# All Questions

335 views

### TLS Key Block calculation - What is a PRF?

In Section 6.3 of the RFC for TLS 1.2, it is written that the key_block is derived from the following formula: ...
92 views

### Proving a decision was randomly made [duplicate]

Alice and Bob want to agree on a bit $0$ or $1$. Both know it would be fair to pick that at random, but there's no way they could meet to throw a dice and no third party they could trust. Are there ...
94 views

### Linear Cryptanalysis - possible without plaintext?

If Linear Cryptanalysis exploits the fact that the plaintext and ciphertext are not completely unrelated, is the attack possible without having access to the plaintext?
383 views

### Breaking Double Encryption

I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly ...
247 views

### Functional Encryption (for Non Experts)

I recently stumbled across "How to Run Turing Machines on Encrypted Data". Given that it's now possible to run turing machines on encrypted data, what open problems remain in the realm of Functional ...
210 views

### PRP, PRF and modular arithmetic

Are there any arithmetic or mathematical functions that can be used as PRPs or PRFs ? Since, Conventional block ciphers like AES are that are proven to be good PRPs are not based on mathematics but ...
117 views

### What makes LSBit steganography detectable? And what would help in concealing it?

In a project of mine I took a 24-bit bitmap image and I performed LSBit steganography over it (saved a black and white image inside each of the planes R, G, B) using pixel shuffling and xor ...
163 views

### Help in understanding exactly how lattices used as one way functions for hashing

I am doing a cryptography course via long distance and we have been given an assignment which is based on lattice-based cryptography. I have spent the majority of the past week sifting through papers ...
211 views

### what's the advantages of identity-based systems over certificate-based ones?

Actually, I'm not familiar to how identity-based and certificate-based systems work, so ,can anyone give me a detail and comprehensive answer to this question? Moreover, in what environments the ...
513 views

### Json AES128: Security against known plaintext attack

I have a system where I am transmitting json messages securely (using for example AES-128), where each message has the same format. For example ...
260 views

### Distinguishing attack on CBC-MAC

I want to ask about distinguishing attack on CBC MAC, as in the paper published by Ketting Jia, Xiaoyun Wang, Zheng Yuan, and Guangwu Xu: Distinguishing Attack and Second-Preimage Attack on the ...
106 views

### Is this algorithm demonstrating “proof of work”

Is this algorithm demonstrating proof of work? This is a algorithm where a "token" is combined with a time stamp and then a cryptographic hash is generated from the combination, next the objective is ...
109 views

### What kind of Quantum cryptography technology(protocols) can be used for Mobile Ad hoc networks(MANETS)?

Typically ad hoc networks do not have a proper infrastructure and the routing is done only through the base stations which are connecting a wired and wireless network. Does quantum cryptography ...
227 views

### Is it possible to split a large AES encrypted string and decrypt the parts one by one?

Due to some platform restrictions our decryption algorithm can only handle up to 1 million bytes. The string we receive is larger, having been generated by AES in cipher block chaining (CBC) mode, ...
146 views

### Publicly exposed hash of private key

Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an ...
123 views

### password generation: random length or max length

In short: Is it cryptographically stronger to have a known length password of the maximum length allowed, or a random length password somewhere in the range of the longest length possible? Does the ...
234 views

### Why is this MAC based on secure PRF with ordering and randomization insecure?

Is this MAC secure: To authenticate a message $m=m_1||\ldots||m_l$ where $m_i \in \{0,1\}^{n/2}$, choose $r \leftarrow \{0,1\}^n$ at random, compute t:=F_k(r)\oplus F_k(\langle 1\rangle || ...
422 views

### How should we interpret the cryptanalysis results of SIMON and SPECK?

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for ...
753 views

### How good is using AES CTR mode with initial counter as 0?

Is it advisable to use AES CTR mode with the counter initialized to 0? How good is it in security terms?
372 views

### LFSR using words

If I've got an LFSR, let's say a 16-bit Fibonacci LFSR as shown in the corresponding wikipedia article, which generates maximum length sequences, could I use it to create word sequences instead of bit ...
101 views

### How do these figures represent a boolean function?

In the Wikipedia article "Bent functions", there are some figures representing those Bent functions: How do these figures represent a boolean function ?
1k views

### How much is slower GCM AES-128 than one of the stream chipher eSTREAM?

Evaluate the speed of the algorithm GCM AES-128 and compare it whith speed of one of the stream chipher in eSTREAM. Can someone give such an assessment?
204 views

### Decryption possible only within a period of time

Time-locked encryption and time-released encryption seem to be security systems focused on making sure that the decryption of certain message cannot take place before a certain time has passed. ...
181 views

### How should I interpret this note on diffusion of the internal state of a PRNG?

This question is about Tyche, a non-cryptographic PRNG. While the PRNG is not cryptographic the analysis and this question surely is heavily involved with cryptography, so I think it's on-topic here. ...
728 views

### Why does second pre-image resistance imply pre-image resistance

I am studying hash functions. I can understand why collision resistance implies second preimage resistance, but I don't get why second preimage resistance should imply first preimage resistance. ...
256 views

### Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
344 views

### Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?

