# All Questions

64 views

### How are RSA and ElGamal compatible in PGP?

I'm starting to play with PGP and I don't understand how if your key pair is RSA you can encrypt a message for someone whose key is for example ElGamal. How does the asymmetric key exchange work if ...
76 views

### Deciphering text encrypted with a changing cipher

I know there are many ways to crack basic ciphers were each letter is mapped to some other letter, but what ways are there to decode something that was encrypted using a cipher that changed after ...
50 views

Server A produces signed messages on request. You can tell server A what type of RSA padding to use in the signature (either RSASSA-PKCS1v1_5 or RSASSA-PSS). Either way, the message will be signed ...
56 views

### Why are modes of operation used, what attacks do they prevent?

I know you always need to use a mode of operation when using a block cipher, AES for example, and Wikipedia has a good explanation for what modes of operation are Now I know if i do not use a mode of ...
98 views

### How do SignRecover and VerifyRecover work?

In PKCS#11, there are the SignRecover and VerifyRecover methods, where the data can be recovered from the signature. How do these methods work? Can I implement signrecover and verifyrecover with ...
86 views

### Performing differential cryptanalysis for randomly generated S-boxes

As far as I know, performing differential or linear cryptanalysis always requires a knowledge of the S-boxes' content and order. Yet in Bruce Schneier's Applied Cryptography, it is stated that random ...
84 views

### What would a backdoor in symmetric key cipher look like? [duplicate]

Pretty much what the title says. DES was suspected of having one, but I couldn't imagine what it could possibly look like if only the NSA knew how to use it. Dual_EC_DRBG's backdoor is asymmetric, but ...
78 views

### ECDSA Public key randomness

If I have a 256bit ECDSA public key how likely is it that the same public key will be generated by another person. Will it take on average 2^256 tries to generate same public key? If I xor the first ...
46 views

### In a additive group is it hard to calculate $bg$ given $ag, g, abg$

The ECDH problem defined that given $g,ag,bg$ it is difficult to calculate $abg$. But it is also difficult to calculate $bg$ given $ag,g,abg$. where $g$ is generator and a,b are elements of group.
64 views

### Is the result of HMAC-sha256 distinguishable from random noise?

Is if the result of HMAC-sha256 distinguishable from random noise? If so, given: a collection of 1000 keys, and 1000 messages of random noise, 100 signed by each of only 10 of those keys Can ...
44 views

### What is the polynomial to use in the Massey-Omura cryptosystem?

The Massey-Omura cryptosystem uses "multiplication over the finite field $GF(2^n)$. I'm just starting understand the idea of multiplying polynomials and I've searched for online calculators to use for ...
65 views

### 3DES Modes EED orEDE?

Can we use EED with 2 keys (K1 K1 K3) rather than EDE (k1,k2,k1) ? We measure the strength of DES by the effort (in term of number of tries) in finding some K1 & K2 to match a known plaintext and ...
73 views

### Finding $x$'s parity in the discrete log problem

Suppose $p$ is prime, and $g, a\in\mathbb F_p$ are given elements with $g$ a primitive root. The discrete log problem poses the task of finding an integer $x$ such that $g^x=a$. Show that even if $x$ ...
108 views

I have a secret message which I want to encrypt such that any of several different keys can open it independently. The keys can't know about each other and it has to be able to work completely ...
86 views

### Why is knowing M not enough to break Blum Blum Shub?

In Blum Blum Shub, the generator is $x_{n+1}={x_n}^2 \mod M$ where $M=p \cdot q$, $p \in \mathbb P$, and $q \in \mathbb P$. Supposedly, knowing $p$ and $q$ is enough to break the system. But if I know ...
36 views

### What does K stand for in frequency analysis

It was from frequency analysis lecture and the professor mentioned but I cannot recall. The K value for English was .067, German was .076. The lowest K was Russian which was .056. When the frequency ...
100 views

### PRF based on the GGM construction

What's the differences between the concepts “pseudorandom generator” and “pseudorandom number generator”? In fact, I want to implement a pseudorandom function based on GGM's construction at ...
65 views

### Usage of GF(p^m) fields, where p != 2

$GF(2^m)$ Galois fields are widely used in different cryptographic algorithms, for example, in Rijndael. However, $GF(p^m)$ fields are possible with any prime $p$, not only 2, but $GF(2^m)$ fields ...
144 views

### How are the AES inverse S-Boxes calculated?

I would like to know, how to calculate the inverse S-box. I followed this link (with affine transformation first, then multiplicative inverse), but the result is wrong. For example, if I use the value ...
59 views

### Is it a variant of Strong RSA assumption?

Informally, the hardness of RSA/Strong RSA assumption lies in the hardness of factoring a large composite number $N$ having two large primes as its factors. If RSA modulus $N$ is a prime number, then ...
112 views

### What kind of attack does the current brokenness of SHA-1 allow?

I understand that the following is becoming feasible, or already is: Find any 2 data (d1 and d2), for which SHA1(d1) = SHA1(d2) However, it is not entirely clear ...
101 views

### Programming language for modular arithmetic over large numbers [closed]

I'am trying to implement algorithms on integer factorization.This involves dealing with integers of 200-500 digits and doing modular arithmetic over them.Which programming language has inbuilt support ...
129 views

### Combining a keystream generator with a block cipher

I understand that: A stream cipher's security is diluted if the same key is used more than once. This is fixed by using an additional initialization vector in the keystream's computation. A block ...
106 views

### The perfect way of using IV in CTR mode

I understand that it is necessary to use the same IV for both encryption and decryption in the CTR mode. I'm thinking about the case when I concatenate the secret ...
113 views

