# All Questions

222 views

### What cryptanalysis is possible against two independent keystreams XORed against plaintext?

If a wise person was unsure about which commercial cryptography standards are truly secure from the fascist powers that be, it would seem the obvious option for companies and individuals is to now use ...
104 views

### Formal security of recycled random blinding in a Paillier scheme

This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ...
132 views

### What kind of attack does the current brokenness of SHA-1 allow?

I understand that the following is becoming feasible, or already is: Find any 2 data (d1 and d2), for which SHA1(d1) = SHA1(d2) However, it is not entirely clear ...
100 views

### Possible to use an accumulator to “license” or restrict the qty of certificates being used?

Suppose in a future version of x509 PKI, it is possible to limit the quantity of certificates being used, what would that look like? Here is a concept that won't work in the real world, but ...
223 views

### Nonces being used in SSL and MAC to prevent replay attacks

I'm a bit confused in the way nonces are used in these processes to prevent replay attacks. Heres How I think it works during SSL: Nonces are exchanged during stage one of the handshake protocol. ...
571 views

### Is double hashing collision resistant?

Double hashing can surely provide more security than only one layer of hashing but does that necessarily mean it is more collision resistant? This question in a more mathematical form: If $H$ is a ...
626 views

### Is RSA with SHA1 broken?

I am using CryptSignMessage to sign a string/file. Is using RSASha1 insecure? I know Sha1 is broken as a hashing algorithm, but does that also mean that using it for signing with RSA is broken?
73 views

### Confused with the role of AES round keys

AES works when each plaintext block is arranged in a 4x4 array of bytes called states. State goes through 10 rounds of encryption consisting of 4 operations: bytesub, shiftrow, mix columns and add ...
422 views

### What cryptography is suitable to motivate High School students to learn math?

A High School math teacher in the Bronx asked me if I knew of any way to use cryptography in a way that motivates students (15 to 18 years old) to learn math. I do know that many of them want to ...
57 views

### TimeStamp in Cache-time attacks on AES [closed]

I have recently read about AES cache timing attacks. More specifically, I read Daniel Bernstein paper Cache-timing attacks on AES. I have a question about the code in Appendix A: ...
4k views

### Specification of the Megamos crypto algorithm

It has recently emerged that a paper that was scheduled to appear at Usenix Security 2013, titled "Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobiliser", has been censored ...
83 views

### PKI Infrastructure

I've got a very simple but for me a difficult question. I analyzed the public key cryptography and understand the process. But I didn't understand why is only the receiver able to decrypt to message. ...
286 views

### Programming language for modular arithmetic over large numbers [closed]

I'am trying to implement algorithms on integer factorization.This involves dealing with integers of 200-500 digits and doing modular arithmetic over them.Which programming language has inbuilt support ...
91 views

