Questions tagged [keys]
Private and secret keys consists of secret information used as input to various kinds of cryptographic algorithms such as encryption, signature and MAC to select the concrete transformation done by the algorithm.
137
questions
174
votes
2
answers
187k
views
What is the main difference between a key, an IV and a nonce?
What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their ...
- 6,230
32
votes
2
answers
26k
views
Using the same RSA keypair to sign and encrypt
The RSA signature operation is basically the same as encrypting with the private key. In particular, both operations use the same kind of keys.
Is it safe to use the same RSA keypair both for ...
- 421
22
votes
1
answer
6k
views
Related-key attacks on AES
According to Wikipedia:
Related-key attacks can break AES-192 and AES-256 with complexities $2^{176}$ and $2^{99.5}$, respectively.
What are the requirements for these attacks (i.e how many ...
- 1,192
4
votes
1
answer
2k
views
How do I multiply two points on an elliptic curve?
Tell me if there is a way to multiply two points on an elliptic curve?
For example, as in secp256k1
...
25
votes
4
answers
15k
views
How many RSA keys before a collision?
I was wondering how many possible private/public keys exist? If a million people – for whatever reason – would try to generate 5 keys each in the same minute (on the same date and time) is there a ...
- 363
4
votes
1
answer
3k
views
How to calculate RSA CRT parameters from public key and private exponent
Given the public key (n, e) and private exponent (d), how to calculate CRT parameters (p, q, dP, dQ, and qInv) of this RSA key pair?
- 573
31
votes
2
answers
4k
views
When using Curve25519, why does the private key always have a fixed bit at 2^254?
When using Curve25519, the private key always seems to have a fixed bit set at position $2^{254}$.
Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private ...
- 694
8
votes
2
answers
5k
views
DES — Can I recover the key when I have both ciphertext and the plaintext?
Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?
- 183
32
votes
2
answers
39k
views
Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?
What are KDFs? What are their main purposes? How they can be used, in other words, what's their drill in a cryptography scheme?
- 485
15
votes
3
answers
1k
views
Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?
Like people always say: “Attacks only get worse…” — which is why I'm asking early.
I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, ...
- 18k
12
votes
2
answers
6k
views
Can curve25519 keys be used with ed25519 keys?
Can curve25519 keys be used with ed25519?
I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java.
...
user7024
21
votes
6
answers
2k
views
Why does PBKDF2 xor the iterations of the hash function together?
The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively:
$U_1 = PRF(password, salt)$
$U_2 = PRF(password, U_1)$
…
$U_n = PRF(...
- 313
16
votes
3
answers
10k
views
Are all possible EC private keys valid?
I usually generate a key pair using OpenSSL or Bouncy Castle.
I'm using curve secp256k1.
The 256bit private keys look fairly random.
Do all values of "private ...
- 649
9
votes
1
answer
2k
views
For a given plaintext-ciphertext pair, how many valid AES keys are there?
For $PT\in \mathbb{M}$ and $CT\in \mathbb{C}$, let $\mathbb{F}=\{f|f:\mathbb{M}\rightarrow\mathbb{C}\}$ be the collection of all functions from $\mathbb{M}$ to $\mathbb{C}$. Then AES encryption under ...
- 327
6
votes
5
answers
3k
views
What is the actual difference between security through obscurity and true encryption?
In an abstract sense, aren't both the same?
Don't their definitions boil down to the following?
security through obscurity:
trying to make sure some information cannot be obtained without knowing ...
- 313
4
votes
1
answer
2k
views
Generating a cryptographically secure, many-time use, symmetric encryption key
I need to generate a 256 bit encryption key described by the adjectives in the title. Currently I intend to create the key using this RNG.
Is this a secure manner of creating the key, given that it ...
- 483
16
votes
2
answers
8k
views
How exactly does key whitening manage to increase security?
Wikipedia states that key whitening increases security:
In cryptography, key whitening is a technique intended to increase the security of an iterated block cipher. It consists of steps that combine ...
- 389
13
votes
5
answers
15k
views
Two different keys decrypting same content
is there some generally available algorithm which will encrypt a short string and generate two unique keys so that any of the two can be used to decrypt the message again? It doesn't has to be "super ...
- 233
11
votes
4
answers
6k
views
What is the largest performed/possible bruteforce attack to date?
