# All Questions

1answer
4k views

### How long does it take a quantum computer to brute force AES?

I understand that using Grover's algorithm it only requires $2^{64}$ lookups for a 128 bit AES encryption, leading people to say we need to increase to 256 bit keys. But how long would it actually ...
1answer
3k views

### How much is slower GCM AES-128 than one of the stream chipher eSTREAM?

Evaluate the speed of the algorithm GCM AES-128 and compare it whith speed of one of the stream chipher in eSTREAM. Can someone give such an assessment?
4answers
406 views

### Why to try get key out of white box crypto? How can one protect WBC itself?

Help me understand the following. With WBC the question is mainly being stated as can one try to break WBC to identify the key. My question is: Why would one ever want to do that anyways? If one can ...
1answer
555 views

### Why does NaCl's crypto_secretbox for xsalsa20-poly1305 require the first 32 bytes to be zero?

The NaCl web site says this is a requirement of the API, but its seems more than just an API issue. It means the first 32 bytes of the first salsa20 block are effectively ignored. I didn't see ...
2answers
581 views

### What is the definition of “security beyond the birthday paradox”?

I'm reading a paper about MACs and I would like to be sure about the meaning of a security beyond the birthday paradox. Is there a definition?
2answers
364 views

### What (precisely) is a block cipher?

If I follow the wikipedia or crypto.stackexchange definition, any simple XOR encryption where the key is as long as the plain text should qualify as a secure block cipher. Now I thought what would ...
2answers
597 views

### Encoding information in packet lengths to actively sidestep encryption

If you've only got an encrypted data channel can you actively sidestep the encryption and communicate with an outside party who can see the data but cannot decrypt it? Yes - if you can find some ...
1answer
105 views

