# All Questions

109 views

### SSH rekey security implications

When an SSH session is rekeyed due to either the time limit or data limit for rekeying having passed, does the Diffie-Hellman exchange take place within the encrypted channel provided by the existing ...
461 views

### Encrypting a key with the same key using AES

I am new to crypto and trying to understand why it would be insecure to use AES to encrypt a key with the same key. Basically, something like this: encrypt(key, key) What happens when both key and ...
47 views

### Determine safety of exercise hash functions

There have been several attacks against hash functions such as $h_{sha1}$ and $h_{md5}$. Professor A suggests a new function $h_{666}$ with an output length of 666 bits. Professor B suggests ...
123 views

I am extremely new to cryptography, still trying to learn basics. I got stuck in the following example of an eavesdropping experiment with a private key. $$\begin{array} {|r|r r r|r|} \hline C & ... 0answers 81 views ### Worst case one way function the worst-case one way function is defined as follows$$\forall A \exists x : pr(A(f(x))\in f^{-1}(f(x)))\neq 1$$can you give any example of such function? 2answers 509 views ### What's the GCM-SHA 256 of a TLS protocol? If we read the Google line information about how the cypher the https communication, it reads: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 I understand it's using ... 0answers 174 views ### Construct rainbow table to break DES I'm facing a project where I need to build a rainbow table to break DES. I've already collected information about Hellman, DP, rainbow table method. Finally, I chose the rainbow table approach. I've ... 2answers 211 views ### Addition step in MD5 implementation In MD5, there are four rounds. After every round, why do we need to add the computed Q values to the initial values and then take this value as input to the next round. For example after the first ... 1answer 601 views ### What is Polymorphic encryption? [closed] Well i have downloaded some cryptographic algorithm. Do there are those I didn't understand so this is my question: What is polymorphic RC4 or Polymorphic xor encryption? I heard this in malware ... 1answer 139 views ### Double-and-add/Montgomery VS blinding I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC? 0answers 123 views ### DPA Attack on HMAC SHA-256 I have read the paper Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written: The last ... 2answers 189 views ### power consumption in a XOR I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards. What's the difference in energy radiated in a 1 \oplus 1 and in a 0 \oplus 1? ... 1answer 137 views ### Spritz cipher sponge function capacity Rivest and Shuldt proposed a new sponge like cipher algorithm called Spritz: http://people.csail.mit.edu/rivest/pubs/RS14.pdf In this paper they say that the strength of the cipher is related to the ... 0answers 421 views ### Variant of the Decisional Bilinear Diffie Hellman problem I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem: Let e: \mathbb G_1 ... 1answer 103 views ### Hash “Preimage by product” resistance Let H() be a hash function that achieves collision resistance as well as first and second preimage resistance. Let's equip the output set of H of a multiplicative group structure, more precisely a ... 2answers 312 views ### Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight? A modern trend in cryptography consists of defining security as rigorously as possible, and then designing schemes which are secure according to those definitions. Proving security comes in the form ... 1answer 78 views ### Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit? [duplicate] In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter ... 1answer 110 views ### Is there any serious discussion about using blinding intermediaries in digital currency scenarios? A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ... 1answer 1k views ### What is “Blinding” used for in cryptography? What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation? 0answers 112 views ### RSA Key Blinding I was looking the answer to the following question (Timing attack on modular exponentiation), discussing the Private Key Blinding as a countermeasure for timing attacks. Therefore I'm asking if ... 1answer 128 views ### Inversion Free Direct Conversion between Twisted Edwards (X,Y,Z) and Montgomery (X,Z) The Wikipedia page for Montgomery curves shows how to convert points on a twisted Edwards curve to and from points on an equivalent Montgomery curve. However, their description and the original ... 0answers 103 views ### Montgomery Multiplication in FPGA explanation I'm trying to implement an RSA module in a FPGA. I choose to use Montgomery multiplication. I've found a document where the Montgomery Multiplication is pretty clear. I don't understand only a step. ... 0answers 124 views ### RSA timing attack Given an RSA implementation that uses Montgomery multiplications and CIOS exp algo, but NOT CRT. Given a decryption1 oracle that takes chosen cipher text and responds the plain text and the time it ... 1answer 181 views ### Montgomery Algorithm I'm trying to undestand how it works and how to implement the algo described in this paper. The paper shows a methods to compute a modular multiplication where it is used multiplier with a resolution ... 0answers 65 views ### Implementing modular reductions (n*n) [closed] I'm implementing a public key cryptosystem in a proprietary System On Chip that only allows modular reductions by n. However, that cryptosystem requires (n^2) modular reductions. Perhaps someone ... 