# All Questions

1answer
457 views

### Is there a method to break an EC curve for all key-pairs (Q,d) such that (Q=d*G) faster than breaking every single key-pair?

Related to this question: Is there any memory trade-off that helps such attack? Obviously if the field size is very small (say 40 bits) it´s possible, but what if the field size is 160 bits long? or ...
1answer
386 views

### implications of SSH server key compromission when authenticating users against a public key

Friday we had a disagreement with a colleague of mine about the implications of SSH server key compromission The question was stated as this : What could a hacker do while provided with the SSH ...
1answer
1k views

### How can the Diffie-Hellman key exchange be extended to three parties? [duplicate]

Possible Duplicate: Can one generalize the Diffie-Hellman key exchange to three or more parties? How can Alice, Bob, and Charlie share a common secret key using an extended version of the ...
2answers
2k views

### Difference in one time key and one time pad and many time key

These terms are confusing me. One time pad is when you use one key for one message. That is what One time key is. Secondly, what is the connection of many time key, can i use one time pad many ...
1answer
486 views

### Is there difference between Algebraic Homomorphic Encryption and Fully Homomorphic Encryption Schemes?

Is there difference between Algebraic Homomorphic Encryption and Fully Homomorphic Encryption Schemes?
1answer
274 views

### Signing 14 bytes of data

for an embedded device I need to sign a 14-byte string and want to verify that string on the device. Since there is already an AES-Library on the device, I thought about using the following scheme: ...
3answers
540 views

### Entropy of system data - use all and hash, or trim least significant bits?

I'm working on a background entropy collector for key generation that monitors hardware and produces an entropy pool. Here's my list of sources: Mouse position Keyboard timings (i.e. time between ...
2answers
501 views

### Encryption with private key?

we normally always encrypt by public key and decrypt with private key. If i encrypt with private key, then its still secure as normal PKI ? i mean known-plain-text will not take private key on the ...
1answer
323 views

### Vulnerabilities of encrypting data with known regularities

I need to encrypt data that has a pre-defined header and footer structure, and furthermore the data follows pre-defined patterns. The header and footer structure follow a defined structure but cannot ...
1answer
2k views

### Deciphering a key from XOR encrypted cypher using boolean logic

Assume there's an unencrypted message A, and an encrypted message B. You know that message B was encrypted using a simple XOR method of A with a private key K, resulting in message B. Thus, B = A ⊕ K ...
2answers
221 views

### Is there a way to compare the 923 bit pairing based key with RSA or AES, etc

I've see many articles, most of them basically the same, praising Fujitsu for cracking what is referred to as a 923 bit pairing based encryption. I understand that in comparing RSA to AES you've got ...
1answer
3k views

### In which order are the round keys used during AES decryption?

In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step? Is it the 10th round key? For example, is this the right order? ...
1answer
2k views

### AES-NI implementation examples

Newer Intel and AMD processors have hardware support for implementing AES using the instruction set AES-NI (instructions AESENC, AESKEYGENASSIST etc). Do you know of any clean example implementation ...
1answer
4k views

### Is AES restricted to only 64 characters for the key/password?

I am wondering if AES only supports 64 character passwords? When using truecrypt, the maximum character limit on passwords is 64 characters; however, when using WinRAR, the limit is 128 characters. ...
1answer
140 views

### McEliece for streaming data

Under the assumption that there exists a real-world implementation of the McEliece scheme, could it be applied to streaming data as is? By that I mean in 'block cipher mode'? I've read that McEliece ...
1answer
425 views

### Security analysis of a “one-time pad” type hill cipher

Suppose the Hill cipher were modified to something like a one-time pad cipher, where Alice wants to send a message to Bob, and she chooses a key matrix randomly everytime a new message is sent (and ...
2answers
206 views

### How can I store a combination of multiple pass phrases?

Let's assume we have 2 phrases, one is the real password from a user, and the other is generated from the real password and almost impossible to guess. You would need both to authenticate a user. What ...
1answer
165 views

### Is there a way to provide proof of batch RSA security?

Suppose we have two encrypted messages with two different public key issued from the one server. There is a client who wants to send these to messages to the server. In the middle there is an ...
1answer
110 views

### Is it possible to spoof an identity cert modulus?

I was looking at FOAF+SSL and wondering if its possible to spoof the modulus of the browser certificate so that the FOAF and browser certificate's modulus match?
1answer
958 views

### Where can I find Secp256k1 ECDSA test vectors?

I`m currently implementing an ECDSA library based on curves like secp256k1. I would like to test it using some test vectors, like ...
1answer
820 views

### iSeries (AS/400) Database File: password encryption

I am helping with a project in which an old software system on an iSeries is having a brand new .NET UI applied to it. It's going well... except... In order to allow users to login and maintain ...
1answer
94 views

### Block cipher not resistant to collisions

If we have the following block cipher, $E(k,m)$, which is a permutation, why is $f_2 (x,y)$ not collision resistant? $$f_2(x, y) = E(x, x \oplus y)$$
1answer
79 views

### Is secure lattice based cryptography in future?

Lattice cryptography is a post quantum cryptography that work on two NP-hard problem in below: Find shortest nonzero vector from origin and Find minimum distance of a arbitrary point out of lattice ...
1answer
32 views

