All Questions

84 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 <= A,B < N$ in the Montgomery representation ...
218 views

Adding tweak to a block cipher

I know there are XEX, XTS and other ways to add tweak to block cipher without modifying cipher itself. However they are quite slow and/or complex. If we assume we have a secure block cipher round ...
378 views

Key derivation of public key without knowledge of private key

I'm looking for a convenient way to share a set of public keys across multiple services, while preserving privacy by preventing these services from tying the identity of these public key sets together ...
77 views

How to select parameters based on some condition

I am implementing a protocol for authentication where parameters need to be selected with $gcd(\mu,\phi)=1$ where $\phi=(p−1)(q−1)$. What is the best way to select the parameters while implementing
46 views

Forgery attack on OCB

When using same nonce in OCB mode of authenticated encryption, how forgery attack can be done?
130 views

HMAC-SHA1( secret key ) with header of a transmitted file

Given: an AES-128 secret key (ASecKey) encrypts a file (CBC mode). (Assume good random) Is is insecure to append (include) an HMAC-SHA1 of ASecKey to file? Purpose: The receiver can then quickly ...
217 views

What is a “lattice” in cryptography?

There are some questions here concerning lattice-based cryptography and this kind of cryptography seems to be especially useful if quantum computers are assumed to exist. When reading such questions ...
35 views

Establish authentication

I have designed a basic authentication scheme where two nodes will mutually authenticate that other holds a shared secret. I have very limited RAM/ROM (its on uC) and bandwidth. Here it goes: ...
188 views

How does bitmessage encryption work?

I have been reading around protocol specification and there is either too much technical detail or too bad articles on various sites. I need you to explain in simple words how encryption in ...
109 views

Doubling a point on an elliptic curve

I'm working with the elliptic curve $\mathcal{E} : y^2 = x^3 + 11x^2 + 17x + 25$ over $(\mathbb{Z}_{31},+,\cdot)$ and am trying to double $P=[2,7]$. Following the instructions here, I'm doing the ...
3k views

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

Assuming in the future there was a functioning 1024 qubit quantum supercomputer and it could run Shor's algorithm or Grover's algorithm to crack encryption very quickly. I'm interested in how the ...
674 views

What exactly is the base for the KECCAK (SHA3) claim that a security strength of 256 bits is “post-quantum sufficient”?

On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says: Instantiation of a sponge function the permutation KECCAK-f 7 permutations: b → ...
4k views

How long does it take a quantum computer to brute force AES?

I understand that using Grover's algorithm it only requires $2^{64}$ lookups for a 128 bit AES encryption, leading people to say we need to increase to 256 bit keys. But how long would it actually ...
590 views

Implementations of Ntru TLS

Has anyone come across any implementations of Ntru TLS? I'm working a project for uni that does quantum secure encryption. It relies on a mix of Ntru & AES, but I can't find an implementation of ...
109 views

Can I use HKDF to improve security of HMAC used with weak hash function?

I am writing a framework which encrypts/decrypts files (or streams, in general) with symmetric key using block cipher (for example, AES). To authenticate encrypted file, I use HMAC, which is ...
65 views

Block Ciphers - Standardize plain text

I need to use AES-128 to encrypt a plain text about 720 bits. Is it correct to say that – in this case – the plain text will be divided in 5 blocks of 128, the result will be equal 640 bits, and the ...
254 views

ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?

I know the usual way of using getting shared secrets for encryption with ECC is DH, however, this only works with two keypairs of exactly the same kind, for example two curve25519- or two ...
146 views

Question is a follow-up to this one. The question was about accelerating SHA1. I am writing an application, where I do have a choice of hash algorithm, as long as it's a strong one. I want to be able ...
55 views

Security of MSS

I have started reading about the Merkle Signature Scheme. I am a little confused about why it is believed to be secure against quantum attacks, couldn't the hash function be attacked? What would make ...
104 views

OTP - Reuse key BUT add IV, is it secure enough?

EDIT: REUSING KEY IS SECURE! OTP - Reusing key IS SECURE! PROVED! I have already asked a similar question and now I can continue to this question about adding a "extra key" = IV. My last question ...
97 views

Will adding space to the Vigenère block make it truly unbreakable?

I just have gotten into cryptography and learned about the Vigenère block. I think it's a very good idea because, if used correctly, it is unbreakable. But the only downsite is, the key must be the ...
89 views

Vigenère cipher frequency analysis not working

I'm writing a C++ program to use the Kasiski method to crack the Vigenère cipher. I'm testing it with a bit of Shakespeare encrypted with the key ABCDEFGHIJKL. It ...
149 views

Finding Vigenère cipher key(s) [closed]

How can we find the key used with a Vigenère cipher in small number of steps? If we have text like: Peit Wokm! Mhfa fepatgb ets bvvrvxmea ebte bae twkd qiqi ...
107 views

Words in “index of coincidence” in relation to the Vigenère cipher

I am trying to interpret the formula for index of coincidence from here… I am not understanding $f_i$. How can I calculate $f_i$ in this context? Is this the appearance of single word like ...
132 views

Why must the sender and receiver be synchronised in synchronous stream ciphers?