Could you choose the number of PBKDF2 iterations based upon the system time? I've heard a few people recommend that the number of iterations for PBKDF2 should be doubled every two years (starting ...
103 views

### Recasting randomly generated numbers to other widths

Suppose I have a list of randomly generated uint_8's, uniform over the whole range of uint_8. I write them into a file as raw ...
91 views

### Is it possible to generate a message using the mac and the key?

Say that you have the Key and the MAC value that was generated from the Key using CBC. Is it possible to generate a message with just the mac and the key? If so, how would you do it?
132 views

### Can stream ciphers (usually) be “run backwards”?

Is it possible to reconstruct the previous output bits of a stream cipher, e.g. RC4, when only the current state is known, or is that computationally hard, or even impossible (due to ambiguous ...
159 views

### Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
143 views

### Camellia cipher - is it a symmetric or asymmetric cipher?

I read a wiki page about Camellia cipher and know that it is a block cipher that can use 128-bit, 192-bit or 256-bit keys. But I cant find any information about if its a symmetric cipher (uses one key ...
159 views

### Public Keys on Social Media

Is there any problem with using social media (i.e. Facebook) as a directory of public keys? For example, couldn't Alice put a note containing $(g^a \bmod p, g, p)$ on her Facebook page so she could ...
131 views

### Can OTP still be broken if there are several messages being sent with only a slight variation in a password?

If an attacker were able to get a hold of 2 encrypted messages that were both encrypted in a one time pad with a password that were each similar but had one change in the first character, could it ...
189 views

### Why must we hash lot of times in rainbow tables?

I don't get the utility to chain and reduce in generating rainbow tables. Hash functions are made to not have collisions, or at least chain only 2 times so we don't return to the concept of the hash ...
2k views

### How is input message for SHA-2 padded?

I read about how is an input message prepared to be hashed by MD4,MD5 or SHA-1: Step1 Append padding bits The input message is "padded" (extended) so that its length (in bits) equals to 448 ...
125 views

### Can you explain what the AES paper means by “sharing active S-boxes”?

I am reading the "Biclique cryptanalysis of the full AES" paper. What do they mean by "sharing active S-boxes"? How can this concept can be advantageous to make a bicycle? If there is someone who ...
1k views

### How does SafeNet MobilePASS generate passwords?

We use MobilePASS at work but the latest version of the android client seems to be buggy so I wanted to have a go at implementing the algorithm myself. You can download the client to play with here: ...
176 views

### Pseudorandom functions

The usual case to distinguish a pseudorandom function from a random function is to assume that the adversary can choose the plaintext blocks. Is there another case (game) in which the adversary can ...
220 views

### Are SSL modes with forward secrecy vulnerable to the BEAST attack?

From the original BEAST paper, it seems to me that you need the same session key when encrypting data, so you can check if the original plaintext block is the same as your chosen plaintext (which is ...
486 views

I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts. The problem is that I need to ...
164 views

### No IV for one off symmetric file encryption

My question is (hopefully, for somebody) a simple one; but my project is holding as I'm not sure. I read on SO that generating encryption keys without an IV is a bad idea, so is using a constant IV ...
239 views

### HMAC and assumptions on the cryptographic hash

According to Wikipedia, a cryptographic hash function has the following properties: Pre-image resistance: Given $h$, it's difficult to find any message $m$ such that $h = H(m)$. Second pre-image ...
276 views

### How insecure in practice?

I am in attempt to understand relative insecurity of certain encryption schemes. Particularly of interest is DES and RC2. I know AES is better and should be used to encrypt. But practically, if ...
741 views

### How to test if a number is a primitive root?

How to test if a number is a primitive root, assuming the modulus is a prime? And if not? Is it not enough if the number is relatively prime to the modulus or prime?
603 views

### Could quantum computers “break” symmetric crypto-systems (e.g. AES)?

These days I'm reading about quantum computing and quantum cryptography which I've found extremely interesting. Well, I also read some blog posts of Bruce Schneier talking about how quantum computers ...
148 views

### Is this algorithm secure?

I recently found this site, proposing a hashing algorithm for passwords. They describe the following: pad the password on both sides with SHA1(email) to ...
923 views

### Is Base64(SHA1(GUID)) still unique like the original GUID?

Basically what the title is; GUIDs are unique by design. If you run the GUID through SHA1 and then Base64 the hash, will the resulting string have the same guaranteed uniqueness as the GUID, or not?
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...