# All Questions

15 views

### How can a poor RNG impact security?

I have read this article and I do somehow "understand" that the reduction of entropy makes it easier to guess. But how exactly can the security be reduced by that? Can you give a concrete scenario, ...
13 views

### Derive $x$ when given $g,g^x$ and $g^{(1/x)}$?

If an adversary has access to the generator g of a group G and is given access to $g^{x}$ and $g^{(1/x)}$, will it make it any easier to derive the value of $x$ compared to when he had access to only ...
159 views

### Why can an elliptic curve private key be 1?

I often see in papers (e.g. this one) that for an elliptic curve with generator point $G$ and order $n$ the private key $d$ can take on any integer value in the range $[1, n)$. When $d = 1$ the ...
30 views

### Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
26 views

### Master keys' strengh

If I am going to use a master key to generate a session key, why the master key must be "stronger" than the session key? Like should not be distributing 128-bit AES keys derived from a 56-bit DES ...
9 views

### Use MDC to provide origin authentication for public key encryption?

Why can't we use an MDC to provide origin authentication when using public-key encryption?
211 views

### Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...
39 views

### Collisions in the cyclotomic knapsack function

I've been working my way through the paper “Efficient Collision-Resistant Hashing from Worst-Case Assumptions on Cyclic Lattices” by Peikert and Rosen, and I've come across something that doesn't seem ...
40 views

### Where and how to store private keys in web applications for private messaging with web browsers

I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy ...
44 views

### Can you still decrypt XTS if half of the cipher text is deleted?

If a part of my data is damaged, corrupted, or deleted, is it then still possible to decrypt the rest of the data if you still have the key? The situation: a piece of data (something like a document ...
520 views

### Using bcrypt for MAC - is it correct and secure?

Suppose there is a hashing function: $$ph = bcrypt(sha256(m + k), salt)$$ Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...
162 views

### Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
20 views

### Use $e$ in GGH as shared secret?

I was wondering if we could construct a symmetric encryption scheme by assuming that the secret key itself in GGH is public and the shared "key" is the error vector $e$. To encrypt we would take the ...
26 views

### What is this encryption type? [on hold]

I just get the encryption from some website. Here the encryption output: 1) ZFRSA00013GDU and this is the key before encrypted PKR003 2) YHZSA00100PE9 and this is the key before encrypted PJR011 ...
53 views

### About random self-reducibility of DDH

In Section 8 of this, Lindell presents a construction of an oblivious transfer protocol which is secure in the malicious model under the following variant of the DDH assumption (page 53): [F]or ...
418 views

### How to sign a large file for random-access reading?

I need to write an "Authoring" application which produces large files. These files must be signed so that the "Consuming" application knows that it was authored with a matching key. The consuming ...
48 views

### Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.
14 views

### NORX parallel speedup?

How much of a speedup can be expected going from serial NORX (6441) to 4-way parallel NORX (6444) assuming the latter is implemented as 4 word-sliced instances of the former?
68 views

### Designing a secure protocol to avoid MITM?

Imagine that you are designing an online game, the framework consists of a player A, a game host H and a trusted central server S. The player A has a symmetric key KAS and id A that is known ...
40 views

### Padding schemes for asymmetric encryption with provable security in the standard model

Most padding schemes for asymmetric encryption (OAEP, OAEP+) are only proven secure in the random oracle model. Although no attacks are known, it would be nice to find a padding scheme with provable ...
18 views

### Man-in-the-middle-Attack three Parties [duplicate]

How does this work in Diffie Hellman ? I'm working for days on this but i'm a little bit Confused. If Oscar changes only the last key (for example Kabc ) is this enough ?
22 views

### Using a round function intended for an SP network in a Feistel network?

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher? My thought is "yes" because: it already has ...
52 views

### How to generate an RSASSA-PSS signature with MGF1-SHA256?

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
81 views

587 views

### How does blocksize affect security?

I have recently read about how blockciphers and how stream ciphers work, and although I think I finally got everything right, I'm still wondering how increasing blocksize increases security.
20 views

### Having trouble with a double encoded keyword sypher [on hold]

IIYFATKOHRFDQLRTUKFOLDTIQLTFAZLGZFUNCKYCEFUCUQUGCWWOGYSOCZTXGZPNHYPMPQDOLNONAZOEQLUSEYELNUDEPQDOKPTIPQTYCZUZQQORUFANHQRGHIUJUQOEQQUWKEURLYHCSLUCUUUFKLUNAYLRUFAZQZONKYIGBKYITDOEAWGDPIKOOTRCUJLIGZWNSZGC ...
62 views

### Can I use a block cipher in CTR mode to generate keys from a master key?

Suppose I have an AEAD mode based on a block cipher that requires two or more keys. In some cases, there is a complex proof that one key suffices. But finding such a proof is hard. An alternative ...