# All Questions

130 views

### How can I show that the DDH problem is self-reducible?

I have trouble to understand how I can show that the Decisional Diffie-Hellman problem (DDH) is self-reducible. I found this as a description of a random self-reducible problem. ...
159 views

### Do any one-key-of-many cryptographic schemes exist?

I'm pretty sure I understand how public/private key cryptography works. Anybody can encrypt a message using a well-known public key, but only the person who holds the private key can decrypt it. My ...
158 views

### Given p and q of DSA how do you show they are prime?

I am given p = 4916335901 q = 88903 and am asked to show these are prime as well as q|(p-1) in DSA. I am unsure on how to ...
2k views

### How to calculate the maximum output size for data encrypted with a RSA Private Key?

I have an an encryption algorithm I am working with that looks like this: prv_key_enc(sha1_hash(data)) Where, the RSA parameters are: RSA/ECB/PKCS1Padding 1024 ...
379 views

### What key exchange protocols give Forward-Secrecy resisting future progress?

I (wrongly) understood what I've been told as meaning DHE in TLS, PFS in IPSec do not provide Forward-Secrecy; and I'm told that common forward-secure key exchange protocols are restricted to ...
324 views

I know about PBKDF2, bcrypt, scrypt, etc. and while I'm not a crypt professional, I think I understand why are they better than just "hash(pass+salt)". But a colleague of mine surprised me with the ...
616 views

### How is LUKS dm-crypt secure if the key is stored with the encrypted data?

I've posted this question over at superuser, but haven't had any success at getting answers. That's why I've posted it here. Furthermore, I believe this is a more appropriate place for it as it is ...
237 views

### Is use of pre-shared key for sharing session key in symmetric key cryptography vulnerable to MITM?

Consider the following protocol: ...
129 views

### Pseudo random permutation for arbitrary size domains

Popular block ciphers like AES or Twofish are keyed pseudo random permutations on the domain $\{0,1,\dots,2^{k}-1\}$ with $k\in\{128,192,256\}$ or similar. I'm interested in pseudo random ...
184 views

### Is this approach to generating a “random” number from a sha512 hash effective?

I'm looking to run a small raffle but i'd like people to be able to verify that the number chosen was fair. I know some sites use a "Provably Fair" system to achieve this where user input is combined ...
335 views

### How is HKDF-Expand better than a simple hash?

Why do we need HKDF-Expand if we can simply hash the pseudorandom key to make it longer? The docs (in the link) say: The second stage "expands" the pseudorandom key to the desired length... ...
180 views

242 views

### Diffie-Hellman: Does the size of the prime modulus depend on the potential size of the secret?

I'm writing my own cryptosystem that uses One Time Pad and Diffie-Hellman to generate keys for the OTP. I am using Rails on the server side and Javascript for the client side. Please don't tell me ...
258 views

### Does SpongeWrap (from the Keccak team) absorb ciphertext or plaintext?

I have been reading the Cryptographic sponge functions paper, but I'm still confused. Does Keccak in authenticated encryption mode absorb ciphertext or plaintext? Edit: Are there any test vectors to ...
2k views

### Find the key to a Vigenère cipher, given known ciphertext and plaintext

I have the ciphertext and the plaintext. Is it possible to know the key? If not, what do I need to find it?
121 views

### How well does breaking multiple DH key exchanges over the same group scale?

Suppose you are running a server with the Diffie-Hellman parameters (so the group G and generator g) generated once. There are ...
461 views

### Difference between Pedersen commitment and commitment based on ElGamal

Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme? For the sake of completeness, I recall what both of them look ...
230 views

### Brute force attack expected running time

I am a bit confused about the expected running times of brute force attacks on different cryptosystems. So let's assume a key size of $2^n$ bits. Symmetric key cryptography: $E(brute)$ = ...
504 views

### Is CBC mode encryption vulnerable to a reordering attack?

I know that, if CBC-MAC is used in such a way that the tag is the concatenation of all the blocks' outputs (and not just the last one), it's insecure under CPA for the simplest case of 2 blocks ...
326 views

### Scalar Multiplication on Elliptic Curves

In the elliptic curve: $y^2 = x^3 + 20x + 13 \bmod{2111}$. Using the point $P=(3, 10)$ I am wondering how to multiply this point by the scalar $57$? I realize I can write $57*P$ as \$2^5*P + 2^4*P + ...
770 views

### How do I test my encryption? (absolute amateur)

I am a hobby programmer with a background in biology and have developed an encryption program based on DNA. I tried to make it hard to crack, but it's essentially a substitution cipher and uses the ...
327 views

### Why is it important to generate a pseudorandom permutation from a pseudorandom function?

Most of the papers on block cipher constructions, especially the ones which discuss constructing block ciphers of arbitrary lengths or small domains, the techniques are designed based on building a ...
342 views

