# All Questions

528 views

### What changed in PKCS#1 v2.2, and why?

PKCS#1 is one of the most used (de-facto) standard for real-world use of RSA. That's for good reasons: PKCS#1 is well thought, versatile, understandable, has been relatively stable for over two ...
4k views

### How does a birthday attack on a hashing algorithm work?

A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits. That means it takes about ...
243 views

### Why does Skein use an output transform, but other similar hashes don't?

Skein uses an additional compression function call to finalize the output, even when the output isn't larger than the native output size. The Skein paper says: Due to Skein’s output ...
172 views

### Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
336 views

### Who first published the interest of more than two prime factors in RSA?

Multi-prime RSA is now a well known technique: it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed boost in ...
649 views

### Turning a cipher into a hashing function

This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;) The first hashing functions created ...
930 views

### Encrypt a file once with 50 characters password or twice with 25 characters?

What better Encrypt the file once with 50 characters password or encrypt it twice each time with 25 characters password.
16k views

### RSA encryption with private key and decryption with a public key

When using the RSA cryptosystem, does it still work if you instead encrypt with the private key and decrypt with the public key? What about in the case of using RSA for sender authentication?
800 views

### How can I improve a password generation scheme based on a shared secret and URL?

I currently use the following method to generate a different password on every website I have to login: password = SHA1 ( mainPassword . domainName . number ) ...
1k views

### Can someone explain the ECB Penguin?

I've seen the ECB Penguin used to demonstrate why ECB is not a recommended method of encryption, but I do not understand how this translates to text or passwords. Aren't the people who create these ...
2k views

### Is there a way to make RC4 (ARCFOUR) secure, or is it completely broken?

I need a method to authenticate a process with another in order to establish interprocess communication between them, to prevent malicious processes from trying to hook onto the system. Currently I ...
4k views

### How can one securely generate an asymmetric key pair from a short passphrase?

Background info: I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
1k views

### Perfectly secret cipher can leak about the key?

As defined by Shannon, a cipher is perfectly secure if ciphertext leaks no information about the plain text. Under this definition, can ciphertext leak something about the key? Are there any ciphers ...
2k views

### Is a die implemented in a physics engine truly random?

So, a fair die throw is really random, not pseudo. So, would a RNG implemented as the result of a die throw in a physics engine (say, Newton, Havok, Nvidia's PhysX) be regarded as both ...
306 views

I have thought of a system for generating passwords which works as follows: Take the following items: A password, such as williamwallace. A secret 1000 digit ...
1k views

### Pre-image resistant but not 2nd pre-image resistant?

Are there any cryptographic hash functions for which there is a known pre-image attack, or a known second pre-image attack, but not both? The attack doesn't have to be practical - just anything that ...
508 views

### Can I determine if a user has the wrong symmetric encryption key?

We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
303 views

### Reduction from signatures to encryption?

Is it possible to construct an (asymmetric) encryption scheme from a signature scheme? If the signature scheme is deterministic and allows existential forgery (e.g. RSA), then the answer is yes ...
662 views

### Can one implement AES on 4-bit microcontroller?

It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID. I have yet to come across ...
521 views

### Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?

A recent paper showed that the McEliece cryptosystem is not, unlike RSA and other cryptosystems, weakened as drastically by quantum computing because strong Fourier sampling cannot solve the hidden ...
797 views

### How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

If cryptanalysts today were to crack the original Enigma machine, how fast/ how easily could they do it? What methods would they use? The original cracking was significantly helped by operator ...
360 views

### Should I delete cryptographic data from memory?

When dealing with cryptographic data, is there a chance that attacker recovers portion of data I used in my program? Should I try to delete every bit of keys and encrypted data that I used, overwrite ...
1k views

### How many RSA keys before a collision?

I was wondering how many possible private/public keys exist? If a million people – for whatever reason – would try to generate 5 keys each in the same minute (on the same date and time) is there a ...
2k views

### Why is the IV passed in the clear when it can be easily encrypted?

The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ...
1k views

### Modern integer factorization software

What are the modern software packages that can be used to factoring large numbers into primes. By modern I mean developed and made public within the last 5 years. I'm interested in things that are ...
956 views

### SHA-224 Purpose

One of the new features of Java 8 is the SHA-224 message digest. What is the use case for having a 224-bit-length hash?
6k views

### HMAC vs MAC functions

I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences. What are principle differences? When to use one and when the other?(Typical Use Cases)
2k views

### Unpredictability of X.509 serial numbers

About X.509 certificates serial numbers the RFC 5280 says: The serial number MUST be a positive integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a ...
147 views

### Can Skein be used as a secure MAC in format H(k || m)?

Can Skein be used as a secure MAC in format H(k || m)? I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
522 views

### Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
2k views

### Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
709 views

### Predicting PRNG given some of its previous output

I a have a question about PRNGs and this is my very first experience with them. I have the following generator that takes a 56-bit seed $p$ during initialization and then chooses both $X$ and $Y$ ...
869 views

### Is it possible to distinguish a securely-encrypted ciphertext from random noise?

Say I have a bunch of data encrypted with a secure block cipher (such as AES). An attacker has unlimited access to this encrypted data. The attacker doesn't know whether the data is encrypted or if ...
543 views

### Why should I use Authenticated Encryption instead of just encryption?

There are various different modes of operation for block cipher use, some of which provide "encryption" and some of which provide authenticated encryption. Why should I use an authenticated ...
3k views

### Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
279 views

### AES CTR with similar IVs and same key

Lets say there is a piece of software that uses AES CTR to encrypt different messages using the same key but with slightly different IVs So for example, a 16 byte IV, the 2nd 8 bytes are always the ...
1k views

### Why are the constants so simple in Keccak?

Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF) The initial values of the state in Keccak is ...
2k views

### Why is asymmetric cryptography bad for huge data?

I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length. Why is this? I know about hybrid encryption, which uses symmetric encryption to ...
3k views

3k views

### Why exactly is Blowfish faster than AES?

I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
2k views

### Where can I begin to study the math behind modern cryptography?

Why do I start the word buffers in MD5 with those values specifically? What in the world motivated the decision to use the numbers 1, 1, 2, 3 for the mix columns stagein AES? And what kind of ...
548 views

### creating a small number from a cryptographically secure random string

i'm trying to figure out the best way to generate a cryptographically secure random number between 0 and 200 from a cryptographically random string of bytes (ie. read from /dev/urandom or some such) ...
2k views

### Use of salt to hash a password

In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
756 views

### What is a hard-core predicate?

I read this article on Wikipedia: Hard-core predicate. Still I don't understand what exactly is a hard-core predicate. Is it possible to put this in simple English terminology, and perhaps with a ...
348 views

### Mapping between subgroups and the integers

This question is a companion to the equivalent question on elliptic curves. Preliminaries Diffie-Hellman, Elgamal, DSA, etc. are examples of protocols that work in the integers modulus a large prime ...
264 views

### Trial divisions before Miller-Rabin checks?

I'm trying to understand prime number generation (more correctly, the primality checking) as described in Handbook of Applied Cryptography. The context is circa pages 145 - 150, and specifically ...