I've read that cracking 128-bit key is currently out of reach of all humanity. However, I can't seem to find any information on what scope of brute force attacks have been performed or are possible at ...
- 1,679
7
votes
1
answer
748
views
Is it possible to weaken a bitcoin private key by “using” it elsewhere?
What are the increased possibilities (if any) of being able to crack a private key given the following:
The associated bitcoin (ECDSA Secp256k1-based) public key is known.
The private key has been ...
4
votes
3
answers
2k
views
Why in one time pad must the key distribution to be truly random
One time pad required a truly random key.
Why canwt it be a psudo-random key?
For example, if the key distribution is that for each bit the probability to get 1 is 0.6 and the probability to get 0 is ...
- 49
2
votes
1
answer
5k
views
Is there a way to find $a$ and $b$ keywords in an affine cipher when only ciphertext but no plaintext is known?
I know simple formulas like
$$E(x) = (ax+b)\pmod n$$
where $E(x)$ stands for encryption,
$$D(y)= z(y-b)\pmod n$$
where $D(y)$ stands for decryption,
and
$$ax==1\pmod n$$
Assuming someone gives ...
- 33
1
vote
2
answers
474
views
Is it possible to generate a key from a hash function, being the key larger than the hash function digest output without spliting the seed?
Let's suppose I have a 2MB photo and I want to generate a key from it, and the key should have 2048-bits of size.
A hash function such as SHA3-512 would not deliver a key with with the desired ...
- 887
49
votes
1
answer
18k
views
Why do all SSH-RSA Keys begin with "AAAAB3NzaC1yc"?
My friend and I have been generating a few SSH2 RSA keys and noticed all the public keys begin with AAAAB3NzaC1yc, with the similarity extending to ...
- 705
10
votes
1
answer
2k
views
How does GPG verify succesful decryption?
How does GPG (or other programs using the OpenPGP file format) verify that it has succeeded with decryption (for symmetrically encrypted data)?
Is something appended to the clear text so there exist ...
- 203
9
votes
2
answers
11k
views
How to calculate an IV when I have a shared private key?
I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
- 491
8
votes
2
answers
1k
views
How to find fixed points for DES weak keys
Can someone explain me this please I am a bit confused? It's from a texbook I am reading (block cipher companion) it says that:
each weak key has $2^{32}$ fixed points $m$ where $\operatorname{...
- 879
7
votes
2
answers
872
views
Entropy preservation through cryptographic hash function
Background
First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
- 187
6
votes
1
answer
1k
views
What is 'key agility' in relation to symmetric-key encryption?
I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
- 4,696
6
votes
2
answers
3k
views
Using bad generator in ElGamal Encryption
Suppose Alice chooses a random Prime $p$ and a random private Key $a \in \mathbb{Z}^*_p$. By accident, she also chooses a random number $g \in \mathbb{Z}^*_p$, which is not a generator of $\mathbb{Z}^*...
- 195
6
votes
3
answers
2k
views
Re-encryption without knowing the secret
Which encryption algorithms could be used for the following scenario?
A user stores a file encrypted by someone else
Then the user is asked to re-encrypt the file with a new secret
The user stays ...
- 169
6
votes
1
answer
2k
views
Do any one-key-of-many cryptographic schemes exist?
I'm pretty sure I understand how public/private key cryptography works. Anybody can encrypt a message using a well-known public key, but only the person who holds the private key can decrypt it.
My ...
- 223
5
votes
2
answers
3k
views
How common are weak RSA keys?
There exist certain attacks that can be used against RSA keys whose prime factors are of specific forms, such as one by Coppersmith.
How common are these RSA keys? If you generate primes randomly, ...
- 2,615
4
votes
2
answers
8k
views
Why is a Diffie-Hellman key exchange required when RSA is already being used for key exchange in TLS?
Specifically with TLS,
What is RSA used for during key exchange?
What is Diffie-Hellman used for?
Since RSA already provides authenticity and confidentiality, why is Diffie-Hellman used during the ...
- 203
4
votes
2
answers
434
views
Is there a theoretical maximum useful keysize given the block-size?
Consider a block-cipher $F$ with a $N$-bit block-size and a $M$-bit key-size. That is, if $k$ is a $M$-bit key, $p$ is a $N$-bit block of plain-text and $c$ is a $N$-bit block of cipher-text, then:
$$...
