# All Questions

149 views

### Elgamal test vectors

I know that Elgamal algorithms have fallen out of fashion, and they are not included in any widespread cryptographic standard nowadays. However, they are still present in several popular crypto ...
356 views

### Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
1k views

### How to perform file encryption using 128-Bit AES?

I am confused, how can I encrypt a file using 128 Bit Advanced Encryption Standard? Do I need only to encrypt the file name and it's content or is there something that I need to do to encrypt it? Is ...
873 views

### How secure is the Vigenère cipher in file encryption if you encrypt the password first?

I created a basic file encryption method, that seems pretty secure to me (based on an answer below, it seems to be an implementation of the Vigenère cipher) , but one of my colleagues claims that it ...
416 views

### Does the Biclique attack on AES pose a credible risk to its security?

I have heard a lot about the biclique cryptanalysis research on AES, which as far as I know is the closest anyone has got to breaking AES. Exactly how close did they get? Does this attack propose a ...
4k views

### How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
372 views

### Is this authenticated one-way communication protocol secure?

I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
383 views

### Finding the LFSR and connection polynomial for binary sequence.

I have written a C implementation of the Berlekamp-Massey algorithm to work on finite fields of size any prime. It works on most input, except for the following binary GF(2) sequence: $0110010101101$ ...
64 views

### Distributed knowledge problem

I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
246 views

### Can a digital money system exist, that's secure, anonymous and allows offline transactions?

I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that ...
52 views

### Proving item association without revealing one of the associated items

I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category. I have two associated pieces of information: tag — known by both parties. Unique per ...
3k views

### How to solve MixColumns

I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this? I found some topic in the internet about MixColumns, but I still have a lot of question to ...
114 views

### Tips on conceiving safe software messaging platform

I have a personal project in mind in which I plan to use cryptography in order to let the users be confident in the fact that, even if all data get's stolen, it would be virtually impossible to crack ...
340 views

