# All Questions

33 views

### Are timing attacks exploitable if each key is used only once?

Suppose that one performs (for example) AES-GCM encryption and decryption using an algorithm that is vulnerable to timing attacks, but each key is used only once. Is it still possible to perform a ...
57 views

### Practicality of codebook in current-day secret communications

Codebook appears, if I don't err, to be an antiquitated topic rarely touched upon in discussions of modern cryptography. Couldn't codebook nonetheless be of high practical utility and even be ...
54 views

### Can gnupg master key decrypt something encrypted with subkey?

When creating gpg subkeys, the master key signs and certifies that a subkey belongs to that master. That's ok, but, can master key decrypt something encrypted by a subkey? I guess no, but I want to be ...
45 views

### finding the basis of a kernel in a lattice

Given a parity check matrix $A$ we define the $q$-ary lattice $$\Lambda(A) = \{x \in \mathbb Z^m\;:\;Ax\equiv0\pmod q\}$$ How to find the basis of the lattice and how to find its hermite normal form? ...
37 views

### I am trying to implement TLS v1.1 {3,1} but get alert 70 on hellomessage to goolge

I am trying to implement TLS on top of the winsock api's from windows. I am using port 443 and have created a socket. I have sent this message in decimal. ...
116 views

### Block cipher not resistant to collisions

If we have the following block cipher, $E(k,m)$, which is a permutation, why is $f_2 (x,y)$ not collision resistant? $$f_2(x, y) = E(x, x \oplus y)$$
106 views

### Elliptic curve ElGamal with homomorphic mapping

I am interested in ElGamal due to the fact that you can achieve some degree of homomorphic properties. I became interested in applying ElGamal to elliptic curves, and found this other question with an ...
60 views

### Proving property of Modified Rabin Signature

I'm trying to prove one of the properties of the “Modified Rabin Signature Scheme”: If $gcd(x, n) = 1$, then $x^{\frac{(p−1)(q−1)}{2}} \equiv 1 \pmod n$ This is what I’ve got so far… Proof Let ...
74 views

### Preserving Confidentiality and Integrity in a Public channel

Let's say I've got two people that are trying to talk in a public channel $A$ and $B$ and they want to preserve their confidentiality and integrity. Which cryptographic algorithm would they want to ...
74 views

### Does the time to evaluate a hash function depend on the function input size?

Suppose we have a (variable-input size) hash function modeled as a random oracle. Can it be consistent to say that the time to evaluate this function depends on the input size ?
85 views

### Can I shorten the large ECDSA public key output file from OpenSSL?

I am working in a very bandwidth restricted environment where I from time to time have the need to distribute public keys. The distribution happens in bit format, so there is no need for encoding, at ...
59 views

### How to test an implementation of a homomorphic scheme?

I want to implement the following homomorphic encryption scheme from On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption by Lopez-Alt et al. I use C++ and I want ...
72 views

### Is the security of an HMAC equally important as the security of the cipher itself?

I'm a little unclear on how hash based MAC works... So I would like to know, is the security of your hash function as important as the security of the overall cipher? Basically, if you can crack the ...
59 views

### Is (1 bit HW signal) XOR (8 bits PRNG output) sufficient for a HWRNG?

This is really a follow up question to a comment made regarding How to roll a HWRNG In the situation of whitening a hardware generated random bit stream, "XORing the two bitstreams should be fine ...
86 views

### Attack on textbook RSA with small messages

We learned in class that if Alice wants to send a small message $m$, such that $m < N^{\frac{1}{e}}$, so we can break the system using $e$-th square of $m^e$. But what if Alice knows this flaw and ...
58 views

### NMaster key from n secret key

I have to derive master key from N secret key. With the help of master key, i can collect all the secret keys which is used to derive master key. key1, key2,..keyN ==> single master key and single ...
110 views

### Message security and also program copy detection

Imagine I have client and server running on different machines, each as a separate software. I want to ensure: message authenticity, integrity and confidentiality at least of messages coming from ...
70 views

### Implicit authentication aritcle

First, I want to know what is the logarithm used in the following system of equations (from the paper Flexible and Robust Privacy-Preserving Implicit Authentication - Domingo-Ferrer, Wu, ...
33 views

### How to force non-negative int64_t output for blowfish encryption with int32_t input?

I would like to encrypt a series of small integers one by one. The range of them is about 0~10^8. The output must be non-negative int64_t integers. Since Blowfish is 64-bit cipher, I prefer to use it ...
80 views

### Is this MAC scheme secure?

Say we have a computationally secure Message Authentication Code scheme (Gen, Tag, Ver). Let $Tag'_k(m):=$ first half bits of $Tag_k(m)$. Let's assume the range of tags is $n$bits. Is (Gen, Tag', ...
113 views

### Key Derivation Function (KDF): Can a key derived from KDF be considered as a secure key?

Consider a case where we have a master key MS that is used in pseudo-random function to generate a set of pseudo-random values. Then we use key derivation function to derive a key from each of ...
149 views

