# All Questions

108 views

### Are formal methods used for cryptographic protocol design?

I decided to learn more about the application of formal methods to cryptographic protocols and found this interesting talk by Cathy Meadows at YouTube. After doing research about how people are using ...
109 views

### Encryption time in ECC

In RSA, encryption time is usually much less than decryption time due to having a small public exponent. Can this be achieved in Elliptic Curve Crypto (ECC)?
104 views

### How does this SSL-related flaw work?

I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked. First how HTTPS works… to be sure I’m on the same page: Server ...
125 views

### Understanding math behind RSA key derivation [duplicate]

I was reading through the key derivation for RSA. Here are the steps per wiki - Select strong primes $p$ and $q$ such that $pq = n$ $\phi(n)$ = $(p-1)(q-1)$ select $e$ such that $e$ and $\phi(n)$ ...
71 views

### Security assessment between $g^{a_ix_i+r_i}$ and $g^{x_i+r_i}$ [closed]

Imagine a tagging system whose security requirements imply to learn nothing from the tag about the encoded value. We consider a plaintext space $X \in \mathbb{Z}_p$ and a group $\mathbb{G}$ where ...
65 views

### How exactly are PRNG's used to encrypt material, and what makes one any more secure than the other?

I hope my question isn't as lazy as the title indicates. What I want to ask is how people literally integrate a PRNG with encrypting material. I wrote a silly little script in Python a while back ...
156 views

### Breaking RSA when some bits of one prime are known

RSA primes are 100 bit. You know first 80 bits of one of the primes. In this system, come up with an efficient way to decrypt the cipher-text. This was the question on my quiz. I'm not sure how ...
83 views

### Initialize the eight working variables SHA256

I have a little confusion in understanding explanation of SHA256 by FIPS a, b, c, d, e, f, g, h are being initialized as (this is what i don't understand) 2 . ...
161 views

### How to retrieve the plaintext of a substitution ciphertext?

So the other day, I was piqued by a ciphertext that was trivially encoded through substitution. Solvable only because we can use our eyes to determine word boundary word detection, etc. Trawling the ...
65 views

### On modeling a random oracle hash function which maps $\mathbb{G}_1 \rightarrow \mathbb{G}_2$

How can one model a random oracle hash function which maps $\mathbb{G}_1 \rightarrow \mathbb{G}_2$? (Assume $\mathbb{G}_1$ and $\mathbb{G}_2$ to be additive and multiplicative groups of prime order ...
52 views

### How is an X.509 public key used for TLS?

Wikipedia's TLS article says: The client responds with a ClientKeyExchange message, which may contain a PreMasterSecret, public key, or nothing. (Again, this depends on the selected cipher.) This ...
142 views

### Can 64-bit “PRINCEcore” practically be brute forced?

There is a cipher called PRINCE proposed in ASIACRYPT two years ago. See the paper: “PRINCE – A Low-latency Block Cipher for Pervasive Computing Applications” The cipher divides the 128-bit key into ...
115 views

### How do you test the security of your cipher? [closed]

I got asked this question and I didn't know what to answer. How do you test the security of your cipher? What comes to my mind now would be to test it with famous attacks: padding attacks, ...
62 views

### Why does knowing the number of points on a curve help solve ECCDLP?

Perhaps, this is a really obvious question, but I am still having trouble understanding how this all fits together. Why is knowing the number of points on an Elliptic Curve helpful in cracking it? ...
103 views

### Timestamping using a hashed linked list and public known events

Let's say we have a timestamping scheme of the following characteristics, The hashes of the documents we are trying to timestamp are XOR'ed with "events" whose time of occurrence are very publicly ...
142 views

### What's the entropy of the output for Tiger Encryption?

I'm tasked to apply tiger encryption to my string(key). Does anyone have any idea how to find the entropy of the hex output by tiger encryption?
243 views

### Generalize the Merkle–Damgård construction for any compression function

I am trying to figure out this question: Generalize the Merkle–Damgård construction for any compression func­tion that compresses by at least one bit . You should refer to a general input ...
67 views

### Using beginning of TLS ecnrypted data to reveal secret [duplicate]

I have the following question about TLS security: Assume TLS-PSK protected HTTP with AES256-CBC cipher. When a TLS connection is established, client sends some encrypted data, where the plaintext is ...
131 views

### Key construction in the Full Cramer-Shoup cryptosystem

The Full Cramer-Shoup Encryption scheme needs to choose six random numbers from $\mathbb{Z}_q$, which we denote them by $x_1,x_2,y_1,y_2,z_1,z_2$. Then the scheme hides these random numbers in the ...
78 views

### Is a tweakable block cipher still considered deterministic in nature?

"a block cipher is a deterministic algorithm operating on fixed-length groups of bits, called blocks, with an unvarying transformation that is specified by a symmetric key. - Wikipedia " But with a ...
182 views

125 views

### Homomorphic crypto allowing anonymous yes/no votes?

I'd need a crypto system allowing online yes/no votes but without revealing who voted what. Is a "partial" homomorphic crypto system what I'm after? Would, for example, Damgard-Jurik work in my case? ...
169 views

### Non-interactive Zero-knowledge proof signature validation without public key

I'm looking for a method for a scenario with following requirements: At least 3 people (A,B,C,...) are in a Network where they can broadcast messages to everyone but not communicate with a specific ...
424 views

### Exercise: Attack on a Two-Round DES Cipher

Working through the exercises in Cryptography Engineering (Schneier, Ferguson & Kohno) I have stalled on the following exercise: Consider a new block cipher, DES2, that consists only of two ...
102 views

### Is there a method to combine encryption and ring signing?

There's the well-known question on whether to sign or encrypt first. However, if instead a message is to be ring-signed such that either recipient could be the actual signer, is there any scheme that ...
105 views

### If its possible to derive the public key from a private key, why can't we go in reverse?

I'm looking at source code for BitcoinJ that derives a public key from the private key. ...
190 views

### Current standard for hash function security parameter?

When designing a hash function, what should be the secure input and output lengths? In particular, what lengths do I need for collision resistance?
189 views

### Generating Diffie-Hellman parameters efficiently

I am working on an Android project for school and I am supposed to do a DHKE (Diffie Hellman Key Exchange). Everything works well. The problem is that it takes a lot of time (really a lot) to ...
241 views

### What are some restrictions when converting Montgomery Curves into Weierstrass Curves?

I want to represent a Montgomery Curve (curve25519) in Weierstrass form as a personal exercise. After doing some math and referencing the conversion equation at ...
98 views

### Why does a one-time-pad key have to be at least as long as a message? [closed]

I am studying one time pad and find it hard to understand. What happens if the key is one bit or 100 bits shorter than the message?
114 views

### Is it ok to send part of digital signature if we have bandwidth constraints?

When creating digital signatures is it ok to send part of it when we have bandwidth constraints?
71 views

### Using cryptographic hash to match AES key size

I am making a tool for myself where I intend to store cipher text. I wish to use AES together with arbitrary sized keys to create these cipher text strings. The idea is to use a cryptographic hash ...
187 views

### Derive both MAC and AES keys from same PBKDF2?

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be ...
307 views

### Shamir's ID based signatures

I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, ...