# All Questions

242 views

### How does generating random numbers “remove entropy from your system”?

In a previous question, I quoted the --gen-random entry in the GPG Man Pages. At the end it says: PLEASE, don’t use this command unless you know what you are ...
157 views

### Is it true that 7zip doesn't use any salt with its KDF?

This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679 If that's true, wouldn't that mean you can crack multiple ...
28 views

### How do we measure number of possible encryptions in One Time Pad [duplicate]

trying to brute force a specific length of ciphered pad, how do we measure the total number of possible encryptions in One Time Pad
331 views

### Simulation-based proofs and universal composability proofs

I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says The stand-alone ...
11k views

### How can one securely generate an asymmetric key pair from a short passphrase?

Background info: I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
54 views

### Upper bound on r* on page 7 in the Scale Invariant Fully Homomorphic Encryption over the Integers paper

I was hoping to get some clarification on how the bound on r* was calculated (bottom of page #7). I'm trying to reproduce the results that have been shown, however I keep getting a slightly smaller ...
84 views

### Is it safe to use AES-CBC like this?

Is it safe to generate the IV for AES-CBC as the following? It's like the real IV is all zeros. The first block of data will be a low-entropy but unique data. Once the first block is encrypted, the ...
29 views

### Does CPA attack assumption requires the oracle to have the key?

In CPA model, we assume Eve has access to an oracle who has the correct key and Eve can send query to the oracle to encrypt in CPA the data. Assume this encryption algorithm is a plain ECB mode AES ...
51 views

### Is it possible to get my x,y coordinates from my “secret exponent”?

...or is that possible? I am very new to cryptography! But, I think it's very interesting!! I have autism and numbers "are my thing" :) I already understand a couple of things. For example I know ...
38 views

### Key derivation function in theory & practice

I am implementing a cryptographic protocol and I'd like to generate a set of seeds using a seed for a pseudo-random function. The reason is that I can pass on only one seed and it can be used to ...
6k views

### In RSA, do I calculate d from e or e from d?

In the original paper introducing RSA, it is implied that one should first choose $d$ and then calulate $e$ from $p$, $q$, and $d$. However, I have found in other places (such as the wikipedia article ...
350 views

### Signing/verification between Java and the OpenSSL

I'm trying to sign/verify data between a C application and a Java application. In java for now I was using the built-in JCE provider with SHA256withRSA as ...
266 views

### Keyless integrity checking with SHA-256

Currently a program is loading some files from an untrustworthy source (e.g. a CDN) which could have been tampered with. It has a known SHA-256 hash of the file stored locally, then it downloads the ...
140 views

### Is it an overkill to add external integrity check to the AES-GCM encoding?

There is a java library for android which implements integrity checking to predefined encrypting mode(which can be found here). Short class description from author page to avoid further questions ...
178 views

### Using AWS KMS with AES GCM

I am implementing client-side encryption for data stored in AWS DynamoDB, and was wondering about the correct use of AWS KMS for key management in addition to using AES/GCM. I am using the master key ...
95 views

### Securely generating auth tokens

(Disclaimer: I'm an experienced server-side Java programmer, but with little crypto experience.) Objective: I've got a login server which, given a login+password pair, should issue a unique auth ...
27 views

### Are there any real-world E-voting systems in use with the Paillier cryptosystem?

There are a lot of theories of Paillier cryptosystem with references to e-voting. Are there any real-world E-voting systems in use with the Paillier cryptosystem?
349 views

### Is there a scheme where two cipher texts can be proven to have the same (unencrypted) content?

Is there a scheme where two ciphertexts (encrypted with different keys) can be proven to have the same (plaintext) content without disclosing the plaintext or any private keys? I assume that the ...
143 views

### DES and using the S-Box 1

Can someone please check my work and correct me if I am wrong, I am just starting to learn about DES. I am trying to solve the following problem: Show that ...
64 views

### Is it OK to use a secret IV as key when creating keyed MD5 checksum for fixed-size data?

Is it OK to use a secret IV as key when creating keyed MD5 checksum for fixed-size data? Because data size is known, attacker cannot append anything. And I think it's hard to raise chosen-plaintext ...
42 views

### Are there any FHE-MPC schemes implemented?

I want to know if there are any publicly available multiparty computation schemes derived from fully homomorphic encryption schemes. An example would be the implementation of this scheme https://...
264 views

### Encrypt large data with RSA through blocks in java

I'm working on a communication protocol where a client sends encrypted data to a server. What happens is that in some point, the client creates a symmetric key used to create data digests through the ...
71 views

### Why is Tor alone not enough to guarantee anonymity for Bitcoin?

Why is Tor alone not enough to guarantee anonymity for Bitcoin? Why do we need the constructions like Zerocoin?
45 views

### What part of an RSA key is referred to by the number of bits? [duplicate]

When we speak about 4096- or 2048-bit RSA keys, what part of the key is this number of bits? The public key comprises both the modulus and the public exponent, and the strength of the key can also be ...
176 views

### Proving collision resistance of a hash function?

Let $f$, $g$, and $h$ be hash functions that each map binary strings of length $2n$ to binary strings of length $n$. Suppose that $h(x) = f(g(x)||g(x))$. Prove that if $f$ and $g$ are collision ...
90 views

### Is it interesting to design stream ciphers parametrized by a CSPRNG?

Would it be interesting to have new stream ciphers whose design is parametrized by a CSPRNG? I.e. to instantiate the stream cipher, you just have to select and plug in any CSPRNG of your choice.
89 views

### Do low-entropy fingerprints actually make any sense?

I'm thinking of ZRTP and OTR in particular here. From my understanding, after a Diffie-Hellman session is initiated, the shared secret is then hashed into a 4-digit number, which the two parties can ...
950 views

### HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
160 views

### Branchless AES Implementation

Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks? Is it even true, ...
363 views

### Using a SHA512 hash to encrypt data

How can I judge the level of security with the following algorithm: I create a 64 byte hash using SHA512 via some input. I use this hash to iterate over the plaintext, byte by byte, and similarly ...
78 views

### Improving security of (authentication) protocol

I have a basic protocol which tries to authenticate messages going from client to server. Basically it is like this: Imagine I want to send message M to server. Client computes a MAC over the message....
49 views

I've read the following paper and have one question on it. M. Luby and J. Staddon, "Combinatorial Bounds for Broadcast Encryption", EUROCRYPT'98. On page 523 (12th page of the paper) the authors say ...
43 views

### Is this ECC based messaging method secure?

I developing an encrypted messaging for ZeroNet (aP2P file-based network, website: zeronet.io) and would like to have some guidelines if any of this could work. My first idea: In ZeroNet every user ...
53 views

103 views

### IV larger than block size of cipher?

Is there any advantage to using an IV larger than a cipher's block size? Say I'm using AES-256 in Galois Counter Mode (GCM). My file format looks like this: ...
316 views

### What is the use case for XOF functions (i.e. SHAKE128/256)?

FIPS 202 defines 2 functions: SHAKE128 SHAKE256 As extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...
97 views

### Time complexity of trial division

Suppose $n=pq$, where p,q are prime numbers. let $p ( \le q)$ be the smallest prime, then we know that $p \le \sqrt{n}$. In trail division, we check $n \mod i$ for the values of $i$ from 2 to \$\...
176 views

### Is there any relation between two strings with the same MD5 hash?

Is there any relation between two strings with the same MD5 hash? For example these two strings: ...
2k views

### How can an S-Box be reversed?

So, as an exercise to greater understand some things about cryptography, I decided to try and implement GOST 28147-89, which uses eight 4x4 S-Boxes. I can grasp the concept of putting 4 bits through ...