# All Questions

154 views

### Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?

Let R1 and R2 be (32 byte) random values, and let a H = Hash (R1, R2, Message) be of the same length as each R value. Provided E (R2, R1, Message) is operating in some chaining mode, are there any ...
141 views

### Does Runge phenomenon affect Shamir's secret sharing scheme?

Lagrange interpolation seems to be affected by the so-called Runge phenomenon when one tries to interpolate polynomials of high degree from a set of equidistant points. Lagrange interpolation is ...
338 views

### Seed / reseed DRBG too often?

There are limits to how much you can use a the DRBG before you have to reseed it, but are there any limits to how much you must use it before reseeding? Take the following scenarios as an example… ...
89 views

### What informal indicators exist for estimating the computational infeasibility of cryptographic problems?

When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ...
95 views

### Practical usage of S/KEY

The One-Time-Password (OTP) topic became quite popular in the recent years. But unlike the well-known HOTP and TOTP standards I haven't heard about any applications/systems implementing and using the ...
258 views

Are there any "good" ways to get a permutation from a password/pass-phrase? If one, for example, wanted to get a permutation of letters from a password, how might one do that in a smart way? I would ...
1k views

### Analogue encryption algorithms

I have a basic understanding of how strong encryption works on digital data. Bits can be changed so that they appear completely random and map one-to-one back to the original set, given the correct ...
79 views

### Shamir's ID based signatures - Notation issues

I am currently implementing Shamir's ID Based signature scheme as defined in the original paper. The sign and verify operation are defined as follows: Sign: $s = g * r^{f(t,m)} (\mod n)$ ...
323 views

### Hashing SHA-512 1000 times

SageMathCloud security (http://goo.gl/dCujW1) is as follows: Only the hash of your password is stored by the server, which uses 1000 iterations of the sha-512 hash function, with a salt length of ...
105 views

### How much plainext could be known without reducting security of RSA?

It is known, for example, that exposing 50% of most significant bits of RSA private exponent does not provide security risk (when a small public exponent it used). So how to qualify security ...
130 views

### Which gives better deterministic encryption SIV or Plain ECB mode?

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ? AES-ECB($key$ , $msg$) SIV($key$, NIL , ...
210 views

### Is use of pre-shared key for sharing session key in symmetric key cryptography vulnerable to MITM?

Consider the following protocol: ...
72 views

### Necessity of changing $p$ and $q$ when your private key is exposed?

Suppose your private key $d_1$ has been exposed. Instead of changing $p$ and $q$, instead you just choose a new public and private key (say $e_2$ and $d_2$) and use these instead. What kinds of ...
113 views

### Homomorphic crypto allowing anonymous yes/no votes?

I'd need a crypto system allowing online yes/no votes but without revealing who voted what. Is a "partial" homomorphic crypto system what I'm after? Would, for example, Damgard-Jurik work in my case? ...
208 views

### Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?

Is it possible to leverage a preexisting implementation of AES-GCM to provide the key security benefits essential for full-disk encryption (similar to AES-XTS)? GCM is a popular encryption mode ...
153 views

### How does converting character set affect hash entropy?

Does mapping a large character-set hash onto a small character-set hash lower entropy for a fixed size substring? I'm writing a python app that involves generating passwords for websites. During the ...
120 views

### What makes LSBit steganography detectable? And what would help in concealing it?

In a project of mine I took a 24-bit bitmap image and I performed LSBit steganography over it (saved a black and white image inside each of the planes R, G, B) using pixel shuffling and xor ...
96 views

### Secrete message sharing using N private keys

I'm looking for an encryption scheme that could possibly meet the following requirements. Let, $X = plaintext$ $M = (pub, priv)$, where $priv == (Ky + Kz)$ Given ...
159 views

### Non-interactive Zero-knowledge proof signature validation without public key

I'm looking for a method for a scenario with following requirements: At least 3 people (A,B,C,...) are in a Network where they can broadcast messages to everyone but not communicate with a specific ...
360 views

### Exercise: Attack on a Two-Round DES Cipher

Working through the exercises in Cryptography Engineering (Schneier, Ferguson & Kohno) I have stalled on the following exercise: Consider a new block cipher, DES2, that consists only of two ...
37 views

Let $g$ be a group generator of prime order $q$. Suppose we are given two elements $g^y$ and $x_1$. Can we find out if $y=x_1+x_2$ for some $x_2$? Thanks
181 views

### Digital signatures under plain RSA

Show that digital signatures under plain RSA are insecure (Plain RSA means that signing is done by calculating $m^d\bmod n$, with $0\le m<n$, and no padding or hashing of $m$). Write an algorithm ...
178 views