### Memory hard key derivation (password hash) using AES encryption

I am restricted on a certain environment involving PHP and am currently unable to implement new memory hard hashes such as scrypt (and I am not trying to compete with the likes of scrypt). My ...
114 views

### State of the art techniques for Anonymous Authentication?

What are the state of the art techniques for Anonymous Authentication? What are the most popular ones? The problem domain I am considering is with respect to different users accessing cloud content; ...
42 views

### Is a hash “reset sequence” possible?

Is there such thing as "hash reset sequence" that brings hash to the same known state? A hash function has a state. In MD5 and others vulnerable to the length extension attack, the attack works by ...
121 views

### Is it an overkill to add external integrity check to the AES-GCM encoding?

There is a java library for android which implements integrity checking to predefined encrypting mode(which can be found here). Short class description from author page to avoid further questions ...
81 views

### Easy hash function collision

I'm designing a cryptography-breaking assignment for a college-level introductory security course, and I'm looking for a hash function which is reasonably easy (but not too easy) to generate ...
52 views

### Are private and public key sizes of Elliptic curve related?

I'm new to elliptic curve cryptography. I just want to know in the case where I take a random number (private key) and find its associated public key, does the size of the public key depends upon ...
39 views

### Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and ...
105 views

### How do you communicate the hash function used with RSA signing?

When it comes to RSA signing, I understand why you need to hash the data before signing it, but don't you need to communicate what hash algorithm you use to whoever will need to verify the signature? ...
72 views

### Can the salting function complexity improve the hash robustness?

I'm quite novice in security, and all examples I saw seem to salt the password by concatenating it, or by applying a simple binary OR or XOR. So the hash is based on "salt + password", "salt | ...
50 views

### Symmetric-like cyphers with several steps

Are there any good symmetric-ish cyphers that involve three or more steps with independent key material for each step? Formally, there should be a function $K(s)$ that returns a tuple $(k_1,..,k_n)$ ...
72 views

### Does Mersenne Twister generate homogeneous numbers?

I have been assigned to generate 15000+ homogeneous and uniform random numbers for a work. I have been searching if Mersenne Twister generate homogeneous distribution of numbers but I don't find ...
40 views

### Proving the security of a one-way function with partially known input

Let's say we have a construction like in this question: We have a OWF $h(.)$, a secret salt TXT, and a counter starting at 1, and we compute ...
62 views

### Weaknesses of RFC6628

In RFC6628 section 2.2, they say: w = The password remembered by the user. W = The password verifier registered in the ...
77 views

### Secret only known on consensus

Does a method exist where a secret is generated so that is is unknown until 3 or more people (predetermined) reach consensus that it should be revealed?
193 views

### Is my protocol that uses hybrid cryptography and AES-GCM secure?

I'm having a lot of trouble trying to understand how to implement AES-GCM. My usecase: Person A sent me a file with a gauranteed unique name. I want to be assured it was from person A, and that no ...
169 views

### RSA 1024 bit forge a new matching signature from a chosen message

I have an RSA signature scheme with 1024-bit key where I know the following: Public modulus $N$ Public exponent $e=3$ A lot of signatures Summary: To compute a signature, an MD5 hash is ...
105 views

### Why is the tweak length 64bit in BPS FPE algorithm?

In the algorithm for BPS Format Preserving Encryption Is this tweak always the same length (64bit)? Why did they choose the length 64bit for the tweak?
35 views

### What are the number of output bits of the internal function F used in BPS algorithm?

In the BPS specification document it says We denote by f the number of output bits of the internal function F What is this if the internal function is AES? Would it be the block size (e.g. 128)? ...
310 views

### Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
32 views

### Is it not secure if we use weak passwords to protect exported PKCS #12 files with private keys?

Consider a practical scenario as described in Microsoft's Expand Export a Certificate with the Private Key. We can see a certificate with private key can be exported as a PKCS #12 file, where the ...
55 views

### Encryption on the cloud with versioning

Can file-versioning, which is available for instance in Dropdox, weaken the security of encrypted files if someone is able to see two or more snapshots of the ciphertext at different times? To be ...
64 views

### Subkey generation in OMAC1/CMAC with XTEA?

All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key. If ...
133 views

### Reverse output of general Fibonacci LFSR

Suppose we have some Fibonacci LFSR, and it outputs some sequence. How to change starting LFSR so, that it outputs exactly same sequence, but in reverse order?
58 views

### Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?

I have a follow-up question about the extended Euclidean algorithm, as applied to RSA key generation, described in this answer. Let us say we have $p=5$, $q=11$ and $e=17$, so that $N=55$ and ...
60 views

### Using Skein as PRNG

I have read that the Skein hash can be used for quite a few different functions, including a PRNG. Would using the 1024 Skein hash to return 16KB of data be appropriate for a PRNG? Or would it only be ...
280 views

### How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
236 views

### What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...