All Questions

Filter by
Sorted by
Tagged with
5 votes
1 answer
317 views

Algorithm or closed form solution that lets me directly compute the $n^{\text{th}}$ state of an LFSR?

I have a large linear feedback shift register with a known state and taps. Now I want to compute the state of the LFSR after $n$ iterations. The problem: $n$ is in the order of $2^{256}$ so just ...
Nils Pipenbrinck's user avatar
5 votes
1 answer
4k views

Elliptic curve and embedding degree

I am new to ECC. I am confused about what the embedding degree in an elliptic curve group represents and what is the impact of its values on the curve and security (small values or large values?) ...
Mariam's user avatar
  • 69
5 votes
1 answer
745 views

ECDSA key recovery - floating point values

I'm currently attempting to recover an ECDSA key. I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such,...
Ben's user avatar
  • 51
5 votes
2 answers
936 views

Converting a 5-bit s-box to its bit-sliced format

I'm currently trying to convert a 5-bit sbox (the one from this cipher: http://primates.ae/wp-content/uploads/primatesv1.02.pdf) to its bit-sliced format (i.e. to a boolean network). Most papers ...
oPolo's user avatar
  • 367
5 votes
2 answers
199 views

Is there a security problem with this prime generation algorithm?

I am facing the following algorithm to generate an RSA public key: ...
Niklas B.'s user avatar
  • 211
5 votes
5 answers
1k views

How to disguise ciphertext

If I want to have a secret conversation, then I can encrypt it (with OTR etc). However, since big brother watches all communication, sending encrypted data will likely raise flags. Does anyone know of ...
John Henckel's user avatar
5 votes
1 answer
1k views

Faster alternative to HKDF

HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ...
Siyuan Ren's user avatar
5 votes
2 answers
1k views

Why is 2048-bit RSA always paired with 320-bit ECC?

You may already have noticed that most smart cards ship with 2048-bit RSA support and 320-bit ECC over GF(p) support. You may have already asked yourself "why exactly 320-bit?". Now I remember having ...
SEJPM's user avatar
  • 45.9k
5 votes
1 answer
1k views

Is it true that 7zip doesn't use any salt with its KDF?

This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679 If that's true, wouldn't that mean you can crack multiple ...
ItM's user avatar
  • 207
5 votes
1 answer
458 views

Can Alice send Bob a secure message with only DSA and no key exchange?

Suppose Bob has a DSA key pair, and Alice has Bob's public key. Is there any secure way that Alice can send Bob a message only he can read if Bob can not send any reply? I think the answer is no, ...
AndrewH's user avatar
  • 203
5 votes
4 answers
909 views

Which symmetric cipher is best for studying? [closed]

I would like to study a modern symmetric cipher (I have never studied a cipher before) and I was wondering which would be the best cipher for studying purposes of the following: AES (Rijndael), ...
Superpelican's user avatar
5 votes
3 answers
2k views

Fast PKI for embedded device

We are creating a device with a small microcontroller (20 MHz CPU 16 KiB RAM). We need some way to securely send signed files to device (only signature, no encryption necessary). An external company ...
Toni Homedes i Saun's user avatar
5 votes
1 answer
4k views

Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure

Any thoughts on how this can be done? Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for ...
Gordon's user avatar
  • 487
5 votes
2 answers
26k views

Meet-in-the-Middle attack on 3DES [duplicate]

How can I apply the Meet-in-the-Middle attack to the 3DES algorithm, and why does the literature say that 3DES is more secure than DES?
hadil da'na's user avatar
5 votes
2 answers
839 views

Weaker alternative to Ed25519?

For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast. However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
Chris's user avatar
  • 989
5 votes
1 answer
30k views

How to accurately calculate Unicity Distance for English?

The Unicity Distance for the DES cipher is around $8.6$ characters, and can be calculated using the $U=H(k)/D$ formula, where $D = R - r$, and where $R = 8$ is the number of bits in a byte (ASCII is 7 ...
spc16670's user avatar
  • 151
5 votes
2 answers
2k views

Generation of strong primes

It seems that this is pretty difficult to find large (above 1024 bits) strong primes, or at least such primes $p$ where $(p-1)$ has a very large prime factor. Is there any information regarding the ...
Boaz Shahar's user avatar
5 votes
1 answer
5k views

how to calculate non linearity of AES S-box?

