# All Questions

129 views

### One cipher to rule them all?

I learned from Dan Boneh's course that many cryptographic primitives (prngs, stream ciphers, hashes, hmac, key derivation functions) can be built from just one a block cipher or PRF. For example, the ...
96 views

### Simulation aborted because the adversary doesn't use the random oracle

I'm trying to construct a proof for an encryption scheme in the Random Oracle model. This encryption scheme is like a PKE scheme but with an additional function that kind of "alters" ciphertexts ...
72 views

### Source for PKCS#11 Header Files

Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there ...
69 views

### Logjam-style attack on Factoring?

We're all aware of the Logjam attack, which is known as "FREAK on discrete logarithms". The attack works by doing a large pre-computation step, which needs only to be done once per field and then ...
81 views

### NTRU less secure than previously thought?

A new paper (https://eprint.iacr.org/2015/552.pdf) says: This makes it possible to asymptotically and heuristically break the NTRU cryptosystem in subexponential time (without contradicting its ...
38 views

### Why is the re-encryption algorithm in Universal Re-encryption for Mixnets more complicated than apparently necessary?

This is the paper. On page 6, the paper describes a variant of El Gamal and a way of re-encrypting ciphertexts. I thought an easier way to do encryption is to output $(m(g^x)^y,g^y)$, and universal ...
119 views

### Is secure communication without public-key crytography feasible?

We all know about public-key cryptosystems, and we know some of these are computationally secure (for the time being, of course). Are there any algorithms out there which allow safe communication ...
122 views

### RSA public key recovery from signatures

Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized. I need it to verify any future message comming from ...
292 views

### How to prove that someone encrypted a specific (large) chunk of data

Alice encrypts her data with HER secret key. Then she sends the encrypted data to Bob who should encrypt it with HIS secret key. Caroline should then eventually get this double encrypted data. ...
46 views

### Does the plaintext have to be at least as long as the key in Polyalphabetic substituion cipher

In polyalphabetic substitution cipher, if we have a key $k$ (a string of letters) of length $n$ does the plaintext $m$ (also a string of letters) have to satisfy $|m| \geq n$? Also, side question, ...
105 views

### Does the Paillier system remain secure if it is used to encrypt only binary values, i.e. {0, 1}?

Is there any security compromises if the Paillier system was used to encrypt only binary message in {0, 1}? i.e., plaintexts are either 0 or 1.
74 views

190 views

### Security of RSA with $\gcd(pq, (p-1)(q-1))\ne 1$

The Congress of ThéOùÇa enacted that civilian use of any public-key encryption system is authorized on the territory of ThéOùÇa, subject to meeting certain security requirements published by the ...
195 views

### Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity?

Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity? My reasoning is that the attacker doesn't know all the plaintext, so by having a hash, the ...
112 views

### How can I know when a file was signed?

I have been thinking about digitally signed documents (Word files and PDF files) and can not get over the fact about - how can I securely know when the file was signed? Scenario: If the date of the ...
89 views

### How do you create a large PRP from a small one?

How can you efficiently create a pseudorandom permutation with a large domain given a PRP with a small domain? Meaning: given an $n$-bit PRP, how can I create an $n k$-bit PRP? I'm only interested in ...
222 views

### Is it possible to generate a secure permutation F over 32-bit integers even if F(0) … F(n) is public knowledge?

I'm currently interested in the problem of generating random-looking URLs from sequential database IDs, like how they do it in link shorteners. One way to do this is to encrypt the sequential database ...
691 views

### What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?

The DES retail MAC, also known as ISO 9797-1 mode 3 with DES, computes the MAC of a block of data using a 16-byte (112 bit) key. It can be seen as CBC-MAC using simple DES with the first half of the ...
81 views

### ElGamal signature scheme: Why is r included in s

In the ElGamal signature scheme we calculate a signature for a (hashed) message $m$ as $r \equiv_p g^k$, $s \equiv_{p-1} (m - xr) k^{-1}$ and verify it by checking $g^m \equiv_p y^r r^s$. Here ...
89 views

### Entropy Loss of KDFs

Am I losing any entropy when using KDFs, such as the ones in NIST Special Publication 800-108? For example, can I derive 128-bit session keys from a (uniformly random) 128-bit master key?
134 views

### Multi-key decryption

Let's assume I want to send a secret message to $N$ recipients in an asymmetric way. My message could be encrypted with $N$ different public keys $p_i$ one after another and send to each user ...
886 views

### ECDSA with SHA256 and sepc192r1 curve: Impossible, or how to calculate $e$?

I need to use ECDSA as the signing algorithm and SHA256 for hashing the message. I'm running into troubles verifying the signature calculated on two different platform (one is BouncyCastle, another ...
507 views

### Using GMAC for Authentication without encrypting the message

I am pretty new to cryptography and have a sample of GCM mode of operation for AES. PFB the code ...
222 views

### Decrypting an encrypted text out of order

Does there exist a cipher that can be encrypted twice with two different keys and then decrypted twice using either key first? For example: ...
107 views

### Galois field step in XEX mode

I'm reading through the XEX mode spec, and I want to make sure I've understood the $\alpha^j$ step correctly: $X = E_K(I) \oplus \alpha^j$ $C = E_K(M \oplus X) \oplus X$ where: $M$ is the ...
109 views

### Is there a practical upper limit for password rehashing?

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security? Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, ...