# All Questions

803 views

### Why is ElGamal considered non-deterministic?

One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is). What makes it non-deterministic? Is this advantageous to security? How else does this property ...
672 views

### How do I solve this RSA instance for m?

How we can solve this equation and get the value of M? $$8 = M^{13} \mod 33$$ not a computer program, but a mathematical operation.
1k views

### What is the importance of Modular arithmetic in cryptography?

Why do we use modular arithmetic so often in Cryptography?
200 views

### How to control the output of a hash function to output to specific data according to similarity?

I do not know if the question lies exactly in that field but i'll give it a try unless rejection. I want to study methods of applying LSH functions to feet in a specific area of digest values. Briefly ...
882 views

### Demonstrating the insecurity of an RSA signature encoding scheme

I'm working on problem 12.4 from Katz-Lindell. The problem is as follows: Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and a textbook RSA signature scheme where ...
217 views

### Hermitian curves introductory references

Could you give me some reference to start on Hermitian Curves. Some papers or textbooks would be perfect, and please mention if it's math inclined or comp.sci. inclined. I've only seen hermitian ...
288 views

### Is it safe to store initial counter value for AES-CTR alongside with ciphertext?

The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.
175 views

### Does hash_df use binary or an ASCII hexadecimal representation for numbers to be passed to the hash function?

I'm implementing the HASH_DRBG algorithm. As per NIST-SP800 90 document for HASH DRBG Generation, section 10.4.1 "Derivation Function Using a Hash Function (Hash_df)", the Hash_df algorithm contains ...
4k views

### Cracking plain RSA without private key

I was wondering whether plain RSA encryption can be cracked given: The public key A plaintext of a known cipher text(s). In other words the decrypted message from an encrypted one (but without ...
280 views

### Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?

Section 8, Security considerations, of RFC3526, which defines groups used for Diffie-Hellman has a table recommending some random exponent sizes. In particular, it says: The strength of a key ...
522 views

### Are there two-way encryption algorithms that include a work factor?

I recently learned about the hashing algorithm bcrypt, which allows you to specify a "work factor" for the hash which can be incremented to stay ahead of Moore's Law. I understand there are some other ...
545 views

### Generalizing the conversion of Diffie-Hellman to El Gamal

How can we generalize the conversion of Diffie-Hellman to El Gamal public-key encryption scheme? The goals is to be eventually able to show that any 2-round key-exchange protocol can be converted into ...
336 views

