# All Questions

340 views

### How to calculate key size of a security algorithm?

There are lots of security algorithms. One of the way to measure security of a cryptography algorithm is to find out its key size. There are many key size of a single algorithm. ECC (Elliptic ...
172 views

### RSA private key finding method

Bob uses RSA with $p=83$ and $q=103$. His public key is $e=445$. Alice claims that she can calculate Bob's private key without using the definition $d=e^{−1}\bmod φ(n)$? But how?
735 views

### Is this DIY remote lock protocol secure?

I need your advice on following scheme of exchange protocol between remote lock and key. I'm planning to use following algorithm: Key generates unique value that never repeats (in reality it's just ...
207 views

### Difference between Pseudo Mersenne primes and Generalized Mersenne primes

The field prime numbers $p$ proposed by the NIST standards are referred to as Generalized Mersenne prime numbers [1] and as Pseudo Mersenne prime numbers [2]. Is there a difference between Pseudo ...
74 views

### Faster alternative to HKDF

HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ...
65 views

### (Non-) Perfect Secrecy of Vernam Cipher Using $E(m) = m \oplus k \oplus \operatorname{rev}(k)$

Given the cipher $$E(k, m) = m \oplus k \oplus \operatorname{rev}(k)$$ where $\operatorname{rev}(k)$ is the reversed binary of $k$, how would one prove that the cipher is not perfectly secret. I ...
72 views

### Is it secure to use hexadecimal data for IV instead of raw binary?

Is it safe and secure to use a function like bin2hex (which converts binary data to hexadecimal) on the binary output of functions like ...
173 views

### Checking the integrity of RSA public key

Let's say I need to verify a digital signature and the public key is stored in untrusted storage which I need to fetch before I verify the digital signature. However, I can store the cryptographic ...
422 views

### ECC keys vulnerable to brute force attack?

I have started learning about Elliptic curve cryptography. Since the key size required in ECC is relatively lesser than the key size in RSA to provide the same amount of strong encryptions, I wonder ...
308 views

### What is the use case for XOF functions (i.e. SHAKE128/256)?

FIPS 202 defines 2 functions: SHAKE128 SHAKE256 As extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...
136 views

### Relationship between exponent and modulus in RSA (as RSA properties as listed in X.509)

In one of my assignments, I had the following question (Please read on. Not a homework assignment :) ): X.509 (1998 version) lists properties that RSA keys must satisfy to be secure. One such ...
225 views

### HMAC-SHA256 on large data files

I currently need to encrypt large files (video, over 6 Gbytes) for our customers. To ensure authenticity and integrity, we chose HMAC-256 as we already use it in our internal messaging system. But ...
101 views

### Define “cryptographer”

I often encounter the phrase "I am not a cryptographer". Is there a generally accepted definition for who is a cryptographer? What qualifications would be expected? For instance, should that person ...
89 views

### Implementing 5 modes of operation with a hash function

Is it possible to implement any of the 5 modes of operation (ECB, CBC, OFB, CFB, CTR) with a hash function?
354 views

### Definition of authenticity

I came across various definitions of what authenticity means in cryptography. I would like to know which one is correct. The first definition - the one I always used - is the following: Data ...
125 views

### Does CTR mode yield a PRF?

Can the keystream generated by CTR mode be considered a pseudo-random function? I give more information. Assume $f$ is a PRF. We define a function which takes 2 inputs, the desired length, and an ...
188 views

What is the advantage of AEAD ciphers? Why is the TLS working group pushing for them? I thought modern cipher suites require SHA256 for authentication. What advantage is there to including Poly1305? ...
528 views

### Is there a multiple asymmetric encryption algorithm, which requires all private keys to reveal the secret?

I am looking for an asymmetric encryption algorithm, which allows to encrypt a secret with multiple public keys, but to reveal the secret all private keys must be used. You shouldn't be able to tell ...
143 views

### RSA with $\lambda(n)$ or $\varphi(n)$

The PKCS #1 v2.0 specifications suggest using $\lambda(n) = \mathrm{lcm}(p-1,q-1)$. What is the benefit of choosing $\lambda(n)$ over $\varphi(n) = (p-1)(q-1)$ in RSA key generation?
147 views

### What does signed fixed window method mean in ECC?

I am studying (sliding) window method in Elliptic Curve Cryptography (ECC) but I am confused by the term, signed fixed window method. By the way term is used in a research paper and not in the book ...
351 views

### Weaker alternative to Ed25519?

For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast. However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
115 views

### What practical uses can random hash collisions be put to?

Using magic, I've built a machine that instantly generates hash collisions. To try it out, I set the dial to SHA256 and typed in "e7cf3ef4f17c3999a94f2c6f612e8a888e5b1026878e4e19398b23bd38ec221a". I ...
2k views

### Key Length vs KeySpace

I am a newbie here, this is my first post. I have searched the forum but I haven't found a clear answer to this. In general. What is the relationship between key length and the keyspace? (if there ...
398 views

