# All Questions

3answers
2k views

### What are some disadvantages of homomorphic encryption schemes?

I'm doing some self-teaching / research for my own benefit in homomorphic cryptography. I've studied both additive and multiplicative schemes (Pallier and RSA respectively), but all I can seem to ...
1answer
140 views

### Signature with appendix

I see sometimes signatures schemes with appendix. This is about signatures schemes in which the message is needed in the verification algorithm, that is, the ouput of the signature algorithm is of the ...
1answer
200 views

### How did they factor RSA-704?

I don't understand the 'Wiedemann algorithm' works. Can someone explain the factoring of RSA-704 in an easy way?
1answer
502 views

### Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
2answers
557 views

### If we can find prime numbers larger than 17 milion digits, why can't we find all 1024bit primes? [duplicate]

"Largest Known Prime Number Discovered; Has 17,425,170 Digits" http://www.sciencedaily.com/releases/2013/02/130213225424.htm If we can find prime numbers larger than 17 milion digits, why can't we ...
1answer
115 views

### How to build a secure AE scheme with generic composition?

I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed ...
2answers
341 views

### How practical is proxy re-encryption for AES?

In proxy re-encryption schemes, a proxy is given special information that allows it to translate a ciphertext under one key into a ciphertext of the same message under a different key. How ...
1answer
221 views

### Using AES-CBC and providing the IV in file header -> security hole? [duplicate]

currently I audit some code I've written in the past to use KeePass 1.x databases. I stumbled over the following question: The database itself is decrypted with AES-CBC and inside the file header the ...
0answers
162 views

### How is key rotation defined?

I'm aware that it's advisable to rotate cryptographic keys periodically. HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length. It also accepts a salt, ...
1answer
70 views

### How does the possible attack on passwords and salts mentioned in PKCS#5 v2.1 work?

From PKCS#5 v2.1, 4.1 Salt (page 6, emphasis by me), also in v2.0, RFC 2898: In password-based encryption, the party encrypting a message can gain assurance that these benefits are realized ...
1answer
207 views

### How to pad messages with large amount of padding

I'm playing around with an application for secure email-like communication and I want to perform length hiding padding on the plaintext messages so they always have a consistent size before encrypting ...
1answer
426 views

### Help with example RSA problem

While learning about RSA, I found this example problem. The answer is supposed to be "a 4-digit number that is a pattern of digits." I have computed it to be 16657 twice. OK, now to see if you ...
2answers
274 views

### How to calculate leaked information from a check digit

Given a check digit calculated using mod 11, of an encrypted numeric sequence of 8 digits, how much information can be known about the plaintext? More specifically, a single 3DES encrypted CBC block ...
1answer
1k views

