# All Questions

0answers
137 views

### If H(m) = 0 for some m, how can a DSA signature be forged?

If we know for some message $m$ that $H(m) = 0$, how can we forge a DSA signature with only the public key? I got that $g^s*r = (g^x)^r$ where $x$ is the private key, but that's one equation with 2 ...
0answers
38 views

### Why doesn't this authentication protocol work? [duplicate]

I am a student taking a cryptography course so forgive me if this comes off as a silly question. This is an assignment question: Alice ------R--------> Bob Alice <-----[R]B------ Bob Alice ...
2answers
129 views

### Is a simple stream cipher “partially homomorphic” if no integrity check is applied?

My understanding is that, simply put, a stream cipher is just a CSPRNG such that $R(i,k)$ will produce a deterministic but statistically random sequence, where $i$ is an IV, and $k$ is the session ...
3answers
255 views

### What is the difference between a 'cipher' and a 'mode of operation'?

What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)? Aren't these both terms for the encryption/decryption technique?
2answers
294 views

### Are there any bijective one-way functions not based on number-theoretic hardness assumptions?

I'm trying to find a bijective function $y=F(x)$ which should be easy to compute in one direction but hard to compute in the other, where the one-way property is not based on a number theoretic ...
6answers
13k views

### Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
1answer
62 views

### The real-life meaning of proving over a group that doesn't support the oracle?

If I proved a scheme's security under GDH assumption, in real-life, if this DDH oracle does exist, then it's good, but what about other side ? In real-life, if this DDH oracle doesn't exist, then ...
0answers
300 views

### What is the chance of a collision when using SHA-3?

I currently am writing a web app and am using two random hashes that are before and after the string and are both 50 char long (alphabet, numbers, and special chars). ...
2answers
99 views

### Is the composition of collision resistant hash with non collision resistant hash a collision resistant hash?

Suppose $h_1$ is collision resistant, and $h_2$ isn't. Will $h(x)=h_2(h_1(x))$ always be collision resistant? [Edited:] the output of h2 must be uniformly distributed
2answers
255 views

### Graphically representing points on Elliptic Curve over finite field

I have taken elliptic curve $E\colon y^2=x^3-4x+20$, defined over $\mathbb{F}_{29}$. The number of points on the curve, $\left|E(\mathbb{F}_{29})\right|=37$. I took base point $P=(1,5)$, and got ...
0answers
95 views

### $\phi$ function in Dual_EC_DRBG

I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition ...
2answers
116 views

### Why use two affine transformations in Multivariate Cryptography?

I'm reading Multivariate Cryptography and would like to know why we use two affine transformations to scramble the central map? Why not use only one?
2answers
325 views

### Testing the Fortuna random number generator?

I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at ...
2answers
110 views

### What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
2answers
133 views

### Splitting a password for dual roles [duplicate]

I would like to prompt users for a single passphrase to establish trust with separate, normally (but not always) complementary systems from one password input. I'm essentially looking for a box where ...
1answer
170 views

### What is the difference between, and security of $Z_p$ and $F_p$?

While reading some papers, I found that sometimes $Z_p$ was used but sometimes $F_p$ was used ($p$ is prime). Usually, the author will only use their subgroups like this: choose a big prime factor of ...
1answer
128 views

### What does this step in this protocol for the Yao's Millionaire Problem mean?

I was reading “An Efficient Protocol for Yao’s Millionaires’ Problem” (Ioannidis and Grama 2003). In the proposed protocol in section three, it is written: (Step 4) For every $i$, $1 \le i \le d$, ...
4answers
692 views

### Would this simple encrypted chat program be feasible using One Time Pads?

Lets say I want to build a simple chat program that has encryption that is impossible to crack for anyone, even a theoretical government with a massive super computer. Ok here's my idea. You'll need ...
1answer
208 views

### Purpose of leading zero in PKCS1-v1_5 padding

According to this document the padded message has the following structure: $EM \;= \; 0x00 \; || \; 0x02 \; || \; PS \; || \; 0x00 \; || \; M$ What is the purpose of this null byte at the beginning ...
1answer
216 views

### XOR cipher Pseudo-random key strength

When implementing a XOR cipher with a pseudo-random key equal in length to the plaintext, Is there a significant difference in potential key strength between keys drawn from a pool of either 1000 or ...
2answers
145 views

### Publicly exposed hash of private key

Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an ...
1answer
23k views

### What is safer: ZipCrypto or AES-256?

Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with ...
0answers
48 views

### Can you clarify the proof that secure LR-two party protocols do not exist?

In the paper “Multiparty Computation Secure Against Continual Memory Leakage” on pg. 1237, the footnote #1 discuss why it is not possible to construct a leakage resilient two-party protocol. But I'm ...
1answer
127 views

### Can minimum encrypted message length be used to identify public key algorithm or derived some of its features?

Encrypting a very small message using public key cryptography always result in larger encrypted messages. Is it possible to deduce the algorithm used, key length, etc just by looking at the minimum ...
0answers
71 views

### How can user privacy be preserved in certificateless cryptography?

In certificateless cryptography, how can a user preserve his privacy from Key Generation Center? If the KGC becomes malicious, how can the user's privacy be preserved? I read "Privacy-Preserving ...
2answers
584 views

