# All Questions

394 views

### Why is diffie-hellmangroup1-sha1 used instead of diffie-hellman?

For SSH why is diffie-hellmangroup1-sha1 used instead of just diffie-hellman? In other words, why is the hash function used?
233 views

### Concatenation of two strong hashes may have striking weakness

For any hash functions $H_0$ and $H_1$, it is easily proved that their concatenation $H_0\|H_1$, defined by $(H_0\|H_1)(X)=H_0(X)\|H_1(X)$, is at least as resistant as the strongest of $H_0$ and $H_1$ ...
187 views

### Differential Fault Analysis of AES

Let's say: an error is induced into an implementation of the AES-128 to produce a faulty ciphertext. The error is a one-byte eror and is always induced on the last state byte, during round9, before ...
123 views

### How obvious is it to decrypt numerics encrypted with a reused one time pad?

For instance say you encrypt text using the one time pad and you end up with some scrambled text that appears illegible. If you reused the key for multiple times for enough text, someone could ...
100 views

### Hash “Preimage by product” resistance

Let H() be a hash function that achieves collision resistance as well as first and second preimage resistance. Let's equip the output set of H of a multiplicative group structure, more precisely a ...
466 views

### How to accurately calculate Unicity Distance for English?

The Unicity Distance for the DES cipher is around $8.6$ characters, and can be calculated using the $U=H(k)/D$ formula, where $D = R - r$, and where $R = 8$ is the number of bits in a byte (ASCII is 7 ...
226 views

### Explanation of each of the parameters used in ECC

I'm having a very difficult time finding a clear explanation of the parameters used elliptic curve cryptography. I know for certain that $p$ is the number or order or whatever of the given field that ...
194 views

### Why are there no MACs inspired by block cipher modes other than CBC and CFB?

I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter. Why are CBC ...
152 views

### Is the salt used with PBKDF2 secret?

I have two network endpoints that need to use the same derived key. Can the server send the salt to the client 'in the clear'?
341 views

### Point decompression on an elliptic curve

I'm programming an elliptic curve cryptosystem and I'm having difficulty with decompressing points. The following information is from my project specification as to my understanding: Given a point ...
116 views

### what are multi-primes and how are they different from semiprimes?

I came to know of semiprimes recently. The simplest explanation of semiprimes is you take any two prime numbers and you multiply them, say 3*11 = 33 in which case 33 would be a semiprime. The numbers ...
143 views

### Private Information Retrieval--Is it still theoretical?

Are there any real world products in which private information retrieval techniques are used?(a data hosting server oblivious of which data item was fetched from it?)If not what are the major barriers ...
156 views

### What is the difference between order of base point and curve order in EC? [duplicate]

When I was read about the elliptic curve cryptography I found some definition about domain parameter of elliptic curve like the follow. But I did not understand something $p$: prime number. $a, b$: ...
138 views

### Do data-dependent rotations have any advantage over fixed rotations?

There are many ARX ciphers, however most use fixed rotations. I know data-dependent compared to fixed rotations are: patented harder to implement constant time more expensive in hardware harder to ...
172 views

### What is the use of segments in Cipher Feedback Mode (CFB)

In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
189 views

### Why is this cryptosystem insecure?

Can someone help me see the flaw in this cryptosystem? Note: This is homework and it is due today at 1:30pm. An answer before that is not expected; I'd just like to understand what the flaw is. ...
105 views

