# All Questions

0answers
145 views

### Safe and computationally efficient way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which ...
1answer
369 views

### crypto design with AES256 MODE OFB

I have the following APP Design key store (contains 1:n user payload as 1:n key store entries) key store salt (is used to extend to key store password to 256 bits, stored in clear text) key store ...
1answer
1k views

### Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
1answer
149 views

### Pseudo random permutation for arbitrary size domains

Popular block ciphers like AES or Twofish are keyed pseudo random permutations on the domain $\{0,1,\dots,2^{k}-1\}$ with $k\in\{128,192,256\}$ or similar. I'm interested in pseudo random ...
1answer
170 views

### simple multiplication in GF(8)

I am trying to do multiplication in the GF($2^3$) defined by the irreducible minimum binary polynomial $X^3+X^2+1$. I want to multiply $A(x) * B(x)$ where $A(x) = x$ and $B(x) = x^2$. The ...
1answer
126 views

### If its possible to derive the public key from a private key, why can't we go in reverse?

I'm looking at source code for BitcoinJ that derives a public key from the private key. ...
3answers
329 views

### How can we sign a contract digitally between two parties?

I'm trying to sign a contract with another party, without using handwritten signatures. I've just read through Applied Cryptography, but there doesn't seem to be a protocol that can solve this ...
1answer
429 views

### Proofs by reduction and times of adversaries

I have some difficulties to understand, when we construct a reduction, how we determine the time for the constructed adversary to break a target security property. In general these details are not ...
1answer
190 views

### ElGamal with elliptic curves I

It is very interesting to see @tylo's answer on ElGamal with elliptic curves. Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its $x$ coodrinate. ...
3answers
257 views

### Why can't hashes be reversed with toffoli gates?

This is a follow up question to this question: Crack cryptographic hash functions using Toffoli gates?. Suppose there is a hash function $$H(x)=y,$$ where $x$ is the input of the function and $y$ is ...
2answers
223 views

### Current standard for hash function security parameter?

When designing a hash function, what should be the secure input and output lengths? In particular, what lengths do I need for collision resistance?
1answer
246 views

### Is this approach to generating a “random” number from a sha512 hash effective?

I'm looking to run a small raffle but i'd like people to be able to verify that the number chosen was fair. I know some sites use a "Provably Fair" system to achieve this where user input is combined ...
2answers
95 views

### Should tweak be unique per message?

Since tweaks are like IV,Salt for block cipher inputs . Should they be unique for each message ? If they are to be unique per message then what is the advantage of giving tweak directly into the ...
2answers
519 views

### Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
2answers
405 views

### If attacker knows salt and hash, how is salt effective?

Maybe I'm missing something, but if my salt and hashed/salted password are stored in the same place, how is salting any more secure than just hashing? Does this just rely on attackers not knowing how ...
4answers
164 views

### Is there a standard way to extend the output of a hash?

Say I have a hash function, a state-of-the-art hash function that we would all approve of that produces a fixed number of bits (n) as output. (I'll call it HASH.) Is there are a standard way to ...
0answers
151 views

### Hash function that is efficient on GPU and poorly suited to ASIC

I have such requirements to the hash function in my project: operating on 32-bit data, not mathematically breakable (built on existing hashes known to be secure), free of branching, as much as ...
0answers
60 views

### What does the notation $1^n$ stand for? [duplicate]

I'm seeing this all over my Katz and Lindell book and I don't see where they introduced it.
2answers
106 views

### Needed: signature over a collection of hashes

I'm looking for some kind of crypto-based data structure that will allow me to produce a signature over a set of hashes. Call this a SignedSetOfHashes. I want to be ...
1answer
211 views

### a doubt in Rijndael's key expansion sizes

I've often heard/read that AES key sizes 256 & 192 would be weaker than 128 or not stronger as expected from the size increase, but I've never seen a proof. How does one proof the strength of a ...
3answers
407 views

### RSA assumption and cryptography

The RSA assumption states that it is hard to find $m$, given $c = m^e \bmod{n}$, $e$, and $n$ (for appropriate choice of $n,e$). Suppose that there exists an algorithm, $D(c,e,n)$, that finds $m$ in ...
2answers
388 views

### How can I simulate and measure brute force hacking using RSA?

I want to implement brute force hacking using RSA. How can I simulate and measure time duration? What software (or software-based simulator) would be needed?
1answer
114 views

### Hashing a uuidv4 + time to create a unique id

First, I am no crypto expert although I am doing the MOOC. I have an item which has as id: uuidv4 When I create this item: I create a new uuidv4 check if it already exists and if not, I store it ...
1answer
678 views

### Is the random data at the end of my decrypted message supposed to be there?

This is my PKCS#5 & AES/ECB Python 3.3 code: ...
3answers
320 views

### One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on ...
2answers
491 views

### Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?

