All Questions

189 views

Are there any quantum-resistant symmetric encryption schemes?

It seems that quite a few currently available encryption schemes will possibly be broken by quantum computing. Are there any symmetric encryption schemes that will remain unbroken (either because of ...
81 views

Is “Bit Independence” of SHA-2 hashes secure?

I know bit independence is good in SHA2 function output, but is it truly 100% secure? For example: Y = SHA512(secretKeyNonce256bit) A = first 32ytes / 256bits of Y, used as message encryption key B ...
133 views

Rationale for use of right-shift (rather than rotate) in SHA-2?

The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a ...
199 views

Is it possible to choose which point will have the public key of a given Elliptic Curve?

I am wondering if there is a feasible way that, given a specific elliptic curve (such as secp256r1), I could create a keypair where the public key has a given $x$-coordinate. If it is not possible, is ...
69 views

What is the proper usage of GCM nonce in TLS1.2?

I have written a program with the help of the bouncy castle for C# library. I am monitoring the traffic which is send between the client and the server and found something (i find) strange. The ...
35 views

Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
35 views

Why does P1363 require RW signature with $0 ≤ s < n/2$?

I'm using an older copy of P1363 Public Key Cryptography was used below. It may (or may not) reflect the current state of affairs. P1363 has the following requirement in section 8.2.8 IFSP-RW, p. 45: ...
2k views

What does an RSA signature look like?

I am using OpenSSL libs to generate signatures. Internally, I learn that a signature is a hash of the message with some padding added to it. I am trying to understand the structure of a signature. If ...
98 views

Tweaked Square Roots and Rabin-Williams

I'm reading Bernstein's RSA signatures and Rabin–Williams signatures: the state of the art. In section 6, Bernstein states: Recall that Rabin’s system needed to try several values of r, on ...
201 views

Is the inverse of a point on an elliptic curve over $\mathbb{Z}_p$ always in the group?

I'm working on a zero knowledge proof system that uses ECC over $\mathbb{Z}_p$ (currently using NIST P-256 since mbed TLS doesn't support group operations on Curve25519, but the problem should be ...
109 views

What's wrong with an iterative (with counter) hashed salted KDF?

It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a ...
50 views

How to find an impossible differential?

Given an arbitrary SPN-based cipher with X rounds. How to find an impossible differential for this cipher? What are strategies to find one?
79 views

zero knowledge framework for c programs - how to prove correct C program execution with private inputs

I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as: I know x s.t. SHA-256(x) = y (y is public, x is ...
3k views

Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
291 views

RSA public key recovery from signatures

Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized. I need it to verify any future message comming from ...
349 views

Calculating XOR Key Sizes

I've been playing around with the Matasano crypto challenges (cryptopals.com). I had a couple false-starts on the challenge that has you creating a program to calculate the key size of a XOR encrypted ...
128 views

Is randomsound for increasing entropy pool not doing what it is supposed to do?

I am using randomsound because I thought it would be a good idea to inject some additional entropy into the entropy pools of my linux machines (clearly those machines have a corresponding sound card). ...
274 views

I have a construction that requires as primitive an Additively Homomorphic Encryption scheme that does not rely on hidden group order, meaning I can't use Paillier. I now have two different ...
61 views

Are there security issues with adding plaintext length to TLS packets?

I have quite a big problem, because of a software implementation of TLS I had to adapt I had to create something which is now biting me. It all comes down to this: I need to know the length of the ...
90 views

I've reading on GPG since yesterday and I have a doubt: the whole system of double key encryption does make sense but it looks to me like either way you are compromising something in terms of security....
141 views

Pailler encryption of small integers to 32-bit integers

I want to encrypt very small integers in the range 0-44 using the Paillier cryptosystem. Is there a way to select p, ...
162 views

Converting ECC Code from python to Java. Extended Euclidean Algorithm not working. [closed]

I'm in the process of converting a Python program I found for calculating ECDSA public keypairs from a given private key. In this particular case it's on the Bitcoin curve. https://raw....
148 views

Is it OK to encode data using key equal to data

For some project, I need to store some short string in encrypted form. It would be ideal for the current purposes to encrypt it using itself. ...
163 views

PQ Key Exchange based on Elliptic Curve Isogenies

I was reading the Wikipedia article on Post Quantum Cryptography and was interested in opinions as to whether the Supersingular Elliptic Curve Isogeny Diffie-Hellman listed there would be a good Post ...
227 views

Why does anyone use elliptic curves for a CSPRNG?

I saw Martijn Grooten's talk on elliptic curves at BSides London this year, and it helped me understand how elliptic curve crypto works, especially in the case of Diffie-Hellman (ECDH). He also ...
109 views

Unicity Distance - AES

I am quite confused calculating the unicity distance and I was hoping that someone can clarify some things for me. My main issue comes from somewhat a difference of the calculation given by our ...
55 views

Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
128 views

Is it OK to use a hash of the key as nonce for AES GCM?

