# All Questions

55 views

### Prove that the following MAC is insecure

I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function $F$ involved: Gen generates a uniform $k \in \{0, 1\}^n$. To ...
54 views

### (How) Can we use HOTP for file encryption?

I recently went through the list of available KeePass plug-ins and noticed one that advertises support for HOTP as a means to derive the database key. Now I trust the developer of this plug-in who is ...
68 views

### How does order-preserving encryption work on string?

I have read “How does order-preserving encryption work?”. After that, I completed order-preserving encryption on integer data. Now, I have four questions in this subject: Is it possible to apply ...
37 views

### Rainbow Table - Number of Chains and Chain Length

Is there a difference between having 10,000 of chains (with 1,000 chain length) and 10,000 chain length (with 1,000 of chains)? How does it affect the success rate of the rainbow table? I understand ...
69 views

### Is there an example of a “robust, yet not private” SMC protocol?

I have been trying to understand the interplay between robustness and privacy of an SMC protocol. It is easy to come up with a protocol that is private but not robust. Can someone provide an example ...
51 views

### Is there any IND-CPA secure stream cipher with a “standard” hardness assumption?

I've read our recent question: "One-time pad using RSA and Diffie-Hellman functions" which asks about the security of a particular way to convert RSA and discrete exponentiation into a stream cipher. ...
72 views

### Do other one-time signature schemes exist?

I'm curious to know if there are any one-time signature schemes other than Lamport's or its variants (Merkle trees are one such variant). The first I've discovered is called "Bins and Balls" which ...
57 views

### Padding password before SHA-512 hashing to avoid info leak via timing

I've noticed that SHA-512 password hashing leaks some information about the password length. There's a weak correlation between password length and time to hash. It's roughly linear, but in steps of ...
35 views

### Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...
122 views

### Using One Time Pad with a block cypher

The One Time Pad is often described with a xor cipher. This is nice to show the theoretical strengths of the one time pad but not so great in real world scenarios where key reuse is a danger. So Is ...
56 views

### How is McEliece chosen plaintext secure?

Suppose a challenger creates a McEliece encryption system where there is a public key consisting of a matrix $G$ representing some linear code, and a number $t$ for the number of errors. Then the ...
67 views

### How does the verification process associated with this signature scheme work?

My cryptology professor asked us to show that while the following signature scheme is conceptually valid, that it is inherently insecure, however, I am not sure how to demonstrate that the associated ...
137 views

### How to generate fingerprint for PGP public key

I would like to know how to generate a fingerprint for an openPGP public key. To be clear, I'm interested in how the fingerprint is generated. I'm aware that I can get the fingerprint with a ...
105 views

### How does the Flickr length extension attack work?

I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there. ...
85 views

### Diffie-Hellman: *assumed* largest prime factor of order of $g$?

I've read in several places: some of my confusions about DDH assumption - comment by Thomas Pornin on his own post Is there a key length definition for DH or DHE? - the answer by Tom Leek that ...
87 views

### Is my pin algorithm secure?

I'm a hobby programmer and very new to this field. I opened a bank account recently and got two pins. One for the girocard and the other for a creditcard. And I needed two more pins for the online ...
48 views

### Blake2: truncate 512-bit hash is safer than 256-bit by Config?

I need to calculate 256-bit hash in my code, using BLAKE2. I know I can set BLAKE2 to generate itself a 256-bits hash for any data but I´m curious to know what can be safer and faster: 1- Create the ...
89 views

### If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

Say we construct a pseudo-random generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back into the ...
142 views

### Private and Public Keys

I have a very basic understanding of encryption and the encapsulation process, but for the life of me I can't grasp how public keys and private keys work, how they're made, and how they're exchanged. ...
291 views

### Is there a difference between asking for a signature and asking for a decryption in challenge-response authentication?

Consider the following two authentication schemes. In both cases the server knows a public key of the client (for a signature system in the first and an encryption system in the second case). Scheme ...
124 views

### Fast forwarding hash functions

We know that a good hash function is a one way/trapdoor function. Easy to calculate one way, harder to work out a previous state. I was wondering if anyone knew a good hashing system that allowed you ...
73 views

### Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme?

Let's assume we have a message $M$ and it's signature $S$ and that $|$ is the concatenation operator. Should we encrypt $S|M$ or $M|S$? Does it even matter?
108 views

### Probabalistic Polynomial-time Algorithms & One-way functions

I've been reading up on probabilistic polynomial-time algorithms and one-way functions, and I was hoping to get some guidance on the topic. A textbook I'm reading states the following for one of the ...
279 views

### How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure?

I was presented with this seemingly paradoxical information, and am hoping someone can explain what I'm missing here. I have an encrypt-and-mac scheme here.If I want to transmit message m to Bob, I'd ...
143 views

### Do we have to consider the cryptographic properties of the decryption, if we're only using the encryption?

Treyfer for example has slower diffusion in decryption. It has full diffusion between words in 2 rounds for encryption and 7 rounds for decryption. Do we have to consider the (bad) cryptographic ...
125 views

### ElGamal Signatures

I know various applications of RSA signatures. I wonder, is there any real-world applications of ElGamal signatures and encryption?
205 views

### Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ?