A secure and somewhat fast way to "re-encrypt" (refresh? anonymise?) a Paillier ciphertext, $c$, is to multiply it by an exponentiated random value: $c \gets c \cdot r^n \mod n^2$ (with $r \in ... 3answers 394 views ### Implementing a web app where the server cannot decrypt its own data? I'm a cryptography novice, but I think that the world needs to move towards an "encrypt everything" mentality as much as possible. As a result, I've been thinking a lot about ways to build a web app ... 2answers 277 views ### Factors of RSA modulus In the article A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ... 1answer 144 views ### Private Information Retrieval--Is it still theoretical? Are there any real world products in which private information retrieval techniques are used?(a data hosting server oblivious of which data item was fetched from it?)If not what are the major barriers ... 0answers 129 views ### Key Recovery Smart-Vercauteren SWHE In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I ... 1answer 119 views ### white-box cryptography and its applications [closed] I am a programmer who is doing research into whitebox cryptography. What I hope to do is to use WBC for an DRM application however as some of us may know, WBC is theoretically impossible therefore I ... 4answers 252 views ### Difference between Pseudorandom Function vs randomly chosen function I am currently going through a course in cryptography. In this, I stumbled upon Pseudorandom Functions. I got a little idea of Pseudorandom Generators which map an input string (key) to an extended ... 0answers 28 views ### How to find the factors of the modulus? [duplicate] In the article "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems", the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ... 1answer 335 views ### ASN.1 encoding off RSASSA-PSS default parameters I am not totally sure the question belongs to crypto and not stackoverflow but nevertheless... The problem is the encoding of the RSASSA-PSS default algorithm identifier parameters in an X509 ... 3answers 166 views ### private keys for multiple devices [closed] I have an architecture where: a user can have multiple devices (phones) the server needs to broadcast the payload to all devices through the same channel (basically, all devices listen and receive ... 1answer 1k views ### Difference between Hash function and Random Oracle Going through the blog post, I was under the impression that any cryptographic scheme which makes use of hash function is said to be using random oracle. But, I have come across one construction of ... 1answer 47 views ### Can one deduce the symmetric key size used to encrypt a given a piece of ciphertext? Assume an attacker captures a piece of ciphertext encrypted with a symmetric key. He knows all the details of the algorithm used to encrypt except for the size of the key used in this case. Can he ... 1answer 175 views ### Key management protocol for end-to-end security on Advanced Metering Infrastructure I am currently working on a research on end-to-end security implementation for Advanced Metering Infrastructure (AMI). Pardon me if I a bit off topic or not asking the right question as I am ... 1answer 94 views ### Integrity protection in wireless sensor networks [closed] I have done a lab about wireless sensor nodes and got in touch with encryption for the very first time. There are some questions on my sheet, especially on integrity protection (the attacker wants to ... 1answer 260 views ### Problem with implementing DES in python i'm implementing DES in python and i've stumbled upon a problem i can't really find the problem, after debugging it i narrowed it down to this function, can anyone tell me if i'm implementing the DES ... 1answer 94 views ### Unique assignment of X.509 certificate to each client I'm trying to implement a short scale electronic voting application in a domain comprised of no more than 100 clients. System administrator is able to create new election instances and each client is ... 1answer 151 views ### How much (home PC) CPU time is required to generate a prime number of a given size? How much CPU time is required on a typical home computer to generate a prime number of size 100 bit, 200 bit , 512 bit and 1024 bit using given random bits of the respective sizes? Please note that ... 1answer 315 views ### Strength of RSA with OAEP In our current system we use an encryption solution based on RSA with OAEP padding. Key size is optional but default 2048. What is the general strength of RSA with OAEP? Are there know attacks that ... 2answers 209 views ### Is there a client-side program to cryptography a HTML page and decode if correct password is writen? [closed] I want to know if there is an easy way to do this: create a complete HTML page cryptography the text content (image is not important) ask user some password check the password with a cryptographed ... 1answer 753 views ### What is the algorithm behind PasswordDeriveBytes? Microsoft has created an implementation of PBKDF1 in the PasswordDeriveBytes class. It can however generate more bytes than PBKDF1, which is limited to the number ... 1answer 95 views ### What is the difficulty of DLP in GF(P^Q) with a subgroup with a prime order of L Given a finite field GF(P^Q), having a subgroup with a prime order of L (P,Q,L are all primes), how difficult is it to find the discrete log, is it related to P and Q or is it related to L, or to ... 1answer 157 views ### Using hash of plaintext as nonce in NaCl secretbox- bad idea? I need a nonce to encrypt my stuff using NaCl secretbox. I will be transmitting the nonce along with the ciphertext, which I have been told is OK to do. It occurs to me that one could simply use the ... 1answer 89 views ### Is changing$H(R\mathbin{\Vert}A\mathbin{\Vert}M)$to$H(R\mathbin{\Vert}A\mathbin{\Vert}H(M))$in EdDSA secure? EdDSA calculates$s=(r+H(R\mathbin{\Vert}A\mathbin{\Vert}M)\cdot a)\bmod\ell$and$r=H(h\mathbin{\Vert}M)$, with$H$being the hash function (SHA2/512);$B$being the generator;$A$being the public ... 1answer 207 views ### Base64 with shuffled alphabet I have a base64 'cipher' text, I know that in clear text is a hidden xml document (I do not know nothing about its structure), but the base64 aplhabet was somehow shuffled. Is there any smart way, how ... 1answer 348 views ### Isn't the security of EC curve 25519 126 bits? The security of the EC25519 is given as 128 bits, but since the order of the group is 252 bits shouldn't the security be 126 bits? Given as half the magnitude of the underlying field, since DLP ... 3answers 646 views ### P = NP and current cryptographic systems I've recently heard some people claiming that if the fact that P = NP is proven, most (all?) the current cryptographic algorithm considered secure like RSA will be unusable in secure systems. My ... 1answer 103 views ### Effect of CFB IV reuse If an Initialization Vector (IV) is reused (under the same encryption key) in Cipher Feedback Mode (CFB), what is the effect upon security? I know there is some negative effect upon security, but I ... 1answer 428 views ### What criteria make the theta step of Keccak's round function reversible? From what I've been reading, Keccak's round function is reversible. That's pretty obvious for the$\rho$,$\pi$and$\iota$transforms. For$\chi$to be reversible,$x$'s range has to be odd — but ... 2answers 127 views ### Is it possible to use structures other than finite fields? I have some difficulties to understand why we are using finite fields in cryptography. Why do we use field? Why not ring or group? Is that really necessary that the field is finite? Why not real ... 3answers 335 views ### Can you help me with this Random Number Generator function? By someone's suggestion, I am posting this question from math.stackexchange.com. I want to find out a suitable function or algorithm, which can provide a random sequence like this… Input:$3\$ ...
36 views

I am studying for network security exam. And in the slide about Key Management, under a heading Key Verification I see this: Key Verification Almost all cryptographic algorithms have some weak keys ...
11k views

### What is the SSL private key file format?

I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys. In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
2k views

### Why is the private key generated first in public key crypto?

I'm still new to public key crypto. I'm trying to understand how it is that the private key is generated first in public key crypto? I would have expected the private and public key to be generated at ...
202 views

if a number is said to be a subgroup of a quadratic residue of Z∗p, can I affirm that it is a generator of a cyclic group ? ie, say i am looking for a number which is an element of order q in Z*p, ...
253 views

### CBC with a fixed or random IV

I have two probably quite naive questions: 1) Why, exactly, is it so bad to have a fixed (or predictable) IV in CBC mode? An example would be great! 2) Given 1), why is a random IV better? And if ...