### Is it necessary to use single hash function for signature generation and HMAC?

I am trying to figure out if we need to use single hash function across all the places in a ssh session. i.e – signature generation/verification and HMAC calculation/validation. Is it possible to use ...
193 views

### Partially-known-plaintext attack of a stream cipher based on modular arithmetic

I have a function called $F$, using modular arithmetic as does RSA, defined as $$x\mapsto F(x) = g^x\bmod p$$ where $p$ is a 1024-bit prime and $g$ is a generator of $\mathbb Z_p^*$. A secret key $r$ ...
433 views

### Who first published the interest of more than two prime factors in RSA?

Multi-prime RSA is now a well known technique: it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed boost in ...
265 views

### Block Ciphers and (Non-)Generic Attacks

I am currently reading through Cryptography Engineering and came across this definition of block cipher security: Definition 2 An attack on a block cipher is a non-generic method of ...
212 views

### IV/Nonce in CTR&GCM mode of operation

We know reusing IV can compromise our secrecy. I have some questions aiming to clarify the use of an IV/Nonce in CTR/GCM: Is it OK to use the same key for encrypting plain-texts in authenticated ...
47 views

### Private Set Intersection Polynomial Computation [duplicate]

I am trying to implement the protocol mentioned in Section 3.4 of “Efficient Robust Private Set Intersection” in Java. In the Second Step, the Client computes a polynomial of degree $n$ over the ...
130 views

### Proving that a function is not a OWF (One-way-function)

I was trying to prove that a given function is not a one way function and I was not sure how to do it because maybe I had unclear what a one way function was (OWF). The definition that I have for a ...
193 views

### Simplified Fiat-Shamir example generates wrong output

I am trying to implement the Fiat-Shamir identification protocol, however the end results always fail to match. I am using algorithm's description from here. Preparation: Select 2 prime integers ...
101 views

### Is there a method to combine encryption and ring signing?

There's the well-known question on whether to sign or encrypt first. However, if instead a message is to be ring-signed such that either recipient could be the actual signer, is there any scheme that ...
86 views

### Does a cofactor of an elliptic curve have to be an integer?

What are the implications of a curve having a non-integer co-factor for its generator point? Is that even possible?
564 views

### My SSH server public key is 2048 bits, but my account's private key is 4096. What is my effective security?

My SSH server has a 2048-bit public key. But my private key, for clients to login, is 4096-bit. In this case, do I have the brute force protection of 2048 or 4096 bits? My worry is that someone ...
315 views

### GCM encryption for 256-bit and 512-bit block ciphers

The Galois/Counter Mode of Operation (GCM) This paper describe using GCM mode with 128-bit and 64-bit block cipher. Can we use this mode for 256-bit and 512-bit block cipher?
167 views

### Do deterministic secret sharing schemes exist?

Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations. If there aren't, is such an algorithm ...
197 views

### Hash functions with or without secret key

The classical definition of hash functions (found in books) are OK, but when studying a little more there is a lot of notions that seem ambiguous (contradictory) to me : Sometimes we have hash ...
304 views

### Making my steganography code more hard to detect and crack

I'm doing a college project about digital image steganography on MATLAB. So far i've been able to get the help i needed from cool guys on stackoverflow but i now need to make my algorithm more hard to ...
108 views

### Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
2k views

### Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...
127 views

### ML/NN Cryptanalysis

Is it computationally plausible to use NN/ML to do any of the following tasks? "Real" cryptanalysis. Cyclic neural networks for extended computation, but break the hash all the way through. ...
103 views

### How unsafe is to share parts of a password

The best way to ask this question and have a concrete answer is to set a very specific example. This is the example I would be interested in reading an answer to: Consider that my friend Alice has ...
322 views

### Encrypting firmware with AES and no IV [closed]

I have an embedded device with a AES CBC engine on it that is used to ensure the integrity of the firmware. I know that CBC mode requires unique IVs to be any good, but I'm unsure if it makes a large ...
324 views

### Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
41 views

### gnupg: display digest of key [closed]

How can I display what digest algorithm has a key? If I import a public key which has MD5 as digest, I get a warning about this weak algorith. But how can I check, what digest algorithms all my keys ...
998 views

### Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?

In the public certificate, an RSA public key specified as 2048 bits long is represented by 540 hexadecimal characters. Converted to base-2, this yields 2160 bits, 112 more than the stated 2048.
1k views

### Can someone explain the ECB Penguin?

I've seen the ECB Penguin used to demonstrate why ECB is not a recommended method of encryption, but I do not understand how this translates to text or passwords. Aren't the people who create these ...
150 views

### Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent. Can ed25519 be cracked after a certain amount of ...
358 views

### Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...