I don't see an immediate risk of using the hash of the key as the nonce for AES GCM. Is there something I could be overlooking?
113 views

Defining format-preserving encryption for natural language

Assume we have plaintext in natural language. Can we use format-preserving encryption in such a way that the produced ciphertext cannot be distinguished from natural language?
264 views

Will non-ECC algorithms like RSA eventually become too inefficient?

The strength of symmetric and asymmetric encryption schemes scales with the key length, but there is a difference between symmetric algorithms like AES and asymmetric algorithms like RSA. For example,...
642 views

SHA-256 hash of null input?

What is the SHA-256 hash if the input is null, i.e. an empty bitstring? (Not the hash of 0 or "0".)
44 views

AM protocol for 2 distinct objects

Prover is going to convince verifier that 2 objects are distinct, do you know any Arthur-Merlin protocol for this problem?
715 views

Trying to understand the use of ECC in TLS certificates

I was looking the certificate of this website: https://www.cloudflare.com that has an ECC based certification. I'm just curious to know if is possible to understand which elliptic curve is used and ...
252 views

Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, etc....
80 views

What is meant by - computational complexity $2^x$?

Recently Bi-clique Cryptanalysis allowed to obtain following results on full AES ES that claim to have The first key recovery attack on the full AES-128 with computational complexity $2^{126.1}$ The ...
253 views

How is information disclosed by modular multiplication?

Consider the case that $c = a \cdot b \mod p$ where $p$ is a known prime and $0 < a < p$ and $0 < b < p$ are unknown integers numbers. Furthermore, some bits on the value of $c$ are ...
85 views

Distinguishing attack on stream cipher created from a block cipher in counter mode

A block cipher in counter mode creates a key stream by: $$z_i = E_K(IV || i)$$ Where $IV$ is some chosen initialisation vector (with some length $l$ less that $n$ bits) and $i$ is the binary ...
333 views

What makes SHA-2 and SHA-3 have security levels half their output hash length?

The tag wiki for sha-256 says, in part: SHA-256 ... processes the input in 512-bit block and has a 256-bit output, for a 128-bit security level. I'm not a cryptographer, just an interested ...
103 views

Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?

From wikipedia, the DDH assumption says，given a cyclic group $G$ of order $q$ with generator $g$, $(g^a, g^b, g^{ab})$ looks like $(g^a, g^b, g^c)$ where $a,b,c$ are randomly and independently chosen ...
476 views

How secure is a lagged fibonacci sequence for encrypting brief messages?

Say I start with a 26-letter keyword and convert the letters into 26 integers (A=0, B=1...Z=25) nr[0] to nr[25]. Then I create a stream, nr[26] onwards, with a lagged fibonacci sequence where nr[n]= (...
87 views

Is it possible to encrypt a message's destination as well as its content?

I have imagined a way to break through any kind of censorship but since I don't have enough professional knowledge of cryptography I don't know whether it is feasible or not. If there is a method ...
58 views

Share two secrets between two parties [duplicate]

Alice has a secret A, Bob has a secret B. They have a secure channel and a MAC. They each want to know the other's secret, but don't particularly want to give up their own. However, neither will not ...
79 views

Is it right about an example of bilinear map $e$?

The equation for the elliptic curve is $y^{2} = x^{3} + x$ and is defined over the field $F_{q}$ for some prime $q\equiv 3 \pmod 4$, and set $q=307$. Choose random generator $g=[182, 240]$. My ...
78 views

Solving discrete logarithm when p is not a safe prime

If you have the cyclic group of integers modulo $p$, where $p$ is not a safe prime, as well as a generator $g$ with which for all factors $q$ of $(p-1)$, $g^{(p-1)/q} \ne 1$, This answer says that ...
134 views

Sending the next one-time pad key in this one-time pad message? [duplicate]

I am doing a research project on cryptography next year, and I'm really new to cryptography. This isn't some really advanced thing or anything, and I'm just trying to come up with something basic. ...
107 views

Is it OK to substitute a PRF for a random oracle?

Random oracles don't exist, but aren't PRFs essentially indistinguishable from them? So why can't we substitute pseudorandom functions wherever we use random oracles? And if we can do this, why is ...
91 views

Brute Force on Key

If you are brute forcing a key and trying trillions of combos, how will you know when you accidentally hit the right answer? Clearly you can't look at each decoded answer to see which "looks right".
1k views

AES-CTR in BouncyCastle with string key, without IV or salt [closed]

Our team is encrypting data using a javascript snippet. My problem is I'm supposed to parse them back in my Java code. I am having troubles identifying parts of the algorithm. The code says it's CTR ...
How does one decrypt the many time pad: ($R$ is a random string, $C$ is ciphertext, $P$ is plaintext) $R_0 \oplus R_1 = C_0$ $R_2 \oplus R_1 = C_1$ $P_0 \oplus R_1 = C_2$ assuming that $R_n$ are ...