# All Questions

1k views

### Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
717 views

### Identification of correct plaintext after decryption in Rabin cryptosystem

In the Rabin cryptosystem, decrypting a message can produce four different outputs, of which only one is the correct plaintext. How can one know which of the outputs is the correct one?
232 views

### Alice's forgetful banking

Alice has a bank account number, but has forgotten which bank it is for. There are 4 banks, run by Bob, Carlos, David, and Eve. She could find out by going to all of the banks and asking if they have ...
464 views

### Encrypting and MACing different data with same key

It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
262 views

### What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?

I'm working with the affine representations of points of the Secp256k1 elliptic curve (from Bitcoin). I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed ...
147 views

### Does knowledge of original file size provide a cryptographic weakness?

I'm encrypting files using an AES-256 CBC cipher and an SHA-256 HMAC every 64KB in the file. Since AES CBC needs an amount of input bytes to be divisible by 16, I use PKCS#7 padding to bring the ...
367 views

### Many consecutive hashes to slow down brute force attack?

I've heard that hash algorithms like bcrypt are more secure because they take longer to complete, and therefore take much longer to brute force, without a ...
149 views

### AES Message Authentication Vulnerability

My securities instructor recently posed this question to the class and I am bending my brain in half trying to figure it out. Suppose $y_1 = AES(K, x_1)$ and $y_2 = AES(K,x_2)$, and suppose you ...
194 views

### How comparable is OFB to a one-time pad?

This is a rather trivial question, I just want to see if I get the concept right. In OFB you generate a pseudorandom stream based on some nonce, and you XOR that with the message to get the ...
350 views

### How to efficiently generate a stream of independent, but biased random bits?

Usually, in cryptography, one is interested in debiasing a stream of independent (true) random bits, and several algorithms exist to do this. What about the converse? Let's assume I have a stream of ...
384 views

### Is semantic security important in a hybrid cryptosystem?

RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption. Is this a problem for hybrid cryptosystems at all? My ...
2k views

### Can a shift cipher attain perfect secrecy?

On a practice question for my intro cryptography exam, it asks the following: Assuming that keys are chosen with equal likelihood, the shift cipher provides:    A) computational security ...
209 views

### Need for Twin Elgamal encryption

What is the need for two private/public keys in twin elgamal? I'm relatively new and would need some help.
1k views

Say I have ...
594 views

### AES key expansion vs. a hash

Is there something special about the AES key expansion algorithm that makes it secure, or it is a compromise between security and speed? For example, say with a key I expand it by taking pbkdf2(key) ...
840 views

### Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. It's the task from two-years ago exam. At the bottom I reminded one definition. Let $(Gen_E,Enc,Dec)$ be an IND-CPA-...
581 views

### What is the strength of unpadded RSA?

I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling. How many bits of security does unpadded RSA have, in relation to its key ...
355 views

### Why does .NET's ECB mode implementation append a constant block to my ciphertext?

Consider the following code and output: ...
1k views

### Can we trust digital signatures?

Consider that Alice wants to send a digitally signed message to Bob. Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
552 views

Sorry if this is a noob questions, but I finally figured out how to implement the Tiny Encryption Algorithm in C++. My question is what to do about padding the key and the plaintext? I know that ...
213 views

### How hard is to find the operators of an addition knowing the sum of them?

I want to learn whether or no there is a cryptographic primitive,scheme assumption that is based on the following hard problem if it is hard . By hard we mean that we have a polynomial adversary: The ...
2k views

### How to sign a message using RSA?

Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits. I don't know much about cryptography, but I can get these numbers ...
81 views

Suppose you need to authenticate yourself to a program with the password - but the program's source code is public, the program doesn't have access to any private information and all your ...
379 views

### Realize a MAC using a Pseudo-random function?

Given a pseudo-random function and assuming that we do not have any other tools, How can we construct a MAC? I believe this can be done. Would like to know if there is more than one way of doing ...
4k views

### Secure way to transfer data over NFC?

I am currently writing a payment system to accept payment details from an NFC enabled smartphone (BlackBerry 9900) to a Windows client (C#.NET) I am currently having two issues relating to security: ...
390 views

