# All Questions

11k views

### What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not. Can anyone explain to me how ...
3k views

### What is the most secure hand cipher?

By "hand cipher", I mean a symmetric cipher for which encryption and decryption can can both be performed with a pencil on graph paper, consuming about 10-20 seconds per character by a proficient ...
1k views

### Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
3k views

### What is the difference between a stream cipher and a one-time-pad?

A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$. This key-stream is ...
355 views

### Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
486 views

### Physical analogue for MACs

What would be a good analogue with which to describe Message Authentication Codes to a person who has little to no understanding of cryptography? For instance, a vault is a reasonable analogue for ...
3k views

### How is XOR used for encryption?

I am a programmer, so when I hear XOR, I think about the bitwise operator (e.g. 0110 ^ 1110 = 1000). The mention of "XOR" comes ...
1k views

### PBKDF2 for key diversification

I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
604 views

### How to construct a good PRF from a block cipher?

We want to explicitly construct a good (as tentatively defined below) Pseudo-Random Function $F$ with $b$-bit input and output, from (preferably just) one Pseudo-Random Permutation $E$ of $b$-bit, as ...
3k views

A fixed length CBC-MAC uses an all-zero block as the initialization vector. Suppose that we used a randomized IV instead, and sent the IV along with the tag. So if the message $m$ will be $m = b_1 || ... 3answers 500 views ### Are these emerging threats against AES affecting your designs? Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount. The first key recovery attack on the full AES-128 with computational complexity ... 2answers 3k views ### How can I calculate the SHA-256 “midstate”? Recently I've been trying to implement some Bitcoin-related code, and I've stumbled upon a weird concept, a SHA-256 "midstate". Some explanation is given here. The general concept is that Bitcoin ... 3answers 373 views ### Mapping between subgroups and the integers This question is a companion to the equivalent question on elliptic curves. Preliminaries Diffie-Hellman, Elgamal, DSA, etc. are examples of protocols that work in the integers modulus a large prime ... 3answers 575 views ### How broken is a xor of two LCGs? Suppose we define a PRG as the xor of two LCGs modulo a 64-bit prime: something like the following Python code. ... 2answers 7k views ### Why is TLS susceptible to protocol downgrade attacks? A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ... 4answers 1k views ### Is there an intuitive explanation as to why only the private key can decrypt a message encrypted with the public key? I have just learned about using PGP/GPG for email encryption and one thing has always bugged me: How is it possible that a message encrypted with somebody's public key can be decrypted only with that ... 1answer 585 views ### How random are commercial TRNGS I'm thinking about buying a USB TRNG. How do I evaluate its randomness? I'm sure some are better than others but which is which? Are thermal-noise better than radio-noise TRNGs? 1answer 3k views ### Why is CAMELLIA suddenly so widely used? When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available. Is that not ... 2answers 373 views ### Is RC4 a problem for password-based authentication? This is a follow-up question to Does TLS use RC4-drop[n]?. As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that ... 2answers 1k views ### Can I select a large random prime using this procedure? Say I want a random 1024-bit prime$p$. The obviously-correct way to do this is select a random 1024-bit number and test its primality with the usual well-known tests. But suppose instead that I do ... 3answers 329 views ### Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such? Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute ... 1answer 717 views ### Why are the outputs of the md5sum tool and Crypto++'s MD5 different? Could you please tell me what is the difference of coreutils' md5sum and sha*sum tools (... 2answers 2k views ### Why do we use XTS over CTR for disk encryption? I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption. It seems that CTR mode would do exactly what XTS can do, but is simpler to ... 2answers 12k views ### When to use RSA and when ElGamal asymmetric encryption If i am not wrong in cryptography there are 2 basic cryptographic schemes for public key cryptography. RSA encryption whose security is based on the infeasibility of solving the factoring of big ... 1answer 580 views ### Is it possible to actually verify a “sponge function” security claim? When using a “sponge function” to create a cryptographic hash, we can look at the flat sponge claim, which flattens the claimed success probabilities of all attacks using a single parameter: the ... 1answer 3k views ### repeating-key xor and hamming distance I read that to break repeating-key xor you can do the following: try a keysize$n$and compute the hamming distance between the first$n$bits of the encrypted string and the bits$n+1$to$2n$of the ... 