# All Questions

411 views

### Expectation Value of the Index of Coincidence

Can Anybody tell me why the expectation value of the Index of Coincidence is the following? For a cipher text string of length $L$, where $n$ is the number of alphabet characters, $k_r = 1/n$, and ...
1k views

### Use of nonces in Kerberos and Needham–Schroeder protocols

Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport. In particular : Can you explain me the use of $N_A$? And ...
79 views

### Incorporating known ciphertext into new message

Which ciphers $c_k$ enable one to define a joining function $f_{c,k}$ such that: $$f_{c,k}(c_k(p_1), p_2) = c_k(p_1 + p_2)$$ That is, the result of joining some known ciphertext $c_k(p_1)$ with a ...
414 views

### How to represent a 32-byte SHA2 hash in the shortest possible string?

I'm calculating a SHA2 hash of a certain sensitive key value. I need to store files on disk using this hash a directory path prefix. So lets say I hash the key value 150023, I get a 32-byte value ...
465 views

### Recovering the key in an ElGamal Signature Scheme variant

From page 318 in Stinson's "Cryptography: Theory and Practice", question 7.3: Suppose that Alice is using ElGamal Signature Scheme. In order to save time in generating >the random numbers k that ...
118 views

### Tips on conceiving safe software messaging platform

I have a personal project in mind in which I plan to use cryptography in order to let the users be confident in the fact that, even if all data get's stolen, it would be virtually impossible to crack ...
387 views

### Brute forcing Cardan grille

Having a "rotating" square Cardan Grill with sides long n cells, how could i determinate the cost of a brute-force attack? How many configurations should be considered to perform an exhaustive ...
243 views

### Twofish key length

I'm using twofish. Say you have a 120 bit key, is there any difference in using a 128 bit bit keylength or a 256 bit one? Since the most significant digits of the key will be allo zero in both cases, ...
478 views

### Is this fixed length MAC unforgeable?

Consider the following fixed length MAC for messages of length $\ell(n)=2n-2$ using a pseudorandom function $F$: On input of a mesage $m_0||m_1$ ($|m_0| = |m_1| = n-1$) and a key $k \in \{0,1\}^n$, ...
134 views

### How is the password sent across for verification?

I am familiar with Challenge-Response Authentication scheme. However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel. ...
606 views

### iSeries (AS/400) Database File: password encryption

I am helping with a project in which an old software system on an iSeries is having a brand new .NET UI applied to it. It's going well... except... In order to allow users to login and maintain ...
56 views

### Encrypting twice with same key gives back plain text

I read in the answer here that when encrypting twice the plain text with same key could result in plain text as shown below $encrypt_{key}((encrypt_{key}(plain)) = plain$ Which block-cipher ...
56 views

### How can a good pseudo-random number genarator be made?

I am trying to make a pseudo-random number genarator so that I can use it in a synchronous stream cipher for encrypting plain text. I want it to genarate numbers which are as random as possible. Can ...
30 views

### A simple attack on DESX in time $2^{120}$

Let $\mathcal{M}$ be our message space and $\mathcal{K}$ our key space. Now, let $\mathrm{E} : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$ be a block cipher. Define the block cipher ...
60 views

### Are there any many to one encryption frameworks available?

I am reasonably new to the cryptography. For my use-case I need a method where in I would need a receiver to accept encrypted messages from a range of senders (each having their own, say, public key). ...
43 views

### Monoalphabetic cipher key

I'm new to cryptography and have just completed homework on Monoalphabetic cipher. I managed to decrypt the cipher text successfully but I cannot identify the key from my plaintext to ciphertext ...
47 views

### Where is defined the fact of having a “learning” and “challenge” phase in cryptography proofs?

I've read Bellare and Rogaway 2004 and Shoup 2004 about game-based cryptography proofs, but I lack precisions about how should be built the "learning" and "challenge" phases, since my games will ...
59 views

### Can Diffie-Hellman be scaled up or force-multiplied?

I'm not too familiar with the math involved with the exchange of keys, I've read it over several times, but math isn't my strong point. My understanding is that smart people are hard at work to ...
44 views

### SpongeWrap without padding and frame bit

Assuming all inputs are same length as rate except last can be shorter. Is it necessary to pad every input (not just last) to sponge for authenticated encryption to be secure? Is this just, because ...
81 views

### Breaking RSA moduli

Let suppose that the sizes of factors $p$ and $q$ are $b$ bits. We construct two RSA numbers $n$, $n'$ of same sizes. Can we say that the duration to break these two numbers is two times the duration ...
57 views

### What benefits do substitution boxes and permutation boxes offer in DES?

I understand that with more encryption rounds the more complex the ciphertext becomes due to multiple substitutions and permutations. What I don't understand is the purpose of these features. I am ...
46 views

### How can I do minus on plaintexts in the Paillier cryptosystem?

We have $E(a)$, $E(b)$ encrypted under the same Paillier key. As we all know, we can get $E(a+b)$ by calculating $E(a)*E(b)$. But can we get $E(a-b)$, by calculating $E(a)/E(b)$? I tried to ...
45 views

### What does OIW stand for

There seem to be many OID's that have been put in the ASN.1 tree that have the following ISO identified organization: OIW. One example is SHA-1 (ElGamal seems to be another): ...
56 views