### What is the appropriate public key encryption for secure coin flipping?

I quote Bobby's question here since I encountered the same one... Random Coin Flip using ElGamal and a Trusted Party Consider the following protocol for two parties to flip a fair coin. Trusted ...
In RSA, suppose we know that $e=N$ and we are given the value of $e$. ($N = p\cdot q$ for some large primes $p$ and $q$; $\gcd(e, \varphi(N) = 1)$ Can we calculate $d$ ($d = e^{-1} \mod ... 1answer 89 views ### How do we find the last two correspondences in an otherwise known even permutation? A secret even permutation$P$of the set of non-negative integers less than$n$is chosen. That might be a Feisltel cipher with a random key. We are given in sequence the$P(x)$for$x$from$0$to ... 2answers 853 views ### Is it a good idea to use bitwise XOR on a set of MD5 sums? I have designed an SQL aggregate function in Oracle that bitwise XORs all MD5 sums of the values stored in a column. For example, if my table is: ... 1answer 469 views ### Hash or encryption function for challenge-response protocol? Say I have an authentication protocol where the shared secret is never transmitted. The server passes a challenge to the client and the client calculates a response using an algorithm where the ... 2answers 178 views ### Protocol to generate Client Certificates at the start of a SSL session automatically? A more secure form of 'cookie' could be created for SSL communications through the following method. The client generates and requests the server to sign a certificate. Then the client authenticates ... 3answers 442 views ### Is it reasonable to assure that p-1 and q-1 aren't smooth? I came across the requirement that, in RSA,$p-1$and$q-1$shouldn't be smooth, shouldn't consist of lots of small factors. Therefore my question: How complicated is it to check whether$p-1$is ... 1answer 93 views ### Is there any serious discussion about using blinding intermediaries in digital currency scenarios? A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ... 2answers 1k views ### Design properties of the Rijndael finite field So we've already had a question on replacing the Rijndael S-Box. My question is - can we use a different finite field other than the one given by$x^8 + x^4 + x^3 + x + 1$in$GF(2^8)$. In other ... 2answers 182 views ### Where is the proof of security of Diffie's cipher? There is an apparently provably secure cipher that was proposed by Diffie, but enhanced by R.A. Rueppel. The scheme, which was mentioned in Applied Cryptography, works like this: Measure the length ... 3answers 1k views ### Is a book cipher provably secure? I've seen ciphers (usually in spy drama shows) that involve taking a book and writing down an index to individual characters. Essentially it's a keyed substitution cipher, where the key is the name ... 2answers 2k views ### Unpredictability of X.509 serial numbers About X.509 certificates serial numbers the RFC 5280 says: The serial number MUST be a positive integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a ... 1answer 805 views ### AES and perfect ciphers I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES. Obviously AES isn't a perfect cipher, since the ... 1answer 618 views ### Verilog simulation of Data Encryption Standard I interested in developing DES(in verilog) for my college project.Can i get help in understanding the simulation results of DES encryption and decryption ? thanks in advance . 2answers 345 views ### How does the wider cryptographic community view non-abelian group based cryptography? Is there perhaps some neural expository article on crypto systems based on non-abelian groups? I've gleaned that Anshel–Anshel–Goldfeld key exchange is the most well-known cryptographic algorithm ... 3answers 865 views ### Using a Non-Random IV with modes other than CBC The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ... 3answers 1k views ### How can I create a fixed length output in my hash function? I've been recently looking into the creation (and theory) of hash functions, however I just can't figure out how to turn a message into something of a fixed length. At the moment, my theory of a hash ... 2answers 398 views ### 101: Advanced Access Content System (AACS) and Subset Difference techniques for Broadcast Encryption I'm trying to get a grasp on AACS and Subset Difference for a project I'm working on and am having a hard time coming up with a technically valid layman explanation, let alone implementation. Is it ... 2answers 627 views ### Is a RSA-signature of some identifying data a safe way to implement a license key? I have this idea of implementing a license key: After the user downloads the program, he connects to a website and sends his Windows product ID. The website, then, sends this back to him with a ... 3answers 261 views ### Cipher for Product Registration? I'd like to implement a "Product Registration" scheme into my software where upon initial use, the User must enter a key to unlock it. The key they enter is compared to their encrypted Username. ... 3answers 738 views ### Does knowing common prefixes help crack blowfish? I have strings that are if the form: {static data}{changing data} The beginning static data part is around 20 characters and is common to all strings. The last ... 1answer 822 views ### Example of CHI Square test on Caesar Cipher? I am trying to get my head round the chi square test, when used with the Caesar cipher. I started off using this formula, $$X = \sum_{i = 1}^k \frac{f_i · f'_i}{n · n'}$$ Where ... 3answers 1k views ### What is Identity-Based Encryption (IBE) and why is it “better”? Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ... 3answers 1k views ### Calculating the amount of zero bits to be appended to the message From FIPS 180-3 Suppose that the length of the message, M, is l bits. Append the bit “1” to the end of the message, followed ... 3answers 241 views ### Derived Shared Key vs Distinct Keys? I've seen a lot of 2-party applications that derive a shared key from distinct keys created by each party. Why is this technique employed? Would it not be better to use those two distinct keys for ... 1answer 148 views ### What are the consequences of a MAC tag collision? I've seen some proofs of MAC security that are based on the extremely-unlikely event that two MAC tags collide (ie, they are equal for distinct messages). Suppose that this extremely unlikely event ... 3answers 1k views ### Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable? The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ... 2answers 5k views ### How does a chosen ciphertext attack work, with a simple example? Can someone please explain - using a simple example - how a chosen ciphertext attack works? 3answers 488 views ### Encryption technique performance evaluation I've come up with a light weight bit wise encryption algorithm and seems good. Ive tried it with text and image input. But I've the following questions I would like to ask What do you think of bit ... 1answer 619 views ### Mapping points between elliptic curves and the integers My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to$\mathbb{Z}^*_q$where$q$is the ... 1answer 688 views ### What is the proper way to use a client nonce? I've implemented an API for one of my clients, it relies on nonces and a shared secret. The structure: Client's Site (CS) requests nonce from My App (MA), posting their username MA verifies the ... 1answer 2k views ### RSA-PSS salt size One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verfication is carried out. However, this makes interoperability ... 2answers 477 views ### Random Coin Flip using ElGamal and a Trusted Party An old exam question I am trying to figure out: Consider the following protocol for two parties to flip a fair coin. Trusted party T publishes her public key pk A chooses a random bit ... 2answers 3k views ### Are there practical upper limits of RSA key lengths? Suppose one wanted to use RSA encryption for the sole purpose of sending key bits for use in symmetric crypto systems, a dedicated key exchange system so to speak. And say you didn't think that the ... 3answers 462 views ### Threshold Secret sharing - How to create a shared secret from pre existing secret parts? In usual$(t, n)$secret sharing schemes, a secret$S$is split into$n$parts so that any$t$out of$n$parts reconstruct the original secret. So, suppose that there is a group of$n$participants ... 2answers 373 views ### For public-key encryption, why does COA resistance imply CPA resistance? My professor told me: If a public-key crypto-system is secure against ciphertext-only attacks, then it is also secure against a chosen-plaintext attack. Why is this true? Is there a proof that ... 1answer 674 views ### Is H(k||length||x) a secure MAC construction? If$H$is a typical secure hash function, then$(k,x) \mapsto H(k \mid\mid x)$is not a secure MAC construction, because given a known plaintext$x_1$and its MAC$m_1$, an attacker can extend$k ...
Suppose that in order to avoid loss in transmission, a secret key encryption scheme $(Gen, Enc, Dec)$ is modified to be $(Gen, Enc', Dec')$, such that the message m is encrypted independently ...