### Is XCBC where k2 and k3 might be the identical, secure?

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding. ...
378 views

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ... 2answers 131 views ### Is it safe to salt a MAC? Say that I define a scheme where the salt is public and is MAC-ed with the message:$k = KDF(password, salt)tag = MAC_k(salt || message)$Is it safe to salt the MAC this way? Assume that the salt ... 1answer 297 views ### Do Export Restrictions Still Apply To The Key Length of RC4? I've just read a paper from 2004 which stated that the RC4 encryption algorithm was restricted to a 40 bit key size when exported from the USA; however the reference for this information (Applied ... 3answers 260 views ### If a cipher has key length shorter than plaintext, then it is not perfectly secure I am trying to verify the statement above. So far I only know that a One-Time-Pad is the only “perfectly secure” cipher. It has a key length which is exactly the same as the plaintext. I think the ... 1answer 502 views ### Calculate the RSA private exponent from the CRT parameters I am trying to make the RSA structure of Openssl manually, knowing the public key ($n$,$e$) and the CRT parameters$p$,$q$,$d_P$,$d_Q$, and$u = q^{-1} \mod p$. That is, I want to get the$d$... 2answers 151 views ### Is it possible to find out whether a number is greater than another number without knowing the numbers? Is it possible to construct a zero knowledge proof that one encrypted number is larger (or not) than another encrypted number without releasing the values of either numbers? 1answer 550 views ### Why is 224 bit ecdsa faster than 192 bit ecdsa? I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ... 3answers 172 views ### Feasibility of finding public key when private key is known We all know that in a public key cryptosystem, given a public key it is extremely hard to compute private key from it. Is it the same case in reverse? Given a private key, how easy is it to compute ... 1answer 405 views ### Will I be able to (ab)use a FIDO U2F compliant hardware token to decrypt data? I have heard good things about the emerging "FIDO U2F" standard. I am especially interested in having a JavaScript API for cryptographic functions that I can access through a plug-in in a browser. ... 1answer 277 views ### Perfectly secure shift cipher Prove that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure. I want to show that$P(P=p | C=c)=P(P=p)$. But I don't know how to relate. Can anyone ... 1answer 742 views ### Entropy of the key Suppose a$1000$-bit key used in the one-time pad is not randomly and uniformly generated. Suppose that the values of the first$5$bits are$0$, and the other$995$bits are randomly generated and ... 1answer 296 views ### Why are some key stretching methods better than others? I'm trying to understand why some key stretching methods are better than others. The wikipedia article presents 3 different key stretching methods: A collision prone simple key stretching ... 1answer 113 views ### How to only encrypt a subset of the plaintext I was wondering if there is a smart way for a user to only encrypt a subset of a plaintext. I'll try to be more specific. Let's suppose the user U wants to use a special cipher such that given a ... 3answers 418 views ### Can a EC private key be derived from a public key? I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ... 1answer 271 views ### How to calculate complexity of ElGamal cryptosystem? How to calculate time and space complexity of ElGamal encryption and decryption as there are two exponentiation operation during encryption and one during decryption? Here is my code for encryption: ... 2answers 240 views ### What is the entropy per Diceware word if a random symbol is inserted into a random position in the word? On the Diceware page is this little gem: For extra security without adding another word, insert one special character or digit chosen at random into your passphrase... Inserting a letter at ... 1answer 186 views ### Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve? Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ... 1answer 145 views ### Pick faster private exponent I recently tried to send 1536-bit modulus CSR to COMODO. They refused to sign the certificate. I later found out that it's because NIST mandated 2048-bit modulus on the SSL certificate. I think it's ... 2answers 99 views ### One Time Pad for large changing files i wondered what the security implications are if I do the following. If I had a large file encrypted with a OTP and want to change only a few bytes in the plaintext. what security vulnerabilities do I ... 2answers 214 views ### How can I perform matching on an “encrypted- fingerprint feature matrix” using Fully Homomorphic Encryption? I am doing a finger-print authentication process. The feature-extraction using minutiae has been done and I get an N x 6 matrix, where the 6 columns are {$x_i$... 1answer 474 views ### How is padding oracle attack mitigated by encrypt-then-MAC? Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ... 3answers 165 views ### Is it possible to find data which makes sense when decrypted with different keys? In theory, does a piece of data exist which, when encrypted (using any method) with a given key, makes some sense when decrypted with the wrong key? Here, a definition of "some sense" might be ... 1answer 123 views ### Computing youngest person among 3 while keeping ages private I already found a protocol to find out who is richer (older) between two parties, but Is there any protocol to find the youngest person among 3 parties, without revealing actual ages? 1answer 718 views ### PRF and hash functions Is there a difference between PRF and a hash function? For example: Creation of a secret key is using PRF and creating a secret key is using hash function. 1answer 151 views ### Can I make a PRNG that is secure even when state can be modified by user? I am interested in making a PRNG which, after being initially seeded, can accept and incorporate client data as the only ongoing source of "entropy". It is not directly for a cryptographic purpose, ... 2answers 714 views ### DES with actual 7 byte key Do we have any library or any mechanism where we can use true 7 byte key for DES instead of 8 byte key. I need it for keys analysis in DES and 8 byte key requirement for associated library is creating ... 1answer 222 views ### Pairings in Identity-based encryption vs. Attribute-based encryption The bilinear map in Identity-based encryption should satisfy$e(aP,bQ)=e(P,Q)^{a\cdot b}$whereas Attribute-based encryption schemes use$e(P^a,Q^a)=e(P,Q)^{a\cdot b}$with$a,b\in\mathbb{Z}_p$and ... 1answer 194 views ### “Fine grain Cross-VM Attacks on Xen and VMware are possible” and OpenSSL 0.9.7 Here's a paper that just made its way into Cryptology ePrint Archive: Fine grain Cross-VM Attacks on Xen and VMware are possible!. Its a good survey of past attacks and presents a couple of new ... 2answers 310 views ### Diffusion in Shamir's secret sharing scheme The popular command line utility ssss implements the classic Shamir's secret sharing scheme over the generic field$GF(2^q)$with$8 \le q \le 1024$. When$q>=64$, the constant coefficient ($c_0$) ... 1answer 86 views ### Do Chosen-Chiphertext attacks only apply to public-key cryptosystems? Do Chosen-Chiphertext attacks (CCA-1/2) only apply to public-key Cryptosystem? 1answer 643 views ### How to select$g\$ in Paillier Cryptosystem

For my cryptography class project in university I have selected Paillier Cryptosystem as a course project ...