I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines: Consider routine 2.2.7 of ...
1answer
158 views

### How to determine which type of crypto is used in a text file? [closed]

is there a tool or a way to determine which type of crypto is used in this type of text: ...
0answers
218 views

### Prove preimage resistance property

Let $f : \{0,1\}^* \rightarrow \{0,1\}^n$ and $g : \{0,1\}^* \rightarrow \{0,1\}^m$. $h$ is created by concatenate f and g: $h : \{0,1\}^* \to \{0,1\}^{n+m}$ with $h(x) = f(x) || g(x)$. How do I ...
1answer
128 views

### AES CBC encoding of decomposable OAuth2 tokens

We're building a stateless RESTful API that relies on the content of OAuth2 tokens to identify users and what they have access to. Users authenticate with other means and are given a token, which they ...
1answer
231 views

### Unique, anonymous online authentication

Is there a way to authenticate users online without knowing their real identity yet preventing them from registering twice? If not, what is the least amount of information you would need? If it helps, ...
1answer
83 views

### Collecting entropy from a stream to a file

I have a potentially infinite stream of data originating in some physical phenomena that may expose random behavior (due to quantum effects, thermal noise, the butterfly effect in chaotic dynamical ...
1answer
270 views

### Generating Diffie-Hellman parameters efficiently

I am working on an Android project for school and I am supposed to do a DHKE (Diffie Hellman Key Exchange). Everything works well. The problem is that it takes a lot of time (really a lot) to ...
1answer
346 views

### What are some restrictions when converting Montgomery Curves into Weierstrass Curves?

I want to represent a Montgomery Curve (curve25519) in Weierstrass form as a personal exercise. After doing some math and referencing the conversion equation at ...
1answer
126 views

### Diffie-Hellman explicit key confirmation

Suppose I wanted to add explicit key confirmation to Diffie-Hellman key exchange, would the following scheme be secure? Alice selects a random $a$ and sends $g^a \mod p$ to Bob Bob selects a random ...
3answers
1k views

### What is a Non-Interactive Zero Knowledge Proof?

I understand the concept of a Zero Knowledge Proof thanks to the easy to understand analogy of Alibaba's cave. However, this seems to require interaction between the verifier and the other party. I ...
1answer
279 views

### Help in understanding exactly how lattices used as one way functions for hashing

I am doing a cryptography course via long distance and we have been given an assignment which is based on lattice-based cryptography. I have spent the majority of the past week sifting through papers ...
0answers
77 views

### For $e(g, d) = c$, can we compute $d$, given others

Given $$e(g, d) = c$$ where, $e$ is bilinear pairing function chosen by the user/attacker, the values of $g$ and $c$ are known $g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$ can we somehow ...
1answer
502 views

### Encrypting a payload for transmission over HTTP. AES256 with PBKDF2

I've done some reading about implementing AES256 and deriving a key from a password. If I understand correctly: I want to generate a new salt (for the key) and a new IV (for the encrypted message) ...
1answer
544 views

### Known vs. Chosen (plaintext and ciphertext) and RSA

I want to know whether I can break RSA (textbook) with known plaintext/ciphertext attacks. Known plain-text Let $c$ be the ciphertext and $m$ the plaintext. $$c = m^a \mod n$$ Since all I have is ...
1answer
108 views

### Do both client and server need to implement OpenSSL protections to protect from CBC attacks

In regards to the protections implemented in OpenSSL 0.9.6d (described in section 2. http://www.openssl.org/~bodo/tls-cbc.txt). My understanding is that the mechanism prepends an empty record when ...
1answer
80 views

### Key change and key derivation

There are two ways for key change: key update, and Re-keying. Which of these methods use a KDF (Key Derivation Function) for getting new keys?
1answer
118 views

### Why does a one-time-pad key have to be at least as long as a message? [closed]

I am studying one time pad and find it hard to understand. What happens if the key is one bit or 100 bits shorter than the message?
2answers
894 views

### Securely send public key from client to server in RSA?

I have a client and a server communicating with messages encrypted using RSA. Initially, the client knows server's public key, but the server does not know the client's public key. Is it possible to ...
1answer
288 views

### One-way permutation over a small interval?

I am wondering what concrete computable functions we know that are a permutation over an integer interval of parameterizable size $s$, for relatively small $s$ starting circa $2^{64}$, to perhaps ...
1answer
282 views

### Practical (and secure) PRGs

Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, ...
1answer
64 views

### Bicliques for permutations

So I'm trying to understand the complexity of the biclique attack on Grostl and I have some questions: 1) The paper introduces sliced bicliques where on Grostl one constructs a biclique of dimension ...
2answers
176 views

1answer
452 views

### Importance of block size in CBC mode

Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
1answer
1k views

### Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...

15 30 50 per page