# All Questions

830 views

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes? Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
328 views

### Secure Hash Function based on AES

How secure would a hash function be which appends an extra block of 16 zeroed out bytes to the end of the message and then AES-encrypts it with a well-known password (say the first 128 bits of pi) ...
1k views

### Which attacks can be avoided by the use of OFB instead of ECB?

For a file encryption program, I was told to use Output Feedback mode (OFB) instead of ECB (Electronic code book) mode. Which attacks can I avoid by this choice?
491 views

### How does one provide a secure and authentic communication channel?

Let assume two participants Alice and Bob who perform a given protocol which is a sequence of messages exchange between them. My question is: How can I provide a secure and authentic communication ...
165 views

### Is it okay to include relative time for true random number generation?

Similar questions have been asked regarding use of time in true random number generation, but I'd like to consider using time as just one source of entropy, complementing others. True random number ...
77 views

### Concerns about use of MAC in my specification

Here is the pseudocode for a routine I am designing: ...
207 views

### Is encryption time greater than decryption time?

Is encryption time always greater than decryption time for all encryption techniques (AES / DES / RSA / DNA), or is there a mistake somewhere in my implementation?
142 views

### Are modified implementations of cryptographic algorithms a good idea?

Are modified implementations of standard cryptographic algorithms better that the standard versions? Since the algorithm is not standard, is it harder to break? Is it safer?
186 views

### MAC using a modified CBC mode of operation

I'd like to know whether the following modified CBC-MAC is secure (given a fixed IV). Source: an old course on Network Security Are there some obvious attacks I can't see?
224 views

### Decryption issue with self-coded AES-128

I have written my own AES-128bit implementation in Java, till yesterday I thought it would be alright. (I was working on the encryption) Now I’m trying to decrypt my encrypted cleartext, but this ...
253 views

### Does MAC provide origin authentication? Why not just use symmetric encryption?

Let's assume Bob and Alice has a secret key for MAC. If MAC is constructed by the key and the message, that means that both Alice and Bob can construct the exact same message and MAC. So, Bob can ...
387 views

### Extracting only the entropy

(I cleaned up the question a bit, It was previously titled "extracting entropy without hashing" .. thus some of the comments / answers) I'd like to extract the entropy of data without injecting ...
224 views

### How resilient to attackers with extreme resources available is this encryption method?

How could the following scheme be made more resilient to attacks capable of utilizing massive amounts of resources? Assume all random values are cryptographically secure. Key derivation: scrypt ...
330 views

### why AKS is so slow in practice? [closed]

This note (http://maths-people.anu.edu.au/~brent/pd/primality4.pdf) states that AKS is not practical. However, it is known that AKS runs in polynomial-time, and I cannot understand where the slowness ...
177 views

### What parts of AES encryption result are safe to pass on the network

I'm using AES to encrypt the message. both sender and receiver know the passphrase, but only sender knows IV and salt I assume that receiver also needs to know IV and salt to decypher text; is it ...
357 views

### Help me describe/identify this challenge-response protocol/algorithm?

My area of expertise is reverse engineering, specifically embedded systems. I do attack cryptographic systems, but this largely involves key recovery or exploiting the implementation. I was asked to ...
342 views

### What's the difference between AES and earlier block ciphers?

Is there any difference except speed and key and block size from user's point of view? Or does AES have something that ideal block cipher doesn't have?
385 views

### ElGamal: Generation of “g” value?

I haven't been able to find a clear explanation on this (and I'm probably just confused in general). I have the following parameters of ElGamal signatures: $p$ = safe prime $q = (p-1)/2$ $g$ = an ...
485 views

### Is there a preferred way/standard on how to transmit an initialization vector for AES encryption

Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
158 views

### Slow hash algorithm that does not require salt?

I usually choose bcrypt when hashing as I can set the work factor to slow down the calculations of the hash. However, I have to keep a copy of the hash in order to verify it (since it includes the ...
748 views

### Is Common Name encoded in the certificate?

When I make a certificate like so cd /etc/openvpn/easy-rsa/2.0/ source ./vars . /etc/openvpn/easy-rsa/2.0/build-key client1 Then ...
219 views

### I read ECB is bad because the same plaintext outputs the same ciphertext. Isn't that a requirement of a cipher?

In the Wikipedia article on Block Ciphers, it says about the Electronic Code Block mode: The disadvantage of this method is that identical plaintext blocks are encrypted into identical ...
154 views

### Why can't we use a hash with no collision to compress data reliably?

According to wikipedia, a hash maps digital data of arbitrary size to digital data of fixed size. For all practical measures, a hash is a unique signature of a big chunk of data. But there is such a ...
123 views

### Severity of Cooking NIST P Curve Constants

Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
469 views

### What are words in a HASH algorithms

From wikipedia: "They differ in the word size; SHA-256 uses 32-bit words where SHA-512 uses 64-bit words." In this context what do they mean with words? is it the same as a 32 bit (or 64 bit) block ...
98 views

### How to attack the Two Time Pad?

I encrypt 2 random keys with the same 'one' time pad. You can get both encrypted keys. You don't know anything besides the size. Is there a way to attack the two time pad in this scenario? And what ...
167 views

### Cipher text only attacks on deterministic fully homomorphic encryption schemes

If we have encryptions of additive and multiplicative identities in the corpus of cipher text of a deterministic fully homomorphic encryption (FHE) scheme, I guess we can break it. If the FHE scheme ...
149 views

### Cycles in SHA256

In the recommendations, it seems cycles is used usually as in "CPU Cycles", but, that's not what I mean here. What I mean, is this: Let's say I start with a particular 256 bit value. Call this v. I ...
641 views

### Comparing Files: Is it better to use multiple hash algorithms or just one?

I'm looking to compare (for byte-for-byte equality) two binary files. I already have the process down: Check for existence etc. Compare file lengths Use a hash or CRC of a sort (right now I use ...
164 views

### What is “msg = group.random(GT)” in Charm encryption schemes?

In many encryption schemes in Charm the random group message is used instead of a text-message: msg = group.random(GT) For example, in CP-ABE scheme, random ...
12k views

### AES256-CBC vs AES256-CTR in SSH [duplicate]

I used AES256-CBC to SSH to a remote server. Recently, it stopped working with the following message: ...
288 views

### Different padding rules for Merkle–Damgård and Keccak/sponge function

We learned that length padding was used in Merkle–Damgård where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
943 views

### Fastest random number generator

I just read High performance physical random number generator by K.H. Tsoi, K.H. Leung and P.H.W. Leong. It proposes a physical RNG of speed 400 Mbps. Is this the fastest random number generator at ...
95 views

321 views

### homomorphic encryption special case of multi party computation?

I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ...
2k views

### AES GCM symmetric encryption of data at rest in c#, ciphertext much longer than plaintext

I've written encryption/decryption routines using AES GCM. Code can be found here. I recently realized that the cipher text is longer than I believe it should be. It should add the tag and IV onto ...
692 views

### Real life collision when only using truncated hash

For MD5 two different inputs are known that produce the same 128 bit hash value. However, these inputs are artificially created for this specific purpose. For normal, real life inputs I believe no ...
509 views

### two public keys with same passphrase insecure? | can two hashes be compared?

Suppose someone had generated a 2.048-Bit RSA GPG/PGP key pair and published the public key on the usual key servers. Then he withdraws this key and generates a new one in 4.096-Bit RSA using the same ...

15 30 50 per page