# All Questions

974 views

### Generating unbiased numbers with a biased six sided die?

Eve takes a fair six-sided die and adds some heavy paint to the side of the die with the 6 on it. This results in a biased die that rolls a 6 with probability 2/7, and each other number (1-5) with ...
112 views

### Is it safe to initialize secret keys by just reading /dev/random on Linux?

For a software, I don't want the user to choose weak keys, so I plan to just read the needed number of bytes from /dev/random to create the needed secret keys. Is it safe to do so?
56 views

### Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...
564 views

### Encryption of 8 bit of block data

I'm looking for a cryptographic algorithm that allows encrypting only 8 bits of data in a block. Is there any such algorithm that is considered secure? The reason I'm asking is because I have to ...
153 views

### Chopping off SHA256 entropy?

I have a NoSQL key-value database. I want to insert couple million of records to it. For the key generation, I'm, using a prefix (something like data-one-) and ...
161 views

### Why is Rabin encryption equivalent to factoring?

I don't understand the proof of equivalence I've read everywhere (e.g., in Rabin's paper or on Wikipedia). Here's my objection: let's say you have a Rabin decryption oracle that takes ...
173 views

### Meaning of entropy of a bitstring in NIST SP 800 - 90A

From NIST SP 800 - 90A from January 2012 (see http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf), page 6: For the purposes of this Recommendation, an n-bit string is said to have ...
344 views

### Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure

Any thoughts on how this can be done? Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for ...
396 views

### Why isn't CTR mode (counter mode) used more often?

For the CTR mode, the design is good for parallelization, yes, it seems the benchmark of the program downloaded from crypto++ proves that on an Intel I7 CPU. My question is that as most of CPU on ...
326 views

### Discrete logarithm modulo a smooth number

I am solving the discrete logarithm problem modulo $N$. $N$ is a composite number, I found its factors — lots of small primes and two big primes ($> 2^{50}$). Does the factorization of $N$ somehow ...
214 views

### Why would an Initialization Vector be supplied externally?

My software uses a 3rd party encryption appliance. One of the capabilities they allow is for the client software to supply an IV while doing CBC encryption. Why would they not generate a random ...
116 views

### Checking both Quadratic residuosity and Jacobi symbol simultaneously and efficiently

I have to randomly generate a number $u$ such that $u \in J(N)-Q(N)$ where $J(N)$ denotes the set of elements less than $N$, whose Jacobi symbol value is equal to 1; and $Q(N)$ denotes the set of ...
126 views

### Strange MAC algorithm

I'm working with a payment provider which uses the following algorithm for signing messages: The merchant is securely given a secret key k, known to them and the ...
879 views

### CMAC vs HMAC security strength

From the perspective of a Birthday Paradox attack, isn't it true that CMAC based on AES-128 is weaker than HMAC-SHA-1? The attack on CMAC-AES-128 requires about $2^{64}$ operations whereas the same ...
567 views

### AES VS PRNG+HASH+XOR

I was thinking of doing symmetric encryption using just hashing and simple XOR encryption. It would work as: Alice and Bob share a symmetric key Alice manages to send an (authenticated) IV to Bob ...
305 views

### Practical (and secure) PRGs

Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, ...
828 views

### What was the problem in the SSL version 2.0?

What is the main reason (attacks) the appearance of the protocol SSL version 2.0 to replace version 3.0?
236 views

### Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, ...
147 views

### How does secret sharing solve the partial exposure problem?

I have been trying to understand how secret sharing methods like Shamir's secret sharing solve the problem of a share revealing information about the secret. I guess there are some random numbers ...
313 views

### Public-key cryptosystems without poly-time quantum attacks

It's well-known that Shor's algorithm can solve integer factorization, discrete logarithm and discrete log over elliptic curves in cubic time. This implies that cryptosystems like RSA, ElGamal, and ...
279 views

### Isn't the deterministic property of (EC)DSA a security problem?

From what I read in Wikipedia's article "Elliptic Curve DSA ~ Security", the "deterministic" generation of $k$ can help prevent certain type of attacks (such as the one happened to Sony). However, ...
191 views

### Is this really the correct way to do an IND-CPA test?

In a description of IND-CPA (indistinguishability under the chosen plaintext attack), I have been reading the following, simple test: The adversary can generate as many messages as he wants. Then, ...
392 views

### Elliptic Curve Cryptography Encryption Results

I'm playing around with a package that does Elliptic Curve Cryptography from http://jecc.sourceforge.net/ Every time I encrypt a value it produced a different result (same private key). However I'm ...
732 views

### Textbook-RSA meet-in-the-middle attack against other RSA based schemes?

A “meet-in-the-middle” (not “man-in-the-middle”!) attack on textbook-RSA was presented to me. The only requirements for it was that the attacker gets the output of RSA and the public key, and that the ...
130 views

### How difficult is it to find the “pre-image” of a block cipher?

Say that I have $$C_1 = AES_{k_1}(M_1)$$ How difficult would it be to find a key, K2 and plaintext M2 $$C_2 = AES_{k_2}(M_2)$$ such that $$C_1 == C_2$$ How would using a block cipher ...
103 views

### Can CBC-encrypted files be modified in-place?

When changing a (small) part of the plaintext of a CBC-encrypted file, how much of the file will have to be rewritten? My suspicion is that everything after the modified block will have to be ...
913 views

248 views

### AES 128 bits with 12 bytes IV vector composed of a 4 bytes counter : safe?

I have a 128 bits AES cypher (GCM, Galois/Counter Mode) using a 12-byte initialization vector (IV) composed of: 8 constant bytes: 6 bytes (device ID) 2 bytes (zero) 4 bytes (incrementing frame ...