# All Questions

87 views

### Forgery Attack Against RSA Digital Signature

I have been reading about attacks against RSA Digital Signature in a book The attacker chooses the signature first and then computes the message. As a consequence, he cannot control the ...
74 views

### How to use HKDF to combine two keys

I have heard that to combine two keys HKDF is better than using XOR function. But if you look at the HKDF RFC I could not figure out how to use it for concatenating two keys. What I can see is HKDF ...
143 views

### Attacks against El Gamal private key

El Gamal encryption involves picking $(p,g,b)$ which is our public key. We compute $b=a^x$ $mod$ $p$. Here, $x$ is the private key which we don't know. What are some efficient and strong algorithms ...
144 views

### What exactly is inside a private key?

May sound stupid to many, but I would like to have some pointers on what exactly is contained inside a private key. I have decent understanding of public/private keys/certificates (have created them ...
159 views

### Encrypt and decrypt data accessible by multiple users within a team

I'm currently working on web services which allows to send and retrieve data. The data belong to a team. A team is composed of users. Each authenticated user can send and retrieve data to/from their ...
90 views

### Difference between implicit signature and explicit signature

In most of time, what I see is explicit signatures such as ElGamal, it's rare to see the implicit signatures. So I wonder why it's rare to be seen? what aspect is it mainly used? what's the ...
64 views

### collision resistant summarizer for long hash values

how we can summarize SHA-256 into shorter values when we for example can't handle more than 128 bits on system? its better just use first 128bit and ignore the rest of bits or split full value and XOR ...
131 views

### Does SpongeWrap (from the Keccak team) absorb ciphertext or plaintext?

I have been reading the Cryptographic sponge functions paper, but I'm still confused. Does Keccak in authenticated encryption mode absorb ciphertext or plaintext? Edit: Are there any test vectors to ...
64 views

### PRP representation size

I'm now studying the block cipher substitution-permutation network construction and realized that it uses several small pseudo-random permutations instead a big one for saving memory (or that is one ...
194 views

### How do I calculate the private key in RSA?

Given $n=pq$ for $p,q$ known, I can calculate $\phi(n)$. $e$ is selected such that $\gcd (e,\phi(n)) = 1$. Using this, how do I calculate the RSA private key? Example: I have $n = 35$, with ...
115 views

### Why doesn't this dummy mutual authentication protocol provide mutual authentication?

I am a student taking a cryptography course so forgive me if this comes off as a silly question. This is an assignment question: ...
140 views

### How does Google's “authenticator number generator” work?

I have two-factor authentication enabled on my Google account, and I have this app on my phone which generates a number I have to type when I'm logging in to Google-Mail. But I don't understand how ...
67 views

### Adversary to Any Collision Resistance Hash Function

I'm reading a notion Any Collision Resistance for Hash Functions. In the lecture define a collision finder CF. CF is said to $(t,\epsilon)$-break the family of hash functions $F_K$ if the ...
120 views

### Difference between Pedersen commitment and commitment based on ElGamal

Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme? For the sake of completeness, I recall what both of them look ...
79 views

### What is adaptive zero-knowledge?

In this paper on pg. 1241 the authors discuss bullet point on Adaptive Zero-Knowledge : I am new to Zero-Knowledge and I am having trouble understanding what they are saying. I think they are ...
92 views

### How does the length of the plaintext affect the cipher strength?

Let the block length 64-bit, 256-bit key, cipher text accordingly - 64 bits. What is the strength of the block cipher, if any unknown attacks, which could reduce its strength. We can only brute force. ...
122 views

### Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which ...
189 views

### Can you explain partial private key extract algorithm in certificateless Public key cryptography?

Related to the algorithms of certificate-less Signature approach of Al-Riyami and Paterson… Why is there a need for a "partial private key extract algorithm"? Why should it be needed when ...
305 views

### Is it true for Java that the transformation mode and padding is ignored when using RSA?

Consider GregS's comment to this question (more specific to bouncycastle's provider implementation): http://stackoverflow.com/questions/11717646/bouncycastle-rsa-key-size-and-padding The mode, ...
242 views

### Signature algorithm SHA 1-2 with ECDSA

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. ...
163 views

### randomly generated key reused with XOR

If I have a long randomly generated key (k), XORed with a message (m), but since the message is longer than the key, there is a chance of reusing the keystream with the same message, but the key is ...
73 views

### secret sharing of product of 2 numbers

Does evaluating the products of shares $a_jb_j$ give a secret sharing of $ab$? I think it's a no, but I am not sure on how to prove it.
149 views