### Static DH/Static ECDH certificate using OpenSSL

I've been searching for some time and have found no way to create a working certificate and private key pair with a DH or ECDH public key using OpenSSL. Once I do this, I'd like to sign it with an RSA ...
78 views

### Triple DES in Firefox - in practice

Reading about triple DES and understanding the principles, I am still curious how Firefox defines their three keys for the encryption/decryption. Suppose that the user saves his passwords in the ...
60 views

### Basic question about design of program with data encryption

I need to store encrypted files on a hard disk. The actual code side is not important for me now (I plan to use C# and AES-GCM encryption from Bouncy Castle library, please tell me if you think that's ...
41 views

### Deprecation of RSA-SHA-1 in DKIM keys?

I recently noticed that OpenDKIM on my mail server is objecting to DKIM signatures from a client, saying their key is insecure. It may be that that's due to lack of secure DNS (confirmation anyone?) ...
49 views

### Verifying signature owner (without verifying the actual document)

Programming in Java. I have an RSA key-pair, a document, and a signature created with the Java Signature class, using SHA512WithRSA. In order to verify the signature, of course, I need to provide the ...
65 views

### AES Affine Transformation Polynom Representation

I have been reading on the polynomial representation of the AES Sbox in the PDF “Essential Algebraic Structure Within the AES” by Murphy and Robshaw (www.isg.rhul.ac.uk/~sean/crypto.pdf) on page 7, ...
131 views

### Equal length of primes in paillier cryptosystem

In the key generation step of paillier cryptosystem , In order to satisfy $\gcd(pq,(p-1)(q-1))=1$ , we can take equal length primes. Instead of taking(length as parameter to generate $p,q$) equal ...
71 views

### How often do I need to rotate AES 256 keys

I'm trying to design a protocol for a resource constrained environment. The device has to communicate with a server through an insecure node. My plan is to use AES 256 end to end for all ...
82 views

### Why is Rijndael key length restricted?

Why is Rijndael restricted to key length in {128, 160, 192, 224, 256} bits (and not larger)? The algorithm looks to me like it would support an arbitrary-sized key (multiple of 32). The rounds ...
45 views

### ECIES: Purpose of MAC?

Assumptions: $A$ wants to communicate with $B$ $A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$ $A$ knows the address of someone who pretends to be $B$ $A$ wants ...
99 views

### Privacy-Preserving relational databases: checking the existence of a record (or multiple records)

I would like to know if there exists a protocol which performs the following operation in a privacy-preserving fashion: User $U$ wants to know whether a record is stored in the database. The primary ...
46 views

### Comparing Difference Distribution Tables

I have been studying the Diff. Cryptanalysis and finding it hard to do a problem. The problem is I have calculated the tables programmatically and found that the second table has a max value of 6 ...
50 views

### EAX: OMAC and CMAC

OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2? If it is OMAC1, does that mean it ...
108 views

### Rainbow tables, where have I got it wrong?

There seems to be some error in my understanding of the concept of rainbow tables, despite going through quite a bit of articles on it. Let me show what I don't seem to agree with. My plain text is ...
96 views

### Decrypting an Affine Cipher with known characters

I am trying to cryptanalyse multiple cipher–texts that I know are encrypted by different Affine ciphers. I have already analysed the frequency that each character occurs, and compared it to a ...
61 views

### Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
68 views

### Choosing primes in the Paillier cryptosystem

In the first step of key generation phase in Paillier cryptosystem given here. It's given that ( length($p$) == length($q$) )$\implies$ gcd$(pq,(p-1(q-1)))$=1 where length($k$) = # bits in ...
158 views

### CBC-MAC length extension attack with IV simulation

I'm doing Matasano's challenges and struggling with second part of 49th problem where I'm asked to do the length extension attack with CBC-MAC without IV manipulation. There is a hint that I can ...
58 views

### Does OpenTSA support PKCS11 to talk to HSMs?

We are planning to implement the time-stamping service (RFC 3161) using OpenTSA wanted to know: Does OpenTSA support PKCS-11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or much ...
104 views

### How to convert projective to jacobian co-ordinate in ECC?

I am doing a small project using elliptic curve in cryptography. My doubt is, can I directly convert a projective to a Jacobian coordinate system without using the affine conversion in elliptic curve ...
107 views

### Large text file encryption per line

Some background: I receive data in text files of over 16 million records (lines). I need to be able to encrypt the first column in that file so that it cannot be deciphered. This process will be ...
62 views

### Pohlig-Hellman Algorithm: Adding up the solution via CRT

I have a question about the Pohlig-Hellman Algorithm for the discrete log problem. I understand the concept, but doing the exact calculations I get confused at one point; to illustrate, let's look at ...
127 views

### Where do I truncate the bits in SHA 256 hash algorithm?

I'm implementing SHA-256 in PHP using strings. Where do you truncate in the algorithm? There are a lot of places where there's binary addition happening so the number of bits in $W(i)$ keep ...
71 views

### Protocol composition [closed]

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
43 views

### Fiat–Shamir: why do r and s have to be smaller than n?

I have a question regarding the Fiat–Shamir identification protocol. In this source (pdf) for example it says on pages 9 and 10 that the random commitment $r$ and the private key $s$ have to be ...