# All Questions

581 views

### Cracking an RSA with no padding and very small e

I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
390 views

### Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?

I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
582 views

### Timing attack on modular exponentiation

It is known that computing $a^x \bmod N$ takes $O(|x| + \mathrm{pop}(x))$ multiplications modulo $N$, where $|x|$ is the number of bits of $x$ and $\mathrm{pop}(x)$ is the number of $1$ bits (Hamming ...
127 views

### How hard are discrete logarithms problems in $\mathbb Z^{*}_{n}$ and $\mathbb Z^{*}_{n^2}$, where $n$ is the RSA $n=pq$

Use the notations form the Wikipedia article Paillier Cryptosystem , assume that the chipertext $c$ and $c^{\lambda} \mod n^2$ are both given, is it possible to compute $\lambda$ easily?
184 views

### Why does Rijndael with a 256-bit block require the bottom two rows to be shifted one more space than usual?

From Wikipedia: For a 256-bit block, the first row is unchanged and the shifting for the second, third and fourth row is 1 byte, 3 bytes and 4 bytes respectively. Why the change? Is there any ...
128 views

I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, ...
562 views

### How does using salt reduce rainbow table attack?

I could create a rainbow table for a particular salt value and still create a successful attack similar to one without salt value.
373 views

### How do single use passwords work for an encrypted message

LastPass encrypts its data before sending it to their servers. The key for the data is generated using a combination of the master password and username. How then can a one-time password be used to ...
360 views

### Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?

Can hash trees provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key?
865 views

### Why can't I break ElGamal encryption by brute-forcing the secret exponent?

I am doing a course on cryptography on coursera and one of the topics covered was the ElGamal Encryption system. I am using the terms as defined in Wikipedia. Alice publishes $g$ and $g^x$. ...
1k views

### How to generate a public key from a private ECDSA key?

Having some specific ECDSA curve and a private key, how does one calculate the public key? I am having a hard time finding the algorithm and equations for it.
493 views

### Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
272 views

I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message. Given that an ...
167 views

### Is there an advantage to storing keys split between several hashes?

I have a question about the way to store a key or password that was used for encryption, so that the application can check if the user put in the right key for decryption. If I make a mistake, please ...
2k views

### Cracking the Beaufort cipher

Is there any easy way to crack a Beaufort cipher? We have a Vigenère table, and are trying to guess the keyword. Any easier way?
205 views

### Impact of algorithms for factoring using elliptic curves over $\mathbb{Q}$

Recently a few papers have appeared that describe a new approach to factoring, using elliptic curves over $\mathbb{Q}$. See, e.g., Factoring integers and computing elliptic curve rational points, ...
406 views

### Is frequency analysis a useful tool against encryption by multiplication?

If I transform natural plaintext by: making each letter two decimal digits, considering the whole as a decimal number; multiplying by the key (some integer constant), giving the ciphertext; would ...
155 views

### Attack by replaying messages

Assume Alice and Bob communicate over an insecure channel using one-time perfectly-secret encryption together with one-time secure message authentication code. Say Eve has the ability to eavesdrop and ...
156 views

### Correct method to encrypt data so that it can be decrypted only by Alice and Bob

I need to build a system that stores encrypted transactions. Transaction involves always two parties. Payer and payee. Both must be able to download encrypted transaction from server and decrypt it ...
281 views

### Why not encrypt salt?

Assuming I had to distribute salt+ciphertext together over an insecure channel, isn't it better to store the salt encrypted? By encrypted I mean with a block cipher and with key and IV derived from ...
1k views

### AES CCM vs CCMP

Are the terms AES CCM and AES CCMP are equivalent, or is there any technical differences between the two?
316 views

### Conforming Randomness To An Alphabet

Imagine that we're trying to create a function to generate a random string conforming to a user-supplied alphabet. That way, users can generate random strings with given characters. Something like: ...
474 views

### Is symmetric encryption vulnerable to plain-text-attacks?

Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob ...
2k views

### “Signing” with public key

For this question, the following caveats and assumptions hold: There exists a 2048-bit RSA key pair used exclusively for signing/verification The private key is kept completely private There exists ...
520 views

### Is it possible to figure out the public key from encrypted text?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
4k views

### RSA cracking: The same message is sent to two different people problem

Suppose we have two people: Smith and Jones. Smith public key is e=9, n=179 and Jones public key is e=13, n=179. Bob sends to ...
353 views

### How is de-synchronisation of HOTP solved?

From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
220 views

### A set of key pairs and one hash to secure them

I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it ...
29 views

### What are possible caveats when generating a group for use as parameters for Diffie-Hellman key exchange?

As reusing a widely used group for Diffie-Hellman key exchanges might lead to far easier third-party key discovery through precomputation for that specific group, I would like to know what can ...
114 views

