# All Questions

237 views

### Partially-known-plaintext attack of a stream cipher based on modular arithmetic

I have a function called $F$, using modular arithmetic as does RSA, defined as $$x\mapsto F(x) = g^x\bmod p$$ where $p$ is a 1024-bit prime and $g$ is a generator of $\mathbb Z_p^*$. A secret key $r$ ...
530 views

### Who first published the interest of more than two prime factors in RSA?

Multi-prime RSA is now a well known technique: it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed boost in ...
370 views

### Block Ciphers and (Non-)Generic Attacks

I am currently reading through Cryptography Engineering and came across this definition of block cipher security: Definition 2 An attack on a block cipher is a non-generic method of ...
327 views

### IV/Nonce in CTR&GCM mode of operation

We know reusing IV can compromise our secrecy. I have some questions aiming to clarify the use of an IV/Nonce in CTR/GCM: Is it OK to use the same key for encrypting plain-texts in authenticated ...
47 views

### Private Set Intersection Polynomial Computation [duplicate]

I am trying to implement the protocol mentioned in Section 3.4 of “Efficient Robust Private Set Intersection” in Java. In the Second Step, the Client computes a polynomial of degree $n$ over the ...
198 views

### Proving that a function is not a OWF (One-way-function)

I was trying to prove that a given function is not a one way function and I was not sure how to do it because maybe I had unclear what a one way function was (OWF). The definition that I have for a ...
335 views

### Simplified Fiat-Shamir example generates wrong output

I am trying to implement the Fiat-Shamir identification protocol, however the end results always fail to match. I am using algorithm's description from here. Preparation: Select 2 prime integers ...
106 views

### Is there a method to combine encryption and ring signing?

There's the well-known question on whether to sign or encrypt first. However, if instead a message is to be ring-signed such that either recipient could be the actual signer, is there any scheme that ...
97 views

### Does a cofactor of an elliptic curve have to be an integer?

What are the implications of a curve having a non-integer co-factor for its generator point? Is that even possible?
807 views

### My SSH server public key is 2048 bits, but my account's private key is 4096. What is my effective security?

My SSH server has a 2048-bit public key. But my private key, for clients to login, is 4096-bit. In this case, do I have the brute force protection of 2048 or 4096 bits? My worry is that someone ...
470 views

### GCM encryption for 256-bit and 512-bit block ciphers

The Galois/Counter Mode of Operation (GCM) This paper describe using GCM mode with 128-bit and 64-bit block cipher. Can we use this mode for 256-bit and 512-bit block cipher?
220 views

### Do deterministic secret sharing schemes exist?

Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations. If there aren't, is such an algorithm ...
414 views

### Hash functions with or without secret key

The classical definition of hash functions (found in books) are OK, but when studying a little more there is a lot of notions that seem ambiguous (contradictory) to me : Sometimes we have hash ...
412 views

### Making my steganography code more hard to detect and crack

I'm doing a college project about digital image steganography on MATLAB. So far i've been able to get the help i needed from cool guys on stackoverflow but i now need to make my algorithm more hard to ...
161 views

### Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
3k views

### Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...
154 views

### ML/NN Cryptanalysis

Is it computationally plausible to use NN/ML to do any of the following tasks? "Real" cryptanalysis. Cyclic neural networks for extended computation, but break the hash all the way through. ...
108 views

### How unsafe is to share parts of a password

The best way to ask this question and have a concrete answer is to set a very specific example. This is the example I would be interested in reading an answer to: Consider that my friend Alice has ...
509 views

### Encrypting firmware with AES and no IV [closed]

I have an embedded device with a AES CBC engine on it that is used to ensure the integrity of the firmware. I know that CBC mode requires unique IVs to be any good, but I'm unsure if it makes a large ...
410 views

### Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
51 views

### gnupg: display digest of key [closed]

How can I display what digest algorithm has a key? If I import a public key which has MD5 as digest, I get a warning about this weak algorith. But how can I check, what digest algorithms all my keys ...
2k views

### Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?