Suppose Alice has two primes $p$ and $q$ such that $p\equiv q \equiv 3 \pmod 4$. $n=p\cdot q$ is part of her certificate to identify her. A party say Bob, sends her a random quadratic residue ${}\bmod ... 1answer 116 views ### Is there any restriction in using lossless compression algorithms for huge key sizes? I'm studying McEliece and Multivariate Public Key cryptographic systems. The main problem here is the huge key size. Is there any restriction in using lossless compression algorithms to fix this ... 1answer 346 views ### Is SHA-256 a one way permutation when restricting the domain to {0,1}^256? [duplicate] Suppose we consider the space of$\lbrace 0,1 \rbrace^{256}$as the domain and SHA-256 as our hash function. Does SHA-256 become a one way permutation? Has anyone tried to prove this? Or can it be ... 1answer 577 views ### Key-size of encryption method Is there a definied keysize to be used with the "AES_256-CBC" method in PHP, and what is the size? Some background: I want to store encrypted text into a PostgreSQL database. The user who posts the ... 1answer 174 views ### Repeated Encryption using same/different Encryption systems [duplicate] I would like to know if there are any security risks/gains from encrypting twice, i.e. $$\text{plaintext}\xrightarrow{encrypt}\text{intermediate text}\xrightarrow{encrypt}\text{ciphertext}.$$ I would ... 2answers 3k views ### Which stream cipher can we replace the RC4 in the SSL? In cryptography, the Fluhrer, Mantin and Shamir attack is a particular stream cipher attack, a dedicated form of cryptanalysis for attacking the widely-used stream cipher RC4. The attack allows an ... 3answers 278 views ### One-Time Pad Distribution of Keys Between Two Parties Consider the One-Time Pad (OTP). Suppose two parties, A and B, generate a completely random secret key in a real-life meeting, and they keep this secret. Now A wants to send some message to B using ... 1answer 386 views ### Is using Ed25519 parameters in ECDSA safe? I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above ... 0answers 674 views ### How do I enable AES-NI (hardware acceleration) for Node.js crypto on Linux? [closed] I wrote a basic function to test the speed of the AES-256-CBC mode of the Node.js built-in crypto functions. These functions use OpenSSL, so they should support AES-NI, but when I correctly enable ... 2answers 535 views ### Do we have to use an IV for AES encryption to be FIPS 140-2 compliant? I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus ... 2answers 372 views ### Decrypting without using the private key Let$g$be a generator of a multiplicative group$G$of order$q$,$x$be a private key, and$h=g^x$be a public key of an exponential ElGamal cryptosystem. Given a ciphertext$c$produced as the ... 1answer 251 views ### 2 comparable hashes generated from one string Assume a website where people log in with their password. The password is now stored in sql database as: md5(password + random_salt) We are adding the ... 1answer 174 views ### Derive a public EC key from two public EC keys Alice has two EC key pairs:$a_1$,$a_2$are private keys (integers),$A_1$,$A_2$are the corresponding public keys (points). Alice and Bob want to create a new public key$C$. Alice must prove that ... 1answer 907 views ### Hash functions throughput performance [closed] Without taking into account security, which hash function is the fastest one among the following: MD5, SHA-1, SHA-2 (for various internal size), Keccak, and other… ? 2answers 189 views ### Blind Signatures The verification algorithm given in blind signature. Should it work for both Original message and the signature on it Blinded message and the signature on it. If yes, then how can we verify if ... 3answers 461 views ### Encrypting files with known headers If I encrypt a file of a known format that has a lengthy header (e.g. an XML Excel file), does that render the encrypted file susceptible to a "known plain text" attack? In other words, if the first ... 1answer 178 views ### Use of Different keys with PCBC Currently I am having a doubt, while making a "DES PCBC" encryption on an image I observe a bit of the silhouette of the image (Probably because of the XOR between plaintext blocks and ciphertext ones ... 5answers 831 views ### How to prove the security of the PRNG? Are there any realties tests or criterias that prove the security of the PRNG? What kind of tests or criteria? 0answers 155 views ### Infinite depth BLAKE2b tree hashing In the BLAKE2 paper, the authors define Maximal depth (1 byte): an integer in [1, 255] (set to 255 if unlimited, and to 1 only in sequential mode) Node depth (1 byte): an integer in [0, 255] ... 1answer 164 views ### The Goldreich-Goldwasser-Micali Construction with bad PRGS I understand that if we have a secure PRG then the Goldreich-Goldwasser-Micali construction gives us a secure PRF. However, what I've not been able to find much material on is how will the GGM ... 1answer 208 views ### NP complete problems related to permutations of binary vectors or block ciphers Recently, T.Gowers wrote a blog entry called "How not to prove that P is not equal to NP" about the Razborov/Rudich Natural Proofs paper. He has a construction where he talks about compositions of ... 1answer 8k views ### Decrypting the password from SHA-512 hash value I am currently studying AES algorithm and writing a Code using Python. I am trying to add 'Salt' into the user input password, Here is what I am doing, ... 0answers 141 views ### How many messages needs to be send to server to get AES key in Cache-timing Attack I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on ... 2answers 130 views ### post-quantum threshold secret sharing I am looking for a references for post-quantum threshold secret sharing schemes. I am especially interested in knowing whether any one based on one-way compressor functions or cryptographic hashes ... 2answers 379 views ### what are the uses of tweaks in block ciphers? Few block cipher modes has additional parameter , tweaks , especially the ones that are format preserving . Now the comments section of this blog entry says such tweaks can be used for BIN numbers, ... 1answer 431 views ### AES file encryption with PBKDF2. Safe parameters? I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ... 2answers 236 views ### What is the intuition behind AES or SPN? I'm new to cryptography and have just encountered AES and SPN. I would like to know how the S-box, permutation step and the MixColumn step help improve security. It seems to me (perhaps mistakenly) ... 1answer 238 views ### Encryption algorithms and the “One-Time pad” [duplicate] I am not well versed in the field but I believe I know the basics. All encryption algorithms that I know of utilize direct data manipulation to encrypt a message (string of bits) such as shifting, ... 1answer 305 views ### How does redundancy in a file effects performance and security of encryption? Does redundancy in a file or data effect performance and security of encryption? (for example for AES, if not for general case) Is it easier to encrypt something that has high redundancy or something ... 1answer 345 views ### Definition of cryptographic advantage vs. probability of success In game-based security definitions, like for example the one defining IND-CPA security, a given cryptosystem is said to be secure if any probabilistic polynomial time adversary has only a negligible ... 1answer 641 views ### How do TLS 1.1 and 1.2 generate IVs (initialization vectors) for each record? According to RFC 4346 Explicit IVs [CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC ... 2answers 150 views ### how much trust can we place in protocol verifiers? [closed] I read many papers on authenticated key exchange protocols, and most security proofs are done by the authors. In this method, you can imagine that the efficiency is low. Moreover, even if you have ... 1answer 552 views ### How does one use AES block cipher modes of operation? This is the sequel to my previous question about AES block cipher modes of operation. (See: AES block cipher modes of operation) Now, here is my real problem. I have to use a block cipher with 8 bit ... 3answers 219 views ### Decryption possible only within a period of time Time-locked encryption and time-released encryption seem to be security systems focused on making sure that the decryption of certain message cannot take place before a certain time has passed. ... 2answers 526 views ### AES block cipher modes of operation have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ... 1answer 493 views ### WIN LM Password Hashes (using John the ripper) [closed] In a problem set, we've been asked to use John The Ripper to crack a list of Win LANMAN passwords. They are of the following form: 953A55E36AB85C0B9DA92C18555E42E1:0169295E0A6A6B35B2DD9932D10C1978 ... 2answers 119 views ### Self authenticating tamper resistant first meetings I'm not sure what the precise words I am looking for are so I apologize if there is a better way to phrase this. What I am thinking of is ways to transfer an identity in a way that it is tamper ... 1answer 388 views ### Does ElGamal Encryption create a different key for each block sent? I ask about ElGamal algorithm. Is ElGamal algorithm used new key for each encryption process. in other word it should we use new key for each chunk? For example, if we have message that has four block ... 2answers 2k views ### Why initialize SHA1 with specific buffer? SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why? 2answers 166 views ### SHA-1 colission resistance proof I'm searching Why the SHA-1 is collision resistance? Anybody could help me with the proof or say me where I can find this proof? 2answers 779 views ### What does an RSA signature look like? I am using OpenSSL libs to generate signatures. Internally, I learn that a signature is a hash of the message with some padding added to it. I am trying to understand the structure of a signature. If ... 0answers 438 views ### Question about modifying the MD5 plain text to cause a collision I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition The MD5 collision in Problem 25 is said ... 2answers 347 views ### Is prime regeneration necessary for every new session using a Diffie-Hellman key exchange? As I understand it, bruteforcing a Diffie-Hellman generated secret key takes$P-1$attempts to crack the shared secret, where$P$is a very large prime used for modulus. If your$P\$ is quite large, ...

15 30 50 per page