# All Questions

2answers
685 views

### Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
1answer
668 views

### Understanding Feldman's VSS with a simple example

I'm trying to understand Feldman's VSS Scheme. The basic idea of that scheme is that one uses Shamir secret sharing to share a secret and commitments of the coefficients of the polynomial to allow the ...
1answer
437 views

### Question about why RSA is hard to attack

I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ...
1answer
408 views

### Why does the SRP-6 calculation of B include a multiplier k = 3?

In SRP-6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$? (In SRP-6a, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP-6.)
2answers
496 views

### Commutativity of keyed hashes

Definition ${H_1}^{K_1}(X)$ means data $X$ hashed by keyed hashing algorithm $H_1$ with key $K_1$. Short question Is $H_1^{K_1}(H_2^{K_2}(X))$ equal to $H_2^{K_2}(H_1^{K_1}(X))$? Is ...
1answer
343 views

### Questions about William's p+1

First off, if you're doing William's p+1 test, then also doing Pollard's p-1 is redundant, since the p+1 test covers both cases, right? Second, why is the recurrence $V_{n+1} = aV_n - V_{n-1}$ used? ...
2answers
2k views

In my notes, there are 2 definitions of perfect security: "For $M \in \{0,1\}^m$, define the distribution $D_M$ on strings as follows: to choose a random member of $D_M$, choose a random $K \in ... 1answer 2k views ### Figuring out key in hill cipher (chosen-plaintext attack) I have been wondering what approach to take in order to figure out what key was used to encrypt a message using the hill cipher. I know it is possible to obtain it even if it were just a ... 1answer 162 views ### Safety of a pre-keyed DH-Key Exchange Asuming this scenario: Bob and Alice each have the public key of the other party for a D-H function and want to exchange data. Now, if they each generate their shared secret, is it safe to assume ... 1answer 463 views ### Is this a good way to encrypt a file? I need to encrypt a file, distribute it over an insecure channel, and decrypt it later. Using a symmetric-key algorithm. Here's what I intend to do: Get a password P from the user. Generate a 16-byte ... 2answers 315 views ### Detect tampering of data I have the following problem: There are$n$users and each users fills in three data points per day, this are three integers between say$-10$and$10$. I have access to the database and hence I am ... 3answers 4k views ### How do ciphers change plaintext into numeric digits for computing? For example, in RSA, we use this for encryption:$ciphertext = (m^e \mod n)$and for decryption. If our message is "hello world", then what number do we have to ... 1answer 994 views ### How to securely use Elgamal encryption in libgcrypt? How secure is libgcrypt's Elgamal implementation of encryption (how different it is from textbook Elgamal), and how can I tweak padding and other preprocessing actions? For example, I know that usign ... 2answers 913 views ### Is this a correctly formatted PGP session key packet? RFC 4880 may be full of information, but it can be incredibly vague at times, so im looking for someone who actually knows the answer to this. Given this public key: ... 1answer 567 views ### Using a derived key for CMAC Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication: Two keys are derived from the master key k (16 byte): ... 1answer 1k views ### Is this authenticated one-way communication protocol secure? I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ... 1answer 2k views ### What is the 'Version Incompatibility" Problem in TLS 1.1/1.2 and 1.0? It's unclear to me if there are multiple problems, or a single one, (and just what that problem is) with servers incorrectly negotiating down from a client offering 1.1 or 1.2 to something they ... 1answer 67 views ### Differential & linear characteristics for integer multiplication What are the probabilities of differential & linear characteristics for the function that XORs the high and low bits from a$n \times n \rightarrow 2n$bit multiplication? I remember reading ... 2answers 42 views ### How long should a HMAC cryptographic key be? In the top answer to this question the answerer says 'with a sufficently long key'. I am using a SHA1-HMAC (may switch to SHA256-HMAC) algorithm to verify cookies sent to clients as authentication ... 1answer 49 views ### Prove that the following MAC is insecure I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function$F$involved: Gen generates a uniform$k \in \{0, 1\}^n$. To ... 1answer 47 views ### How does order-preserving encryption work on string? I have read “How does order-preserving encryption work?”. After that, I completed order-preserving encryption on integer data. Now, I have four questions in this subject: Is it possible to apply ... 1answer 35 views ### Rainbow Table - Number of Chains and Chain Length Is there a difference between having 10,000 of chains (with 1,000 chain length) and 10,000 chain length (with 1,000 of chains)? How does it affect the success rate of the rainbow table? I understand ... 1answer 66 views ### Is there an example of a “robust, yet not private” SMC protocol? I have been trying to understand the interplay between robustness and privacy of an SMC protocol. It is easy to come up with a protocol that is private but not robust. Can someone provide an example ... 1answer 69 views ### Do other one-time signature schemes exist? I'm curious to know if there are any one-time signature schemes other than Lamport's or its variants (Merkle trees are one such variant). The first I've discovered is called "Bins and Balls" which ... 1answer 33 views ### Is it okay to use a variable-time RSA implementation to verify TLS certificates? RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ... 2answers 118 views ### Using One Time Pad with a block cypher The One Time Pad is often described with a xor cipher. This is nice to show the theoretical strengths of the one time pad but not so great in real world scenarios where key reuse is a danger. So Is ... 