### Multi Party System with n-1 adversaries

Novice here. Is there a MPC function where no information is leaked even if all parties are not trustworthy ?
1answer
69 views

### Would it be better to use HKDF or SCrypt for deriving a child key?

Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure. Mp: The master key pair, this includes a ...
2answers
34 views

### How to check the integrity of a key received through mail using symmetric encryption?

I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To ...
1answer
28 views

### Is PKCS#7 padding generated with a pseudo-random-number generator okay?

Let's take this PHP code. We use libsodium and libsodium-php. You have $text,$senderPrivateKey, ...
1answer
37 views

### Data Encryption Standard (DES) S-Boxes

I read that the S-boxes introduce the much needed nonlinear behavior to DES. Can someone give me a lay mans explanation of why the effect of the S-boxes is said to be non-linear?
1answer
127 views

### Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
1answer
35 views

### Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
1answer
62 views

### Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent ...
1answer
66 views

### Implicit authentication aritcle

First, I want to know what is the logarithm used in the following system of equations (from the paper Flexible and Robust Privacy-Preserving Implicit Authentication - Domingo-Ferrer, Wu, ...
1answer
72 views

### Does including the size of the hashed data improve security over just the hash

Trying to settle a discussion at work. We are mostly concerned with pre-image resistance. Suppose we have a common secure hash function $H$ (e.g. SHA-1/SHA-2) and some message $M$ we want to hash. ...
1answer
47 views

### Finding collisions for the DES F-function

It's known that for a given subkey, the F-function of the DES is not injective (see Is the DES F-function injective for a given subkey?). I am interested in efficiently finding collisions for this ...
1answer
52 views

### What is the difference between LCG and Affine cipher?

What is the difference between LCG and Affine cipher? More specific: What are they used for, and what are the structural differences between them?
1answer
96 views

### RSA: must $d$ be an integer?

I am only taking baby steps in RSA. If $p=11$, $q=7$ and $e=3$, $$\phi(n) = 10*6 = 60$$ Then: $$d = (2 (\phi(n)) + 1 ) / 3 = 121/3$$ Should $d$ be kept as a non-integer or is such a $d$ invalid? ...
1answer
46 views

### Rogue CA Certificate MD5 Collision Control

Papers from Marc Stevens et al show that X509 certificates that rely on MD5 signatures can break the assumed security model, that is, it allows for a forged certificate to have the same signature as a ...
1answer
64 views

### Cryptographic hash with ability to ignore specific bits based on a hidden pattern?

I'm looking to use password-style hashing to validate an environment, where some parts may be irrelevant. For example: ...
1answer
32 views

### Should I authenticate memory data which was loaded from authenticated disk file?

Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to ...
1answer
37 views

### Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in ...
2answers
61 views

### Find plaintext of RSA by solving extended euclidean algorith for two encrptions with two different exponents for same plaintext

This is my homework question (but I am not asking the answer to it): Suppose two users Alice and Bob have the same RSA modulus n and suppose that their encryption exponents eA and eB are ...
1answer
80 views

### Breaking a Modified Caesar Cipher

Does anyone know of an efficient way of breaking a modified Caesar cipher (where the key is a set of numbers (the amount of shift) that is repeated throughout the plaintext, e.g. {1,2,3,4,5}) via ...
1answer
37 views

### Alter plaintext in block cipher AES in CBC mode

How can I alter the plaintext before decryption by changing the IV? I know what the value of the plaintext should be. I also know the value of the IV (initial vector). The IV and the AES block are ...
1answer
121 views

### For a given PlainText-CipherText pair how many valid keys are there in AES?

For $PT\in \mathbb{M}$ and $CT\in \mathbb{C}$, let $\mathbb{F}=\{f|f:\mathbb{M}\rightarrow\mathbb{C}\}$ be the collection of all functions from $\mathbb{M}$ to $\mathbb{C}$. Then AES encryption under ...
1answer
47 views

### PublicKey Unknown Encoding

I have a public key: ...
1answer
155 views

### Public Key Encryption using ECDHE and AES-GCM

Using a text book example, Alice and Bob want to communicate securely using encrypted messages over an insecure channel (the Internet). Alice and Bob have decided to use ECDH (using ephemeral keys ...
1answer
45 views

### What is the most an adversary can do in the context of public key masquerading?

Suppose two parties A and B are using a public-key encryption scheme in order to communicate securely. A and B both have a public/private key pair: $$A: (P_A, S_A), B: (P_B, S_B)$$ and A already ...
1answer
66 views

### Collision likelihood from /dev/urandom for VMs using the same underlying hardware

We have multiple virtual machines sharing the same physical hardware. We use /dev/urandom for session key generation. But a question comes up: if ...
1answer
53 views

### Design for file transfers to a new party

I'm pondering a problem of how to enable transfers of files from clients to people that does not yet have an application/account/keys yet. Here's my current thought for Alice wanting to send Bob ...
1answer
49 views

### How to detect changes in data while preserving confidentiality (under constraints)?

Suppose party $A$ has two pieces of data, $X$ and $Y$, either of which may change separately, or they may change together. Given the following constraints: $A$ knows its current $X$ and $Y$ but has ...

15 30 50 per page