# All Questions

106 views

### Counter Mode with a sequence of zeros bits plaintext, is it secure?

I had a quiz last week in computer security course. There was a confusing question that I am still looking for a good and clear answer. First, I know that counter mode with a good block cipher is ...
383 views

### Generation of a cyclic group of prime order

I am trying to implement a cyclic group generator in Java, but I am running into some issues. In many cryptosystems, the following phrase is expressed during the key generation stage. Let G be ...
53 views

### What does K stand for in frequency analysis

It was from frequency analysis lecture and the professor mentioned but I cannot recall. The K value for English was .067, German was .076. The lowest K was Russian which was .056. When the frequency ...
197 views

### How fast would a polynomial time factoring algorithm compute?

I know factoring is the chief means of breaking RSA keys. I know an algorithm that runs in polynomial time would be able to break an RSA key pair "quickly". But how quickly is "quickly"? Note, I'm not ...
37 views

### ssh-keygen bit why not use 4095 or 4097? [duplicate]

All examples of using ssh-keygen I have seen has always been some power of 2 (2048, 4096). ssh-keygen -t rsa -b 4096 Why use those numbers? Why not use 3333? ...
70 views

### Weak Boneh-Boyen Signature in Composite order group

In the paper Ring Signatures of Sub-linear Size Without Random Oracles, authors have remarked that the scheme is instantiable in composite order setting, too. I am attaching the following reference ...
276 views

### Encrypting with Davies-Meyer hash function scheme

So I need to to illustrate Davies-Meyer hash function for a message “123” with 1-byte blocks. I can use the extended ASCII representation where each character is represented as a byte. And I can pick ...
558 views

### Who first published the interest of more than two prime factors in RSA?

Multi-prime RSA is now a well known technique: it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed boost in ...
50 views

### Automatic generation of secure passwords with the least inconvenience for a user

I'm working on a web site for a private company that should allow them to upload files, which will be later retrieved by their affiliates. The site will be available from a public Internet using ...
87 views

### Is BBS used for generation of keys for any modem cryptosystem?

Is there any (current) cryptosystem or digital signature or cryptographic primitive that uses the BBS PRG in order to generate its secret keys?
152 views