### Is EKE attackable by a brute-force password search?

So I'm trying to properly implement the EKE protocol and I'm using C# with the Windows CNG and ECDH key exchange. I need to use this because it's FIPS certified and all that jazz. So what I'm ...
28 views

### Homomorphic Encryption operation for regression

I must be missing something, and I am sorry if this is a novice question... I have seen in places (eg. https://crypto.stanford.edu/~dwu4/talks/SecurityLunch0214.pdf page 13) that linear regression is ...
62 views

### SEAL Homomorphic multiplication

In SEAL homomorphic encryption library, there is an internal procedure to decompose a polynomial with large coefficients into a vector of polynomials with smaller coefficients. The procedure is ...
45 views

### Do reversible black box obfuscators exist?

We shall say that an obfuscator $\mathcal{O}$ is a reversible black box obfuscator if for each reversible program $P$ the obfuscated program $\mathcal{O}(P)$ is still reversible but does not reveal ...
55 views

### Random oracles and independence

I'm reading an unpublished paper in which the author makes the following conclusions several times: Assumptions: finite probability space, $H$ is a random oracle, $X$ and $Y$ are two (not necessarily ...
117 views

### Forgery attack against Textbook RSA with simple redundancy

I know how to forge vanilla Textbook RSA message signatures (easy). I've learnt that by adding a good redundancy to the message, it cannot be forged anymore. How can one add redundancy so that the ...
61 views

### Why is it that most messages seem to be expanded?

Whenever I have seen a more secure version of a message, the message seems to be expanded by some factor. One example is RSA encryption, but whenever a message does not appear to be expanded it is ...
97 views

### Do I need to use a CSPRNG when creating salts for user accounts?

I'm not sure about the need of using CSPRNG to create salts for each user account. I found “Cryptographically Secure Pseudo-Random Number Generator in Qt/C++ (Cross platform)” (at StackOverflow) with ...
314 views

### An example of of an information theoretically secure protocol that is not cryptographically secure

Does there exist a protocol $\pi$ for some functionality $F$ which is information theoretically secure protocol that is not cryptographically secure for some threshold number of corrupt parties? ...
82 views

### How to prove a symmetric encryption scheme provides perfect secrecy?

I learned in class that in order to achieve perfect secrecy, the source of the plaintext $\mathcal{P}$ needs to be independent from the source of the encryption key $\mathcal{K}$. We also learned that ...
64 views

### Is “reused one time pad” safe to encrypt a message like “random number + mod”?

I want to encrypt a message that contains a fixed length random number and a long mod. i.e. 1234564284 (created like this 123456 + (123456 mod 9931)) I assume that reusing the same key is not a ...
414 views

### Entropy calculation

I calculated the entropy for "variable", "property" and their concatenation "variableproperty" (with e.g. the Shannon Entropy) and got $2.75, 2.5$ and $3.33$ respectively. These are all entropy per ...
40 views

### Can one passively load-balance HTTPS traffic based on TLS SNI?

Is it theoretically possible to passively snoop into the HTTPS traffic, reliably detect whether or not TLS SNI is attempted to be used by the client, and, if it is, redirect the stream of the ...
170 views

### Is $H'(M) = 5M + 9H(M) \pmod{2^n}$ a secure hash function?

theorem: For arbitrary $i≥0$ there exists $m,n≥0$ such that $35+i=5m+9n$. We can use this theorem for constructing simple hash function. Let $M$ be message and $H(M)$ be its hashed value with hash ...
69 views

### Which values are used for an elgamal cryptosystem public key?

I know that – within the elgamal cryptosystem – the values of $a$ and $b$ are public. But which values are used to create public keys?
131 views

108 views

### Three party coin flipping protocol with only 2 active participants

Is there a coin flipping protocol where: Alice, Bob and Carol don't trust each other, and The coin is flipped only by Alice and Bob, and The result must be trusted by all three participants.
111 views

113 views

### Stream Ciphers and cycling questions

For all PRNGs (including CSPRNGs) lets say there is a sequence x, y, z, then when the PRNG cycles back to x, then the sequence following it will be exactly the same as before. Is this true for all ...
114 views

### Practical benefit of using a KDF?

I see that KDFs should be used in systems that rely on PSKs, but what practical benefit does it provide? For instance, suppose the system relies on a shared secret for AES encryption and decryption. ...