# All Questions

273 views

### Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
32 views

### Is it not secure if we use weak passwords to protect exported PKCS #12 files with private keys?

Consider a practical scenario as described in Microsoft's Expand Export a Certificate with the Private Key. We can see a certificate with private key can be exported as a PKCS #12 file, where the ...
54 views

### Encryption on the cloud with versioning

Can file-versioning, which is available for instance in Dropdox, weaken the security of encrypted files if someone is able to see two or more snapshots of the ciphertext at different times? To be ...
58 views

### Subkey generation in OMAC1/CMAC with XTEA?

All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key. If ...
58 views

### Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?

I have a follow-up question about the extended Euclidean algorithm, as applied to RSA key generation, described in this answer. Let us say we have $p=5$, $q=11$ and $e=17$, so that $N=55$ and ...
58 views

### Using Skein as PRNG

I have read that the Skein hash can be used for quite a few different functions, including a PRNG. Would using the 1024 Skein hash to return 16KB of data be appropriate for a PRNG? Or would it only be ...
259 views

### How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
215 views

### What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...
108 views

I would love to have a system where the password is never send in plaintext (even with TLS) to authenticate a user. I've come up with this protocol, but I'd rather use something proven. Registration: ...
75 views

### How to encrypt/decrypt data in an SPI BIOS FLASH

I need some info/suggestions about the cryptographic algorithm that make me sure that the executed bios by the CPU is an authenticated bios. The check has to be performed by a FPGA. I have SPI Flash ...
91 views

### How does the small n attack work?

I'm studying the Lamport's Hash one-time password scheme. This is the scheme: Alice wants to authenticate herself to Bob from a workstation that knows nothing about her. Alice only knows her ...
61 views

### Strong LRSW assumption for type 3 pairing groups

Why does the "strong LRSW" assumption by Ateniese et al. [Untraceable RFID Tags via Insubvertible Encryption, CCS'05] hold ONLY for type 3 pairings and NOT for symmetric pairings? Whereas, the LRSW ...
106 views

### Hash and salt or salt and hash?

People say "hash and salt", but aren't you supposed to salt password the first, and then hash it? So that means its called "salt and hash" right?
178 views

### Why is the definition of Special-honest verifier zero-knowledge probabilistic?

Let $P$ be a prover willing to prove to a verifier $V$ that he knows a witness $w$ satisfying $(x,w) \in R$ for some relation $R$ and some common input $x$. As found in the literature, $P$ can use a ...
52 views

### MDC-2 recommended IV values?

I'm currently reading Menezes' "Handbook of Applied Cryptography", and in it, when describing the MDC-2 cryptographic hash function, has the following line: Choose the 64-bit non-secret constants ...
184 views

### Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs ...
62 views

### Can string lookups be vulnerable to timing attacks like array lookups are?

Per “Can non-assembly crypto libraries truly be secure against timing attacks?”, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and ...
117 views

### Is Cramer-Shoup backdoorable?

We recently had the question whether it's possible to have multiple private keys with one public key for the cramer-shoup cryptosystem. There it was stated that finding such "secondary" private keys ...
131 views

### Attack on Double Encryption Scheme

In this protocol: A → B : { <[A, {K}pk(B)]> }pk(B) B → A : { <[B, {K}pk(A)]> }pk(A) I'd like to determine why this is insecure. How can the attacker learn the key K if A and B are both ...
178 views

### Point addition in NaCl/libsodium (Curve25519)

In NaCl and libsodium, the crypto_scalarmult function implements the operation $Q = kP$ (scalar/point multiplication). There doesn't seem to be a function for point ...
70 views

### Simulator in Private Outsourced Computation over Outsourced Datasets

Please, consider two honest parties $A$ and $B$ outsourced their private data to a malicious server $S$. So the parties store their data in the server. Then at a later point in time they want to ask ...
44 views

### Does pseudorandom secret sharing require a central dealer?

I'm trying to figure out whether pseudorandom secret sharing (as described in this paper) requires a central dealer, i.e. one party who doles out keys to the other players and thus who would be able ...
67 views

### Improve security of transposition ciphers

As we know, breaking a Transposition Cipher is quite trivial and can be easily done by either exploiting single letter frequencies (not $d$-gram frequencies though, given that $2 < d < L$), or ...
42 views

### N users must approve a request

I have a locked-down production system that we'd like to process specific requests, picked-up (poll) from a less-secure location. For security and "go slow, this is production" reasons, a request ...