In the public certificate, an RSA public key specified as 2048 bits long is represented by 540 hexadecimal characters. Converted to base-2, this yields 2160 bits, 112 more than the stated 2048.
2k views

### Can someone explain the ECB Penguin?

I've seen the ECB Penguin used to demonstrate why ECB is not a recommended method of encryption, but I do not understand how this translates to text or passwords. Aren't the people who create these ...
192 views

### Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent. Can ed25519 be cracked after a certain amount of ...
463 views

### Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
108 views

### Modular protocol design

What does modular protocol design mean? Why does TLS not have modular protocol design? What protocols have modular design? (IPSec, SSH)
280 views

### RFC 3526 - What does pi mean?

In RFC 3526 there are a series of primes listed as standard parameters used for Diffie-Helman. The primes are list in two formats. One is the long format, where the number is given in hex. For ...
264 views

Ok - i will try to ask my question as clear as possible. Im getting a little deeper into the RSA-cryptosystem. At one point i'm a little confused. We have a plaintext $x$ and ciphertext $y$, with $x ... 1answer 290 views ### Prime factorization of RSA modulus Consider RSA public-key encryption with public modulus$N=3953$. Suppose we know that the public keys$e_1=337$and$e_2=23$correspond with the decryption information$d_1=3385$and$d_2=2663$. ... 1answer 109 views ### OTP sequence uniqueness Is it possible to use Time-based One Time Password (TOTP) algorithms to generate tokens from multiple channels (where a channel is defined as a "user" using a certain shared key$K_c$for channel ... 0answers 142 views ### Safe and computationally efficient way to verify a curve25519 identity? A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which ... 1answer 328 views ### crypto design with AES256 MODE OFB I have the following APP Design key store (contains 1:n user payload as 1:n key store entries) key store salt (is used to extend to key store password to 256 bits, stored in clear text) key store ... 1answer 1k views ### Certificate signature with SHA-1 and RSA: where do 1888 bits come from? Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ... 1answer 145 views ### Pseudo random permutation for arbitrary size domains Popular block ciphers like AES or Twofish are keyed pseudo random permutations on the domain$\{0,1,\dots,2^{k}-1\}$with$k\in\{128,192,256\}$or similar. I'm interested in pseudo random ... 1answer 164 views ### simple multiplication in GF(8) I am trying to do multiplication in the GF($2^3$) defined by the irreducible minimum binary polynomial$X^3+X^2+1$. I want to multiply$A(x) * B(x)$where$A(x) = x$and$B(x) = x^2$. The ... 1answer 112 views ### If its possible to derive the public key from a private key, why can't we go in reverse? I'm looking at source code for BitcoinJ that derives a public key from the private key. ... 3answers 312 views ### How can we sign a contract digitally between two parties? I'm trying to sign a contract with another party, without using handwritten signatures. I've just read through Applied Cryptography, but there doesn't seem to be a protocol that can solve this ... 1answer 364 views ### Proofs by reduction and times of adversaries I have some difficulties to understand, when we construct a reduction, how we determine the time for the constructed adversary to break a target security property. In general these details are not ... 1answer 180 views ### ElGamal with elliptic curves I It is very interesting to see @tylo's answer on ElGamal with elliptic curves. Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its$x$coodrinate. ... 3answers 224 views ### Why can't hashes be reversed with toffoli gates? This is a follow up question to this question: Crack cryptographic hash functions using Toffoli gates?. Suppose there is a hash function $$H(x)=y,$$ where$x$is the input of the function and$y$is ... 2answers 216 views ### Current standard for hash function security parameter? When designing a hash function, what should be the secure input and output lengths? In particular, what lengths do I need for collision resistance? 1answer 219 views ### Is this approach to generating a “random” number from a sha512 hash effective? I'm looking to run a small raffle but i'd like people to be able to verify that the number chosen was fair. I know some sites use a "Provably Fair" system to achieve this where user input is combined ... 2answers 95 views ### Should tweak be unique per message? Since tweaks are like IV,Salt for block cipher inputs . Should they be unique for each message ? If they are to be unique per message then what is the advantage of giving tweak directly into the ... 2answers 486 views ### Signature based on public key cryptography and forgery In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ... 2answers 371 views ### If attacker knows salt and hash, how is salt effective? Maybe I'm missing something, but if my salt and hashed/salted password are stored in the same place, how is salting any more secure than just hashing? Does this just rely on attackers not knowing how ... 4answers 159 views ### Is there a standard way to extend the output of a hash? Say I have a hash function, a state-of-the-art hash function that we would all approve of that produces a fixed number of bits (n) as output. (I'll call it HASH.) Is there are a standard way to ... 0answers 148 views ### Hash function that is efficient on GPU and poorly suited to ASIC I have such requirements to the hash function in my project: operating on 32-bit data, not mathematically breakable (built on existing hashes known to be secure), free of branching, as much as ... 0answers 59 views ### What does the notation$1^n\$ stand for? [duplicate]

I'm seeing this all over my Katz and Lindell book and I don't see where they introduced it.