# All Questions

2k views

### Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
255 views

### DES key expansion: why are these two descriptions different?

I would like someone to explain me how to generate DES subkeys, because in the documentation that I saw, sometimes they say: "We rotate the initial key according to the number of iterations given ...
2k views

### Should I salt an AES password at each encryption?

I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message. I don't understand ...
346 views

### What do $0^n$ and $1^n$ mean in cryptography?

EDIT : I added more context. Let $f$ = {$f_k$} be a pseudo random function family. Let $G(x)$ be a pseudo-random generator such that: $G(x)$ = $f_x$($0^k$)$f_x$($1^k$) where k=$|x|$ . I don't ...
355 views

### Determining the algorithm used to generate a digital signature

I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature. From the signed string, is it possible to find out what ...
1k views

### Difference between symmetric and asymmetric hash function?

The Linux kernel supports symmetric and asymmetric hash functions. E.g. sha1, sha256, ... See tcrypt.c and search for test_hash_speed and ...
223 views

### Choosing good parameter for Lenstra's elliptic curve factorization

In Wikipedia, there is an article explaining Lenstra's factorization algorithm. As far as I got it, we choose some $e \in \mathbb{N}$ and a point $P$ on the curve and then calculate $eP$. While ...
143 views

### Public keys and their protocols

I'm having difficulties understanding exactly what this protocol means: $S \to D : \{N_S , S\}K_D$ $D \to S : \{N_S , N_D \}K_S$ $S \to D : \{N_D \}K_D$ "where $S$ represents the supervisor’s ...
138 views

### efficient authentication with broadcast encryption?

(I am not a crypto expert, so I apologize if the terminology I use is incorrect.) Suppose I have the following simple broadcast encryption scheme for securely sending content to $n$ authorized ...
168 views

### Future-Proof Versioning and Validation

I am working on a library (using standard primitives: AES256 CTR; HMAC with SHA256; PBKDF2 with SHA256, 128 bit salt, and 10000 rounds) to encrypt and decrypt data, given a password. The encrypted ...
7k views

### How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
148 views

### What are the cryptographic assumptions in the Dolev Yao model?

In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox. Does blackbox here mean that the primitive is to be considered CPA ...
237 views

### Can Add and Multiply On Cipher Text achieve all operations?

A Fully homomorphic encryption scheme needs to support an evaluate function that can do add and multiply operations on cipher text. Can we do all kinds of complex operations on cipher text like ...
432 views

### Blind quantum computing and fully homomorphic encryption

I am somewhat familiar with current research on fully homomorphic enryption schemes and their possible application to Cloud computing. I've just noticed (somewhat late) that a marketing-savvy group ...
17k views

### Best way to reduce chance of hash collisions: Multiple hashes, or larger hash?

I would like to maintain a list of unique data blocks (up to 1MiB in size), using the SHA-256 hash of the block as the key in the index. Obviously there is a chance of hash collisions, so what is the ...
169 views

### Security model for privacy-preserving aggregation scheme.

Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
751 views

### On-the-fly computation of AES Round Keys for decryption?

The usual implementation of AES first computes all the Round Keys sequentially starting from the key, and stores them in RAM for later uses. However, when enciphering a single block with a key that ...
2k views

### AES-GCM and its IV/nonce value

I was reading about the differences between the GCM and the CBC more here and I have a follow up doubt on the same. In the CBC mode the person who performs the encryption is the one who provides the ...
2k views

### Why is it important that phi(n) is kept a secret, in RSA?

Why is it important that $\phi(n)$ is kept a secret, in RSA?
161 views

### What would the Internet be like without public-key cryptography?

The functioning of the Internet as we know it nowadays depends very heavily on public-key cryptography, including several key root systems that depend on its asymmetric properties. But what would it ...
462 views

### True 128bit secured password length?

assume we say 128bit keys are secure so a 16 character long password is safe, but if i even use lower case and upper case letters with numbers and special characters on my keyboard its about 80 ...
102 views

### AES 128bit round level recommendation

we don't want change standard just after every attack, now for AES 128bit blocks i think 16 round is secure, but what is best round amount ? we had attack for 7 round then 10 round and it going so on ...
946 views

### Why the following attack in common modulus RSA works?

Suppose that i share a common modulus $N$ with two users $u_1$ and $u_2$ with public, secret keys ($e_a,d_a$), ($e_b,d_b$). Why then $gcd(V,e_b)=1$ where $V=d_a*e_a-1/$W and $W=gcd(e_b,d_a*e_a-1)$ ...
164 views

### Does zero-padding the secret in Shamir's sharing scheme increase security?

When performed in binary Galois fields $GF_{2^n}$, Shamir's threshold secret sharing scheme produces shares that are each the same bit-size as the secret. Though the scheme is "perfectly secure" in ...
1k views

### Double Encrypting with two different keys

In terms of security, would it be MORE or LESS secure to take, say, an RC4 output (or Serpent) or other, that is encrypted with one key, and to encrypt that output with AES (using a different key)? ...
552 views

### creating a small number from a cryptographically secure random string

i'm trying to figure out the best way to generate a cryptographically secure random number between 0 and 200 from a cryptographically random string of bytes (ie. read from /dev/urandom or some such) ...
136 views

