# Questions tagged [algorithm-design]

Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its name.

153 questions
Filter by
Sorted by
Tagged with
9k views

### Kerckhoffs’ principles – Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
121k views

### Difference between stream cipher and block cipher

I read that A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. (...
25k views

### Can one generalize the Diffie-Hellman key exchange to three or more parties?

Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties? I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
51k views

### What is the lowest level of mathematics required in order to understand how encryption algorithms work?

What mathematical fields of knowledge would be required in order to get a good understanding of encryption algorithms? Is it basic algebra, or is there a "higher education" mathematical field ...
9k views

### Why not the one-time pad with pseudo-number generator

I am very new to cryptography (so be kind), but I have a question that may seem silly. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one ...
991 views

### Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?

I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the ...
4k views

### What are recommended, general strategies to start block-cipher design and/or analysis?

I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers. Now, the ressources on the "black art" of design and ...
7k views

### Turning a cipher into a hashing function

This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;) The first hashing functions created ...
3k views

### Is there a length-preserving encryption scheme?

Is there a length-preserving encryption scheme, that preserves the lengths of input sizes such that the length of the input plain text is same as length of the output cipher text ?
847 views

### Just how surjective is a cryptographic hash like SHA-1?

From “Are common cryptographic hashes bijective when hashing a single block of the same size as the output” and “How is injective, inverse, surjective & oneway related to cryptography”, it is ...
520 views

### Would a HMAC digest make sense in an RSA / ECDSA signature?

When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
22k views

### What are the differences Between “White-Box Cryptography” and “Code Obfuscation”?

I have been reading the question "What is a white-box implementation of a cryptographic algorithm?" and it led to this short article / Q&A which states in question 2: Q2: What is the ...
2k views

I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not ...
467 views

### Building a stream-cipher out of a hash function?

I've already read this: Is it feasible to build a stream cipher from a cryptographic hash function? However, my proposed construction differs… Suppose the hash generates N bits. These bits are split ...
1k views

### How to optimise Euclidean Algorithm for large numbers? -RSA

I am using the standard version of the Euclidian Algorithm (i.e. GCD(270, 192) = GCD(192, [270 % 192]) = ...repeat until 0) to determine if two numbers are coprime. I run the algorithm, check if the ...
9k views

### Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
10k views

### Is there a string that's hash is equal to itself?

I was wondering if there's any string that has a hash equal to itself, so that – when using any (none specific) hash function – the hash would be equal to that string? so that: ...
8k views

### Reason why “XOR” is a linear operation, but ordinary “addition” isn’t?

I'm new in cryptography and try to read some articles in this field. Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity. I have a simple ...
6k views

### What's a cryptographic primitive, really?

The more I encounter the term "cryptographic primitive," the less I feel confident that I truly understand what it means. Is it just me, or is there no universal definition for the term? Or does the ...
966 views

### Counter mode secure hash algorithm

Ever since the SHA-3 competition, I've been wondering if it is possible to create a hash algorithm that is easier to parallelize. The current algorithms all seem to require building a tree of hashes. ...
4k views

### Are there any specific requirements for the function $F$ in a Feistel cipher?

In a Feistel cipher (as shown below), it seems that the security of the cipher would be entirely dependent upon the function $F$. What requirements on $F$ are necessary for a secure Feistel cipher? Is ...
12k views

### Does encrypting twice using the same block cipher produce a security weakness?

If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system. ...
653 views

### Can we exchange the permutation of a sponge construction?

Part of a sponge construction (like SHA3 uses) is a fixed permutation $p$; which is clearly not one-way. Could we, theoretically, exchange the permutation $p$ with any other permutation? What basic ...
3k views

### Symmetric vs. Asymmetric cryptographic approaches to data security

I know the basic differences between Symmetric vs. Asymmetric cryptography, but I'd love to know more details: Exactly why is the asymmetric approach slower than the symmetric? Why does it make use ...
314 views

### Algorithm Design for only Mutual Information Sharing

Bob and Alice each have a bit string they want to keep private. They each want to know what the bitwise AND of their two strings would be without telling the other or anyone else listening to their ...
229 views

### How can I verifiably announce a choice without revealing its content?

Here is the simplified problem: Alice chooses from a small set of possible values. Bob guesses which value Alice picked. Alice reveals what value she picked. Alice's choice must stay secret ...
308 views

### What is the difference between strong/weak alignment?

In this answer there is the mention of "weak alignment", followed by an indication that it is related to "resistance to truncated differential cryptanalysis". What exactly is the difference between ...
694 views

### How exactly is the input message of SHA-256 (pre-)processed?

I’m very interested how SHA-256 handles messages, but I’ve got 3 questions. (As I have already read in some answers before, SHA-256 is not directly performed on the message but on an array, thanks for ...
5k views

### Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
31k views

### Do identical strings always have the same SHA-256 value?

If you hash a string using SHA-256 on your computer, and I hash the same string using SHA-256 on my computer, will we generate the same value? Does the algorithm depend on a seed (so we'd both need ...
1k views

### What is the best way to put a backdoor in an encryption system?

How can you put a backdoor into an encryption algorithm? Are there any techniques that can be used to reduce the time it takes to break a key? I am looking for practical examples encryption schemes ...
4k views

### Why is Pearson hash not used as a cryptographic hash?

The original algorithm produces 1 byte long hash and is (of course) not suitable for cryptography use. But according to wikipedia, it is possible and easy to produce Pearson hash of any length, simply ...
4k views

### Are there any secure commutative ciphers?

This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure. My question is, here there any commutative ciphers out there that are secure ...
854 views

### Understanding the wide trail design strategy

I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to ...
5k views

### How exactly does key whitening manage to increase security?

Wikipedia states that key whitening increases security: In cryptography, key whitening is a technique intended to increase the security of an iterated block cipher. It consists of steps that combine ...
1k views

### Elliptic curve cryptography related key attacks [closed]

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
491 views

### Is it possible to exactly reverse engineer an unknown cipher inside a black box?

Consider the following arrangement:- There is an unknown cipher algorithm operating inside the black box. You can enter infinite key /plain text pairs, and observe all of the outputs. The box might ...
1k views

### How to choose constants in a cryptographic function?

A number of cryptographic functions have constants built in. For example, the constants used in RFC 2104 for HMAC, or the constants used in s-boxes (e.g., DES and AES), or MD5. In general, how are ...
2k views

### What are the constraints for an IV using AES in CBC mode?

I'm designing a protocol for use into a VPN software. The VPN frames are encapsulated into AES-256 CBC encrypted frames. I understand that IVs must be uniquely used for each message encrypted with ...
2k views

### How was the MDS matrix used in AES chosen?

$$\begin{pmatrix}2&3&1&1\\ 1&2&3&1\\ 1&1&2&3\\ 3&1&1&2\end{pmatrix}$$ In the above MDS matrix used in AES encryption, why are the numbers $2$,$3$ and $1$...
8k views

### What happens if a SHA-256 input is too long (longer than 512 bits)?

What I understand is: When we parse a message into 512 bit message blocks. Then we extend the first message block to 64 entry array and start with the compression function. What happens if the ...
862 views

### Homomorphic Encryption with Addition and Exponentiation

Is there any homomorphic encryption scheme which supports addition and power over cipher text ? Paillier is close but it supports addition and multiplication with a constant. I am getting an output ...
460 views

### Are there any security issues when replacing the SHA-256 initialisation values?

As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words. These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
I do not see why the Rcon function is important, it looks like a waste of cycles. $$\operatorname{Rcon}(i) = 2^{i-1} \bmod p(x)$$ is in $\operatorname{GF}(2^8)$, ...