# All Questions

829 views

### How does Output Feedback mode use the initialization vector?

How can I process Initialization Vector inside the Block Cipher Encryption box (using for example AES) together with the Key? Will I encrypt the Initialization Vector like a block of plaintext? So ...
507 views

### RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
158 views

### Signature scheme with two private keys, neither derivable from the other

Is there any scheme, ideally one widely used or at least widely available, where you can treat both the signing and verifying keys as secret? Basically, the functionality I'm looking for is this: ...
211 views

### Is there a cumulative commitment scheme?

For a certain application I need a commitment scheme where each user could make a commitment, and a single verification operation could verify all the commitments simultaneously, faster than single ...
1k views

### Dictionary attack on pass-phrases on common algorithms

I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
19 views

### Is this transposition cipher information-theoretically secure for 1 message?

Given: $m = \{0,1\}^{n}$; a plaintext message of length $n$ encoded in binary $k = randomshuffle([0, 1, ..., 2n-1])$; A secret key consisting out of unique numbers between 0 and $2n-1$ in a true ...
57 views

### Retrieve value of private key after encryption with the public key

Is there a way to find an RSA private key after it is encrypted with the corresponding public key? Does there exist an algorithm to recover the private key in this special case?
56 views

### Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? The reason I ask is that I recently answered this question and it came to my mind that OAEP or OAEP+ might be possible solutions. Note ...
90 views

### How multiplicative property of RSA can be exploited

It is known that RSA has the multiplicative property $E(m_1) \cdot E(m_2) = E(m_1 \cdot m_2)$ because $m_1^e \cdot m_2^e = (m_1 \cdot m_2)^e \pmod n$ But how can this property be used to break ...
101 views

In cases where a large complex data structure contains elements that are a mix of confidential and not-so-confidential data, what would be the pros & cons of: encrypting the entire structure ...
101 views

### New to cryptology, studying Message Authentication Codes

I understand the basic operational theory behind MAC, but I'm getting tripped up on some of the finer details. Also the differences between MAC, HMAC and MIC are getting lost on me, including the ...
90 views

### Can Poly1305-AES be used with AES-256?

I'm reading through Bernstein's The Poly1305-AES message-authentication code. The MAC is predicated on 16-byte block ciphers like AES and produces 16-byte authentication tags. However, Bernstein does ...
53 views

### Is it secure to transmit a short plaintext with its MAC?

I have a short (32-bit) message that needs to be authenticated. Due to the constraints of my platform, I would like to use Speck32/64 (32-bit block, 64-bit key) with a Matyas-Meyer-Oseas one-way ...
128 views

### AES GCM vs other encryption modes in embedded environment for network traffic

I'm doing a lot of research since I'm doing an internship for a company where I need to upgrade their security level. Their own protocol needs a cryptographic upgrade and I'm leaning towards AES since ...
72 views

### Is there any advantage on encrypting the CMAC together with the message?

I'm reading a protocol specification where the procedure is to generate a CMAC, take the first 4 bytes of it, append this authentication tag to the message and then encrypt the message + CMAC together ...
141 views

