# All Questions

1answer
91 views

### Statistical tests for pseudorandom permutations

I'm implementing a format-preserving encryption scheme similar to those described in the literature. I want to sanity test my PRP using some statistical tests like TestU01. However, I'm not sure how ...
2answers
315 views

### Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
1answer
112 views

### OTT service using FPE

Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an ...
1answer
233 views

### Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
1answer
679 views

### Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
1answer
72 views

### Are HMACs based on hashes with larger bit-lengths also more secure?

When doing encrypt-then-mac, I can choose to use a hmac as the MAC. For example, I could use a hash like SHA-256 or SHA-512 (by using it as a keyed hash) to create that HMAC. Does it increase ...
1answer
169 views

### How do I decide what mode to use?

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with ...
2answers
141 views

### Use of less than secure random numbers for 'a' during an SRP proof of password

With Secure Remote Password protocol SRP6a random numbers are used for s, a and b. Where ...
2answers
269 views

### Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
1answer
164 views

### Hide message length in symmetric key cryptography

Is there any way to hide message length from adversary in symmetric key cryptography? Suppose we want to hide message length from active and efficient adversaries.
1answer
189 views

### Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$

So far as I can find, every method better at producing hash collisions in cryptographic hashes than generic collision search involves finding some metric for the distance between two messages' hashes ...
1answer
88 views

### What is the Geometric Generalised T' Method?

This page by Nicolas T. Courtois mentions Geometric Generalised T' Method. It is described as an advanced geometric algorithm, never published, for finding extra linearly independent equations at ...
1answer
199 views

### Private set intersection, using a semi-trusted server

Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
1answer
2k views

### Questions about OAEP for RSA

I have two questions about OAEP for RSA. How are the number of bits to pad with 0 chosen? For example, if I'm sending a 255 byte message with RSA-2048 I have 8 unused bits (1 byte). Should I split ...
1answer
158 views

### Reason for difference in assumptions for practical private-key and public-key crypto

Theoretical cryptography tells us that everything in the world of private-key cryptography (CCA-secure symmetric encryption, message authentication codes, etc.) can be built from one-way functions and ...
1answer
222 views

### Encrypting a TCP connection between two unknown nodes

I'm writing an application for controlling computers from a client. I'd very much like it if the connection is secure and only authenticated clients are allowed access. The workflow will be ...
1answer
74 views

### Oblivious Transfer where neither party learns the index of the message

In a traditional Oblivious Transfer setting, the sender has a list $(x_1, x_2, ... , x_n) \in G$ where $G$ is the chosen group. The receiver has $b \in \mathbb{N}$, such that engaging in the protocol ...
1answer
194 views

### Cryptanalysis of AES on SSD with TRIM enabled

Attack scenario: SSD physically retrieved from a computer that is turned off. The entire disk is encrypted with AES 256-bit (GNU/Linux, LUKS). The SSD has had TRIM enabled for several years and the ...
1answer
195 views

### Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say ...
1answer
535 views

### Blockwise Montgomery multiplication

I have to implement a 256*256 bit Montgomery multiplier for pairing computations. The straightforward approach is to use a bit-serial version, but I would like to utilize the built-in 64*64 bits ...
2answers
724 views

### What is the definition of “security beyond the birthday paradox”?

I'm reading a paper about MACs and I would like to be sure about the meaning of a security beyond the birthday paradox. Is there a definition?
2answers
183 views