S-box has to satisfy different design criteria. How to calculate non-linearity , propagation criteria for an AES S-box?
venkat's user avatar
  • 325
5 votes
2 answers
3k views

Use cases and implementations of RSA CRT

I discovered the chinese remainder theorem (CRT) version of RSA cryptosystem which is used in many crypto libraries (OpenSSL, Java...). The use of this theorem improves the speed of decryption so, ...
Raoul722's user avatar
  • 2,836
5 votes
1 answer
1k views

Why can't garbled circuits be reused?

There are a bunch of papers do research on resizable garbled circuits. But I wonder why garbled circuits cannot be reused? For example, the constructor constructs a garbled circuit of "AND" like this:...
Jan Leo's user avatar
  • 915
5 votes
1 answer
1k views

Is it possible to demonstrate that md5(x) != x for any x?

I am looking for an easy to follow explanation, if possible, that demonstrates/proves the validity (or not!) of this assertion: for any X, md5(X) != X (being X any string of 32 hex characters)
Juanan's user avatar
  • 161
5 votes
2 answers
3k views

Block Ciphers and (Non-)Generic Attacks

I am currently reading through Cryptography Engineering and came across this definition of block cipher security: Definition 2 An attack on a block cipher is a non-generic method of ...
David Brower's user avatar
5 votes
2 answers
12k views

Which stream cipher can we replace the RC4 in the SSL?

In cryptography, the Fluhrer, Mantin and Shamir attack is a particular stream cipher attack, a dedicated form of cryptanalysis for attacking the widely-used stream cipher RC4. The attack allows an ...
NiceTheo's user avatar
  • 591
5 votes
2 answers
299 views

Can S/MIME be still considered secure?

Previoulsy I had asked this question at https://stackoverflow.com/questions/18235983/can-s-mime-be-still-considered-secure but I feel this forum is topic-wise the right place. Recently there has been ...
user2683038's user avatar
5 votes
1 answer
543 views

Does zero-padding the secret in Shamir's sharing scheme increase security?

When performed in binary Galois fields $GF_{2^n}$, Shamir's threshold secret sharing scheme produces shares that are each the same bit-size as the secret. Though the scheme is "perfectly secure" in ...
ampersand's user avatar
  • 375
5 votes
1 answer
898 views

Why doesn't this replay attack work on ECDSA?

I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
Kevin Howe's user avatar
5 votes
1 answer
484 views

Why pairing based crypto is suitable for some particular cryptographic primitives?

Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for ...
curious's user avatar
  • 6,150
5 votes
1 answer
4k views

AES CCM vs CCMP

Are the terms AES CCM and AES CCMP are equivalent, or is there any technical differences between the two?
Lunar Mushrooms's user avatar
5 votes
1 answer
3k views

Can we trust digital signatures?

Consider that Alice wants to send a digitally signed message to Bob. Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
kim's user avatar
  • 51
5 votes
3 answers
501 views

Is the $\ell$-Diffie Hellman Inversion easy when g is known?

From here they define the $\ell$-Diffie Hellman inversion problem as: Given $g^{a},g^{a^2}\ldots,g^{a^{\ell}} \in G$, compute $g^{a^{-1}}$ Would this problem become easy if the generator $g$ is also ...
blz's user avatar
  • 55
5 votes
1 answer
3k views

Why is ElGamal considered non-deterministic?

One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is). What makes it non-deterministic? Is this advantageous to security? How else does this property ...
Bobby S's user avatar
  • 1,943
5 votes
1 answer
3k views

Are there two-way encryption algorithms that include a work factor?

I recently learned about the hashing algorithm bcrypt, which allows you to specify a "work factor" for the hash which can be incremented to stay ahead of Moore's Law. I understand there are some other ...
Nathan Long's user avatar
5 votes
2 answers
631 views

Generating X ids on Y offline machines in a short time period without collision

In theory this is what I have : Around 10 000 offline machines Each machine will generate around 10 000 ids I can program the machine in any way I want, but I prefer a low memory and low cpu They all ...
y.petremann's user avatar
5 votes
2 answers
9k views

Are SHA-256 and SHA-512 collision resistant?

