# All Questions

132 views

### Why is $-1$ an illegal message in the Goldwasser-Micali Encryption Scheme

I'm not sure why in the Goldwasser-Micali encryption scheme with a Blum integer $N$, the message $-1$ is always a illegal message. Can you give me some direction for starting? What is illegal ...
391 views

### Appropriate AES key length for short term protection

Currently I'm doing some initial research for a fully connected distributed network communication model. The context here is a peer-to-peer multiplayer protocol, using a majority-voting system. More ...
542 views

### Serpent cipher : Osvik S-Boxes confusion and test vectors

I'm having hard time with the implementation of the S-Boxes by Osvik found in this paper: Speeding up Serpent. At the end of the paper, all the s-boxes are given and then, I just implement them. ...
601 views

### How difficult is it to brute force d in RSA: d = (1/e) mod φ in a CPT attack?

Given that RSA key generation works by computing: n = pq φ = (p-1)(q-1) d = (1/e) mod φ If I was an attacker who wanted to brute force d, could I brute force d given just the public key, the ...
598 views

### Making counter (CTR) mode robust against application state loss

Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter ...
359 views

### Friedman Index of Coincidence, pruning multiples of the keylength

I'm trying to write a Vigenere decipher script. I defined a couple of possible keylengths using the Kasiski method, using roughly this method: find recurring strings in the ciphertext between 3 and ...
303 views

### What are the possible cryptographic implications of Zhang's proof of the Twin Prime Conjecture?

Earlier this year, Yitang Zhang published a proof of a weakened form of the Twin Prime Conjecture. I'm wondering if any of the new mathematical machinery he developed has uses in cryptography or could ...
402 views

### some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
157 views

### What does it mean to be simultaneously hardcore?

In this paper the term "simultaneously hardcore" is defined as: "We say that a block of bits of $x$ are simultaneously hard-core for a one-way function $f(x)$, if given $f(x)$ they cannot be ...
229 views

### Salsa20 in Davies-Meyer mode with a fixed key (message): is it one-way?

Say I have a function that calculates a pseudo random permutation and this function is easy to invert. For example $P(i) = AES_k(i)$ where $k$ is a publicly known key. So anyone can compute $P(i)$ ...
151 views

### Feedback requested on a method of posting a message without revealing the author

So I was thinking about variations on the Dining Cryptographers problem - In some cases, it's useful to be able to post a message without revealing the source, but with the additional constraint of ...
99 views

### ASN.1 OID of bcrypt

What is the ASN.1 OID associated to bcrypt (the key derivation scheme)? For instance, PBKDF2 has 1.2.840.113549.1.5.12 and it is therefore possible to store a ...
10k views

### How does DES decryption work? Is it the same as encryption or the reverse? [duplicate]

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?
189 views

### salting with password hash to improve security?

Would something like the following improve security (against rainbow attacks, not brute force)? Assume that $P$ is a user-chosen password, and the objective is to obtain a hash $H$ for password ...
160 views

### Finite fields in elliptic curve

I have an elliptic curve defined over finite field where $S_1=aP$ . Is it valid to say that $S_1P$ can also be computed. $P$ is the generator of the group. What my real question is that. Should '$a$' ...
253 views

### How to Compute C^2 in AES MixColumns Matrix?

In mix Columns we have: $$C(x) = \{03\}X^3 + \{01\}X^2 + \{01\}X^1 + \{02\}$$ In Viktor Fischer's Paper on MixColumn and ...
391 views

### Ed25519 choice of private key implementation

This answer to another question describes the different values chosen as private key and public key by various Ed25516 implementations. What are the advantages / disadvantages of each? (Table ...
256 views

### Parallel-resistant proof-of-work scheme?

I am looking for a proof-of-work scheme which cannot be effectively parallelized. For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function $f()$, a target ...
177 views

### Are there any good examples of Contemporary Mechanical Cryptography?

Are there secure mechanical cryptosystems in use today? Not necessarily alphabetic either, ie digital but mechanical?
303 views

### Stream cipher with Diffie-Hellman and Cryptographic Hash Function? [duplicate]

I know: Never do your own crypto. But this question is just theoretical. Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash ...
1k views

### Is it possible to change PGP / GPG Key Size on an exisiting key?

Is it possible for myself to change the key size (say from 2048 to 4096) on an EXISTING PGP / GPG key, and just republishing that key? Or do I have to generate a new key all together? I want to say ...
182 views