For Bitcoin's ECDSA curve (secp256k1, where $a=0$, $b=7$), why can't the generator point's first coordinate be $x=0$? That is, the point on the curve would be $(0,y)$ where $y$ satisfies $y^2 = 0^3 + ... 2answers 88 views ### Formal security of recycled random blinding in a Paillier scheme This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ... 2answers 111 views ### Can I simulate iterated AES-ECB with other block cipher modes? I am trying to write some code using the Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/#algorithm-overview) which provides only some of the block cipher modes for AES, intentionally excluding ... 2answers 228 views ### Chosen plaintext vs Chosen ciphertext What is the difference between chosen plaintext and chosen ciphertext attack? In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference? 1answer 120 views ### How to use ElGamal to encrypt zero? ElGamal encryption algorithm is as follows: To encrypt a value$m$, it chooses a random value$r$, and calculates$c_1=g^rmodqc_2=m*h^rmodq$where$g$is the group generator,$x$is ... 1answer 77 views ### OpenSSL des-ede3 not producing same output as test vector implies it should be I'm encrypting one of the standard TDEA/3DES/DES-EDE test vectors with openssl: ... 1answer 177 views ### How to customize a standard encryption algorithm? I want to modify and customize AES encryption algorithm and develop a variant of it. What factors should I consider so that it does not become weaker? What skill sets would be required to undertake ... 1answer 143 views ### Is it safe to AES-CBC and AES-CMAC both using the same key? There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ... 1answer 92 views ### Roots in modulo field I have a point$(X,Y)$on an elliptical curve$E(a,b)$where$a=-3$and$B$is a large number that is in hexadecimal from -51BD. To compress this point oficially in a program, we know that every$X$... 1answer 117 views ### Private Information Retrieval--Is it still theoretical? Are there any real world products in which private information retrieval techniques are used?(a data hosting server oblivious of which data item was fetched from it?)If not what are the major barriers ... 1answer 133 views ### Modes of encryption for hard drives? What are the currently recommended modes of encryption for large disks? Basic requirements would seem to be that you can update an encrypted sector independently of others, which rules out most ... 1answer 71 views ### Do data-dependent rotations have any advantage over fixed rotations? There are many ARX ciphers, however most use fixed rotations. I know data-dependent compared to fixed rotations are: patented harder to implement constant time more expensive in hardware harder to ... 1answer 90 views ### How many of primitive point on the elliptic curve? In elliptic curves for cryptography, I know$nG=O$, where$G$is a base point represented by$G=(x_g,y_g)\ on\ E(F_P)$, where$n$is Order of point$G$. For example,$P(0,6)$is a primitive point on ... 2answers 108 views ### What is primary security in ECC? I read the following paragraph in a book about Elliptic Curve Cryptography, but didn't understand it: The primary security in ECC is the parameter$n$; where$n$is Order of point$G$, that is$n$... 1answer 87 views ### Encryption in which ciphertext is bigger than plaintext? Is there an encryption which would produce a ciphertext longer than the plaintext? (please ignore block-chaining IV stuff, which would result in a data being generated from the plaintext). The point ... 1answer 100 views ### How secure is a lagged fibonacci sequence for encrypting brief messages? Say I start with a 26-letter keyword and convert the letters into 26 integers (A=0, B=1...Z=25) nr[0] to nr[25]. Then I create a stream, nr[26] onwards, with a lagged fibonacci sequence where nr[n]= ... 1answer 104 views ### Encrypted read-only message queue I'm creating a prototype for a messaging queue with some custom logic (can't re-use any existing solution). One requirement is to have all messages encrypted. There are three classes of nodes ... 1answer 70 views ### Can adding nonces make challenge response authentications weaker? In a custom protocol we want to replace an aged tiger32 based challenge response authentication. I suggested that we use something existing, so threw HMAC into the room. As per wikipedia it works as: ... 1answer 146 views ### what are DP and DQ in Encryption by RSA in c# I want to know about these tags in RSA Encryption by private Key. when I use this code: ... 1answer 205 views ### Calculate the RSA private exponent from the CRT parameters I am trying to make the RSA structure of Openssl manually, knowing the public key ($n$,$e$) and the CRT parameters$p$,$q$,$d_P$,$d_Q$, and$u = q^{-1} \mod p$. That is, I want to get the$d$... 1answer 155 views ### Using modulus in one time pad? I would like to know what is the real purpose of using a modulus in the equivalent of a Vernam cipher: Data$d$, large number$M$. Assume the key length is$\lambda$bits. Then$M\$ could be ...
168 views

The common way to store passwords in web applications is this form: $$hash(password||salt)$$ Does it make sense to store them in the following form instead:? ...
452 views

...
104 views

### What's causing the poor randomness in this program: the LCG, or the program logic itself?

(Crypto Gods, I should begin by stressing that I haven't lost my mind: I'm not doing this in real life, I'm just trying to understand the theory behind what's happening. With your help, hopefully I ...
137 views

### Maximum password length in PBKDF2

Haven't found any clear cut answer in Google so its up to you guys: DK = PBKDF2(PRF, Password, Salt, c, dkLen) Here, what is the upper limit of password length? ...
141 views

### Diffie–Hellman Ephemerality Nomenclature

Below is a short excerpt of available DH cipher suites available on a machine. I understand EDH is ephemeral DH, and that ECDH is for Elliptic-Curve DH which is computationally faster. ECDHE is both ...
55 views

### Constant data as input to hash

I want to use hash function on some data, and part of this data, might be constant for a certain period. The output of the hash function is used as authentication data (MAC). I want to know if there ...
120 views

### Does 3-DES take approximately the same time to encrypt 1B and 1KB?

I am using 3-DES to encrypt some data in Java. I decided to run some tests and plot some graphics to decide how to optimally pack data for its encryption (see how encryption/decryption time behave ...
83 views

### Is my implementation of a PRG at least intuitively secure?

I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism. Basicly I take a random ...
118 views

### Storing encryption key

It's my first time using stackexchange! So, I am doing a password manager in Java. But now I am VERY confused because of the encryption. There will be the program login, where the user types its ...
131 views

### Collecting entropy: can I use timing of reading as a separate source from the reading itself?

I'm implementing an entropy gathering program. For that I collect 2 bits from two gpio-pins connected to a random source. I whiten this stream of bits using the von Neumann decorrelation algorithm. ...
160 views

### How does Web Cryptography API produce secure PRNG?

How does Web Cryptography API (eg window.crypto.getRandomValues) produce secure PRNG? Specifications: https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html#RandomSource-interface ...
503 views

### Cryptool - DES (ECB and CBC ) - double encyption

So, I uploaded a text file in Cryptool and encrypted it with DES-ECB with the key FF FF FF FF FF FF FF FF. I encrypted the cipher text again, with DES-CBC using ...