# All Questions

140 views

### How useful is NIST's Randomness Beacon for cryptographic use?

NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
77 views

### Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
141 views

### Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is ...
93 views

### derangements and permutations in cryptography

Given a partial key for a mono-alphabetic substitution cipher (missing 11 letters), calculate the number $N$ of possible keys, given that no plaintext letter can be mapped to itself. ...
96 views

### Challenge–response authentication which can be done in head?

Say we have door where you have to say a password to pass. If theres someone standing nearby he would hear the password and could also use it. So therefore the doorman gives you a different number ...
61 views

### why it is not possible to find inverse of its own in diffie-hellman protocol? [duplicate]

In DH-Protocol bob calculate $R=g^b$, R as public parameter and Alice calculate $S=g^a$ & common key($K=g^{ab}$) using value $R^a$ then bob calculate common key $K= S^b=g^{ab}$ It can be ...
56 views

### Compare RFC 5246 SessionID re-use versus RFC 5077 Session Resumption?

Can you help me understand the differences, both algorithmic and practical, between RFC 5246 SessionID re-use and RFC 5077 Session Resumption? Both appear to be ways to nail up a second TLS session ...
122 views

### Asymmetric key derivation – Who derives the new pub key can't know the new private key

I'm looking for a peer reviewed protocol or algorithm that can do this, preferentially I need something based on elliptic-curves cryptography. Alice know the main public key of Bob (B-PUB-1). Alice ...
339 views

### How secure is the AES master key if Round Keys are found

If an attacker finds some round key of AES256, is it possible to find the master key? How safe is the master key if an attackers finds multiple round keys?
35 views

### Distributed authentication in low trust environment

I would like to inquire if there is any Method to achieve the following: There is a list $L$ of $n$ entities that are allowed to perform a certain action. $L$ is cryptographically signed by some ...
69 views

### Looking for a detailed example of proof by reduction

I'm looking for a very detailed example of proof by reduction. Say we have two or three protocols (that have been proven secure) and we construct a new protocol. We want to provide a proof of security ...
238 views

### Third-party security issues with Shamir's secret sharing scheme

In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial. How can we ensure security here when we are involving a third party?
122 views

### Construct an encryption algorithm using hash function [duplicate]

We know that Cryptographic hash function is generally a one-way function where we can't retrieve the original message. On the other hand, encryption is a two a function where we get the original ...
166 views

### Is a random oracle controled by the challenger?

When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger? What if the Hash is only used by the adversary?
52 views

### Is it safe to reuse ECDH asymmetric keys for authentication?

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ...
67 views

### Encryption mode with chained algorithms

Suppose that I want to encrypt some data using two different algorithm chained (e.g. AES and Serpent) and harnessing the benefits of CBC. I can do: ...
90 views

### Proof of storage scheme

I'm familiar with client puzzles, where the client performs some work and there is a way to prove to the server that the client has done so. Is there a way to do this, but where the client's resource ...
29 views

### How to invalidate decryption key in multi user model?

I want to develop an application that will allow a user to create a public/private key pair, and encrypt it symmetrically with a key such that once they enter their password, they will be able to ...
153 views

### Is it true that for RSA with no padding, the length of data must be equal to the length of key?

The question pertains not in terms of security but computing operational functionality, as it how the computation is done. Is it true that for RSA with no padding, the length of data must be equal to ...
51 views

### 1-1 trapdoor function mapping the set of $n$-bit numbers to themselves

I am looking for a trapdoor one-to-one function $f : \{0,1\}^n \rightarrow \{0,1\}^n$ (that is, mapping the set of $n$ bit numbers 1-1 onto itself [any $n$ is OK]). I was considering the use of ...
40 views

### Client puzzle using hash

When a server is under attack, it send the client the following data: Nonce - a byte array of Y length Hash - the hash digest of the puzzle solution The client has to find X such as ...
118 views

### Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?

The PKCS #1 v1.5 padding scheme for RSA has been proven to have some weakness when used with TLS for example. My question is: is it still secure under the following conditions? Alice sends a ...
87 views

Let $H$ be a secure hash function (e.g. SHA256), is it possibile to find $H(M1)$ given $H(M1||M2)$ if the length of $M1$ and/or $M2$ is exact the block size of the hash (that is, 64 bytes for SHA ...
132 views

### Hash function and outputs of arbitrary length

I know that Skein can output a digest of arbitrary size, with a kind of counter mode. Blocks of the resulting digest can be computed in parallel. What about Keccak ? I know that a sponge function can ...
79 views

### Rock-paper-scissors over network, how to protect from cheating server?

I'm trying to design cryptographic protocol to play Rock-Paper-Scissors with two parties, neither trusting each other, nor trusting server they use for communication, so game is 'provably fair'. So ...
40 views

