# All Questions

1k views

### What is the PRG period of stream ciphers such as RC4 or Salsa20?

I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ...
209 views

### On the fly signatures and zero-knowledge

I am reading some articles which explain on the fly signatures (also called online/offine signatures). The principle is that a few operations do not depend of the message we want to sign, so these ...
516 views

### Whitening and randomness extraction

The Von Neumann randomness extractor is explicitly mentioned in the randomness extractor page of Wikipedia, but strangely enough that page does not contain any reference to whitening the results of an ...
995 views

### Calculation of time needed to crack DES with my CPU

I have a laptop that has the CPU and the RAMs shown below in the images. My question is that, using this CPU and the RAMs, how much time would it take for me to crack an old school DES algorithm ...
107 views

### OpenPGP Public-Key algorithm

What means when pgpdump shows this kind of algorithm in the Public-Key Encrypted Session Key Packet? ...
1k views

### Why are the first few bytes of a gpg encryption always the same?

If I run the command 'gpg -a -e < input.txt > output.txt' with completely different inputs (e.g. from /dev/urandom), the first 19 characters are always the same. What is this header? Is it ...
442 views

### Encryption algorithm used in WPA/WPA2

I want to know how EXACTLY the WPA password gets encrypted I have been searching through and I was able to catch: The actual password is converted to some hash Salting is applied to the hash The ...
121 views

### Two rounds of SHA-256 HMAC?

In a project we are working on, we have two applications within our datacenter that exchange messages. The messages are protected by an HMAC, and the secret key is stored on a SafeNet device. Update ...
69 views

### How did G.H. Hardy's work contribute to today's public-key cryptography?

I know that Hardy's work in number theory was used by Clifford Cocks in 1973 to develop the basis for public-key cryptography. What specifically was this work, and how is it used today in ...
142 views

### hybrid PKE scheme CCA2 insecurity

I'm reading "An Efficient CCA2-Secure Variant of the McEliece Cryptosystem in the standard model" by Rastaghi which states: As we know, in hybrid PKE schemes XOR alone cannot perfectly hide ...
75 views

I have seen in few places (mostly papers) talking about plain cascade and XOR cascade. I know what is cascade cipher is but I am not clear about what these are. Can anyone help to understand using ...
231 views

### How do I create a PKCS#7 or CMS SignedData in python? [closed]

There doesn't appear to be PKCS#7 or CMS support in pyCrypto. I'd appreciate a recommendation on a Python library wth CMS / PKCS#7 support. Ideally, there will be a call that will create return ...
7k views

### Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
79 views

### Fixed-points in block ciphers; why don't they indicate a vulnerability?

I've seen a few questions here on fixed-points in ciphers, most asking about the possibility and existence. Most of the answers however pointed out that fixed points are not exactly a security threat. ...
2k views

### Estimating bits of entropy

Best ways to estimate average bits of entropy in a byte stream. I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What ...
280 views

### How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
60 views

### Using Skein as PRNG

I have read that the Skein hash can be used for quite a few different functions, including a PRNG. Would using the 1024 Skein hash to return 16KB of data be appropriate for a PRNG? Or would it only be ...
79 views

### Test vectors for TLS PRF function

Does anyone know where I might be able to find test vectors for the PRF function in TLS? (either 1.0 or newer). I'm trying to implement a client and I am getting the BAD Record MAC return after ...
72 views

### Is it possible to have E=D and Ke <> Kd?

Let us consider $E$ an encryption algorithm that encrypts a message $m$ into a ciphertext $c$ using a key $K_e$. i.e $c = E(K_e, m)$. Similarly, decryption is achieved by $m = D(K_d, c)$. Is there ...
720 views

### SHA-256 Reversing A String of Equal Length

I've done a lot of reading on how SHA-256, I've found that SHA-256 is irreversible because more data is fed into the hashed string than the hash string contains. But, what if the data that was ...
103 views

### What procedure to use to verify a raw public key (TLS ECDHE_EDCSA ciphersuite)?

Contrary of verifying a certificate which is a well-known procedure, I am wondering what the procedure is to verify a raw public key 'certificate' (https://tools.ietf.org/html/rfc7250). This ...
174 views

### Physical entropy source: How many bits entropy per byte is sufficent?

8 bit / byte would be perfect obviously. head -c 1M /dev/urandom | ent gives ~ 7.9998 bits per byte. Now, if I have a physical entropy source, how much entropy ...
93 views

### Size of encrypted AES CEK in CMS block

When I run openssl cms -encrypt -aes256 -in sample.der -out wrapped.der -outform DER -recip ecc.crt -keyopt ecdh_kdf_md:sha512 the part of the CMS output which ...
84 views

### Possibility of the encrypted text being the same as the supplied plain text! [duplicate]

I was learning DES when it occurred to me that there could be a possible case where a (key, plainText) pair could result in an ...
61 views