### How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
1k views

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ... 3answers 259 views ### How much bigger does a precomputed lookup table get when salt is added? I am trying to wrap my head around the benefits of salt in cryptography. http://en.wikipedia.org/wiki/Salt_(cryptography) I understand that adding salt makes it harder to precompute a table. But ... 3answers 449 views ### Security equivalence proofs for breaking RSA It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring. In otherwords, ... 0answers 183 views ### Most frequently used digital signature schemes in the recent years I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today. I'm only really interested in what is employed recently (ie. last couple ... 1answer 694 views ### Deterministic nonces in CTR mode I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ... 2answers 807 views ### Can one reduce the size of ECDSA-like signatures? Using$n$-bit ECDSA, a signature has a size of$2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature. Is ... 2answers 364 views ### Can RSA encryption produce collisions? In RSA, a message is encrypted by$m^e \pmod N$.$N$is the modulus,$m$is the message and$e$is the public exponent. (I know that$m$should not be greater than$N$.) My question is, can$m^e$be ... 2answers 279 views ### Simple xor cipher extension Probably the simplest cipher is the xor cipher with a single integer. One can extend this to use more than one integer by several means. I'm wondering if there is any benefit to doing more than this: ... 0answers 68 views ### Is it possible to build an unfair noisy channel from 1 out of 2 oblivious transfer [closed] For a fair channel, sender sends a bit b and receiver gets it with probability 1/2 and gets b's flipped value with probability 1/2. It is trivial to build a fair noisy channel from 1 out of 2 ... 1answer 206 views ### Useful pairings for cryptography I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ... 1answer 268 views ### Blind signature with openssl I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ... 2answers 1k views ### What are advantages of using a HMAC over RSA with SHA-1 hashes? I am currently studying for an exam and this was a previous question: Give one advantage of using HMACs over using RSA to sign SHA-1 hashes. My thoughts are that it has something to do with the ... 1answer 598 views ### X9.62 Multiplying an elliptic curve point by a number I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number. As far as i understand X9.62 gives some recommendation for doing it but i ... 1answer 830 views ### AES-NI implementation examples Newer Intel and AMD processors have hardware support for implementing AES using the instruction set AES-NI (instructions AESENC, AESKEYGENASSIST etc). Do you know of any clean example implementation ... 1answer 467 views ### What is the correct way to generate cryptographically-secure pseudorandom numbers in C? I am learning about crypto, purely for my own interest. As part of that I am implementing a simple 'one time pad' toolset in C. Naturally I need to generate random numbers to create the pad, and they ... 0answers 120 views ### Security of stream cipher based on Matrix multiplication GF(256) with randomized padding The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function ... 1answer 1k views ### Big-O Notation: Encryption Algorithms I am currently completing a dissertation concerning the encryption of data through a variety of cryptographic algorithms. I have spent much time reading journals and papers but as yet have been ... 2answers 219 views ### One-way function and factoring I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ... 1answer 143 views ### DIfferent inner and outer hash functions for NIST Recommended HMAC? The NIST recommended HMAC uses $$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$ Is it ... 1answer 272 views ### Verilog simulation & synthesis of Diffie-Hellman key exchange Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ... 1answer 111 views ### What “Tag Length” should be used for the EAX MAC? Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting ... 1answer 300 views ### Brute forcing Cardan grille Having a "rotating" square Cardan Grill with sides long n cells, how could i determinate the cost of a brute-force attack? How many configurations should be considered to perform an exhaustive ... 1answer 339 views ### Why does a broken hash function undermine an HMAC? For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ... 2answers 3k views ### How does a chosen plaintext attack on RSA work? How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext? 2answers 252 views ### Is there a hash algorithm that is slow to calculate but relatively fast to check? Or more generally, is there a function or algorithm that is slow to calculate/execute, has a reliable execution time, and has a result that can be tested much more quickly than the calculation took? 4answers 696 views ### What is the largest performed/possible bruteforce attack to date? I've read that cracking 128-bit key is currently out of reach of all humanity. However, I can't seem to find any information on what scope of brute force attacks have been performed or are possible at ... 0answers 310 views ### Diffie hellman key exchange on elliptic curve over an extension field [closed] I am attempting to do a final semester project where I implement Diffie-Hellman key exchange on an elliptic curve over an extension field (2^256). Can anybody help me to generate the extension field ... 3answers 1k views ### Does encrypting twice using the same block cipher produce a security weakness? If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system. ... 1answer 1k views ### Is AES restricted to only 64 characters for the key/password? I am wondering if AES only supports 64 character passwords? When using truecrypt, the maximum character limit on passwords is 64 characters; however, when using WinRAR, the limit is 128 characters. ... 1answer 1k views ### What is the difference between CBC and GCM mode? I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and seen code ... 2answers 151 views ### CPA distinguisher for matrix multiplication in GF(256) with randomized padding What is the best CPA distinguisher for the function$F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$described below? Let$E_k$be a$2n\times2n$matrix with elements in$GF(2^8)$, selected by generating bit ... 1answer 140 views ### In RSA, rationale for prime$p$with$p-1$having prime factor$u$with$u-1$having large prime factor? In the 1978 RSA paper, it is recommended, among other things, to choose primes$p$such that$(p-1)$has a large prime factor$u$. This was motivated by Pollard's p-1 algorithm. Further, the authors ... 2answers 243 views ### My custom handshake I am a beginner in cryptography and I designed a custom handshake between 2 entities$\rm C$(client) and$\rm S$(server) which should meet the following requirements: Requirements: The handshake ... 2answers 272 views ### Can I use guids / uuids as counters for key derivation? I have a 512 bit master key, and 128 bit unique identifiers. I'm going to derive 256 bit keys to for use with deterministic and block ciphers. For reference, The KDF I'm going to use is Hash( C | ... 1answer 183 views ### Twofish key length I'm using twofish. Say you have a 120 bit key, is there any difference in using a 128 bit bit keylength or a 256 bit one? Since the most significant digits of the key will be allo zero in both cases, ... 3answers 370 views ### RSA finding the inverse of the public exponent I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq$p \cdot q = N\$) Now, ...

15 30 50 per page