# All Questions

79 views

### Does it necessary the public key is prime number in RSA algorithm?

I read some books talk about RSA cryptography but I did not understand something when choosing a public key $e$ Sometimes the condition is $1<e<$$\phi(n)$ Where $\phi(n) = p-1 * q-1$ also ...
73 views

### Arithmetic modulo 1

In the context of lattice-based cryptography, in particular the Learning With Errors (LWE) problem, I see some definitions given in terms of equations modulo 1 (see for example, Appendix A of this ...
149 views

### Point decompression on an elliptic curve

I'm programming an elliptic curve cryptosystem and I'm having difficulty with decompressing points. The following information is from my project specification as to my understanding: Given a point ...
83 views

### I don't care about replay attacks. What should I do with the nonce in nacl?

My system forwards encrypted and/or signed messages on a gossip network. Replay is part of the design. What should I do with the nonce? I'm tempted to just set it to the same number always. Is this a ...
156 views

### Hash collision using the leading 40-bits of SHA-1

I am trying to implement Floyd's cycle finding algorithm for finding a leading 40-bit hash collision in the SHA-1 algorithm. However, my code will not find a repetition even with 800,000,000 hashes. ...
118 views

### Where have all the cypherpunks gone?

In 1992, cypherpunks was created as a mailing list for activists advocating for cryptography. Arguably, the cypherpunks mailing list was the foundation for the movement and the centre of it all. ...
91 views

### What is the use of segments in Cipher Feedback Mode (CFB)

In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
80 views

### Is $(f(X), G(X))$ pseudorandom?

If $f:\{0,1\}^n \to \{0, 1\}^n$ is a one-way function, $G:\{0, 1\}^n \to \{0, 1\}^m$ is a pseudorandom generator, and $U_m$ is the uniform distribution over $m$-bit strings. Is the joint distribution ...
70 views

### Why do we need password in a server which uses TLS?

Suppose a server uses TLS to protect communication between us and the server. I observe that in the TLS handshake protocol, password is not mentioned anywhere. Then why do we need to have a ...
190 views

### rsa public and private keys

I have a question about RSA key generation. This is a simple RSA algorithm: Choose p = 3 and q = 11 Compute n = p * q = 3 * 11 = 33 Compute ?(n) = (p - 1) * (q - 1) = 2 * 10 = 20 Choose e such that ...
246 views

### Use case of RSA CRT

I discovered the CRT version of RSA cryptosystem which is used in many crypto libraries (openSSL, Java...). The use of the Chinese Remainder Theorem improves the speed of decryption so why it's not ...
82 views

### DES-X , computation load and storage

The passage said that the computational load to attack DES-X can be reduced to approximately $2^{(56+64)}=2^{120}$ steps,and the storage of data sets should be $2^{64}$. But I can't figure why ...
112 views

### What can be learned from the ciphertext of LibSodium's crypto_box_detached()?

LibSodium, (https://github.com/jedisct1/libsodium), has a function crypto_box_detached() which does authenticated encryption using the public key of the recipient ...
100 views

### Protection of Elliptic Curve Implementations against side-channel attacks [closed]

Recent fast elliptic curve implementations, for example a presentation at Eurocrypt 2014 (earlier presentation slides, the paper) talks about protection against only timing attacks. Why only timing ...
102 views