2answers 102 views ### Distribution of hash values I was wondering if the uniform distribution of hash values is a generally required criteria for cryptographic hash functions. The english wikipedia article only mentions four main properties. But it ... 1answer 49 views ### How is McEliece chosen plaintext secure? Suppose a challenger creates a McEliece encryption system where there is a public key consisting of a matrix$G$representing some linear code, and a number$t$for the number of errors. Then the ... 1answer 66 views ### How does the verification process associated with this signature scheme work? My cryptology professor asked us to show that while the following signature scheme is conceptually valid, that it is inherently insecure, however, I am not sure how to demonstrate that the associated ... 1answer 103 views ### How to generate fingerprint for PGP public key I would like to know how to generate a fingerprint for an openPGP public key. To be clear, I'm interested in how the fingerprint is generated. I'm aware that I can get the fingerprint with a ... 1answer 102 views ### How does the Flickr length extension attack work? I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there. ... 1answer 81 views ### Diffie-Hellman: *assumed* largest prime factor of order of$g$? I've read in several places: some of my confusions about DDH assumption - comment by Thomas Pornin on his own post Is there a key length definition for DH or DHE? - the answer by Tom Leek that ... 1answer 78 views ### Is my pin algorithm secure? I'm a hobby programmer and very new to this field. I opened a bank account recently and got two pins. One for the girocard and the other for a creditcard. And I needed two more pins for the online ... 1answer 43 views ### Blake2: truncate 512-bit hash is safer than 256-bit by Config? I need to calculate 256-bit hash in my code, using BLAKE2. I know I can set BLAKE2 to generate itself a 256-bits hash for any data but I´m curious to know what can be safer and faster: 1- Create the ... 1answer 137 views ### Private and Public Keys I have a very basic understanding of encryption and the encapsulation process, but for the life of me I can't grasp how public keys and private keys work, how they're made, and how they're exchanged. ... 2answers 276 views ### Is there a difference between asking for a signature and asking for a decryption in challenge-response authentication? Consider the following two authentication schemes. In both cases the server knows a public key of the client (for a signature system in the first and an encryption system in the second case). Scheme ... 3answers 116 views ### Fast forwarding hash functions We know that a good hash function is a one way/trapdoor function. Easy to calculate one way, harder to work out a previous state. I was wondering if anyone knew a good hashing system that allowed ... 1answer 70 views ### Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme? Let's assume we have a message$M$and it's signature$S$and that$|$is the concatenation operator. Should we encrypt$S|M$or$M|S$? Does it even matter? 1answer 269 views ### How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure? I was presented with this seemingly paradoxical information, and am hoping someone can explain what I'm missing here. I have an encrypt-and-mac scheme here.If I want to transmit message m to Bob, I'd ... 2answers 140 views ### Do we have to consider the cryptographic properties of the decryption, if we're only using the encryption? Treyfer for example has slower diffusion in decryption. It has full diffusion between words in 2 rounds for encryption and 7 rounds for decryption. Do we have to consider the (bad) cryptographic ... 1answer 187 views ### Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ? If the digital signature in ECC (ECDSA) is made using a private key, why is the OpenSSL library using ECKEY pair as an input parameter instead of the private key only ? 1answer 111 views ### How does the ring settings of enigma change wiring tables? EDIT: The model I'm trying to make is "Enigma 1". I learned initially about it from a book called "Code Book" and then looked at it in detail from its wikipedia page. The site wont allow me too add ... 1answer 107 views ### OpenPGP Public-Key algorithm What means when pgpdump shows this kind of algorithm in the Public-Key Encrypted Session Key Packet? ... 2answers 365 views ### Why must we generate the signature before any compression being done at PGP? I have done some research on PGP and I found out there are of two reasons why we must generate the signature before doing any compression. Yet, I am not sure I really understand them both. One ... 2answers 99 views ### Are there simpler FHE methods than Craig Gentry's original paper? Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE. I was wondering though, are there any simpler methods that have been discovered since ... 2answers 137 views ### Is there any such thing as “proof of location”? I'm looking for a way for someone to prove to me their geographical location without a trusted third-party. Imagine wanting to prove to someone you're actually physically in a specific place. I'd ... 2answers 81 views ### Is there a signature scheme for the Cramer-Shoup cryptosystem? I have a project that I have to use cryptosystem and signature scheme for it. I've read about Cramer-Shoup cryptosystem and I want to use it since it is more secure the ElGamal cryptosystem, but, I ... 1answer 186 views ### Parallelization of CFB mode encryption and decryption While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand: Regarding whether CFB ... 1answer 157 views ### Generating PGP key *without* random generator? (using fixed input only) I understand why in general, a strong random generator or source of entropy is used when generating PGP keys. However, I have a use case where I want to generate PGP keys deterministically, i.e. ... 1answer 150 views ### How to generate new LWE samples Assume we are given a small fixed number of LWE samples with secret$s$and error$e\$, where the error distribution is taken so that the LWE problem is hard. My question: How can one further ...

15 30 50 per page