I've read a few papers recently that used a notion of security called "indistinguishability from random bits/strings" under chosen plaintext attack, also called IND\$-CPA. See e.g. ... 1answer 697 views ### How to choose keys for a block cipher? AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e.$\{{0,1}\}^k$x$\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$I know that these ... 1answer 166 views ### Can a PRNG with a fixed amount of entropy always be detected? Given a fixed seed (i.e. no ongoing source on entropy), is there (practically or theoretically) any PRNG algorithm that can generate an infinite sequence of random numbers such that an observer cannot ... 2answers 361 views ### Proof of elliptic curve difficulty Are there any proofs that cryptographic functions on an elliptic curve are any more difficult than the analogues over modulo arithmetic? While at present, ECC appears to be more difficult, as it is ... 2answers 1k views ### Storing Credentials for a Third Party (Originally posted to SOF, but I got no answers) I am designing a small application for use inside my company. My application needs to connect to a third party website on behalf of my application ... 1answer 286 views ### Fractal Merkle Traversal I am studying Fractal Merkle Tree Traversal algorithm in the book “Post Quantum Cryptography” (PDF). On the [pag. 54] I don't understand this paragraph: We may determine the number of pebbles ... 1answer 12k views ### How does DES decryption work? Is it the same as encryption or the reverse? [duplicate] If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits? 1answer 421 views ### How Were secp*k1 elliptic curve generators chosen? The Koblitz elliptic curves specified in the SEC2 document https://docs.google.com/viewer?url=http%3A%2F%2Fwww.secg.org%2Fcollateral%2Fsec2_final.pdf all have the nice feature that the parameters are ... 2answers 328 views ### Advantages of combined PRNGs This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ... 1answer 237 views ### Is my identity exposed when publishing my public key or encrypting with PGP? Let's say I create my PGP keys with my appropriate name and email address. Will these personal information be exposed if I publish my public key? When I encrypt a message for sending it to my ... 3answers 339 views ### Parallel-resistant proof-of-work scheme? I am looking for a proof-of-work scheme which cannot be effectively parallelized. For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function$f()$, a target ... 1answer 2k views ### Is it possible to change PGP / GPG Key Size on an exisiting key? Is it possible for myself to change the key size (say from 2048 to 4096) on an EXISTING PGP / GPG key, and just republishing that key? Or do I have to generate a new key all together? I want to say ... 4answers 1k views ### Decrypting files with an unknown method but a known result I am assuming there is a very simple way of working this out by brute force, but I am not sure if there is a better way. I have a file of data that I wish to get (my data, generated by a machine). ... 2answers 2k views ### definition and meaning of semantic security I'm taking coursera cryptography course. The definition of semantic security is hard to understand. I tried to slightly restate it (the word "efficient" was in the original definition). Do I get it ... 1answer 193 views ### How do you find the inverse degree of a hash function? I am trying to learn cryptanalysis on the Keccak hash function. One of the papers on zero sum distinguishers talks about Keccak having inverse degree of 3. I am unable to figure this out: how do you ... 1answer 769 views ### Can two cipher letters per plaintext letter easily defeat character frequency analysis? For a class 5 years ago I wrote a paper about "defeating character frequency analysis by using two cipher letters per plaintext letter" ... 1answer 345 views ### How hard is it to generate a partial RSA fingerprint collision? When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ... 1answer 153 views ### low-exponent RSA I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages$m_1$and$m_2$related by a known relation$m_2=m_1+1$. Suppose further the messages are ... 1answer 216 views ### Questions about the ideal cipher model I've read that we can study the security of modes of operation by assuming the use of an ideal block cipher. I've also seen a paper suggesting that the ideal cipher model could be something else than ... 1answer 666 views ### Hill-cipher, disordered alphabet I am going to apply a simple substitution cipher to my input, then encrypt the result with a Hill cipher. How can this be broken, in a chosen-plaintext threat model? In other words, instead of the ... 1answer 2k views ### Winzip AES256 vs PGP If I use the AES256 option in Winzip to encrypt a file, is it any less safe or less secure than using pgp encryption? 1answer 228 views ### Combining AEAD with RSA 'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ... 2answers 685 views ### Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ... 1answer 666 views ### Understanding Feldman's VSS with a simple example I'm trying to understand Feldman's VSS Scheme. The basic idea of that scheme is that one uses Shamir secret sharing to share a secret and commitments of the coefficients of the polynomial to allow the ... 1answer 436 views ### Question about why RSA is hard to attack I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ... 1answer 408 views ### Why does the SRP-6 calculation of B include a multiplier k = 3? In SRP-6$B$is calculated as$B=kv+ g^b, k=3$. What is the purpose of$k$, and why was it fixed as$3$? (In SRP-6a, this value$3$is replaced by$k = H(N,g)$, but this question is about SRP-6.) 2answers 494 views ### Commutativity of keyed hashes Definition${H_1}^{K_1}(X)$means data$X$hashed by keyed hashing algorithm$H_1$with key$K_1$. Short question Is$H_1^{K_1}(H_2^{K_2}(X))$equal to$H_2^{K_2}(H_1^{K_1}(X))\$? Is ...

15 30 50 per page