# All Questions

398 views

### Can a monoalphabetic substitution cipher attain perfect secrecy?

Can a monoalphabetic substitution cipher attain perfect secrecy? Definition of perfect secrecy: $${\rm Pr}[\,{\rm Enc}_k(m_1) = c\,] = {\rm Pr}[\,{\rm Enc}_k(m_2) = c\,]$$
122 views

### Modular exponentiation with Chinese Remainder Theorem

I'm learning modular exponentiation with Chinese remainder theorem. I found a great answer from below How can I use eulers totient and the chinese remainder theorem for modular exponentiation? But I ...
78 views

### Convincing “someone” on the (in)validity of DH tuple without revealing $u,v$

Is there a way of convincing someone on (in)validity of Diffie Hellman tuple $<g, g^u, g^v, g^{w}>$ without giving away $u,v$. or at least solve the Decisional Diffie Hellman Problem without ...
464 views

My question is related to PBKDF2. I am unsure how to validate user entered password with already existing hashes and salts. I have heard of the so called "length-constant" comparison which basically ...
337 views

### Simplified Fiat-Shamir example generates wrong output

I am trying to implement the Fiat-Shamir identification protocol, however the end results always fail to match. I am using algorithm's description from here. Preparation: Select 2 prime integers ...
108 views

### Modular protocol design

What does modular protocol design mean? Why does TLS not have modular protocol design? What protocols have modular design? (IPSec, SSH)
290 views

### Prime factorization of RSA modulus

Consider RSA public-key encryption with public modulus $N=3953$. Suppose we know that the public keys $e_1=337$ and $e_2=23$ correspond with the decryption information $d_1=3385$ and $d_2=2663$. ...
164 views

### simple multiplication in GF(8)

I am trying to do multiplication in the GF($2^3$) defined by the irreducible minimum binary polynomial $X^3+X^2+1$. I want to multiply $A(x) * B(x)$ where $A(x) = x$ and $B(x) = x^2$. The ...
451 views

### Known vs. Chosen (plaintext and ciphertext) and RSA

I want to know whether I can break RSA (textbook) with known plaintext/ciphertext attacks. Known plain-text Let $c$ be the ciphertext and $m$ the plaintext. $$c = m^a \mod n$$ Since all I have is ...
289 views

### Hill cipher is not perfectly secure

I am on cryptography course and there is a homework question to show that Hill cipher doesn't have perfect security. So assume we have an cryptosystem $(P,C,K)$, where $P = C = \mathbb Z_{26}^N$ and ...
89 views

Using homomorphic encryption, I would like to be able to take an encrypted integer and either add 1 or -1 for a new encrypted value. I do not want the encrypted value to be recoverable - just the ...
168 views

### Usage of Fermat primes in RSA

Why are Fermat primes ($2^{2^n}+1$) useful as $e$ (the public key) in RSA encryption? I understand why $2^n+1$ primes are useful, because they would simply be ...
52 views

### Would requiring reciprocal signatures create a stronger Web of Trust?

In this post on Cryptome it's noted that a person called Michael Vario is willy-nilly signing people's public key's and uploading those signatures. He is effectively forging a web of trust. I'm sure ...
541 views

### AES mode for file encryption

I'm working on software that should eventually result in a crypto file system similar to encfs. So far, i have a user password that goes through PBKDF2 using ...
379 views

### AES-CBC and IV — Encrypting multiple blocks of a file with the same IV?

I have large files which are broken into blocks of 512 KB and uploaded to a server. In my DB I store the IV, and the user knows the security key themselves. When downloading, I use the same IV and ...
395 views

### Is it possible to decrypt double-key crypted file knowing public key and a having one or more original files?

I have some encrypted files with double-key. I know public key and don't know private key. Can I obtain the private key (and decrypt all files) using two version of one file - crypted and decrypted? ...
175 views

### Trustless, Multiparty Random Number Generation

I've been having trouble with coming up with a random number generator that produces a random number between two parties. My current scheme is this: User 1 gives user 2 the hash of their randomly ...
639 views

### In this example, which is a premaster secret, and which is a master secret?

In the context of this data, as shown in the image below, which one is a pre-master-secret and which one is a master-secret. It looks to me as if the final value of 2, for Alice and Bob is a ...
770 views

### Forgery Attack Against RSA Digital Signature

I have been reading about attacks against RSA Digital Signature in a book The attacker chooses the signature first and then computes the message. As a consequence, he cannot control the ...
67 views