### What is an easy method of proving that a cryptographic oracle attack is possible?

Lets say an application is using CBC mode without authentication. The application is generating cipher text. This cipher text can be manipulated by the attacker and then transmitted back to the ...
I am something new to election protocols and I am trying to construct an election protocol for the following problem: Let $A= \lbrace a_{1} , . . . , a_{n} \rbrace$ and $B = \lbrace b_{1} , . . . , ... 1answer 526 views ### Proving that a scheme is not IND-CPA-secure Suppose I want to prove that a given symmetric encryption scheme is not IND-CPA secure. The first thing I do is to define a specific adversary that attacks the scheme. How can I proof neatly, (using ... 0answers 53 views ### P-Complete hashes, hashing to a larger set Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ... 1answer 259 views ### Is there a field guide to ECC for the IT Security layman? I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ... 1answer 6k views ### AES vs Blowfish taking key-length into account I understand that Blowfish is getting old, but is still a secure algorithm, and that AES is very popular, and is recommended by most people. My question is, how do the two compare when a 256-bit key ... 1answer 2k views ### AES key length greater than 256 bits - is it dangerous to do an implementation outside of the standard? I'm making a digital-asset manager written in ActionScript 3, it will be used to manage highly sensitive information. I'm using the AS3Crypto library (which has quite a good reputation) to implement ... 1answer 85 views ### tower of extension field while working on tate pairing, i have to implement towering technique. like i have point p on F(q) and point Q(F(q^k)) (here embedding degree k=12 for BN curve). instead of taking a point Q on ... 1answer 626 views ### How to generate a public key from a private ECDSA key? Having some specific ECDSA curve and a private key, how does one calculate the public key? I am having a hard time finding the algorithm and equations for it. 1answer 82 views ### Tweaking textbook RSA to make the encryption a Pseudorandom function Lets say I want to tweak/alter the textbook RSA encryption function to create a pseudorandom function by pre-processing the input. Suppose I do something simple like add 2 to the input before ... 2answers 318 views ### Good enough deterministic PRNG based on hashes Lets say I have a seed named iv which has a decent amount of entropy. Are there any glaring issues with the following? First 64 bytes are generated by SHA512(iv) Next 64 bytes are generated by ... 1answer 219 views ### Using chi square for distinguishing between compressed and random data I am trying to find some measurement for identifying and distinguishing between compressed and random data. I tried this first by computing the entropy of such data, the entropy value is extremely ... 0answers 49 views ### Generating Polynomials for the MPQS I'm going to try and eventually factor RSA-100, but my current QS needs a lot of improvement, so I'm going to try and switch over to the MPQS. I'm a bit confused as to how the MPQS works, which is ... 2answers 578 views ### Why is h(m||k) insecure? Here is the post that explains the failure for doing h(k||m) and I understand it. But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain? 2answers 186 views ### Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset Suppose$g$is a generator of an order$p$cyclic group in which discrete logarithm is hard and$p$is a prime (i.e., given$g^x$for a random$x \in \{0,1,\ldots, p-1\}$, it is hard to recover$x$... 1answer 89 views ### Individual bits of Textbook RSA This question relates to the underlying RSA assumption. Forgetting about the fact that Textbook RSA is deterministic, I am curious about the assumed strength of the RSA problem. Does RSA hide all ... 1answer 207 views ### A question regarding relevance of vulnerability of MD5 when linking multiple records together I have been studying a Supreme Court case "IMS Health vs Sorrel". In this case a Friend of Court brief filled by "Electronic Privacy Information Center" states that use of MD5 hash function to link ... 3answers 160 views ### Can the encryption exponent e be greater than ϕ(N)? So I was just wondering in RSA, can the encryption exponent e be greater than ϕ(N)?? For an examples sake, lets just say N = 707, so p = 101 & q = 7. So, we have ϕ(707) = 600. Can I have e = ... 2answers 1k views ### AES Key Length vs Block Length This answer points out that certain key and block lengths were a requirement for the AES submissions: The candidate algorithm shall be capable of supporting key-block combinations with sizes of ... 4answers 577 views ### Cracking WWII-era codes - code found on a pigeon's leg in Surrey A recent BBC article entitled WWII code 'may never be cracked' posted a code: AOAKN HVPKD FNFJW YIDDC RQXSR DJHFP GOVFN MIAPX PABUZ WYYNP CMPNW HJRZH NLXKG MEMKK ONOIB AKEEQ WAOTA RBQRH DJOFM TPZEH ... 2answers 151 views ### Contruct a protocol to determine if three secret keys are different, without revealing any of them? I am trying to find a protocol for this problem: Three persons,$A$,$B$, and$C$, know secret numbers$s_{A}, s_{B}$, and$s_{C}$, respectively. They want to know whether their numbers are all ... 1answer 486 views ### How much extra information is in an RSA public key? I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ... 1answer 168 views ### Is this attack for RSA possible?$N=p·q$($p$and$q$are prime numbers),$m_1, ..., m_x$are the messages,$e$and$d$are RSA encryption and decryption exponents, respectively. I am given$e, m_1, m_1^e, m_1^d, ..., m_x, m_x^e, ...
I was trying to understand RSA when I encountered the Euler Function. I do understand this: $\phi(P)$, where $P$ is a prime is $P-1$. However it seems that for a number $N$ such at $N=P\cdot Q$ where ...