# All Questions

94 views

### Can Pseudorandom values be used as secure keys?

I want to derive $n$ keys from a master key. I pick a master key $mk$ and use pseudo-random function (PRF) to generate $n$ pseudo-random values, $v_i=PRF(mk,i)$ where $1\leq i \leq n$. Next, I use ...
45 views

### Are private and public key sizes of Elliptic curve related?

I'm new to elliptic curve cryptography. I just want to know in the case where I take a random number (private key) and find its associated public key, does the size of the public key depends upon ...
86 views

### A (current or soon-to-be) NIST-recommended alternative to ECC?

So this comes from the professional rumor-mill, and I'm wondering if anyone might either debunk or shed light on this. My understanding is ECC is generally now preferred over RSA simply due to how ...
71 views

### Is XTS basically the cheapest form of (secure) double-encryption?

XTS, as given by the below equation, is a mode of operation primarily targeting full-disk encryption scenarios. By the way it works it also doubles the keylength although a meet-in-the-middle attack ...
42 views

### How to compromise the privacy of NaCl encrypted messages, when nonce is reused?

I want to know to how break NaCl encryption when a nonce used more than once for a given key private key. According to PyNaCl docs: It is VITALLY important that the nonce is a nonce, i.e. it is a ...
297 views

### Deciphering “easy” ciphers without hints

I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic ...
111 views

### HMAC key storage for a web app?

If one is going to use an HMAC, I.E: http://php.net/manual/en/function.hash-hmac.php, where exactly are they storing the key? Without some sort of secure storage (i.e not in a local file or code), I ...
131 views

### How to clock a linear feedback shift register?

I have some trouble understanding what happens when a LFSR is clocked. I have tried many examples but I do not get the correct result. Can anyone point out my errors? I have the following polynomial: ...
61 views

### Why is GCM only usable for ciphers with a 128-bit block size?

All block cipher modes of operation that I understand are generic schemes. They are not restricted by key size or block size. So why is GCM restricted to 128-bit block size?
188 views

### How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure?

I was presented with this seemingly paradoxical information, and am hoping someone can explain what I'm missing here. I have an encrypt-and-mac scheme here.If I want to transmit message m to Bob, I'd ...
59 views

### converting finite field elements to octet strings

I need to convert elements of the finite field $GF(p^k)$, where $p$ is an odd prime, to octet strings. To be more precise, I want to include elliptic curve points over $GF(p^2)$ in a Subject Public ...
56 views

### Is there a standard format for compact 56-bit DES keys?

DES keys are traditionally stored as 8-byte blobs, with only the high 7 bits of each byte being meaningful to the algorithm; the low bit of each byte is set so that the population count of the byte is ...
46 views

### Attacks on WinRAR volumes reusing same password?

I have quite a few WinRAR volumes that are all encrypted with the same password. The password is long and unbruteforceable, but I recently read that WinRAR uses PBDKF2 as its key-derivation function ...
65 views

### Is this a proper PBKDF2 key derivation function algorithm?

I've started implementing PBKDF2 algorithm recently and since I'm new in crypto, I would like to ask if my implementation is good. I looked up some documentations and I tried to follow many of them ...
81 views

### Is it possible to encrypt data points but still be able to select the ones “near” a given value?

We have an application where we would like to store "encrypted" data points (as in, not being able to know the original - plaintext - data just by looking at the stored - encrypted - version of it) ...
83 views

### Do Curtmola et al.'s IND-CKA1/2 security definitions protect against search pattern leakage?

In the article Searchable Symmetric Encryption: Improved Definitions and Efficient Constructions, Curtmola et al. propose adaptive and non-adaptive (indistinguishability and simulator-based) security ...
49 views

### What procedure to use to verify a raw public key (TLS ECDHE_EDCSA ciphersuite)?

Contrary of verifying a certificate which is a well-known procedure, I am wondering what the procedure is to verify a raw public key 'certificate' (https://tools.ietf.org/html/rfc7250). This ...
76 views

### How strong can multiple encryption be?

Suppose I encrypted a homophonic substitution cipher at the level of syllables, trigrams, digraphs, and individual letter with a Vigenere cipher using the keyword cryptography. I would then encrypt ...
317 views

### Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...
80 views

### Is RSA vulnerable to the padding oracle attack?

I know that AES in combination with CBC mode is vulnerable against the Padding Oracle Attack. RSA also uses some kind of padding, hence can this attack be apply to RSA encrypted messages too?
54 views

### Given just the hash of a file, can I verify that the file contains a specific data block?

Imagine I only have the hash of a file which we can call hash(file). Then a user sends me a data block (or section) of the same file, which we can call ...
63 views

### NTRU test vectors

Where can I find NTRU test vectors? In some research work in 2001, it is stated that test vectors were not publicly available at the time. Then in this ESSS1v2 standard under IEEE1363 here , the ...
97 views

### How to generate a large random number from smaller ones?

I'm using a function randInt that takes as input two integers as upper and lower bounds (inclusive) and outputs a pseudorandom number in that interval. ...
87 views

