characters that are combined with a plaintext message to produce an encrypted ... 1answer 173 views ### Monoalphabetic cipher key I'm new to cryptography and have just completed homework on Monoalphabetic cipher. I managed to decrypt the cipher text successfully but I cannot identify the key from my plaintext to ciphertext ... 0answers 49 views ### Infer encoding mechanism from$n$-grams distance? I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance – implying some encoding mechanism as opposed to an encryption procedure ... 2answers 637 views ### Chosen plaintext attack on textbook RSA decryption Let$(n,d)$be an RSA private key and$(n,e)$the corresponding public key. Generate a secret random$r$from$(\mathbb{Z}/n\mathbb{Z})^*$Compute$C’ = C (r^e) \bmod n$Submit$C’$as a chosen ... 1answer 64 views ### Efficiently show/prove knowledge of third party secret without leaking information Say Alice publishes (i.e. all parties in the universe) a key or certificate$x$and sends a secret$s$to Bob. Bob then publishes some data$d$(his identity or a message or smt.) and an ... 2answers 316 views ### Use case of RSA CRT I discovered the CRT version of RSA cryptosystem which is used in many crypto libraries (openSSL, Java...). The use of the Chinese Remainder Theorem improves the speed of decryption so why it's not ... 1answer 498 views ### What do you call one time pad where pseudo-random numbers are used? What is the encryption method called when pseudo-random numbers are used instead of true random numbers? 2answers 1k views ### AES-GCM Disadvantage What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ... 2answers 143 views ### Operation which needs much computing power to be created, but just a little to be solved? Does somebody know a cryptographic/mathematic operation, that needs much computing power to be "encrypted"/"created" but doesn't need much power to be "decrypted"/"solved"? 2answers 247 views ### Secure way to derive separate encryption and MAC keys from a single master key? I want to derive a 256 bit encryption key and a 256 bit MAC key from a single 256 bit master key for an authenticated encryption scheme. I was considering the following construction to derive the two ... 1answer 94 views ### DES-X , computation load and storage The passage said that the computational load to attack DES-X can be reduced to approximately$2^{(56+64)}=2^{120}$steps,and the storage of data sets should be$2^{64}$. But I can't figure why ... 1answer 780 views ### Security of KDF1 and KDF2 (hash based KDF's) It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter:$K_i = KDF(K_{master}, i) = H(K_{master} ...
Is the parity of the permutation of the set $\{0,1\}^{128}$, defined by AES encryption for a certain fixed key, dependent on this key? DES, and any pure Feistel cipher, has even parity for any key. ...