3answers 2k views ### ElGamal: Multiplicative cyclic group and key generation Here on the ElGamal wikipedia page http://en.wikipedia.org/wiki/ElGamal_encryption Alice generates an efficient description of a multiplicative cyclic group G, of order q, with generator g. How ... 2answers 3k views ### Strength of multiple hash iterations? Is it correct that increasing the iteration possibly decreases the cipher strength but increases the amount of time it would take to find the original hash values if using brute-force on a given hash? ... 3answers 6k views ### How does one calculate a primitive root for Diffie-Hellman? In the Diffie-Hellman key exchange, one of the steps involves calculating a primitive root of a prime number$p$. How would one go about doing so, considering that$p$could be very large? Is there ... 2answers 519 views ### Why is there an enormous difference between SAT solvers? SAT solvers are very important in algebraic attacks, for example walksat and minisat. However, when solving the benchmark problems available here there is an enormous performance difference between ... 1answer 848 views ### What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS? It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ... 2answers 1k views ### Why was the winner of the AES competition not a Feistel cipher? The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question. However, most many of the AES candidates, and all 3 out ... 1answer 918 views ### Using SHA-256 with different initial hash value FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value ... 1answer 458 views ### How to choose constants in a cryptographic function? A number of cryptographic functions have constants built in. For example, the constants used in RFC 2104 for HMAC, or the constants used in s-boxes (e.g., DES and AES), or MD5. In general, how are ... 2answers 961 views ### Encryption scheme for social-network-like data sharing data via untrusted server? I am thinking quite a lot lately abut the problem of secure, privacy-preserving social networking. Distributing the network among trusted, preferably self-hosted servers (like Diaspora, GNU Social ... 1answer 1k views ### Windows 8/Server 2012: Passes FIPS-140-2 despite failing AES-GCM for IV != 96 bits long? Background Microsoft certifies Windows 7/8 as well as Server 2008 R2 and 2012 to be FIPS-140-2 compliant. Actually they certify just a small crypto core, bcrypt.dll (the library, which is unrelated ... 1answer 1k views ### Why do the elliptic curves recommended by NIST use 521 bits rather than 512? Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3: Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the ... 2answers 4k views ### How does order-preserving encryption work? Order-preserving encryption (OPE) is, apparently, a method of encrypting data so that it's possible to make efficient inequality comparisons on the encrypted items without decrypting them. I've been ... 2answers 1k views ### Measuring entropy for a ciphertext only attack When bruteforcing a password (e.g. the common attacks on DES), where you have ciphertext only, you need a way to assess whether a decrypted plaintext is the right one. I believe the EFF DES machine ... 1answer 1k views ### SHA-256: (Probabilistic?) partial preimage possible? Currently busying myself with the Bitcoin "mining" algorithm, I am wondering if the process really cannot be simplified. For reference, the algorithm is basically SHA-256d:$success := SHA256( ...
217 views

I was trying to implement zero knowledge protocol for authentication based on the paper "A Practical Zero-Knowledge Protocol Fitted to Security Microprocessor Minimizing Both Transmission and Memory". ...
840 views

### Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
5k views

### How does a birthday attack on a hashing algorithm work?

A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits. That means it takes about ...
431 views

### Making ECDSA public keys one bit shorter

In compressed form, ECDSA public keys are one bit larger than the curve size. There are some situations where this extra bit is extremely inelegant. So I had the following idea as a way to remove it. ...
1k views

### How can I make my cipher show the avalanche effect?

I am a beginner in cryptography. I designed an password based encryption-decryption algorithm, which uses a random salt and a password to encrypt a message. I'm using SHA-512 for hashing, matrix ...
457 views

### Hash function from narrower block cipher operated in CBC-encryption mode?

I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ ...
357 views

### Which MACs can be converted into a secure unkeyed hash function?

It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
416 views

### How should one implement a delegated shared trust protocol?

Consider the following (probably naive) scenario. Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
Multi-prime RSA is now a well known technique: it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed boost in ...