If the digital signature in ECC (ECDSA) is made using a private key, why is the OpenSSL library using ECKEY pair as an input parameter instead of the private key only ?
116 views

### OpenPGP Public-Key algorithm

What means when pgpdump shows this kind of algorithm in the Public-Key Encrypted Session Key Packet? ...
400 views

### Why must we generate the signature before any compression being done at PGP?

I have done some research on PGP and I found out there are of two reasons why we must generate the signature before doing any compression. Yet, I am not sure I really understand them both. One ...
103 views

### Are there simpler FHE methods than Craig Gentry's original paper?

Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE. I was wondering though, are there any simpler methods that have been discovered since ...
174 views

### Is there any such thing as “proof of location”?

I'm looking for a way for someone to prove to me their geographical location without a trusted third-party. Imagine wanting to prove to someone you're actually physically in a specific place. I'd ...
82 views

### Is there a signature scheme for the Cramer-Shoup cryptosystem?

I have a project that I have to use cryptosystem and signature scheme for it. I've read about Cramer-Shoup cryptosystem and I want to use it since it is more secure the ElGamal cryptosystem, but, I ...
189 views

### Parallelization of CFB mode encryption and decryption

While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand: Regarding whether CFB ...
174 views

### Generating PGP key *without* random generator? (using fixed input only)

I understand why in general, a strong random generator or source of entropy is used when generating PGP keys. However, I have a use case where I want to generate PGP keys deterministically, i.e. ...
162 views

### How to generate new LWE samples

Assume we are given a small fixed number of LWE samples with secret $s$ and error $e$, where the error distribution is taken so that the LWE problem is hard. My question: How can one further ...
232 views

### what are the NTRU keysize and application in industry ?

I'm a student currently working on a research project on the NTRU cryptosystem, I've read some papers about this cryptosystem, and in those papers they are talking about keysize, is it the size of the ...
132 views

### Is it ever unsafe to compress an EC point?

I am working with a library that outputs EC points in uncompressed form. To save space, I'm considering modifying said library to use compressed EC points. Assuming that I keep track of the sign bit ...
311 views

### Is there a format preserving cryptographically secure hash?

I want a way to 'scramble' strings (like words, names) in a predictable way but I don't ever want to (myself or anyone else) be able to 'unscramble' the strings. I found that perhaps what I am ...
166 views

### What are the steps to decrypt a TLS 1.1 record?

My question is related to another question in Cryptography about TLS 1.1 and 1.2. I have read both RFC 2246 The TLS Protocol Version 1.0 and RFC 4346 The TLS Protocol Version 1.1. What I know is that ...
144 views

### Spritz cipher sponge function capacity

Rivest and Shuldt proposed a new sponge like cipher algorithm called Spritz: http://people.csail.mit.edu/rivest/pubs/RS14.pdf In this paper they say that the strength of the cipher is related to the ...
199 views

### Is it safe to derive a password from a signature provided by ssh-agent?

I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk. Using the system with some other form of ...
661 views

### What is the difference between “secp…” and “sect…”?

The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”. For example: “secp224k1” and “sect571k1”. What is ...
80 views

### NIZK Proof of knowledge N of M discrete logarithms (threshold)

It is well known how to produce a NIZK that curvepoints $aG$ and $aP$ have the same discrete logarithm $a$ with respect to the curvepoints they are multiplied by. There is also a way to prove that a ...
1k views

### Efficient AES - Use of T-tables

I'm really in trouble! I'm trying to understand how the T-tables in AES encryption work. But I don't know if I get the point. What I understood is that they are used to reduce the whole computation of ...
280 views

### “Practical” operations supported by functional encryption?

I'm curious about what operations have been developed into functional encryption schemes. What I mean by that is: what operations can be performed over encrypted ciphertexts? Obviously homomorphic ...
212 views

### Repeatable crypto

Is there a safe way to do crypto that will always produce the same result for a given input? My use case is transferring deltas of huge files, to a backup server. The backup server has no knowledge ...
197 views

### Session-specific Symmetric Key Derivation Using SHA256

I was wondering if there were any security implications of deriving session keys from a symmetric key using SHA256 in the following manner: $Ks = SHA256(Nonce||K)$, where $Nonce$ is the session ...
115 views

### Clarification of the terms “brute force” and “guess”

In the answer to the question “What exactly is a negligible (and non-negligible) function?” There is a part in the explanation that – as far as my knowledge goes – is conflicting: But instead of ...