# All Questions

2k views

### What does an RSA signature look like?

I am using OpenSSL libs to generate signatures. Internally, I learn that a signature is a hash of the message with some padding added to it. I am trying to understand the structure of a signature. If ...
98 views

### Tweaked Square Roots and Rabin-Williams

I'm reading Bernstein's RSA signatures and Rabin–Williams signatures: the state of the art. In section 6, Bernstein states: Recall that Rabin’s system needed to try several values of r, on ...
199 views

### Is the inverse of a point on an elliptic curve over $\mathbb{Z}_p$ always in the group?

I'm working on a zero knowledge proof system that uses ECC over $\mathbb{Z}_p$ (currently using NIST P-256 since mbed TLS doesn't support group operations on Curve25519, but the problem should be ...
109 views

### What's wrong with an iterative (with counter) hashed salted KDF?

It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a ...
50 views

### How to find an impossible differential?

Given an arbitrary SPN-based cipher with X rounds. How to find an impossible differential for this cipher? What are strategies to find one?
79 views

### zero knowledge framework for c programs - how to prove correct C program execution with private inputs

I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as: I know x s.t. SHA-256(x) = y (y is public, x is ...
3k views

### Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
289 views

### RSA public key recovery from signatures

Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized. I need it to verify any future message comming from ...
347 views

### Calculating XOR Key Sizes

I've been playing around with the Matasano crypto challenges (cryptopals.com). I had a couple false-starts on the challenge that has you creating a program to calculate the key size of a XOR encrypted ...
127 views

### Is randomsound for increasing entropy pool not doing what it is supposed to do?

I am using randomsound because I thought it would be a good idea to inject some additional entropy into the entropy pools of my linux machines (clearly those machines have a corresponding sound card). ...
274 views

### Looking For Additively Homomorphic Encryption

I have a construction that requires as primitive an Additively Homomorphic Encryption scheme that does not rely on hidden group order, meaning I can't use Paillier. I now have two different ...
60 views

### Are there security issues with adding plaintext length to TLS packets?

I have quite a big problem, because of a software implementation of TLS I had to adapt I had to create something which is now biting me. It all comes down to this: I need to know the length of the ...
90 views

I've reading on GPG since yesterday and I have a doubt: the whole system of double key encryption does make sense but it looks to me like either way you are compromising something in terms of security....
141 views

### Pailler encryption of small integers to 32-bit integers

I want to encrypt very small integers in the range 0-44 using the Paillier cryptosystem. Is there a way to select p, ...
161 views

### Converting ECC Code from python to Java. Extended Euclidean Algorithm not working. [closed]

I'm in the process of converting a Python program I found for calculating ECDSA public keypairs from a given private key. In this particular case it's on the Bitcoin curve. https://raw....
148 views

### Is it OK to encode data using key equal to data

For some project, I need to store some short string in encrypted form. It would be ideal for the current purposes to encrypt it using itself. ...
163 views

### PQ Key Exchange based on Elliptic Curve Isogenies

I was reading the Wikipedia article on Post Quantum Cryptography and was interested in opinions as to whether the Supersingular Elliptic Curve Isogeny Diffie-Hellman listed there would be a good Post ...
227 views

### Why does anyone use elliptic curves for a CSPRNG?

I saw Martijn Grooten's talk on elliptic curves at BSides London this year, and it helped me understand how elliptic curve crypto works, especially in the case of Diffie-Hellman (ECDH). He also ...
109 views

### Unicity Distance - AES

I am quite confused calculating the unicity distance and I was hoping that someone can clarify some things for me. My main issue comes from somewhat a difference of the calculation given by our ...
55 views

### Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
128 views

### Is it OK to use a hash of the key as nonce for AES GCM?

I don't see an immediate risk of using the hash of the key as the nonce for AES GCM. Is there something I could be overlooking?
113 views

### Defining format-preserving encryption for natural language

Assume we have plaintext in natural language. Can we use format-preserving encryption in such a way that the produced ciphertext cannot be distinguished from natural language?
264 views

### Will non-ECC algorithms like RSA eventually become too inefficient?

The strength of symmetric and asymmetric encryption schemes scales with the key length, but there is a difference between symmetric algorithms like AES and asymmetric algorithms like RSA. For example,...
636 views

### SHA-256 hash of null input?

What is the SHA-256 hash if the input is null, i.e. an empty bitstring? (Not the hash of 0 or "0".)
44 views

### AM protocol for 2 distinct objects

Prover is going to convince verifier that 2 objects are distinct, do you know any Arthur-Merlin protocol for this problem?
715 views

### Trying to understand the use of ECC in TLS certificates

I was looking the certificate of this website: https://www.cloudflare.com that has an ECC based certification. I'm just curious to know if is possible to understand which elliptic curve is used and ...
252 views

### Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, etc....
80 views

### What is meant by - computational complexity $2^x$?

Recently Bi-clique Cryptanalysis allowed to obtain following results on full AES ES that claim to have The first key recovery attack on the full AES-128 with computational complexity $2^{126.1}$ The ...
253 views

