# All Questions

6k views

### AES in ECB mode weakness

In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long. Very ...
3k views

### How can a random salt for a hash function work in practice?

I understand the theory behind the use salts in hash functions, but when I see it implemented, the implementations always generate the salt on the fly and the salt appears to be different for every ...
2k views

### How were the DES S-box values determined?

It seems like the S-boxes in DES have essentially random values. How were these chosen?
399 views

### Key Length & Hashing

I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit. I am using the SRP protocol for authentication (a ...
2k views

### Does the generator size matter in Diffie-Hellman?

For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators. What is the benefit of using ...
4k views

### RIPEMD versus SHA-x, what are the main pros and cons?

RIPEMD is a family of cryptographic hash functions, meaning it competes for roughly the same uses as MD5, SHA-1 & SHA-256 do. The Wikipedia page for RIPEMD seems to have some nice things to say ...
212 views

### Are there reference implementations of ECQV implicit certificates?

I am interested in exploring ECC implicit certificates, specifically using the ECQV protocol. While the actual implementation would not difficult to perform using building blocks provided by most ECC ...
3k views

### Why has the RSA factoring challenge been withdrawn?

Wikipedia states that RSA challenge has been withdrawn. Does it mean that an efficient factoring algorithm is "just around the corner"? or are there some other reasons? If the challenge was still ...
3k views

### What is the “Random Oracle Model” and why is it controversial?

What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else? And why do some researchers have a strong distrust of this model?
1k views

### How well does scrypt perform on different architectures / OSes?

The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to ...
885 views

### Encrypt-then-MAC Confidentiality, Integrity and Authenticity

Does Encrypt-then-MAC provide equal confidentiality, integrity and authenticity as other constructs such as EAX? If yes, how do I go about using it? My current understanding is: E = ...
159 views

### Generating non-repeating N-bit IVs, which are indistinguishable from randomness

I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
2k views

### How do other, non-RSA algorithms, compare to the PKCS #1 standard?

Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means. I'm considering the ...
170 views

### When is an asymmetric scheme considered broken?

Does the following quote imply that valid encrypted data can be created and decrypted by someone other than the owner of a private key: An asymmetric encryption scheme is considered to be broken ...
161 views