### Plaintext XOR'd with keylength-shifted plaintext

While solving a (easy...) Project Euler cipher problem this week I repeatedly saw instructions for breaking ciphers after identifying the keylength as: 'shift the ciphertext by that key length and ...
90 views

### For which RSA moduli, precisely, is $e=d$ for all $e$?

This question shows that there are at least two valid RSA moduli $n$, namely $35$ and $91$, such that for any $e$ coprime to $\lambda(n)$, $$e^2\equiv1\mod\lambda(n)\text.$$ Reading the linked ...
398 views

### Statistical properties of hash functions when calculating modulo

When using SHA-1 to hash an input, the result is a pseudo-random number in the numeric ID space $\{0\dots2^{160}-1\}$. Do I loose any statistical property in the result if I use modulo to restrict the ...
174 views

### Do data-dependent rotations have any advantage over fixed rotations?

There are many ARX ciphers, however most use fixed rotations. I know data-dependent compared to fixed rotations are: patented harder to implement constant time more expensive in hardware harder to ...
326 views

### Is it possible to demonstrate that md5(x) != x for any x?

I am looking for an easy to follow explanation, if possible, that demonstrates/proves the validity (or not!) of this assertion: for any X, md5(X) != X (being X any string of 32 hex characters)
746 views

### what are DP and DQ in Encryption by RSA in c#

I want to know about these tags in RSA Encryption by private Key. when I use this code: ...
319 views

### Simple proof that shows AES is not a uniform permutation on any n-bit string?

Is there a simple proof that shows AES is not a uniform permutation on any $n$-bit string? Since I'm just starting with crypto, I'd like to see a simple yet elegant proof for the said property. ...
1k views

### Chosen plaintext attack on textbook RSA decryption

Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key. Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$ Compute $C’ = C (r^e) \bmod n$ Submit $C’$ as a chosen ...
248 views

### Security equivalent to Diffie–Hellman problem?

I've been doing the security proof for one of my Theorem. Basically, given $g^a$, $g^b$, $g^{cb}$, $g$ and $c$ as known values. Is the problem of computing $g^{acb^{-1}}$ equivalent to the Diffie ...
1k views

### Why does AES-GCM need a hash/MAC in TLS?

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
1k views

### Generate a unique 64 bit numeric database key without collisions at $2^{32}$ birthday threshold?

What is the best way to generate a unique 64 bit numeric database key from a string? For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...
312 views

### Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
218 views

### Advantages to knowing $p$ and $q$ in Blum Blum Shub?

Do you gain any advantage by knowing the factorization of $M$ (over just knowing $M$ itself) in the Blum Blum Shub generator? The only advantage I see is being able to calculate the $i$-th number ...
527 views

### security in the standard model → random oracle model?

Can a protocol proved secure in the standard model be considered secure in the random oracle model?
2k views

### TLS Key Block calculation - What is a PRF?

In Section 6.3 of the RFC for TLS 1.2, it is written that the key_block is derived from the following formula: ...
611 views

### Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?

Is it possible to leverage a preexisting implementation of AES-GCM to provide the key security benefits essential for full-disk encryption (similar to AES-XTS)? GCM is a popular encryption mode ...
173 views

### What makes LSBit steganography detectable? And what would help in concealing it?

In a project of mine I took a 24-bit bitmap image and I performed LSBit steganography over it (saved a black and white image inside each of the planes R, G, B) using pixel shuffling and xor encryption....
96 views

### Signing the hash of a key with the same key

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in ...
251 views

### A specific way for deniable encryption

I read the summary of deniable encryption on wikipedia: https://en.wikipedia.org/wiki/Deniable_encryption Then I read a question, by doom123 on security.SE: https:/...
332 views

### Cryptographically secure product keys

I am looking for a scheme to generate and validate cryptographically secure product keys. My requirements are: Unforgeable. It must be impossible (or at least very hard) for users to forge a product ...
623 views

### Maximal-length LFSR with $n$ bits when the factorization of $2^n-1$ is unavailable?

There's a classical method to efficiently test if a LFSR with $n$ bits is maximal-length (or equivalently, if the feedback polynomial is primitive), when the factorization of $2^n-1$ is available. Do ...
4k views

### At what stage is DHE and RSA used during the SSL/TLS handshake?

At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further ...
273 views

### counting points on elliptic curve

Given an elliptic curve with equation $y^2=x^3+ax+b$, and i want to find the number of points $(a,b)\in E(\mathbb{F}_p)$ where the polynomial has repeated roots, how do i do it? I have an intuition it ...
1k views

### Difference between Pedersen commitment and commitment based on ElGamal

Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme? For the sake of completeness, I recall what both of them look ...
148 views

### How can two (or more) parties share and agree upon a common random seed?

I really don't know how to call this simple problem: Two (or more) parties need to establish a common (non-secret) value to be used as a seed for a deterministic RNG. The only requirement is that each ...
Is $mac = enc(hash(x))$ a secure MAC for hash = SHA256 and enc AES in CBC mode or ECB mode. Normally AES-CBC is malleable. But in this case I use a hash function for the one-way property. For ...