The Decision composite residuosity problem problem states that is impossible two distinguish between those two ensembles: $\{x^N \mod {N^2} | x \in \mathbb{Z^*_{N{^2}}}\}$ and $\{r \in ... 1answer 203 views ### Diffie-Hellman on additive group Given the finite cyclic, additive group (G, +), with |G| = n and generator = g, what are the computations and exchanged messages for Diffie-Hellman? What I tried myself: Alice chooses a private$a$... 2answers 409 views ### Game traffic encryption AES CTR + HMAC I was asked to implement traffic encryption between the game server and clients. Currently, the traffic is not encrypted in any way, which lets players use cheats to listen to the traffic in order to ... 1answer 111 views ### Sample RSA-style signature confusion I'm trying to study a simplified TLS-style protocol, including verifying RSA signatures. It's an attempt to verify using only a valid certificate. However, I can't manage to get anything to verify ... 2answers 111 views ### Can a zero knowledge proof (or MAC) be generated from human-typable input? Edit: My goal is to create a voting scheme that doesn't require a lot of crypto infrastructure to be deployed on the client side. Smartcards, and tokens are impractical for these purposes. I ... 1answer 431 views ### How should I manage Diffie-Hellman parameters on a Web Server? Is there a best practice for Diffie-Hellman parameters (p, g, and q) used on a web server? The server is using ephemeral keys, but should the parameters be rotated on a regular basis? Is it OK for ... 1answer 137 views ### How do we arrive to the equation for solving D in RSA? We have been shown that DE is congruent to 1 mod phi(n). How do we arrive to the real equation for figuring out d that is d = e^-1 mod phi(n). I want to know the entire process. I am just curious, ... 1answer 424 views ### Can AES decrypt with a wrong key? The title is asking the question in layman terms, but what I really mean to ask is this: Let$x \in \lbrace 0,1 \rbrace^{128}$(an arbitrary input block) and let$K \in \lbrace 0, 1 \rbrace^{128}$... 1answer 139 views ### Weak Stream Cipher cryptanalysis Hi I have a stream cipher which uses a keystream of: F(r) || F(r+1) || F(r+2) || ... Suppose F(r) is the RSA encryption algorithm: ... 2answers 298 views ### scrypt and bcrypt for benefits of both? I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory. Couldn't you just hash something with ... 2answers 266 views ### Shamir's Simple Sharing Scheme - preventing partial recovery of data In SSSS, if you recreate the original secret with one of the decoder inputs being slightly damaged (e.g. one or two chars incorrect), you receive a slightly damaged version of the original secret. So ... 1answer 93 views ### What is the difference between a bijective random oracle and a random permutation? Assume$S$be a finite set$O$be a random oracle from$S$to$S$, such that$O$is bijective$f$be a random permutation of$S$Is there any difference between$O$and$f$? Does it makes any ... 1answer 192 views ### Homomorphic Encryption, LWE, and Practical Applications I've been reading Brakerski and Vaikuntanathan's Efficient Fully Homomorphic Encryption from (Standard) LWE. When the authors discuss a small modulus p used for the transition from (n, log q) to (k, ... 1answer 80 views ### Is the following aggregation scheme private? Is the following scheme private? By private i mean an untrusted aggregator (UA) cannot reveal anything other then an aggregate function output on plaintext data Each party holds a secret key$k_i$... 1answer 75 views ### Why send a challenge with CHAP? I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP). Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash ... 1answer 135 views ### Efficient parameters for group Diffie-Hellman I want to implement a basic version of Diffie-Hellman key agreement for groups. So, my key is$K=g^{abc} \mod p$. Following this, the parameters I would need to transfer would be$K_a = g^{bc}$etc. ... 2answers 262 views ### Why can we always assume that$Gen$algorithm choose key uniformly? Talking about a (symmetric) encryption scheme$\Pi=(Gen,Enc,Dec)$where$Gen$take the security parameter$n$as input and generates a key$k$of length$n$. Generally speaking we say that$Gen$... 1answer 62 views ### order between adversaries and type of resources given We have a game$G0$for which an adversary$A$has access to a certain amount of ressources. Let us suppose that the maximum advantage for the adversary to win this game is$Adv_{G0}$. If we modify ... 1answer 144 views ### Why have 4th and 5th steps in Needham-Schroeder Protocol? Why have 4th and 5th steps in Needham-Schroeder Protocol? It is said "These steps assure B that the original message it received (step 3) was not a replay.". But what is a replay here? And I don't ... 1answer 120 views ### SHA-1 Keyed Hash Function I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is: How I will be able to formalize the ... 1answer 3k views ### What does AES256-CTS-HMAC-SHA1-96 mean in relation to Kerberos? I'm not completely clueless as to what it means, but I'd like to understand it at a higher level. The highest encryption type used by Active Directory domain controllers for Kerberos authentication ... 2answers 122 views ### PPT eavesdroper able to output$m_{0}$and$m_{1}\$ of different lengths

I've read the following two questions and their answers: Messages of different lengths and one-time computationally-secret Why is a non fixed-length encryption scheme worse than a fixed-length one? ...
167 views

### Would this program be useful in cryptography?

I know nothing of encrypting. I'm not even sure how to tag this. I wrote a program that can calculate this pretty quickly on my macbook pro 2.3GHz IntelCore i7. The two exponents are Mersenne primes, ...
162 views

### Splitting a password for dual roles [duplicate]

I would like to prompt users for a single passphrase to establish trust with separate, normally (but not always) complementary systems from one password input. I'm essentially looking for a box where ...
68 views

### Why do authors say conflicting things regarding leak-free stages in their paper?

In this paper the last sentence of the first paragraph in the abstract states: We assume a (necessary) “leak-free” preprocessing stage. But then later on in section 1.4 they say Another ...
357 views

### With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
623 views

### RSA decrypt long messages (javascript)

I am attempting to encrypty/decrypt a long message in RSA using javascript (with crypto-js and jsbn libraries). I posted this on stackoverflow too but I figured someone here on crypto might be able ...
71 views

### Safety when disclosing hashes of secrets used to calculate other secrets

In my application, I am generating a big random number and publishing a SHA256 hash of it. After the hash it published (but not the secret), anyone can submit any number, and the system will calculate ...
570 views

### Serpent block cipher : S0 to S7 functions unclear

I am presently implementing the serpent block cipher in C++ following the specifications. It's important to mention that I'm implementing the cipher in bitslice mode. You'll need the The full ...