A long question here, but I really want to motivate why I'm confused. Consider the following attack on the Schnorr Identification Scheme. Alice chooses a random $k$, computes $\gamma = \alpha^k ... 1answer 192 views ### Compare two approaches for cracking RSA key I came across these questions while studying for a crypto course, does anyone have any ideas on how to answer these? (a) Random prime numbers of size 1536 bits are chosen to generate an RSA modulus ... 2answers 144 views ### Are LFSRs enough for this? Consider the following experiment: Let there be a machine which runs (ie. continually clocks) an LFSR of size (ie. number of bits)$b$, having a button that, when pressed, extracts the next$t$... 2answers 331 views ### Is .NET DESCryptoServiceProvider secure in this case? I have the following piece of .NET code (see below). I know that DES is not quite secure, I saw that MSDN does not recommend using DES, only for compatibility with legacy programs. I also saw that ... 1answer 129 views ### RC4 key schedule and algorithm design I've looked up RC4 algorithm and it's seems easy enough but some parts of it seem random to me. In the key schedule part take for example the following part : ... 1answer 49 views ### Hardness proof? I am little curious about how do we calculate hardness proof of any cryptography algorithm? Also where can I find hardness proof for AES and AES-CBC ? 1answer 102 views ### INT_32_BE in PBKDF2 Trying to understand PBKDF2 in detail. It is clear that the password and the salt is given to the PRF (which is HMAC-SHA-1 in the specification). But what is the role of the INT_32_BE(i)? What does it ... 1answer 103 views ### Question about second preimage resistance of hash function combiner Let$\Pi=(Gen_1,H_1)$and$\Pi=(Gen_2,H_2)$be two hash functions. Define$(Gen, H)$so that$Gen$runs$Gen_1$and$Gen_2$obtaining$s_1$and$s_2$respectively. Then let ... 1answer 144 views ### Modes of operation for Public Key Encryption schemes Symmetric key encryption schemes have well defined modes of operations for achieving deterministic (ECB) or Randomized (CBC, OFB, CTR ) etc. and other applications of the same. But are they defined ... 1answer 116 views ### How hard to break a cipher if it has a different key for each word? Recently I watched the movie 'The Prestige' again but this time the cipher diary impressed me very well. I like to create my own cipher for my diary because I have some time to kill everyday after ... 3answers 177 views ### How is the following different than RSA Signing of a document? If the goal is to demonstrate that you are who you say you are, I think the following will work: Bob wants to know that you are Amy. Bob encrypts a number using Amy's public key and then asks her what ... 1answer 63 views ### where to keep the AES keystream? I am trying to implement an AES encryption on my messages in my app and I want to have a different keystream for each "message group". Therefore, currently I am holding the keystreams in the database ... 1answer 136 views ### Which algorithm do you recommend for practical use to generate unique passwords for each website? So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm ... 1answer 56 views ### How to prove NIZK proof of knowledge? Assuming we have an El-Gamal pk tuple$(G,q,g,g^s)$. Someone, knows only the first three parameters. In round$i$, I send him$X_i=(g^s)^{t_i}$(the$t_i$values are chosen randomly for each round), ... 2answers 173 views ### Deriving 2 keys using HKDF I have an encryption scheme that uses a 256-bit master key, from which 2 separate keys (one for AES-256-CTR encryption and one for a HMAC-SHA256) are derived using HKDF. However, I'm not sure exactly ... 1answer 126 views ### DH “prime size” security in OpenSSL There's a program that uses the following OpenSSL function... DH_generate_parameters(256, 5, NULL, NULL) ...to create DH parameters which are later used for ... 1answer 143 views ### How can I find the multiplicative inverse in the first transformation of the SubBytes() transformation in AES? In FIPS-197 §5.1.1 , it says the first transformation in the SubBytes() transformation is: Take the multiplicative inverse in the finite field$\text{GF}(2^8)$described in Sec. 4.2; the ... 1answer 112 views ### Public and private key lengths I am generating RSA Public and Private keys with node.js instead of reading them from pem/crt files as I can hide them inside a private object using this module https://www.npmjs.org/package/private ... 1answer 96 views ### LFSR and Markov chain question [closed] This may seem an elementary question about LFSRs, and their link to Markov chains. LFSRs show Markov chain behaviour in that there can be a transition matrix defined over the LFSR, this follows from ... 1answer 84 views ### How can a digital signature algorithm incorporate a random data if it is to be authenticated on a separate system I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others ... 1answer 87 views ### Number of different substitution alphabet ciphers possible with given conditions? If you consider a 26 letter alphabet, and a cipher where 24 of the letters are sent to themselves, and only 2 letters switch, how many different substitution alphabet ciphers are there, and what ... 1answer 115 views ### ElGamal digital signature. why mod p-1 in delta? Im trying to figure out why$\delta$in the signature part of ElGamal has mod$p-1$when$\gamma$has mod$p$?$\gamma = \alpha^k \mod p\delta = (x-a\gamma)k^{-1} \mod p-1$1answer 44 views ### Computational Diffie-Hellman problem over the group of quadratic residues Suppose that$N=pq$where$p$and$q$are safe primes.$\mathbb{QR}_N$is the group of quadratic residues which is a cyclic group with order$\frac{\phi(N)}{4}$. Let$g$be the generator of ... 1answer 292 views ### About the Rijndael/AES sbox polynomial (subBytes) I've recently read a question about the irreducible polynomial behind the subBytes() operation in the Rijndael that has awakened and old curiosity I have: Why$\,m(x)$was chosen as ... 2answers 135 views ### reverse an identicon to its source string Identicons are used to create unique images based on IP address or strings. Lots of programs are available to generate identicons based on an input string. My ... 1answer 113 views ### Are the RFC3526 MODP groups Schnorr groups? I was wondering if a group like the 1536-bit MODP Group from RFC 3526 was a Schnorr group? A Schnorr group must apparently have:$p$and$q$being primes$p = q\cdot r+11 < h < p$... 1answer 101 views ### Numeric combination of passwords Pls I need explanation on How i can design a Cryptography that use multiple passwords or passphrase to open a safe(Lock). For example, if i need five people to unlock a secured device whereby all the ... 1answer 89 views ### Definition of one-way functions: randomly-chosen point vs every point Notation:$\Sigma^k$is the set of$k$-strings on the alphabet$\Sigma$;$\Sigma^\ast$is the set of all finite dimensional strings on the alphabet$\Sigma$. In the context of computer-science a ... 1answer 332 views ### Usage of different size chunks during AES encryption/decryption I want to encrypt user's files on our server. For this purpose I decided to use the PHP Mcrypt library. I chose to use the Rijandel-128 algorithm and CBC mode for encryption. Since files are quite ... 1answer 133 views ### XORing a header with SHA512-hash - secure? I am writing a application that encrypts text several times and stores the result. The result looks like complete random bytes, therefore I add some random bytes at the end. To let the program know ... 1answer 61 views ### MAC security and adversaries with memory The usual definition of MAC security is (roughly) that there is no "efficient" adversary that has non-negligible advantage in the "MAC game" where the MAC game is as follows: the challenger chooses a ... 1answer 76 views ### Exchanging Keyspace and Message space in PRF Suppose there is a secure PRF$F: K \times X \to Y$. Then is$F': X \times K \to Y$, defined by$F'(x,k):=F(k,x)$, a secure PRF? In my opinion it should be because exchanging the keyspace with ... 1answer 418 views ### How to select$g\$ in Paillier Cryptosystem

For my cryptography class project in university I have selected Paillier Cryptosystem as a course project ...
243 views

### AES-256 Shift-Rows Offsets

I am currently trying to implement a AES-256 cipher according to this sepcificaciton: http://techheap.packetizer.com/cryptography/encryption/spec.v36.pdf As well as on Wikipedia and in the document ...