Currently busying myself with the Bitcoin "mining" algorithm, I am wondering if the process really cannot be simplified. For reference, the algorithm is basically SHA-256d: $success := SHA256( ... 1answer 438 views ### Verify Signature Failed [closed] I am writing a small module which will verify signed message. Message will be signed using private key in Smart Card. The inputs are: Signed Message Original Message Public Key / Certificate with ... 2answers 746 views ### Is the 64-bit blocksize a fatal issue when encrypting TBs of data with Blowfish CBC? Crashplan uses 448-bit Blowfish to encrypt the data you send them. The mode used is CBC, keys are multiple use, and IVs are generated with SecureRandom from JCE. Keys are not derived from the ... 2answers 156 views ### Is this exponentation or bitwise XOR I'm reading about SRP from this page and came accross the line that says a party computes v = g^x I am unfamiliar with reading cryptography texts. Does this mean gx, or g ⊕ x? 1answer 1k views ### What is U2FsdGVkX1? Using CryptoJS 3.1 I noticed that using 3Des, the encrypted message always start with U2FsdGVkX1 Why is the first part of the encryption always the same? What information does this hold and ... 2answers 297 views ### Is using EAX mode with a 64-bit block cipher a bad idea? EAX mode produces an authentication tag no longer than the length of the underlying cipher's blocksize. So in the case of using Blowfish (a 64-bit block cipher) in EAX mode, the resulting tag would ... 2answers 2k views ### Difference between “one-way function” and “cryptographic hash function” What's the difference between a one-way function and a cryptographic hash function? 2answers 808 views ### Is a small size block cipher usable? Consider a block cipher with a key of size 128 bits but a small block size, say 32 bits. Is this kind of block cipher secure? I would like to know to what extent I can use a small block cipher, like ... 2answers 444 views ### Is rainbow table attack applicable to any hash? Typically when rainbow tables are discussed MD5 hash is used as an example. It's not quite clear whether this attack is specific just to MD5 or to a certain subset of hashes or to just any hash ... 2answers 1k views ### Is there a hash function which has no collisions? Is there a hash function which has no collisions? To clarify: it would be some function which would produce variable-length output, and never produce the same output for differing input. It would ... 1answer 553 views ### Can two cipher letters per plaintext letter easily defeat character frequency analysis? For a class 5 years ago I wrote a paper about "defeating character frequency analysis by using two cipher letters per plaintext letter" ... 1answer 299 views ### Clipper chip (SKIPJACK) key exchange protocol According to the Wikipedia page for NSA (emphasis mine): However, NSA's Fortezza hardware-based encryption cards, created for the Clipper project, are still used within government, and NSA ... 1answer 217 views ### How hard is it to generate a partial RSA fingerprint collision? When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ... 1answer 131 views ### low-exponent RSA I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages$m_1$and$m_2$related by a known relation$m_2=m_1+1$. Suppose further the messages are ... 0answers 143 views ### Hash function with values in a multiplicative group of prime order [closed] I have to implement a cryptographic protocol which involves a cryptographic hash function$H: \{0,1\}^* \to G$. It is viewed as random oracle.$G$is a multiplicative group of prime order. I want to ... 1answer 406 views ### Has GMAC mode a future outside GCM? Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ... 1answer 510 views ### How to build an electro-mechanical public key cipher machine? It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT. Imagine, if the abstract idea of having a public key and a ... 1answer 2k views ### How do I decrypt ciphertext with this cipher? I have an encryption function $$E(p) = (ap + b) \mod{26}$$ where the parameters are$a=7$,$b = 10$, and$p$is the plaintext letter. I was asked to decrypt the ciphertext ... 1answer 647 views ### Security of authenticated encryption modes gcm & ccm I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ... 4answers 349 views ### Can cryptography be used to hide routing information from the router? If Alice wants to talk to Bob and she has to involve a third party system run by Carol to establish, and possibly maintain, communications, then Carol knows that Alice and Bob communicated with each ... 3answers 4k views ### OpenSSL AES 256-bit Key Management I am using C and OpenSSL to encrypt files. After experimenting with the OpenSSL command line utility, it makes you enter a passphrase that can be any length, but uses that to create a 256-bit key. ... 2answers 284 views ### How do zero knowledge protocol with vertex-3-coloring work? I'm currently not sure if I understood how the zero knowledge protocol with vertex-3-coloring works. I'll describe what I think I've understood and I'll write my questions in bold. ... 1answer 443 views ### Why is H(message||secret_key) not vulnerable to length-extension attack? Given a Merkle-Damgård hash function$H$, I know that an attacker can forge a message protected by a MAC computed as$H(\textrm{secret_key}||\textrm{message})$. Why can't he perform the same ... 2answers 274 views ### Recommended authenticated stream cipher for minimum overhead? I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ... 2answers 256 views ### Encrypting and MACing different data with same key It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ... 2answers 215 views ### Is it possible to cryptographically prove when was the last time a ciphertext was decrypted/encrypted? I want to provide a service that encrypts and decrypts documents and I want to provide the users with proof that I haven't stolen their secret key and read their documents. I know I can prove when a ... 1answer 235 views ### How does Poly1305 in the NaCl library calculate a MAC? I've been reading about Poly1305 as implemented in the NaCl library, more specifically I've been referring to this Java implementation of NaCl. My understanding of XSalsa20Poly1305 (in this ... 1answer 220 views ### Can Poly1305 be used with block ciphers running in CTR mode? Is the use of Poly1305 limited to stream ciphers? (note, I'm not talking about Poly1305-AES )? Can it be used with block ciphers running in CTR mode? If so, what other considerations/limitations are ... 0answers 70 views ### Why is it impractical to generate a semiprime dictionary? [duplicate] This might be a very simple question. However, I am just learning the concept, so just excuse me. I am wondering why there is not any attempt to generate all semiprime numbers? (as an dict. attack to ... 1answer 360 views ### Given a private RSA key, how do we get the public key? Is it possible to pre-choose a private RSA key, then obtain a public key from it? 1answer 88 views ### How to choose the appropriate public (i, m) and private (j, m) keys? I studied some encryption and decryption and I have found some very interesting problem to solve on the internet. I hope I am writing to right site - there are so many in StackExchange otherwise I ... 9answers 1k views ### Algorithm: How to use x and y mouse movement co-ordinates to generate random data? Background: I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for ... 1answer 177 views ### Preimage resistance hash in digital signature I'm studying about preimage resistance property of the hash functions. In particularly I'm reading as the missing of this property can be fatal in digital signatures that use RSA. Further details: ... 1answer 3k views ### Security strength of RSA in relation with the modulus size NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size$n$and expected security strength$s$in bits: ... 1answer 281 views ### Can any one explain Circuit Privacy using fully homomorphic encryption from Gentry's thesis? Craig Gentry's thesis talks about circuit privacy being straight forward from fully homomorphic encryption in the last chapter. Can somebody explain in simpler terms what that means ? I have read it ... 3answers 328 views ### What are some good references for the implementation weaknesses in RSA I'm pretty sure I understand textbook RSA. Choose p and q, large primes, and compute n=pq. Choose e such that$gcd(\phi(n),e)=1.$Publish n and e. Compute d such that$de=1$(mod$\phi(n)$). To ... 2answers 113 views ### Differential privacy definition Differential privacy defines "privacy" of a mechanism$A$as the "closeness" of the two distribution$Pr[A(D) \in S]$and$Pr[A(D') \in S]$where$D,D'\$ differ in one element. And the distance between ...

15 30 50 per page