Does any one have, or can refer to a Known-Answer-Test (KAT) for Triple DES Keying Option 2? (Keying Option 2 means $C = DES_{k_1}(DES^{-1}_{k_2}(DES_{k_1}(P)))$ for encryption and $P = ... 1answer 833 views ### Why choose an authenticated encryption mode instead of a separate MAC? What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ... 3answers 251 views ### SIM security for two messages Here SIM means the simulation based security Consider a two message encryption scheme:$$Enc:K \times M \times M \rightarrow C \times C$$ and$Enc(K, m, m')=(K \oplus m, K \oplus m')$, In ... 3answers 2k views ### At the current time, is SHA256 the de facto standard for strong cryptographic hashes? At the current time, is SHA256 the de facto standard for strong cryptographic hashes? From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ... 1answer 155 views ### Signature scheme with two private keys, neither derivable from the other Is there any scheme, ideally one widely used or at least widely available, where you can treat both the signing and verifying keys as secret? Basically, the functionality I'm looking for is this: ... 2answers 1k views ### How exactly would someone crack a private key passphrase? [closed] Lets say for a PGP/GPG pair with a passphrase. 1answer 205 views ### A set of key pairs and one hash to secure them I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it ... 2answers 271 views ### If Bob steals Alice's private key, how exactly would he read her encrypted documents? So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files? What I am reading is that no he does not need it but as far ... 3answers 1k views ### Hashing or encrypting twice to increase security? Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ... 1answer 316 views ### How exactly would someone attempt to analyse ciphertext produced by popular encryption products such as Truecrypt/PGP? I am interested in understanding what the process would be if an attacker wished to attempt to decrypt data secured by common tools such as OpenPGP, Truecrypt or the like. Are there any documented ... 3answers 925 views ### How does one scale encryption strength upwards from 256-bit? I have seen many examples of encryption up to about 256-bit. But how does one programmatically scale the logic upwards in a language such as PHP or Java to say 1024-bit or even 4096-bit and higher? ... 1answer 286 views ### How did the Koblitz/Menezes papers affect the cryptography community? Two highly-critical papers by Koblitz and Menezes (two well-regarded mathematicians who've contributed to the crypto community) were published years ago: Another Look at “Provable Security” in 2004, ... 2answers 552 views ### Where can i get the info to implement AES? I know there are 100's of AES programs and websites out there but I can't seem to find a site that give me the detail I think I would/should need to write my own java program. I was to write AES form ... 3answers 299 views ### Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such? Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute ... 3answers 2k views ### For Diffie-Hellman, must g be a generator? Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must$g$in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ... 2answers 366 views ### Why use a 1-2 Oblivious Transfer instead of a 1 out of n Oblivious Transfer? When initiating an oblivious transfer, why would someone use a 1-2 oblivious transfer rather than going for an 1 out of n oblivious transfer? Perhaps a slight time overhead for the extra message ... 4answers 732 views ### Can an Enigma-style cipher of sufficient complexity be considered secure in today's world? Regarding the German Enigma machines, if I recall correctly, the reason they were defeated was because the Allies were able to generate a massive database of possible rotor settings, and because the ... 1answer 500 views ### Need an introduction to SPKI (or “SPKI for dummies”) I am familiar with concepts such as the following: PKI and CAs ID based cryptography Certificateless cryptography PGP web of trust more or less anything in basic Crypto that is taught in a college ... 2answers 728 views ### Can a computationally unbounded adversary break any public-key encryption scheme? Assume there is a public-key encryption scheme$(KeyGen, Enc, Dec)$with perfect correctness (i.e., for all messages M and valid key-pairs (PK,SK), we have$Dec_{SK}(Enc_{PK}(M))=M$). Will there ... 4answers 948 views ### Webapp password storage: Salting a hash vs multiple hashes? For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better. But, if bad guys steal your ... 1answer 637 views ### Implementation of Tao Xie and Denguo Feng's MD5 attack It is well known that MD5 is completely broken today - however, to understand the theory behind the attacks I am looking for an implementation of the collision attacks described in the 2009 paper A ... 1answer 359 views ### What is the best method to determine the language used in a monoalphabetic substitution cipher? Working on a cipher (which I assume to be a mono-alphabetic substitution cipher due to the letter frequency) I struggle with the fact that I don't know which language the plain text is written in. ... 3answers 641 views ### Converting a stream cipher into a block cipher The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ... 2answers 1k views ### How do I apply differential cryptanalysis to a block cipher? I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis. I ... 2answers 199 views ### Background for modular arithmetic function I'm investigating this function:$a := ((b\cdot c) \bmod k) - (b \cdot c)/k$where$/$indicates integer division. Two things I've noticed: It's equivalent to multiplying a·b, and then ... 2answers 323 views ### Analysis of Repeatedly Enciphered Plaintext using Same Algorithm / Key Please forgive the impracticality of this question, but I'm curious about the behaviors of encryption algorithms applied to their own output. Suppose I have an encryption algorithm E and (using the ... 3answers 592 views ### UMAC: to what extent is it in use today? Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the ... 1answer 157 views ### Is a changing public truecrypt container secure? I have a Truecrypt container which I want to synchronise between computers (i.e. different people, that I want to share the data with). If I used Dropbox for synchronisation and someone downloaded ... 1answer 270 views ### How is the MJH double-block-length hash function constructed? I'm looking for information on the MJH double-block-length hash function, but the best free source I could find is the diagram on page 18 of Efficient hashing using the AES Instruction Set (submitted ... 5answers 645 views ### How do I construct a 256-bit hash function from 128-bit AES? I would like to generate a 256-bit hash on a microcontroller that has a 128-bit (only) AES engine. How can I construct a 256-bit hash function from a 128-bit cipher? 4answers 10k views ### Basic explanation of Elliptic Curve Cryptography? I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ... 1answer 609 views ### Digital Signature Algorithm signature creation I was studying DSS from "Cryptography and Network Security" by William Stallings. What puzzled me was the DSS approach figure described in the text. It says it uses Public and Private Keys for ... 3answers 685 views ### ANSI X9.31: the purpose of the date/time vector in the PRNG? What is the exact purpose of the date/time vector$dt\$ in the ANSI X9.31 PRNG? $$I := E_K(dt)$$ $$R := E_K(I \oplus V_{old})$$ $$V_{new} := E_K(R \oplus I)$$ Specifically, the document seems ...
2k views

My application can authenticate via openid and oauth (facebook, twitter, etc) and also with its own authentication system. I previously switched hashing from MD5 to SHA1 and during migration I had to ...
511 views

### KeeLoq showing that decryption is indeed the inverse of encryption

In some text I am reading, there is an exercise asking to show that KeeLoq decryption function is the inverse of the encryption function. Details about KeeLoq are given in the Wikipedia article. As I ...
235 views

### What is the sign bit for in Feige-Fiat-Shamir?

The Feige-Fiat-Shamir identity scheme is based on a ZKP assuming that square roots are "hard" modulo an integer of unknown factorization. The "parallel version" of this protocol includes a "sign bit" ...

15 30 50 per page