I would like to know why the sender and receiver must be synchronized in synchronous stream ciphers as said in synchronous stream cipher. Why is there no synchronization between the sender and ...
164 views

Why are there no OTP ciphers?

We all know the OTP is unbreakable and we all love the OTP (judging by the amount of question on this site). The strength of the OTP is not that it is unable to find a word without the key but you ...
311 views

Factoring large numbers

I am trying to factor few integers that are each between 115 and 135 digits long. I was wondering if anyone knew of any efficient methods or any programs that I could use to find the two primes $p$ ...
285 views

Use curve25519 for ElGamal crypto [duplicate]

DJB described curve25519 in his paper which can be found here (PDF). It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that Discrete Log is supposed to be hard on ...
51 views

Getting the encryption/has algorithm used for modem configuration file [closed]

Hello guys I have backed up my modem configuration file and found the username and password is in clear text; the files shows the username and the password is : ...
325 views

Prove that the affine cipher over Z26 has perfect secrecy if every key is used with equal probability of 1/312

Prove that the affine cipher over Z26 has perfect secrecy if every key is used with equal probability of 1/312. Just some guidance/help with this problem would be greatly appreciated not sure how to ...
277 views

Perfectly secure shift cipher

Prove that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure. I want to show that $P(P=p | C=c)=P(P=p)$. But I don't know how to relate. Can anyone ...
112 views

Block Cipher Modes

I have a question here asking the following: Why do block ciphers need the use of blocking modes? To encrypt messages larger than the size of the block. To avoid having the same block ...
381 views

Chi-Squared Step of Vigenere Cipher Decryption

So, I have been assigned an assignment where I had to solve a Vigenere cipher. Following along with this webpage I managed to get all the way to the chi-squared step. But, that is the problem. Upon ...
697 views

Do any non-US ciphers exist?

Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples. Are there any public ciphers produced by other states, China or Iran for example? ...
656 views

Isn't a simple Vernam cipher as secure as known symmetric key algorithms?

I have just read little about the Vernam cipher and the problems of implementing it. But, in practice, would not the key, if generated by a commonly used programming language's ...
62 views

RSA Signature Forgery

We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer. I believe that the digest is encrypted only providing one ...
395 views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is ...
216 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
75 views

What is the significance of i^Q mod P = 1 and are there any special properties to be aware of?

I'm studying UProve, and one of the fundamental components of this technology is based upon the relationship between i^Q mod P = 1 Lacking a specific name I can call this mathematical ...
194 views

Establishing encryption key using shared secret

I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes. I have zeroed in on a shared secret based scheme. Setting up shared secret is out of ...
152 views

Prime factorization

What is the largest integer that can be factored by modern algorithm like Msieve and GGNFS in a time less than 5 hours with normal computers? For example, can an integer like ...
501 views

Using ECB as RSA encryption mode, but encrypted messages are unique

As I understand, ECB should not be used as encryption mode unless you are encrypting single blocks of data which are always unique and only are encrypted once. I have a collection of ids represented ...
669 views

bcrypt - collision-resistance against chosen salt and work factor?

Would it be difficult to find $\:$ cost,salt,input,password0,password1 $\:$ such that bcrypt(cost,salt,password0,input) = bcrypt(workfactor,salt,password1,input) and $\:$ password0 != password1 $\:$ ...
29 views

HMAC for encrypted authentication token: recommended iteration number [duplicate]

In the web application I use 10,000+ iterations for hashing passwords stored in database (random salt and all). Password-related operations are not frequent enough to create a noticeable performance ...
195 views

SQL-Like queries in CRYPTDB doesn't work [closed]

I have downloaded and built Cryptdb and it works well. Most of queries on encrypted database run without any issue but, the query with LIKE key word receives an ...
114 views

Do hand-based hash functions / MACs exist?

Is there research on a hash function or a MAC that can be executed without computers? I know there's a lot of history on hand-based ciphers and the OTP can easily be excecuted by hand. (By using ...
1k views

Simple protocol for 1-out-of-2 oblivious transfer

I'm trying to explain the concept of 1-out-of-2 oblivious transfer to folks who haven't seen this idea before. I can explain what properties it provides, but it's also helpful if I can show a simple ...
181 views

Derive cipher IV and cipher Key using PBKDF2 with random salt?

It is said that cipher IV does not have to be secret and the only secret component of the encryption scheme should be a cipher key. Question: is it safe to generate IV using PBKDF2 function, which ...