# Tag Info

14

Definition In the Damgard-Merkle construction for hash functions the compression function takes as input: a message block and a chaining value. For the very first block there is not previous "chaining value". Instead a particular value, called an initialisation vector (IV) is given. A freestart collision is a collision where the attacker can choose ...

7

Grover's algorithm treats the function it is evaluating as a black box and finds, with high probability, an input to the black box such that it outputs a specified value in $O(N^{1/2})$ evaluations of the function. Since Grover's algorithm works on the function as a black box, your modification does not hinder Grover's algorithm at all in finding the ...

6

Yes, this does leak some information. In fact, just knowing $u_1$ and $w_1$ will allow the attacker to calculate $u_1^{-1} w_1 = x^{-1} z$.* In particular, knowing this value will let the attacker calculate $x$ if they know $z$, or vice versa. Similarly, knowing $u_1$ and $u_2$ will let the attacker calculate $u_1^{-1} u_2 = r_1^{-1} r_2$. With $u_1$, ...

3

First, I would like to point you to this answer. Copying the TL;DR from there: Multiple encryption addresses a problem that mostly doesn't exist. You are better off using a single well chosen algorithm. That said, here are answers to some of your questions: A longer password adds more layers of encryption in this hypothetical scenario and thus ...

3

IND-CPA is equivalent to semantic security under CPA.

2

When you have a RSA key pair, it means that you know the private key (otherwise this is not "your" key pair). The private key format, normally, contains the two factors $p$ and $q$ (at least so it goes with PKCS#1). Even if all you have are the modulus $n$, the public exponent $e$ and the private exponent $d$, the factorization of $n$ can still be worked out ...

1

You can use the Frequency test of the NIST statistical random number test suite. ( see http://csrc.nist.gov/groups/ST/toolkit/rng/documents/SP800-22rev1a.pdf, chapter 2.2). In that chapter is also stated the recommended sample size. I would propose to encrypt a block of zeroes with different randomly selected keys. Another test would be to fix the key and ...

1

Consider the limitations of such an analysis. It can summarily reject a PRNG as being insufficiently random by demonstrating that the outputs are predictable by a computer program. However, its ability to generate comfort as to the randomness of a PRNG is limited. We have mathematicians going through hoops with months of mathematical analysis to prove ...

1

As the previous poster says the problem can not be solved if you don't know $x,z,r_1,r_2.$ But the question seems to have some connection with the generalized hidden number problem. In some sense answers the opposite question of the OP. Say that you have an oracle that gives you $r_1,r_2,...,r_{d}$ (polynomial many) uniformly from ${\bf Z}_p$ (so the ...

Only top voted, non community-wiki answers of a minimum length are eligible