# All Questions

1answer
65 views

### Diffie-Hellman on infinite groups

The most common groups to be used as examples for the DH protocol are modular multiplication and elliptic curves. But I've realised that the groups doesn't need to be finite, a suitable infinite group ...
2answers
916 views

### Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Assume it is made a hash based on AES-256 encryption (perhaps because this is hardware-accelerated, but no standard hash is); and it is used the Merkle–Damgård structure, that is padding of the ...
3answers
2k views

### What is the use of REAL random number generators in cryptography?

I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators. However, I don't understand for what a real random number ...
4answers
1k views

### About Cryptography in a Character Language

Suppose I had a message in Chinese (or another non-phonetic language) and I wanted to encipher it. Some of the simplest encryptions in English are substitution ciphers, but such ciphers don't seem ...
1answer
789 views

### Does unbalancing a feistel cipher always improve security? Does it improve security at all?

So according to Wikipedia unbalanced feistel ciphers provide greater provable security. Specifically, they state: The Thorp shuffle is an extreme case of an unbalanced Feistel cipher in which one ...
3answers
2k views

### Is 80 bits of key size considered safe against brute force attacks?

I came across KATAN Family of Ciphers for small domain input blocks . They cipher arbitrary block lengths 32,48,64 but their key size 80 bits only. Is 80 bits of key size considered safe with ...
2answers
610 views

### Do I have to have a different salt for each password?

Should I use a different salt for each password? In my system, there are no user names, only passwords. When a user logins in, he types in one or more passwords and the server compares the results ...
3answers
586 views

### How broken is a xor of two LCGs?

Suppose we define a PRG as the xor of two LCGs modulo a 64-bit prime: something like the following Python code. ...
1answer
4k views

### Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is ...
4answers
359 views

### Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
2answers
299 views

### Definition of “pepper” in hash functions

I am confused about the notion of "pepper" in the context of storing hashes of users' passwords. Definition 1: A pepper is a secret key Looking around the Internet, for example here or here, a ...
1answer
1k views

### How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
2answers
4k views

### Why is asymmetric cryptography bad for huge data?

I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length. Why is this? I know about hybrid encryption, which uses symmetric encryption to ...
3answers
1k views

### Is it possible to distinguish a securely-encrypted ciphertext from random noise?

Say I have a bunch of data encrypted with a secure block cipher (such as AES). An attacker has unlimited access to this encrypted data. The attacker doesn't know whether the data is encrypted or if ...
1answer
2k views

### ElGamal Signature Scheme: Recovering the key when reusing randomness

Show how if Alice uses the same value of $k$ to sign two different messages $m_1$ and $m_2$, using the ElGamal signature scheme, Eve can recover the value of $a$ from the corresponding signatures ...
3answers
599 views

### Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?

A recent paper showed that the McEliece cryptosystem is not, unlike RSA and other cryptosystems, weakened as drastically by quantum computing because strong Fourier sampling cannot solve the hidden ...
1answer
190 views

### Can Skein be used as a secure MAC in format H(k || m)?

Can Skein be used as a secure MAC in format H(k || m)? I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this ...
2answers
292 views

### Why Victor must not know which tunnel Peggy chooses?

In the classic description of Zero Knowledge Proof of Knowledge, Victor must wait outside the entrance to the cave while Peggy goes to the fork and choose a side. It's only once Peggy has entered a ...
7answers
943 views

### Turning a cipher into a hashing function

This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;) The first hashing functions created ...
3answers
1k views

### Why does the recommended key size between symmetric and asymmetric encryption differ greatly?

In various articles it is mentioned that for secure communications, the recommended key sizes are 128-bit key size for symmetric encryption (which makes it $2^{128}$ possible keys?) and 2048-bit key ...
1answer
1k views

### Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme

Shamir's original paper (PDF, 197kb) describing a threshold secret sharing scheme states: To make this claim more precise, we use modular arithmetic instead of real arithmetic. The set of ...
3answers
2k views

### How to attack a classical cipher using known partial plaintext?

I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext. What are the cryptanalysis approaches for ...
3answers
1k views

### Modern integer factorization software [closed]

What are the modern software packages that can be used to factoring large numbers into primes. By modern I mean developed and made public within the last 5 years. I'm interested in things that are ...
1answer
271 views

### Block cipher and parity of permutation

Can anyone explain the following text passage to me? Most real-world block ciphers build even permutations, because it's hard to build odd ones using small operations (32 bit) on larger (128 ...
2answers
1k views