### How to compute the attacker's probability?

Given a random bit string $R=r_1r_2\cdots r_n$, let us encrypt each bit $c_i=E(r_i,k_i)$ where $k_i$ is taken from the stream of encryption keys. Suppose that an attacker can guess the correct $r_i$ ...
666 views

### Block cipher with key longer than block size

When a block cipher key length is greater than the block length, is it the case that for some keys $k_0, k_1$ (with $k_0 \not= k_1$) and plaintext message $m$ that $E_{k_0}(m) = E_{k_1}(m)$?
488 views

### Advantages/disadvantages of different message numbering schemes

For a stream of packets, where each packet is individually encrypted with a block cipher, it's desirable to have each encrypted packet only valid for that position in the stream. A message number ...
538 views

### Can you identify the public key used to encrypt something?

If I encrypt a string with a public key, does the encrypted ciphertext reveal the public key I used to encrypt it? Basically, I don't want anyone to know who the ciphertext is addressed to. I'm ...
273 views

### What's efficient MPC protocol for determining if sum's bigger than y?

My secure multi-party computation (MPC) in need is simply to determine if a sum of two private variable is bigger than a given value $y$, as $f(x_0, x_1) = [(x_0 + x_1) > y]$ in which the value ...
347 views

### Can i modify data “protected” by a CRC16?

There are 100 bytes with a CRC16. However I only know the first 50. I want to change byte 5 from a known value X to another value Y, and fix up the CRC16 to be valid - without knowing bytes 50-100. ...
814 views

### Difference entity authentication and implicit key authentication

From the Handbook of Applied Cryptography, in discussions of key sharing algorithms, I see definitions: Implicit key authentication is when one party is assured that no other aside from a ...
1k views

### Winzip AES256 vs PGP

If I use the AES256 option in Winzip to encrypt a file, is it any less safe or less secure than using pgp encryption?
280 views

### How to derive formulas for addition and multiplication in Jacobian coordinates

Is there a way to derive the formulas for point addition and multiplication on elliptic curves in Jacobian format by yourself? How could I have derived these formulas by myself?
165 views

### How to compare two datasets „anonymously”?

Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation: There are 10 defined colors (blue, orange, yellow etc.) There are ...
491 views

### Counter Mode: static IV but different keys [duplicate]

Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ...
656 views

### Adding and multiplication in jacobian coordinates

How can I derive formulas for adding 2 points and multiplication by a scalar in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
2k views

### Secure encrypt-then-sign with RSA

I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt. However, I have encrypted data that I need to sign, to prove the author of ...
262 views

### GPG and PAR2 error correction data from the plain archive, will it compromise security?

I have the following scenario: Archives compressed with 7z, hundreds of MiB in size GPG to encrypt the archives (binary, without ASCII armor) PAR2 to create error correction data Question 1. ...
1k views

### Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
263 views

### Zero-Knowledge Challenge-Responce Protocol

Good day to everyone. I am trying to implement an e voting system (just for reference -it is not important though-it is described at the Internet Voting Protocol Based on Improved Implicit Security ...
590 views

### How to represent point-at-infinity in affine coordinate

In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate. Whether x=0 and y=0 can be considered as point-at-infinity in ...
644 views

### RSA private key format for Mega

I've been trying to reverse engineer Mega's (mega.co.nz) API calls. And stopped on the step where client needs to decrypt session id with provided RSA key. I can get key data, but I have no idea how ...
753 views

### How can I calculate the time complexity of modular arithmetic?

I'm doing modular arithmetic in a Java program, and I want to calculate the time complexity of the individual operations. $$c= a · b \bmod n$$ $$m = a^{-1} · b \bmod n$$ How do I get an ...
810 views

### estimate of time required to crack sha512crypt password with JtR + OpenCL

OK, I have a shadow file with a password that I know, it is 4 letters followed by two numbers. Using John The Ripper with OpenCL support, on a laptop with AMD Radeon Mobility graphics, how long would ...
277 views

### efficient authentication with broadcast encryption?

(I am not a crypto expert, so I apologize if the terminology I use is incorrect.) Suppose I have the following simple broadcast encryption scheme for securely sending content to $n$ authorized ...
179 views

126 views

### Is the mod_auth_tkt scheme secure?

The third-party Apache plugin mod_auth_tkt uses a tragically-not-HMAC construction: ...
324 views

### Security considerations for partially shared password databases

Programs like KeyPass and 1Password store password database files encrypted by a single password. If someone knows the protecting password ("Vault Key"), they can read the entire database ("secrets"). ...
306 views

### Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?

Consider a communication channel that needs to be secure (Encryption can not use full "volume" encryption, since future messages are not known). Would it be better to only transmit encrypted ...