### How can recovered 5-letters plain text help me to recover reused OTP key

I have 10 cipher texts ciphered with One Time Pad (OTP) using the same key. I need to recover the key (or in other words, to recover the 11th cipher text which I assumed would require me to recover ...
59 views

### Public SRP verifiers or public hash chain “public keys” when secret is low entropy password

I want to set up the following: An untrusted server should host user sessions and authenticate users without knowing their passwords or being capable of creating a fake user session in the user's ...
89 views

### Extend OTP on random data?

If Alice and Bob both start with a shared OTP $P_0$, which is 256-bytes long, and Alice wants to send a 512-byte message, would it be secure to send the first 256 bytes with standard OTP (...
125 views

### Is there any such thing as “proof of location”?

I'm looking for a way for someone to prove to me their geographical location without a trusted third-party. Imagine wanting to prove to someone you're actually physically in a specific place. I'd ...
121 views

### How can I generate a good password from a SHA512 hash?

I have to change local administrator passwords on machines. I don't want to store password in a database. I have to generate a password that I can find later to connect to the machine again. So I ...
65 views

### Is authenticated encryption basically a lockable box?

I recently used a custom construction as a commitment scheme, which was taken from the standard picture you give people while explaining commitment schemes. Basically commitment schemes can be ...
65 views

### How does DPA work on AES?

I am really not much of a crypto guy so I don't really get how a differential power analysis on AES works. Can somebody explain it to me how it basically works?
99 views

### Does authenticated encryption add any protection to a signed digital envelope?

The general scenario of hybrid encryption is to use public key cryptography for the exchange of a one time session key that can be used for the encryption of the plaintext with a symmetric encryption ...
121 views

### Proof that two parties can communicate

Suppose we have three parties, Alice, Bob, and Carol. Alice can receive messages from Bob and Carol individually, but can only send messages to both simultaneously. Additionally, Alice cannot tell if ...
139 views

### Is there a scheme that allows to use RSA based challenge response protocol limited to signing only 8 bytes to create a secure signature of any data?

I have a tiny device that has a challenge-response authentication mechanism where the device signs 8 bytes of any data with it's internal 2048 bit RSA key. I would like to be able to certify any data ...
146 views

### Key exchange using ECDH vs ECIES

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
88 views

### LED cryptography algorithm

I would like to better understand the operation of the LED algorithm, especially the process of substitution and permutation of the blocks and especially the use of the keys in each round. The keys ...
114 views

### Do hand-based hash functions / MACs exist?

Is there research on a hash function or a MAC that can be executed without computers? I know there's a lot of history on hand-based ciphers and the OTP can easily be excecuted by hand. (By using ...
83 views

### How to make PKCS conformation oracle for trying Bleichenbacher’s RSA attack?

I was trying to understand Bleichenbacher’s CCA attack and thought of work it out in python. Can some one throw some light on the the logic behind the oracle used to check PKCS conformation? Will a ...
103 views

### Paillier cryptosystem preserve ordering of sums for two integer sequences

According to Paillier cryptosystem the product of two ciphertexts will decrypt to the sum of their corresponding plaintexts. I have two separate integer sequences X and Y that have same number of ...
130 views

### Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?
115 views

### Is it possible to combine true streaming with AEAD?

It seems there is a difference between "streaming" in cryptographic sense (as in CTR) and "streaming" in general programming sense (as in "accept a file larger than RAM from socket and save it on ...
231 views

### Definition of the Decryption oracle

In the context of public-key encryption, what would be a formal definition of the decryption oracle? I know the informal definition (i.e., a function that is available to the adversary and that ...
283 views

### Achieving 32-bit verification code with 16-bit CRC? [closed]

I am programming an embedded chip that has a hardware 16-bit CRC module. I have to protect some data bytes $d_0,d_1,...,d_{n-1}$ against corruption caused by sudden loss of power; a 32-bit CRC would ...
221 views

### Smart Card - Entropy during on-board public key generation

I know that some (advanced) smart cards or tokens allow generating key pair directly on the device, but I wonder how the card can gather entropy during the process. Any idea ?
109 views

### Security concern about reducing hash value using modulo operation

As stated in the title, what I am looking for is information about a "technique" that I would like to use in some of my algorithms. Sometimes I need to map a hash function's result into a range of ...
146 views

### How many times can a key be used for HMAC-SHA256 before it needs to be rotated?

If I wanted to use hmac for proving that a value hadn't been tampered with, how many times can I use a key before it needs to be rotated?
263 views

### Real life systems that use concepts of crypto computing [closed]

Are there any working cloud/internet solutions/products that operates on encrypted data such as systems using homomorphic encryption, secure multiparty computation, electronic voting, private ...
201 views

### How can a good pseudo-random number generator be made?

I am trying to make a pseudo-random number generator so that I can use it in a synchronous stream cipher for encrypting plain text. I want it to generate numbers which are as random as possible. What ...
104 views

### Use of ElGamal encryption for signature generation

If RSA (textbook RSA that is) generates a digital signature by using the sender's private key, couldn't any cryptosystem (the only two that come to mind are RSA and ElGamal) capable of asymmetric ...