For Bitcoin's ECDSA curve (secp256k1, where $a=0$, $b=7$), why can't the generator point's first coordinate be $x=0$? That is, the point on the curve would be $(0,y)$ where $y$ satisfies $y^2 = 0^3 + ... 1answer 293 views ### SHA1 Partial Collision I'm working on a little python script that reads in two fairly similar English sentences (they're in text files - reading them in) and I'm trying to force a SHA1 partial collision (e.g. first 32 bits ... 1answer 170 views ### CPA security of a stateless and deterministic encryption system Why can no stateless and deterministic encryption system be IND-CPA secure? Is there a formal proof for it? 1answer 43 views ### Using Permutation polynomial to compute a MAC Is the following MAC secure? For a block$y_i$in a file, we defined a MAC as follows:$Mac_i:PRF(k,i) \cdot g^{y_i \cdot r_i} \bmod p$. Where$p$is a prime number,$g \in \mathbb{G}$,$PRF(k,i)$is ... 0answers 23 views ### Kryptos K2 keyword derivation [duplicate] So I've been doing some reading on Kryptos, and to be honest the keyword for K2, ABSCISSA, has a pretty weak derivation. (The method using the eee's). Isn't there a better way to come to that? I dont ... 2answers 104 views ### RSA generation of private key using public key In RSA private key generation e*d ≡ 1 mod φ e is public, also n is public. How to prove mathematically, generation of ... 1answer 143 views ### PRF based on the GGM construction What's the differences between the concepts “pseudorandom generator” and “pseudorandom number generator”? In fact, I want to implement a pseudorandom function based on GGM's construction at ... 1answer 146 views ### Noise bound in FHE over the integers I'm studying the paper Fully Homomorphic Encryption over the Integers by Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan. I have questions about the proof of Lemma A.1. In page ... 0answers 149 views ### Python implementation of a blind signature scheme which doesn't involve RSA RSA seems a bit creepy after the Snowden revelations and i'm looking for a simple python based blind signature library to fiddle around with. So far i've been unable to find anything. What am i ... 2answers 837 views ### Can RSA encryption produce collisions? In RSA, a message is encrypted by$m^e \pmod N$.$N$is the modulus,$m$is the message and$e$is the public exponent. (I know that$m$should not be greater than$N$.) My question is, can$m^e$be ... 1answer 464 views ### What is the difference between a hash function and a pseudorandom function? [duplicate] Read the title. I've seen in RFCs that some MAC functions are called "pseudorandom functions". What are those? How are they different than hash functions? Why can't a hash function be used instead? 1answer 257 views ### Why does the DES crypto algorithm NOT use 2 rounds? Now, if we were to go round by round, you could give a distinct reason for not using a single round since after just one round, the right half of the text comes directly, as-is, to form the left half ... 3answers 4k views ### For Diffie-Hellman, must g be a generator? Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must$g$in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ... 0answers 54 views ### Decrypt a message which is encrypted using XOR? [duplicate] This is a puzzle asked in a contest. Given that encryption , decryption happens as per following rule/code: ... 1answer 111 views ### Definition of ciphertext security If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts). I do not understand why ... 1answer 96 views ### Negative exponents in Shoup's threshold RSA? I'm trying to implement threshold RSA operations, starting with decryption based on Peeters, R., Nikova, S., & Preneel, B. (2008). Practical RSA Threshold Decryption for Things That Think. ... 1answer 102 views ### Proof that$gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$What is the proof for the fact that$gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$Where:$N = P * Q$where$P$and$Q$are both primes.$\varphi(N)$... 1answer 79 views ### Post processing of AAD and len A||C in a hardware AES GCM implementation I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design ... 1answer 67 views ### Non-repudiation and digital signature of a dishonest participant Let's assume a dishonest Alice who sends, encrypts & digital signs a message to Bob. Bob stores the decrypted message and the digital signature in a database. However Alice is a bad girl and ... 3answers 995 views ### Kryptos : K1. What is the origin of the “palimpsest” keyword? I'm studying the Kryptos sculpture with its cryptographic puzzles K1 to K4. I understand that the keyword "palimpsest" was reverse-engineered using the tableau (and brute-force computer processing), ... 0answers 151 views ### Parallel Pollard's Rho: Number of distinguished points When using the parallel version of Pollard's Rho algorithm for discrete logs, each processor performs its own random walk to find distinguished points, and reports the starting point and the ... 1answer 326 views ### Can public key be recovered from ciphertext & encrypted private key? I'd like to implement something like a write-once public/private encrypted shared secret (no better quick description for the lack of terminology knowledge). I guess, I'm trying to implement HSM. The ... 1answer 186 views ### XOR cipher with three different ciphertexts and repeated key, key length known. How do I find the plaintexts? Let us say we have three different plaintexts (all alphabets, A-Z):$x$,$y$and$z$, each of length$21$. Let the key,$a$, be also of length$21$. Now, what we have is$x \oplus a$,$y \oplus a$... 2answers 146 views ### The perfect way of using IV in CTR mode I understand that it is necessary to use the same IV for both encryption and decryption in the CTR mode. I'm thinking about the case when I concatenate the secret ... 1answer 57 views ### Why is it a quadratic equation? In Groth-Sahai NIZK proof system, they have defined something called Quadratic Equation in$\mathbb{Z}_n$as shown below. But, my idea of quadratic equation was a second order polynomial equation in a ... 2answers 75 views ### One-way function definition I cannot understand why a one-way function$f$is defined in this way$\text{Pr}(f(A(f(x))) = f(x)) < \frac{1}{p(n)}$and not$\text{Pr}(A(f(x)) = x) < \frac{1}{p(n)}$where$A$is a ... 1answer 128 views ### One time pad probability I'm trying to solve a question about one time pads but I'm not sure if my assumptions are correct. I am to assume that I have a one time pad with perfect secrecy. This one time pad is used to ... 1answer 47 views ### Do any stream ciphers with aperiodic keystreams exist? Exactly what it says on the tin. I can imagine constructing such keystreams from: The binary expansions of irrational numbers Chaotic systems like the logistic map or the Lorenz attractor. The ... 1answer 12k views ### Decrypt files with original file CTB-Locker [closed] I have problem called CTB-Locker. It encrypted all of my files on computer and since I have lot of documents that are very important I am in problems! As I read online CTB-Locker uses "elliptical ... 1answer 371 views ### Merkle hash tree updates It seems that merkle hash tree (MHT) traversals have been discussed somewhat in the literature, but there does not appear to be much written on inserting, deleting, and updating leaves. Is this lack ... 0answers 32 views ### Reducing key shares in Damgård-Dupont threshold RSA I'm working on understanding and implementing Damgård, I., & Dupont, K. (2005). Efficient Threshold RSA Signatures with General Moduli and No Extra Assumptions. Public Key Cryptography-PKC ... 2answers 85 views ### Usage of GF(p^m) fields, where p != 2$GF(2^m)$Galois fields are widely used in different cryptographic algorithms, for example, in Rijndael. However,$GF(p^m)$fields are possible with any prime$p$, not only 2, but$GF(2^m)$fields ... 0answers 311 views ### Elliptic Curve based blind signature implementation I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ... 0answers 218 views ### Is there a flaw in this ECC blind signature scheme? Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ... 2answers 455 views ### Can AES in CCM or GCM counter mode interoperate with AES in “plain” counter mode (CTR)? I am exploring the use of Windows CNG to replace some OpenSSL-based code that takes advantage of AES in counter mode. From the outside, everything should look the same after the switch. The section ... 0answers 28 views ### Proving the complement property of DES? [duplicate] I'm trying to show that for a given plaintext (P), key (K), and cipher (C) in the DES algorithm: ... 2answers 998 views ### DES Encryption Algorithm all 64 bits for key instead of 56 bits Would a DES algorithm that uses all 64 bits for the key instead of just the 56 bits be more secure? I have been thinking about it but those 8 bits used for parity are very useful and but including ... 1answer 63 views ### Is there a reference that prove that the AES Key Schedule generate random looking round keys? Starting from uniformly random generated AES master key, is there a reference that prove that an specific roundkey can be considered as uniformly random generated as well ? 1answer 13k views ### Many time pad attack [duplicate] I've already sent my correct solution to a homework exercise from Dan Boneh's Introduction to Cryptography class on Coursera: "Let us see what goes wrong when a stream cipher key is used more than ... 2answers 245 views ### Achieving 32-bit verification code with 16-bit CRC? [closed] I am programming an embedded chip that has a hardware 16-bit CRC module. I have to protect some data bytes$d_0,d_1,...,d_{n-1}\$ against corruption caused by sudden loss of power; a 32-bit CRC would ...

15 30 50 per page