### No of keys used in Triple DES Algorithm

I am studying Triple DES. I have got two basic questions. One, why are we following a sequence like encrypt(decrypt(encrypt)); what is the problem using a sequence encrypt(encrypt(encrypt))? ...
113 views

### Explanations for the complexity values for second preimage attack on GOST?

I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities ...
880 views

### SHA-224 Purpose

One of the new features of Java 8 is the SHA-224 message digest. What is the use case for having a 224-bit-length hash?
99 views

### Why is DDH not hard over $\mathbb{Z}^*_p$?

Why is Diffie-Hellman key exchange not hard over $\mathbb{Z}^{*}_p$?
65 views

### What is difference among eavesdropper attack, multiple message attack and CPA attack?

What is/are difference(s) among eavesdropper attack, multiple message attack and CPA attack in context of symmetric key encryption? I only know that in eavesdropper attack there is an adversary ...
141 views

### Difference between lightweight, online and low memory Authenticated Encryption schemes

What is the basic difference between the following types of Authenticated Encryption (AE) schemes? Lightweight Authenticated encryption Online Authenticated Encryption Authenticated Encryption for ...
43 views

### Ensuring that an operation takes a relatively specific amount of time, but easily verify the result

I want an algorithm of some sort that can ensure that an operation takes a fairly specific amount of time, but proof that this operation was done can be completed relatively inexpensively. For ...
88 views

### How does compression before encryption leak info about the input?

Apparently current best practices recommend that you do not compress before you encrypt. For example in this blog entry (*): http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ It ...
72 views

### Proving a decision was randomly made [duplicate]

Alice and Bob want to agree on a bit $0$ or $1$. Both know it would be fair to pick that at random, but there's no way they could meet to throw a dice and no third party they could trust. Are there ...
61 views

### Current standard security level for a hash function?

What is the current level of security needed for a hash function? Until not long ago this was 80 bits. What about now?
55 views

### How can I find the order of the group that an elliptic curve is defined over?

I have a Weierstrass elliptic curve (y^2=x^3+a*x+b (mod p) ) How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] command and WolframAlpha will do it for me, but ...
56 views

### How is HMAC(message,key) more secure than Hash(key1+message+key2)

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is ...
64 views

### RSA timing attack

Given an RSA implementation that uses Montgomery multiplications and CIOS exp algo, but NOT CRT. Given a decryption1 oracle that takes chosen cipher text and responds the plain text and the time it ...
78 views

### Hash Function to get same value for different messages

I am studying a function where I found the some hash properties. Hash functions: Given a code c is computationally infeasible to find m such that ...
100 views

### secure integer comparison

I have been going through a huge amount of papers to find a simple and a practical method to compare integer numbers without revealing their original values. I know that this falls within the area of ...
63 views

### Decrypting triple DES using 2 keys in crypto tools

I'm currently working on crypto tools to encrypt/decrypt 4 blocks of messages using triple des with 2 keys. So i've reached the final cipher text, but now I have to do the reverse and get the ...
79 views

### how to use salt to sign a message and how is it effective?

I've had an assignment to sign a file using hash and salt, so I read about salt and I got why it's important when it comes to password, but not to sign messages. How do I sign something using salt? ...
80 views

### Soundness idea of basic zero knowledge prood

I am having a hard time figuring out the soundness proof of the bellow zero knowledge protocol. As it is a typical proof, I would love to deeply understand it. zero knowledge argument that \$h \in ...
95 views

### How to solve custom made ciphers? [closed]

How would you go about solving basic custom made ciphers - e.g. one generated from this website http://www.wikihow.com/Write-a-Custom-Cipher-Carefully? This is solving it without knowing the method ...
30 views

### In Needham Schroeder key distribution what happens if responder's part is not encrypted in step 2 with Kbs but encrypted instead by Kab in step 3

The Needham-Schroeder protocol is: 1 A→S:A,B,Na 2 S→A:{Na,B,Kab,{Kab,A}Kbs}Kas 3 A→B:{Kab,A}Kbs 4 B→A:{Nb}Kab 5 A→B:{Nb−1}Kab Here Na and Nb are nonces. Kab is the key between a and b Kas is ...
74 views

### CryptoJS.AES result always has same first few bytes?

When using this very minimal CryptoJS AES example: ...
45 views

### What is the idea behind hashing the QueryString in OAuth?

In OAuth 1.0a and 2.0 using MAC Authorization, I need to generate a hash of all the QueryString Parameters, which requires normalization (alphabetical ordering) of them. I'm trying to understand what ...
23 views

### McEliece information set decoding attack vulnerability

Wikipedia states that McEliece is open to "information set decoding attack". What is an "information set decoding attack" and how serious is the vulnerability? (is it just a matter of choosing proper ...