### Most Secure Exchange of Keys [closed]

Given both Alice and Bob must exchange IP addresses to perform such an operation, what is the most secure way Alice and Bob can exchange public keys between two mobile devices without having to rely ...
97 views

### Hashing entropy with only 128 bits of internal state

I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher. As the key size is ...
36 views

### Encrypted Data length in a CBC Block Cipher

The RFC5246 states the following: The encrypted data length (TLSCiphertext.length) is one more than the sum of SecurityParameters.block_length, TLSCompressed.length, ...
64 views

### PRF and pairwise independent hash function

I'm confused with the concepts of pairwise independent hash function and pseudorandom function. They seem identical to me. A family of hash functions $H=\{ h:U \to [m] \}$ is $k$-independent if for ...
97 views

### have a question in the book “introduction to modern cryptography”

"introduction to modern cryptography. 2ed" in page 254 "By obtaining sufficiently many estimates and letting $x_{i}$ be the majority value, $A{'}$can ensure that $x_{i}$ is equal to $gl(x, e^{i})$ ...
156 views

### How much processing power should you assume an attacker has?

The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers Is that a single attacker ...
156 views

### CBC-MAC just to verify integrity

I have a message and I want to verify its integrity and authenticity. I have a shared secret (key) that is not used for other encryption. Is it safe to send a plaintext message containing all the ...
448 views

### Why can ssh-keygen export a public key in PEM PKCS8 format?

In the documentation of ssh-keygen (man ssh-keygen) it says for the option -m that an export ...
84 views

### Finding Galois LFSR and its initial configuration

Suppose recursion for output of Galois LFSR is $u_1=u_3=u_4=0$ What kind of taps are here, and initial state? How to uncover this information?
365 views

### How many bits of entropy can I expect from /dev/urandom in iOS?

Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and ...
80 views

### Use of the IV for the CBC Block Cipher in TLS1.2

I'm struggling to understand at what point a message is encrypted when looking at RFC 5246. The spec gives the generic block cipher in section 6.2.3.2 as: ...
56 views

### Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...
19 views

### Fibonacci LFSR, recovering previous bits

Suppose somewhere is Fibonacci LFSR, we know that it has 7 cells and feedback taps are cell 2 and 7. We intercepted part of a stream, and part intercepted is 1010101. Is it possible to recover ...
37 views

### TLS Cipher Suite definitions

Based off the various cipher suites available for TLS (which I am looking at here:https://www.thesprawl.org/research/tls-and-ssl-cipher-suites/), can anyone clarify if when the suite contains 'SHA', ...
166 views

### OpenSSL ECDH key exchange mechanism

I am using FIPS based OpenSSL module for encryption of sensitive data for my desktop socket server and client applications. I am using ECDH for key agreement.The keys public and private pair is ...
234 views

### What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...
1k views

### AES decryption vs encryption speed

Let's consider the CTR mode. For a faster encryption/decryption, is it preferable to use the decryption operation of AES, or its encryption ?
159 views

### Key Confirmation Attack [Key Distribution Center (KDC)]

Okay this is how I understood it according to this: Alice $A$ establishes a connection to $KDC$ and prepares for session key Exchange $k_{ses}$ $A$ encrypts the request with her key $k_A(A, B)$ ...
127 views

### Proving set membership in less than log(N) bandwidth

I have an unchanging set of unique items, and I want my server to show one of those items to a client, then cryptographically prove that the item is part of the set. How I do this currently: ...
42 views

### Confusion regarding computing Multiplicative Inverse Modulo P?

May be a silly doubt, please rectify my confusion regarding below problem: For concreteness assume $g=2, p=11, a=6$ and $x=9$ $$A = g^a \bmod p = 2^6 \bmod 11 = 9$$ X = g^x \bmod p = 2^9 \bmod 11 ...
25 views

### Deriving message from signature (RSA) [duplicate]

Usually signatures are used for verification, and this requires that you pass both the message and the signature. I was wondering; if the message holds to a certain format (for example, valid json ...
1k views

### Perfect zero knowledge for the Schnorr protocol?

Can somebody explain (or point to a reference) why the Schnorr protocol cannot be proved zero knowledge?
55 views

### Anonymous messaging using blind signatures

I want to implement a message relay server that knows nothing about who has sent a message but at the same time maintains a message quota per user. While searching for ways to do that on the internet ...
279 views

### What is stopping someone from saving encrypted info, and decoding it later?

When I send encrypted data to a website, using public key encryption, what is stopping someone who is listening from storing my encrypted data, and decryption it in a few years after they have ...
In the paper Fully Homomorphic Encryption over the Integers, it mentions a symmetric key scheme on page 1 and 2. Key Generation: Pick a random odd number $p \epsilon [2^{N-1},2^N)$ Encrypt A Bit m: ...