Context: Designing a TinyUrl system. The user inputs a lengthy URL and the system computes the hash and encodes it binary64 and sends it back to the user. From what I understood so far (from this ...
bp4D's user avatar
  • 153
5 votes
1 answer
1k views

Looking at just EC Public Key parameters, how can you tell if it is invalid?

I am trying to handle when a parsers goes off the rails and reads an EC public keys wrong (just the X and Y components, I know the curve prior). Right now I check for the following (false means ...
Liam Kelly's user avatar
5 votes
2 answers
397 views

Recommendation of lightweight RNG for Miller-Rabin primality test

Miller-Rabin tests the compositeness of candidate numbers (hence, input $x$) that's often used as a primality test. The M-R test requires different random numbers for accuracy and confidence in the ...
DannyNiu's user avatar
  • 9,168
5 votes
1 answer
964 views

How is it possible that these two encryption functions yield the same result?

I opened this post in stackoverflow some time ago where I explained a problem I had about not finding a way that would allow to successfully get the result of a string encrypted with a "aes-256-...
user2638180's user avatar
5 votes
1 answer
332 views

Advantages of Paillier vs Goldwasser-Micali

It is easy to see that both Paillier and Goldwasser-Micali are homomorphic addition schemes and are secure, but what would be the advantages of choosing one over the other?
Daniel K's user avatar
  • 189
5 votes
3 answers
1k views

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers. I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
Adam Ierymenko's user avatar
5 votes
3 answers
2k views

What happens if you increment MAX counter in AES-CTR?

Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
Kyoma's user avatar
  • 151
5 votes
1 answer
1k views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
user67091's user avatar
5 votes
2 answers
10k views

What is the difference between a Vigenère cipher and a one time pad cipher?

I'm doing a decryption competition at a nearby college. We are allowed one cheat sheet so I'm trying to make one. I realized that the Vigenère cipher was very similar to the one time pad and wanted ...
StandingFuture's user avatar
5 votes
1 answer
3k views

Encrypting AES in ECB mode

I'm fairly new to cryptography and am starting to understand this weird art of Mathematics and theory. One thing I am trying to understand and do is encrypting a plaintext into ciphertext using AES in ...
Benza Jackpuut's user avatar
5 votes
1 answer
829 views

The role of Shift Register Cascades in Cryptography?

Clearly, there are stages when binary bits are needed and this can be done with the help of Linear Feedback Shift Registers. Registers are required to be connected in such a manner that one register ...
R1w's user avatar
  • 1,940
5 votes
1 answer
955 views

Are ciphertext-only attacks on LFSRs possible?

Reading about LFSR, I know that breaking an LFSR by knowing it's design and having enough (plaintext, ciphertext) pairs is an relatively easy task but let's assume we know the design of LFSR and a ...
Mehran Torki's user avatar
5 votes
2 answers
570 views

Do very short values make a peppered hash less secure?

Given many very short (or low-entropy) values – like 6-digit numbers – that are stored as hashes using a fixed secret pepper, e.g.: ...
Stefan's user avatar
  • 153
5 votes
1 answer
18k views

Is there a way to tell if a given string is a sha256 hash?

Just like, for instance, we can easily check if a given number is a visa card number, by verifying prefix and checksum - can we do anything similar for hash?
shal's user avatar
  • 207
5 votes
1 answer
2k views

What is the maximum number of shares in Shamir's Secret Sharing?

I am using codahale’s Shamir's Secret Sharing implementation of Shamir's secret sharing from Github. I am using this to generate a 32 byte random key encryption key (KEK) to encrypt a 32 byte data ...
Vamshidhar Cheburthy's user avatar
5 votes
3 answers
243 views

Is there any benefit to *really* strong passwords?

Suppose you had these two passwords: ...
twharmon's user avatar
  • 163
5 votes
3 answers
2k views

Substitution-permutation network visualizer

I'm doing differential analysis of a toy block cipher in which I've to extract the differential characteristic of the first n-1 rounds. However, I can't do that very well as I can't see the network ...
SpiderRico's user avatar

15 30 50 per page
1
87 88
89
90 91
606