### Kryptos : K1. What is the origin of the “palimpsest” keyword?

I'm studying the Kryptos sculpture with its cryptographic puzzles K1 to K4. I understand that the keyword "palimpsest" was reverse-engineered using the tableau (and brute-force computer processing), ...
0answers
179 views

### What would make it impossible to deny that decryption of a package has taken place?

I'm part of a team designing a system where a user have to be able to read a certain package, if he has preformed an action or series of actions that makes it legal for him to do so. The tricky part ...
1answer
443 views

### Why does plain RSA not work with big messages ($m>n$)?

From what I can remember, RSA is something like this: Generate 2 distinct prime numbers $p$ and $q$ that have similar bit length. Compute $n=pq$ and $\phi(n)=(p-1)(q-1)$ Compute $e$ such that ...
1answer
156 views

### Can homomorphic encryption filter?

Often in articles homomorphic encryption is praised as the holy grail of encryption for cloud storage. This is done by suggesting that it can do any computation, and as such could be used for ...
0answers
132 views

Let $PRG: \{ 0, 1\}^n \rightarrow \{ 0, 1\}^{n+s}$ be a pseudo random generator and let $A$ be an inverter that runs in polynomial time, specifically: $\large \mathbb P_{d \leftarrow PRG(U_n)}[ A(d) ... 2answers 254 views ### Convert a number to sha-1 I have a task to find a the message for which the SHA-1 hash's last 11 symbols in hexadecimal presentation corresponds to an 11-digit number. I have been given the following example solution: For ... 2answers 232 views ### scrypt and bcrypt for benefits of both? I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory. Couldn't you just hash something with ... 1answer 213 views ### How do you construct a practical full-domain hash function? I am looking for practical constructions for Full Domain Hash. I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a ... 2answers 104 views ### Speed up modular exponentation with fixed base and modulus Can someone explain, how$a^x \mod N$can be speeded up, when$a$and$N$are known constants? How big is the gain and what resources are needed? ... 1answer 261 views ### What operations are used in symmetric cryptography and why? In continuation to Why are bitwise rotations used in cryptography?: what other operations are commonly used in symmetric cryptography? Are there particular operations on numbers that are good for ... 3answers 286 views ### Is it possible to attack RSA with a WalkSat derivative? We consider a large$n$-bit number$N$. We want to find a factor, if it admits any. For$m$taking values from$1$to$n$, perform the following three steps (actually, for each$m$, perform many ... 1answer 160 views ### What is 'key agility' in relation to symmetric-key encryption? I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ... 1answer 77 views ### The exact definition of a symmetric encryption I have doubts for the definition of the decryption algorithm$D(.)$. I think I've already seen that the decryption returns a plaintext$M$on input the key$K$and$C=E_K(M)$. I have also seen thet ... 1answer 209 views ### Why does WPA2-PSK use 4-way handshake instead of 2-way handshake I don't seem to grasp why is the handshake for PTK in WPA2-PSK 4-way and not 2-way. Isn't it enough to just have these two steps: First party sends Nonce1 to the other party Second party sends to ... 1answer 73 views ### How do you prevent the risk of damage to the security of Fully Homomorphic Encryption? In this paper on pg. 1248 in the "preprocessing phase" section the authors say: In the preprocessing phase, the parties run a (standard) MPC to collectively generate a key pair (pk,sk) for the ... 0answers 127 views ### Design requirements for a keyed hash function? I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let$Ek$be the encryption ... 1answer 152 views ### Tamper-evident audit logs I want to be able to detect tampering in a log file that is under the control of an untrusted party. I am not interested in secrecy, only the integrity of the contents in the file - so I want to ... 3answers 217 views ### Ciphers in CBC mode reveal place of change in plaintext Theoretically, when using a symmetric block cipher in CBC mode, the current block is dependent on the previous block. Suppose one plaintext is encrypted using CBC, and then one bit of it is changed, ... 0answers 152 views ### Best group if one wants the discrete log problem to be hard? Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are ... 1answer 163 views ### How can Shamir's method for secret sharing work in the GF(256)? I have been reading about Shamir's secret sharing, and maybe i completely misunderstand something, but the field is meant to be a prime. However, when i look at the implementations of this algorithm, ... 1answer 430 views ### A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt I want a key stretching system that's as strong as the stronger of scrypt and PBKDF2. The consensus now is that scrypt is by far the better system, but that might change if in the future, a weakness ... 1answer 362 views ### Adding and multiplication in jacobian coordinates How can I derive formulas for adding 2 points and multiplication by a scalar in Jacobian coordinates$(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$over an elliptic curve? 1answer 109 views ### Upper bound Linear Feedback Shift Register It is clear that when we have any output stream$x_0,x_1,...$produced by linear feedback shift register than this output has to be periodic. Now I was wondering if we can find an upper bound for ... 1answer 118 views ### password generation: random length or max length In short: Is it cryptographically stronger to have a known length password of the maximum length allowed, or a random length password somewhere in the range of the longest length possible? Does the ... 2answers 347 views ### Timing attack on modular exponentiation It is known that computing$a^x \bmod N$takes$O(|x| + \mathrm{pop}(x))$multiplications modulo$N$, where$|x|$is the number of bits of$x$and$\mathrm{pop}(x)$is the number of$1\$ bits (Hamming ...

15 30 50 per page