### RSA 896 vs 1024 vs 2048 in Javascript?

I am currently working on a secure messaging website and I had been using RSA 2048 for encryption, decryption and signing of messages but I found it to be EXTREMELY LAGGY so i've moved to 1024. I did ...
256 views

### What is the limit of plaintext required to break the Vigenère encryption?

A theoretical question about the Vigenère cipher: Without any knowledge about the key (not even it's length) can we tell how much known or chosen plaintext is needed for the adversary to completely ...
137 views

### How does SSL secure the initial handshake?

I'm reading the SSL specs, and it seems that the initial handshake has no authenticity protection at all. What is to prevent, say, an attacker from overwriting the "available ciphers" list with one ...
427 views

### Some cryptography security questions

I recently had a discussion with a friend of mine about cryptography. As we are both no experts, I thought that I could better resolve are dispute here :-). My friend said that when he used public ...
213 views

### Hypothetical unknown cipher - security in obscurity?

I'm curious what would happen in the following scenario: Suppose an attacker gets a hold of a cipher-text of sufficiently large length. And suppose he has the means to verify a successful decryption. ...
186 views

### Having 4096 bit keys and short (< 256 byte) messages, can I simply use the key as OTP?

Assumptions: Alice and Bob use (cryptographically secure, hardware-rng generated) 4096 bit keys. Each message is encrypted using a new key; meaning: once a key is used, it's destroyed. Alice and Bob ...
444 views

### Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus ...
304 views

### what are the uses of tweaks in block ciphers?

Few block cipher modes has additional parameter , tweaks , especially the ones that are format preserving . Now the comments section of this blog entry says such tweaks can be used for BIN numbers, ...
458 views

### How does one use AES block cipher modes of operation?

This is the sequel to my previous question about AES block cipher modes of operation. (See: AES block cipher modes of operation) Now, here is my real problem. I have to use a block cipher with 8 bit ...
170 views

### Which platforms are most vulnerable to Simple Power Analyse Attack

In a "Simple Power Analyse Attack", the difference in power consumption during multiply or square operation is used. In the RSA decryption process with the "Square and Multiply" algorithm, both ...
491 views

### How hard/easy will be to break a SHA-1 or SHA-256 hash if the attacker knows part of the original text?

I'm creating an algorithm to hash some text variables (20/30 characters long) to send them across an insecure channel. I'm not dealing with high security data, so no credits card numbers or any other ...
332 views

### Rijndael: explanation of Rcon on Wikipedia?

I stumbled onto the explanation of Rijndael Rcon on Wikipedia, and I can't follow it. The example for Rcon indicates that Rcon(9) is 0x1b. That could make sense… ...
300 views

### How much does a successful Distinguishing Attack “break” the attacked stream cipher?

I started reading about the most recent cryptanalysis of RC4 and it's variants. One of the papers I just finished reading ("Two Linear Distinguishing Attacks on VMPC and RC4A and Weakness of RC4 ...
1k views

I would like to know how much padding OpenSSL algorithms expect.
386 views

### Can I construct a feasible stream cipher out of HMAC and a secure hash algorithm?

I have constructed a stream cipher from a secure hash algorithm and a HMAC. Here is a brief description of the algorithm: Let: (Actually Objective-C styled pseudo code) ...
495 views

### AES with different modes of operation

I'm taking up a cryptography class and this is for an assignment. We're asked to find the differences between AES/RSA in the different modes of operation vs the one timepad method. From wiki, I can ...
489 views

### Question regarding multiple SHA-256 rounds on a Bitcoin Brain Wallet passphrase…

I am attempting to come up with a way of memorizing a seed that could lead to any number of brain wallets for bitcoin. I need multiple wallets because a) I don't want all my eggs in one basket, and ...
591 views

### Is there an encryption/decryption algorithm that can give two different outputs?

The recent revelations that airport staff can detain travellers in an interrogation room and force them to give over passwords to encrypted-HDD laptops under threat of jail time has made me think ...
121 views

### Do any (non-hardware) RNGs exist which could be used to create an OTP for crypto purposes?

I've stumbled (jobwise) over a system where small messages (512 Bytes or less) are encrypted and decrypted using a simple XOR using a OTP. That OTP is created using a seed based on the individual user ...
1k views

### Am I insecurely implementing AES in Python? [closed]

My name is Pat, I'm a rising high school senior interested in Comp Sci. I've taken interest in cryptography following the NSA scandal. Since this is the first time I've ever implemented encryption ...
122 views

I'm writing a client application that wants to store some secret information with a storage service. The client has to authenticate the user with the service and the service should not be able to ...