### HW acceleration for Camellia cipher (x86_64/AES-NI/AVX2)

Modern processors support hardware acceleration for various crypto functions such as AES directly, or general vector operations which can be used in crypto ...
52 views

128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key. A simple example: Generate keys $k_1, k_2, ... 1answer 199 views ### Any stream cipher with avalanche effect? As far as I know, all stream ciphers work by generating a stream of pseudo random bytes, and XOR it with the plain text to get the cipher text. It has the property that one bit change in the cipher ... 1answer 37 views ### What information should I send along with an AES ciphertext and is there any standard to do that? While using some crypto implementations I got to see that many times a comment is added to the ciphertext. For example: ... 1answer 367 views ### Is XOR adequate for encrypting truly random data? [duplicate] It is well-known that the two-time pad is very insecure. However, it seems unexploitable in the case where the plaintext is indistinguishable from random (ex. symmetric keys). Is this property ... 1answer 49 views ### Faster alternative to HKDF HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ... 1answer 122 views ### Is finding collisions in a part-hash not often enough a bad problem? My situation: I've been working now for a couple of months on my own unique hash function, I've changed it many times and had two main versions but I won't bore anyone with the details of my work; at ... 1answer 24 views ### What is PCT_SSL_CIPHER_TYPE_1ST_HALF? I'm writing a tool to do security posture assessments of SSL/TLS services, and ran into an interesting result. I ran through all defined cipher suites to test which could be negotiated (like sslscan ... 1answer 184 views ### Homemade Randomized RSA Considering the following encryption scheme where RSA is used to encrypt a plaintext m and then we choose a random r and compute: $$A = r + m^e \bmod N$$ and $$B = r^e \bmod N$$ So the ciphertext is ... 2answers 90 views ### Is it safe to use cipher block sizing instead of padding? I'm using this kind of technique instead of padding of cipher buffer (here goes pseudo-code): ... 1answer 49 views ### Truncating ciphertexts on ring-LWE schemes On the section 5.4 of the paper Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme, the authors explain how to discard some bits of the ciphertexts to get smaller ciphertexts and ... 2answers 119 views ### secure PRF or not I am new in Cryptography and I saw this question in a note I solved it but I'm not sure about my answers. Let$F : \{0, 1\}^n × \{0, 1\}^n→ \{0, 1\}^n$be a secure PRF (i.e. a PRF where the key ... 1answer 87 views ### CTR DRBG dependent on request size? I am trying to understand the CTR DRBG specification in NIST SP 800-90A. It seems slightly different to a pure stream cipher in that the key and counter are reset after each generate call using the ... 2answers 129 views ### What is the use case for XOF functions (i.e. SHAKE128/256)? FIPS 202 defines 2 functions: SHAKE128 SHAKE256 As extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ... 2answers 159 views ### Is there any relation between two strings with the same MD5 hash? Is there any relation between two strings with the same MD5 hash? For example these two strings: ... 2answers 132 views ### Why does the modulus of Diffie–Hellman need to be a prime? I read a lot about Diffie-Hellman, but there is one thing I dont understand: why does the modulus p need to be a prime? What if it would not be a prime? 2answers 61 views ### Re-sending captured encrypted data Let’s assume Bob is some algorithmic stock trading machine. Bob takes commands from Alice, who sends messages to Bob. For example: Alice could be sending a message to Bob to stop trading. But if ... 1answer 120 views ### How can cryptographic signatures be somehow linked to a physical signature? A few days ago, I was asked to sign an online document over DocuSign as well as on SignEasy, any the signature were accepted just by a physical signature sent over email or on the app. They did not ... 1answer 119 views ### Encrypt a message with hash function, shared symmetric key, but no cipher I am very new to Crypto and need some clarification or input. The question is: Suppose that Alice wants to encrypt a message for Bob, where the message consists of three plaintext blocks,$P_0$, ... 2answers 107 views ### How does DSA provide non-repudiation in proving a document was properly displayed (not altered or displayed incorrectly)? I am building an iOS app that allows the user to sign a document served to them by a web server. So that page of the app simply has a document in the top pane, and at the bottom pane, a place to sign ... 2answers 120 views ### Challenge-Response Phases in IND-CPA The IND-CPA game has two challenge-response phases A key is generated by running$Gen(1^n)$and challenger selects a bit b {0,1} uniformly at random. Adversary gets input$1^n\$. Can query the oracle ...

15 30 50 per page