## Top new questions this week:

### Why is this not a viable key exchange algorithm?

I was just wondering why this kind of algorithm can't be used instead of, say, Diffie-Hellman to exchange keys: Alice decides on a key she wishes to share with Bob. Alice generates a stream of bytes ...

public-key diffie-hellman algorithm-design key-exchange

### Can a PRF distiguisher invoke the function's algorithm?

The definition of a function $F:\ \{0,1\}^n\times\{0,1\}^n\to\{0,1\}^n$ being a Pseudo Random Function Family (PRF) is that it's implementable by a P.P.T. algorithm $\mathcal F$, and there is no P.P.T....

provable-security pseudo-random-function

### Does varying ChaCha rounds add any security?

This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...

encryption hash stream-cipher chacha salsa20

### Does it make any sense to sign a GCM authentication tag with RSA?

To achieve double insurance for authentication, can we sign the GCM final tag with using RSA? with RSA, no one is able to create his own tag since the private key is not known. However, according to ...

rsa authentication gcm

### Why Fiat-Shamir based signatures incur a security loss?

I read here that assuming we have a Fiat-Shamir (FS) signature $\Sigma$ that is secure based on the hardness of a particular hard problem $\Pi$. Then, the security proof of $\Sigma$ in the classical ...

signature fiat-shamir

### Crypto scheme to map data to users in a way that is anonymous to database server

I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for ...

### How to encrypt many files with AES-GCM, without running the key derivation function each time?

Linked question: AES encrypting multiple files With a password, I have 100k files to encrypt. (Maybe 100k files today; or maybe 50k today, 10k tomorrow, and 40k ...

aes key-derivation file-encryption aes-gcm

## Greatest hits from previous weeks:

### Should we sign-then-encrypt, or encrypt-then-sign?

We regularly want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active ...

encryption public-key signature protocol-design hash-signature

### Chinese Remainder Theorem and RSA

Wikipedia has a nice section regarding the speedup of the RSA decryption using the Chinese Remainder Theorem here. I need to understand the implementation of a similar speedup for the encryption ...

rsa homomorphic-encryption

### Impacts of not using RSA exponent of 65537

This RFC says the RSA Exponent should be 65537. Why is that number recommended and what are the theoretical and practical impacts & risks of making that number higher or lower? What are the ...

public-key rsa

### Can I remove newlines in a public key?

Can I remove new lines from the RSA public key file to get a one line string? So the question is if the key looks like this AAA BBB CCC or ...

rsa public-key keys encoding ssh

### Can you help me understand what a cryptographic "salt" is?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can anyone offer me a ...

### What is the difference between a digest and a hash function?

I was wondering about the difference between these two terms... What is the difference between a digest and a hash function?

hash terminology

### Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area. I'm trying to understand that attack, but every explanation I saw starts with the ...

encryption rsa public-key chosen-ciphertext-attack

## Can you answer these questions?

### Fisher Yates on "faulted" random number generator cryptanalysis

For the sake of curiosity and fun, i have implemented a C# program that operate as deck dealer on 40 cards deck (following the Fisher Yates shuffeling algorithm https://en.wikipedia.org/wiki/Fisher%E2%...

cryptanalysis random-number-generator randomness pseudo-random-permutation shuffle

### Rounding function used in Saber Key Exchange

In Saber: Module-LWR based key exchange, the authors use a rounding function called $\textit{bits}$, defined (in page 3) as follows: $bits(x, i, j)$, with $j \leq i$, gives $j$ consecutive bits of a ...

key-exchange post-quantum-cryptography lattice-crypto nist lwe