### What's the difference between the long term key and the session keys?

I'm currently studying secret key cryptography, and I've come across the terms "long-term key" and "session key". What's the difference between these two kinds of keys?
125 views

### With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
49 views

### How do you use the Tiger hash function with GPG?

I've searched Google and the GnuPG documentation and I haven't been able to find an answer. Some pointers in the right direction would be greatly appreciated.
871 views

### Can AES use PKCS#5 padding

From What is the difference between PKCS#5 padding and PKCS#7 padding, I understand that PKCS#5 is defined for 8 byte block sizes. Does this rule it out as a padding option for AES since AES has a ...
155 views

### Can you get two unpredictable hashes from the same message with, e.g. SHA1?

I'd like to create a database of questions and answers so that an attacker with access to the database can't obtain either the questions or the answers. If H0 and ...
133 views

### Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

I am trying to prove that: "If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken." Can you help me to prove it? Is there any proof to the relation between ...
107 views

52 views

### RSA Proof - di-mgt - modulo properties

I´m trying to follow one of the very detailed RSA Proofs given by di-mgt: "RSA theory", but unfortunately I stuck at the beginning of solution (chapter 3). I don´t understand where the second part ...
156 views

### Encoding numbers that can be decoded mentally?

I have a lot of objects, all of which need a particular number tagged on them so I can quickly tell the customer accordingly. But the problem is that the customer should not know what these numbers ...
149 views

### NP complete problems related to permutations of binary vectors or block ciphers

Recently, T.Gowers wrote a blog entry called "How not to prove that P is not equal to NP" about the Razborov/Rudich Natural Proofs paper. He has a construction where he talks about compositions of ...
279 views

### How do we prove that AES, DES etc. are secure?

How do we prove that AES, DES etc. are secure? I've read about them and know the basics on how they work, but I still don't quite understand how we can be sure they are secure? What are the proofs?
154 views

### Re-using parts of a one time pad to encrypt a new one?

The main problem with OTP's is the fact that they can only be used once. Would it be possible to use a random number that's, say, 512 digits, then use 256 of those for the (non-random) message, the ...
164 views

### how to mathematically prove a key exchange algorithm [closed]

I want to know the basic methodology that can be used to prove that a key exchange algorithm is secure. I am not asking about any specific algorithm. I want to know what should be proven and how to ...
128 views

### Shamir's Secret Share [duplicate]

I'm not quite sure the benefits of working over a prime modulus in Shamir's secret share- but doesn't limiting the numbers you pull from make the secret easier to guess? Instead of being over the real ...
309 views

### Dual_EC_DRBG and OpenSSL on a Mac

Since there is not much info anywhere on the Internet related to this: Does anyone know if OpenSSL's default CSPRNG is Dual_EC_DRBG or not? Their wiki is not very clear… Related to the first ...
386 views

### Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
99 views

### Is it possible to find a preimage for a reduced size hash?

Given a message $M$ and a 256 bit key $K$, perform HMAC($K$, $M$) with a 256 bit hash function resulting in: $a$ = ...
66 views

### what is PFS game?

when i reading about this paper, in the Setup of SIM section 5.2, it says that "According to the definition of PFS game", i wonder what the definition of PFS game ...
129 views

### Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers

As said in the heading, I want to know how the security of different padding methods, e.g. ANSI X.923, ISO 10126 and PKCS7, is compared to other methods to reach the needed block size, like ciphertext ...
442 views

### Break a simple compression function of a cryptographic hash function

I have a very simple compression function, which looks like this in C++: ...
178 views

### Relationship between Elliptic Curve Discrete Log, Integer Discrete Log, and Integer Factorization

I am trying to look into a relation between the following three problems which are widely used to build public crypto systems: Integer Discrete log Elliptic Curve Discrete log Integer Factorization ...
162 views

### What are the security effects of reusing a public RSA key to encrypt large data by blocks? [duplicate]

I'm trying to figure out a way to do public key encryption on a very large piece of data. For this, I of course want one side to do the encrypting but is unable to decrypt the data, and the other ...
208 views

### How to supply the GCM authentication tag to the OpenSSL command line tools?

I'm using AES-256-GCM for authenticated encryption. In order to decrypt, the ruby OpenSSL library requires an auth_tag parameter (in addition to the key and iv). ...
99 views

### Can an encrypted nonce be used for authentication?

Would a scheme like the following work to allow authentication of a sender: A nonce is appended to data, and the result is encrypted. The encrypted pack is sent to the other party. The sender then ...