- 143
4
votes
2
answers
692
views
Is it safe to initialize secret keys by just reading /dev/random on Linux?
For a software, I don't want the user to choose weak keys, so I plan to just read the needed number of bytes from /dev/random to create the needed secret keys. Is it safe to do so?
- 385
3
votes
2
answers
790
views
Probability of false positive key matching two plaintext/ciphertext pairs
Given a keyspace of $ 2^{80} $ and plaintext space of $2^{64}$. And two plaintext and ciphertext pairs $(x_1, y_1)$ , $(x_2, y_2)$. Now we have $2^{80}/2^{64} = 2^{16}$ keys that encrypt $x_1$ to $y_1$...
- 403
3
votes
1
answer
457
views
How wrong is NIST 800-89's Partial Public Key Validation for RSA step e?
NIST 800-89 Recommendation for Obtaining Assurances for Digital Signature Applications has recommendations for (Explicit) Partial Public Key Validation for RSA which include an example method. It's ...
- 144k
3
votes
2
answers
300
views
How are private keys handed to users in Identity-based Encryption?
I'm using IBE in my applied-crypto project in primitive form. I saw many articles about IBE, but didn't find how user can get private key is generated by PKG after EXTRACT method.
So, my question: ...
- 31
3
votes
2
answers
3k
views
Determine if a public key point y is negative or positive, odd or even?
Take an elliptic curve cryptography public key (x, y) and its additive inverse (x, -y). How do you identify which is the positive point and which is the negative point?
Examples:
Private key 1 -> (x,...
- 167
2
votes
1
answer
619
views
Ciphertext to different plaintext
Is there any algorithm for generating the same ciphertext from different plaintexts, depending on the key used? This seems similar to Honey Encryption, but I don't need to have every key give ...
- 123
2
votes
1
answer
577
views
Key Derivation Function (KDF): Can a key derived from KDF be considered as a secure key?
Consider a case where we have a master key MS that is used in pseudo-random function to generate a set of pseudo-random values. Then we use key derivation function to derive a key from each of pseudo-...
- 1,583
2
votes
2
answers
2k
views
Encrypting and MACing different data with same key
It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
- 4,696
2
votes
2
answers
988
views
Why can we always assume that $Gen$ algorithm choose key uniformly?
Disclaimer: This is exercise 2.1 in Katz-Lindell book.
Given a (symmetric) encryption scheme $\Pi=(Gen,Enc,Dec)$ where $Gen$ takes the security parameter $1^n$ as input and generates a key $k$ of ...
- 2,150
2
votes
0
answers
422
views
Proper way to generate symmetric keys [duplicate]
I'm trying to educate my self in key management, how to store them, how to generate them, how to use them properly.
I've been trying to find how you would generate a key for symmetric encryption (say ...
- 966
1
vote
1
answer
120
views
Hashing a seed together with a block counter and using as a encipherment scheme: Will this have the same security in bits as the seed used?
A user of this forum said that the whole entropy of a seed goes to the hashed result if using a counter and also that is suitable for key generation even if the internal state or digest size of the ...
- 887
1
vote
1
answer
3k
views
Euler's totient function and Carmichael's totient function in RSA [duplicate]
I'm a high school student taking IB and I'm doing my EE on Maths, more specifically on the effectiveness of Euler's totient function and Carmichael's totient function in RSA.
Am I right in thinking ...
- 125
1
vote
1
answer
722
views
How to calculate number of possible key pairs in RSA
What determines the number of possible RSA key pairs for a given $n$?
Is it because $\varphi(n)$ produces the number of values that are less than $n$ and coprime with $n$?
Is it as simple as $\varphi(...
- 11
1
vote
1
answer
810
views
How to determine the prefix of a SECP256K1 compressed public key
I need to store a public key in a variable of maximum 32 bytes.
I recover the compressed key and remove its prefix, but then I have to do the opposite: I have to rebuild the compressed address from it ...
- 11
1
vote
1
answer
790
views
Choosing primes in the Paillier cryptosystem
In the first step of key generation phase in Paillier cryptosystem given here.
It's given that
$$\operatorname{length}(p) = \operatorname{length}(q) ) \implies \operatorname{gcd}(pq,(p-1)(q-1))=1$$
...
- 499