### Strength of RSA with OAEP

In our current system we use an encryption solution based on RSA with OAEP padding. Key size is optional but default 2048. What is the general strength of RSA with OAEP? Are there know attacks that ...
29 views

I am studying for network security exam. And in the slide about Key Management, under a heading Key Verification I see this: Key Verification Almost all cryptographic algorithms have some weak keys ...
102 views

### Transforming a key into a seed with the most entropy

I'm making a very simple encrypter in C# which is basically a Stream cipher. The user enters a key(password), converted to a seed for a pseudo-random generator, and the pseudo-random generator ...
59 views

### KPA on Feistel cipher?

I heard that DES is technically “broken” because of attacks involving large amounts of known plaintext. These attacks are obviously academic and highly complicated, so for some intuition I was hoping ...
84 views

### Does a cryptosystem provide unconditional security if and only if it provides perfect secrecy?

Is unconditional security and perfect secrecy one and the same thing, i.e a cryptosystem provides unconditional security if and only if it provides perfect secrecy ? I've wondered about the above and ...
99 views

### Group description in pairing based cryptography

Suppose we have a public key encryption scheme, in which public parameter contains $(p, G, G_t, e, g)$, where $p$ is prime number, $G$ is a (cyclic) group of prime order, $e:G \times G \mapsto G_t$. ...
60 views

### MD-compliant hashes don't really accept arbitary length input, do they?

When people talk about hash functions, they usually say that they accept arbitrary-length input, but if you actually look at the padding (eg MD-strengthening padding), you see it's like ...
44 views

### Repeating something encrypted and non-encrypted?

If one wants to keep the receiver's name non encrypted, but it also appears in the encrypted message - will it leak information? (other than the receiver's name, of course.) Let's assume a "bad" case ...
55 views

### simulating rc4-256 with rc4-128

OpenSSL supports rc4 with 128-bit keys and rc4 with 40-bit keys. It does not support rc4 with 256-bit keys. My question is... is it possible to modify the state of the pseudo-random generation ...
42 views

### Condition on Vector Boolean Function to be Bijective

Suppose the vector boolean function be \begin{align} f:F^n_2 \longrightarrow F_2^n \\ (x_1,\dots ,x_n) \longrightarrow (x_2,\dots x_n,g) \\ \\ g:F^n_2 \longrightarrow F_2 \\ (x_1,\dots ,x_n) ...
118 views

### Using bcrypt derived keys for encryption?

Sorry for this ignorant question but I am currently weighing up the advantages and disadvantages of BCrypt over PBKDF2 and from what I have read BCrypt is considered more secure but from what I have ...
77 views

### Random Permutation polynomial

I need to know, please: (1) Is there anyway to pick uniformly at random permutation polynomial in a field of prime order? (2) Are there many permutation polynomials in a field? (3) In a finite ...
86 views

### Can DH_anon really be exploited by an attacker?

General consensus is that DH_anon (and ECDH_anon) ciphersuites should be disabled since they offer no way to verify if the server is the one you intend to communicate with. However, I have never run ...
224 views

### AES— Brute force attack versus Known plain text attack

I am taking a codes and cryptology course and the following is a questions on a past exam that I could not and still can't solve: ...
435 views

### What are SNARKs?

What does it mean and what is it used for, I have been hearing this term a lot lately. From the context I've heard it talked about it seems to be connected with zero knowledge?
339 views

### Why does openssl use SHA1 in ECC when I use secp384r1 curve

I need a small clarification that why openssl using SHA1 in ECC when I am using secp384r1 curve, but in rfc they are saying we should use SHA2. Thing here is am using nanoECC in my DTLS, nanoECC ...
102 views

### RSA prove $a^{\varphi(n)/g} \equiv 1 \pmod{n}$

I should prove that $a^{\varphi(n)/g} \equiv 1 \pmod{n}$, so I thought I would prove it with primitive roots but I got stuck. Here is the assignment: Let $p, q$ be primes such that $p \ne q$. ...
211 views

### Frequency analysis of Vigenere Cipher

For Vigenere cipher, I understand Find period first (say we have p = 6) Find highest frequency of letter in each group (from 1 to 6) and assume it is "e" in plaintext What if we have more than ...
141 views

### Operation which needs much computing power to be created, but just a little to be solved?

Does somebody know a cryptographic/mathematic operation, that needs much computing power to be "encrypted"/"created" but doesn't need much power to be "decrypted"/"solved"?
97 views

### Is it just as difficult to find a desired output in a hash digest, for MSB vs LSB?

This question comes to mind after seeing "custom" Bitcoin addresses with some special string at the beginning of the address. They are generated in the same way Bitcoins are "mined", continually ...
159 views

### How to encrypt letters less than block n using Hill Cipher

I am learning about Hill Cipher and know that it is a block cipher where each block of n letters (considered as an $n$-component vector) is multiplied by an invertible $n \times n$ matrix, again ...
85 views

### Is it possible to 'fake' time for TOTP? (Time-based One-time Password)

TOTP (Time-based One-Time Password) Algorithm is used in Two factor authentication. I understand the algorithm and that current time is used as a variable to generate a token. Wiki page for reference: ...
105 views

### How can convert affine to Jacobian coordinates?

I have a point in affine coordinates: $(x,y)$. What should I do when I want to convert to $(X,Y,Z)$ in Jacobian coordinates? I need it for calculating ECC in a prime field.
259 views

### How costly is to find millions of large prime numbers for RSA?

Consider I need to assign a large distinct prime number to each element in a large set. This must be deterministic so the function always gives me the same prime to the same value. What is the most ...