### Using the same RSA keypair to sign and encrypt

The RSA signature operation is basically the same as encrypting with the private key. In particular, both operations use the same kind of keys. Is it safe to use the same RSA keypair both for ...
1answer
458 views

### Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ...
2answers
271 views

### Why have hashes when you have MACs?

It would seem to a naive eye that if you have a MAC, you have a hash function: use a key that all the parties know (such as all-bits-zero). A potential application would be a resource-constrained ...
1answer
2k views

### Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$). That explains why we are using 256 bit ...
2answers
2k views

It is known that the two prime factors $p$ and $q$ of an RSA modulus $n$ should not be too close to each other, otherwise an attacker may factor the modulus. In other words, $\Delta = \left| p - q ... 3answers 1k views ### Understanding CRC There are zillions of articles describing CRC. What can I read to (more deeply) understand what's really going on? Both from an algebraic perspective and a bit-manipulation perspective, I'd like to ... 2answers 207 views ### Is it safe to reuse ECDH asymmetric keys for authentication? Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ... 1answer 821 views ### Diffie-Hellman Parameter Check (when g = 2, must p mod 24 == 11?) I'm adding some Diffie-Hellman groups to a program as specified in RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE). When I test some of the group ... 1answer 3k views ### How long does it take a quantum computer to brute force AES? I understand that using Grover's algorithm it only requires$2^{64}$lookups for a 128 bit AES encryption, leading people to say we need to increase to 256 bit keys. But how long would it actually ... 2answers 1k views ### What is the security loss from reducing Rijndael to 128 bits block size from 256 bits? As you know in the past few weeks it has emerged that NIST/NSA have been involved in weakening encryption standards over a long period of time so that they can retain the ability to break encryption ... 1answer 473 views ### How random is the shared secret in the Diffie Hellman key agreement How random is the value$ZZ$in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously$ZZ$is distinguishable from a ... 2answers 474 views ### What is the key strength reduction encrypting only 160 bits of data using RSA1024 for signatures? I am attempting to determine the strength of an incorrectly implemented 1024 bit RSA signature scheme. The weakness in the implementation is that the padding data lacks random numbers. As a result, ... 1answer 1k views ### How does GPG verify succesful decryption? How does GPG (or other programs using the OpenPGP file format) verify that it has succeeded with decryption (for symmetrically encrypted data)? Is something appended to the clear text so there exist ... 1answer 870 views ### Linear Cryptanalysis What is the principle of linear cryptanalysis, as applied to a block cipher ? For instance, this page gives the rough outline of differential cryptanalysis. 1answer 1k views ### How can I encrypt + authenticate short strings into similar short ciphertexts? I wish to manipulate short ASCII strings (namely unpredictable domain names) into a form which cryptographically assures authenticity and confidentiality, for use in the local part of email addresses. ... 2answers 428 views ### State of the art RSA key generation I would like to know if there is an algorithm to generate a RSA key at the state of the art of the present cryptanalysis. Beside the key lenght I know there are some weakness in the choice of prime ... 2answers 206 views ### Secure degree reduction for Shamir's secret sharing I understand the basic Shamir Secret Sharing protocol, and when two shares are multiplied, the degree of the polynomial increases. I've seen in a number of papers a reference to a degree reduction ... 0answers 251 views ### LT codes with Homomorphic hashing I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and ... 2answers 1k views ### RSA blind signatures in practice Hi I have a problem with moving my blind signature implementation from educational (textbook RSA) to more practical (padded RSA) side. David Chaums paper gives a following figure:$r$- blinding ... 1answer 3k views ### Common modulus attack on RSA when the 2 public exponents differ by a single bit This is an exam question an i have no idea how to recover the message m. John wants to send an encrypted message to mary who has a pair of RSA keys, However, John does not know Mary's public key and ... 1answer 557 views ### Is quantum key distribution safe against MITM attacks too? i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution ... 3answers 1k views ### What is the PRG period of stream ciphers such as RC4 or Salsa20? I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ... 1answer 788 views ### How does a “Tiger Tree Hash” handle data whose size isn't a power of two? Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two. ... 3answers 2k views ### What is the importance of Modular arithmetic in cryptography? Why do we use modular arithmetic so often in Cryptography? 1answer 296 views ### Can a homomorphic encryption scheme be made CCA2 Secure? Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ... 4answers 433 views ### Where does the$\varphi(n)$part of RSA come from?$e d \equiv 1 \pmod{\varphi(n)}$Where does the$\varphi(n)$part come from? How did the inventors of RSA arrive at$\varphi(n)\$?

15 30 50 per page