1answer 522 views ### Efficient setup for a Montgomery multiplication Montgomery described an efficient method to compute a modular multiplication. This works by using a special constant R and assumes the inputs a and b have been made into a special representation ... 1answer 535 views ### Blockwise Montgomery multiplication I have to implement a 256*256 bit Montgomery multiplier for pairing computations. The straightforward approach is to use a bit-serial version, but I would like to utilize the built-in 64*64 bits ... 1answer 520 views ### Montgomery Exponentiation - selecting input value R for a given BigInteger I have Montgomery exponentiation working, but it's working quite slow. I suspect there are two reasons for this - I implemented it bit size instead of word size (I didn't realize at the time that ... 0answers 84 views ### Where is the OID and ASN.1 specified for AES_CMAC? I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under ... 1answer 395 views ### extract ciphertext from encrypted SMIME file the main question of this message is how to get the true ciphertext from S/MIME file? I created RSA keys and encrypted a message with S/MIME as follow : ... 1answer 306 views ### PKCS#7 signed data structure in signed PDF document Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ... 1answer 94 views ### Are keys generated by the user or block cipher algorithms themselves? [closed] We know block cipher algorithms. In the block cipher algorithms, Key Scheduling is the one crucial part. I see that in some simulation programs of the AES,DES,TripleDES encryption algorithms. In ... 1answer 332 views ### How are subkeys, in Feistel block ciphers, derived for each round? I'm bit confused about the subkeys that are used in Feistel ciphers. I know that all the subkeys ki are derived from the main key K, but how? Say I have a simplified Feistel block cipher of i rounds, ... 2answers 219 views ### Is CBC theoretically harder to brute force when compared with ECB? Theoretically – is CBC mode harder to bruteforce when compared with ECB when assuming: we ignore computational cost for the XOR operations, and the IV is made public? 3answers 283 views ### Known plaintext, unknown 128 bit block cipher I have an encrypted configuration file from an embedded device which I'm trying to decrypt. The file seems to be encrypted in 128bit blocks, as changing a single option causes a 16 byte block to ... 1answer 419 views ### Difference RSA keypair creation openSSL and openPGP? Creating a 2048bits RSA keypair I figured that doing this using openssl takes as an input 32bytes of "randomness" from ... 2answers 1k views ### Strength of CBC with Ciphertext Stealing Is CBC with Ciphertext Stealing (CTS) considerably weaker than CBC with padding such as PKCS7? I would imagine the most common situation where CTS is necessary would be due to some size constraint of ... 1answer 281 views ### How to pad messages with large amount of padding I'm playing around with an application for secure email-like communication and I want to perform length hiding padding on the plaintext messages so they always have a consistent size before encrypting ... 1answer 142 views ### Padding always the same, problem or not? I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm. My problem is that I split the message into ... 1answer 197 views ### Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers As said in the heading, I want to know how the security of different padding methods, e.g. ANSI X.923, ISO 10126 and PKCS7, is compared to other methods to reach the needed block size, like ciphertext ... 1answer 408 views ### What prevents a padding standard to cause a data loss? In here different byte padding standards are listed as ANSI X.923, ISO 101.26, PKCS7, ISO/IEC 7816-4 and zero padding. All of them seems to apply padding to the last byte blocks. Odds are rare but ... 1answer 3k views ### Padding methods for block ciphers - PKCS7 vs ANSI X.923 I was looking through block cipher padding methods, and found two good candidates: ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ... 1answer 141 views ### 2DES vs. two-key triple encryption, with no decryption step So studying double encryption (double DES) and understanding why it is subject to a Meet-in-the-middle attack, I tried to see if the same attack could be applied to a triple encryption with only two ... 1answer 1k views ### Okay to use OpenSSL to encrypt then sign a message? I am planning on encrypting a message then signing the message so the recipient can authenticate the source. Reading this article has me concerned that I'm doing something wrong. My current plan is ... 1answer 513 views ### Blind signature with openssl I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ... 2answers 139 views ### Turning a 64 bit block cipher into a 128 bit block cipher There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical. ... 1answer 201 views ### Simplified Example of ECC to use in the classroom I have come up with the following rudimentary example of how ECC relates to asymmetric keys. Is this a valid explanation of ECC and its relationship to asymmetry? To only be deciphered by the person ... 1answer 685 views ### Finding discrete logarithm with baby-step-giant-step algorithm I am trying to use the Baby Step Giant Step algorithm to find discrete logarithm in:$$a^x= B \pmod p$$with using BSGS:$$x = im+ja^j = B a^{-im} where $m = \sqrt{p}$ Wikipedia says: ...
I have an exam and i have no time to solve this problem(I think about it a lot but i do not solve it).please help me and solve it for me: $A$ is a random number and has $512$ bits.We make $B$ ...