### How is information disclosed by modular multiplication?

Consider the case that $c = a \cdot b \mod p$ where $p$ is a known prime and $0 < a < p$ and $0 < b < p$ are unknown integers numbers. Furthermore, some bits on the value of $c$ are ...
85 views

### Distinguishing attack on stream cipher created from a block cipher in counter mode

A block cipher in counter mode creates a key stream by: $$z_i = E_K(IV || i)$$ Where $IV$ is some chosen initialisation vector (with some length $l$ less that $n$ bits) and $i$ is the binary ...
333 views

### What makes SHA-2 and SHA-3 have security levels half their output hash length?

The tag wiki for sha-256 says, in part: SHA-256 ... processes the input in 512-bit block and has a 256-bit output, for a 128-bit security level. I'm not a cryptographer, just an interested ...
103 views

### Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?

From wikipedia, the DDH assumption says，given a cyclic group $G$ of order $q$ with generator $g$, $(g^a, g^b, g^{ab})$ looks like $(g^a, g^b, g^c)$ where $a,b,c$ are randomly and independently chosen ...
476 views

### How secure is a lagged fibonacci sequence for encrypting brief messages?

Say I start with a 26-letter keyword and convert the letters into 26 integers (A=0, B=1...Z=25) nr[0] to nr[25]. Then I create a stream, nr[26] onwards, with a lagged fibonacci sequence where nr[n]= (...
87 views

### Is it possible to encrypt a message's destination as well as its content?

I have imagined a way to break through any kind of censorship but since I don't have enough professional knowledge of cryptography I don't know whether it is feasible or not. If there is a method ...
58 views

### Share two secrets between two parties [duplicate]

Alice has a secret A, Bob has a secret B. They have a secure channel and a MAC. They each want to know the other's secret, but don't particularly want to give up their own. However, neither will not ...
79 views

### Is it right about an example of bilinear map $e$?

The equation for the elliptic curve is $y^{2} = x^{3} + x$ and is defined over the field $F_{q}$ for some prime $q\equiv 3 \pmod 4$, and set $q=307$. Choose random generator $g=[182, 240]$. My ...
78 views

### Solving discrete logarithm when p is not a safe prime

If you have the cyclic group of integers modulo $p$, where $p$ is not a safe prime, as well as a generator $g$ with which for all factors $q$ of $(p-1)$, $g^{(p-1)/q} \ne 1$, This answer says that ...
133 views

### Sending the next one-time pad key in this one-time pad message? [duplicate]

I am doing a research project on cryptography next year, and I'm really new to cryptography. This isn't some really advanced thing or anything, and I'm just trying to come up with something basic. ...
107 views

### Is it OK to substitute a PRF for a random oracle?

Random oracles don't exist, but aren't PRFs essentially indistinguishable from them? So why can't we substitute pseudorandom functions wherever we use random oracles? And if we can do this, why is ...
91 views

### Brute Force on Key

If you are brute forcing a key and trying trillions of combos, how will you know when you accidentally hit the right answer? Clearly you can't look at each decoded answer to see which "looks right".
1k views

### AES-CTR in BouncyCastle with string key, without IV or salt [closed]

Our team is encrypting data using a javascript snippet. My problem is I'm supposed to parse them back in my Java code. I am having troubles identifying parts of the algorithm. The code says it's CTR ...
125 views

### How to decrypt unusual Many Time Pad

How does one decrypt the many time pad: ($R$ is a random string, $C$ is ciphertext, $P$ is plaintext) $R_0 \oplus R_1 = C_0$ $R_2 \oplus R_1 = C_1$ $P_0 \oplus R_1 = C_2$ assuming that $R_n$ are ...
92 views

### verify fails on 3rd party after signing with BouncyCastle

I am using BouncyCastle to perform ECDH and then encrypt the data between the mobile (Android) and my hardware with ECIES. It all works fine. When I try to sign a byte array and send it to the ...
107 views

### Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case

I need to know: 1- What does exactly correctness mean in this context? 2- How is correctness implied in malicious model? 3- If the correctness means " the adversary cannot cause the output to be ...
880 views

I have an application that I use sha3-512 to hash my password with a randomly generated 64 characters salt for each password. Is it bad to use this method to store passwords? I know many people ...
117 views

### Is it possible to decrypt this message with partially known data? [closed]

The following highlighted text must contains 547a5e0e008be33730158d63ce844e67 data. I don't know about encryption method and key. Is it possible to decrypt it? ...
79 views

### Property of Multiplicative group of integers mod n

While practising on paper I've realized of a property of multiplicative group of integers mod $n$. First, let's define $G$ being $p$ a prime and $g$ a primitive root mod n or a generator of a ...
162 views

### Is it possible to make an encrypted text look like a sentence consists of random words?

Without having any knowledge of common encryption methods, I wonder if an encrypted text can look like random valid words as if it is a sentence. Is it possible? If so, what methods should I use?