# All Questions

837 views

### Are there any standards of multi-prime RSA key generation?

FIPS 186-3 specifies a method to generate DSA parameters. Is there anything similar (official standard or widely-accepted recommendation) that shows how to generate the primes for multi-prime RSA?
798 views

### How were the number of rounds for different key sizes of AES selected?

The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
422 views

### How were the AES key and block length subsets of Rijndael selected?

My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
668 views

### What is the PRG period of stream ciphers such as RC4 or Salsa20?

I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ...
1k views

### Why is asymmetric cryptography bad for huge data?

I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length. Why is this? I know about hybrid encryption, which uses symmetric encryption to ...
326 views

### Is quantum key distribution safe against MITM attacks too?

i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution ...
572 views

### What happens when a root CA has its private key compromised?

What happens when a root CA has its private key compromised? Then all children in the tree are compromised too? And then all certificates are compromised? What needs to happen then? Related: - How ...
551 views

### Is there any strong enough pen-and-paper or mind cipher?

Some ciphers are talked about here, but I don't see an answer, are they strong enough, or are non-computer ciphers more or less just a toy and one should abandon using them for practical purposes?
208 views

### Message authentication codes construction

I was reading the paper $[1]$ and came across the scheme that I show below. While I understand the scheme well, I don't understand why they prepend a 0 to the block containing $r$ and a 1 to all other ...
478 views

### How do I generate a session key using the Diffie Hellman algorithm?

How to generate a session key between two nodes in two different subnets when the nodes don't know each other directly, using diffie hellman algorithm?
717 views

### Is RSA of a random nonce with no padding safe?

Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
367 views

### Combining multiple symmetric encryption algorithms - implications?

I was just wondering if I add more security by combining two or more symmetric encryptions on a plain text. For example: Plaintext → AES → Twofish → Serpent Of ...
317 views

### Why are these specific values used to initialise the hash buffer in SHA-512?

I'm reading the book Network Security Essentials written by William Stallings. To create a message digest with SHA-512, we have to go through some steps: append padding bits. append length ...
3k views

### How to solve MixColumns

I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this? I found some topic in the internet about MixColumns, but I still have a lot of question to ...
1k views

### Does encrypting twice using the same block cipher produce a security weakness?

If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system. ...
1k views

### Symmetric vs. Asymmetric cryptographic approaches to data security

I know the basic differences between Symmetric vs. Asymmetric cryptography, but I'd love to know more details: Exactly why is the asymmetric approach slower than the symmetric? Why does it make ...
1k views

### Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?

The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ...
690 views

### About Cryptography in a Character Language

Suppose I had a message in Chinese (or another non-phonetic language) and I wanted to encipher it. Some of the simplest encryptions in English are substitution ciphers, but such ciphers don't seem ...
2k views

### What exactly is a negligible (and non-negligible) function?

The mathematical definition of neglible and non-neglible functions is fairly clear-cut, but why they are important and how they are used in cryptography?
1k views

### Is using a predictable IV with CFB mode safe or not?

While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine): "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
1k views

### What is the use of REAL random number generators in cryptography?

I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators. However, I don't understand for what a real random number ...
238 views

### Elliptic Curves of different forms

Looking at http://safecurves.cr.yp.to/ to find a safe curve, I find that most curves described here are of a different form from that generally used. In Bouncy Caslte, for example, ...
3k views

### What is the effect of the different AES key lengths?

How does a changing key length affects the ciphertext, not only in case of AES, but in general? I know that the key spaces become much larger and the number of rounds in case of AES changes, but is ...
743 views

### Measuring entropy for a ciphertext only attack

When bruteforcing a password (e.g. the common attacks on DES), where you have ciphertext only, you need a way to assess whether a decrypted plaintext is the right one. I believe the EFF DES machine ...
749 views

### How can I improve a password generation scheme based on a shared secret and URL?

I currently use the following method to generate a different password on every website I have to login: password = SHA1 ( mainPassword . domainName . number ) ...
309 views

### Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ...
707 views

### Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme

Shamir's original paper (PDF, 197kb) describing a threshold secret sharing scheme states: To make this claim more precise, we use modular arithmetic instead of real arithmetic. The set of ...
469 views

### Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?

A recent paper showed that the McEliece cryptosystem is not, unlike RSA and other cryptosystems, weakened as drastically by quantum computing because strong Fourier sampling cannot solve the hidden ...
1k views

### Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$). That explains why we are using 256 bit ...
801 views

### What is a tweakable block cipher?

Pretty simple question - but I can't seem to find much information about it. What exactly is a tweakable block cipher? How do they differ from traditional block ciphers? What is the 'tweak'? Is it ...
420 views

### Why are elliptic curve variants of RSA “chiefly of academic interest”?

Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
423 views

### A fair peer-based coin-flipping protocol?

I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight. This is how my idea ...
366 views

### What is the key strength reduction encrypting only 160 bits of data using RSA1024 for signatures?

I am attempting to determine the strength of an incorrectly implemented 1024 bit RSA signature scheme. The weakness in the implementation is that the padding data lacks random numbers. As a result, ...
157 views

### Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
122 views

### Is multiplicative secret sharing secure?

I suggested mulitiplicative secret sharing in an answer to another question, but noted that I wasn't sure if it was even secure and was hoping someone would comment on the security. Since no one did, ...
429 views

### How to prove the security of the PRNG?

Are there any realties tests or criterias that prove the security of the PRNG? What kind of tests or criteria?
234 views

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ... 7answers 434 views ### Turning a cipher into a hashing function This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;) The first hashing functions created ... 3answers 1k views ### Relative merits of AES ECB and CBC modes for securing data at rest I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data. I assume the ... 0answers 408 views ### How can I find two strings$m_1$and$m_2$, knowing that I know$m_1 \oplus m_2$? [duplicate] Possible Duplicate: How does one attack a two-time pad (i.e. one time pad with key reuse)? I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first ... 3answers 1k views ### Encryption with “constant” initialization vector considered harmful I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice. For stream ciphers not doing ... 1answer 1k views ### Why not use CTR with a randomized IV? I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ... 1answer 589 views ### Linear Cryptanalysis What is the principle of linear cryptanalysis, as applied to a block cipher ? For instance, this page gives the rough outline of differential cryptanalysis. 3answers 299 views ### Designing a key expander out of ciphers Is it possible to compose or combine$n$ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate$n$ciphertexts from the same key,$k$, and that recovering the key,$k$, from ... 1answer 554 views ### AES timing attacks I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ... 1answer 1k views ### Why, or when, to use an Initialization Vector? i'm trying to figure out when an Intialization Vector (IV) should be used. There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ... 3answers 310 views ### Is there a public key semantically secure cryptosystem for which one can prove in zero knowledge the equivalence of two plaintexts? If Alice encrypts two messages$a$and$b$, such that$x=E(a)$,$y=E(b)$. Can Alice prove (without revealing$a$,$b$or the private key) that$a = b$? Obviously the proof must not be too long and it ... 1answer 168 views ### Why are there$ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...