Questions tagged [keys]

Private and secret keys consists of secret information used as input to various kinds of cryptographic algorithms such as encryption, signature and MAC to select the concrete transformation done by the algorithm.

Filter by
Sorted by
Tagged with
172 votes
2 answers
182k views

What is the main difference between a key, an IV and a nonce?

What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their ...
curious's user avatar
  • 6,150
31 votes
2 answers
24k views

Using the same RSA keypair to sign and encrypt

The RSA signature operation is basically the same as encrypting with the private key. In particular, both operations use the same kind of keys. Is it safe to use the same RSA keypair both for ...
Lay András's user avatar
22 votes
1 answer
6k views

Related-key attacks on AES

According to Wikipedia: Related-key attacks can break AES-192 and AES-256 with complexities $2^{176}$ and $2^{99.5}$, respectively. What are the requirements for these attacks (i.e how many ...
Chris Smith's user avatar
  • 1,192
4 votes
1 answer
2k views

How do I multiply two points on an elliptic curve?

Tell me if there is a way to multiply two points on an elliptic curve? For example, as in secp256k1 ...
Derick Swodnick's user avatar
25 votes
4 answers
14k views

How many RSA keys before a collision?

I was wondering how many possible private/public keys exist? If a million people – for whatever reason – would try to generate 5 keys each in the same minute (on the same date and time) is there a ...
Nick wheatley's user avatar
4 votes
1 answer
3k views

How to calculate RSA CRT parameters from public key and private exponent

Given the public key (n, e) and private exponent (d), how to calculate CRT parameters (p, q, dP, dQ, and qInv) of this RSA key pair?
user1563721's user avatar
31 votes
2 answers
4k views

When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position $2^{254}$. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private ...
Trina's user avatar
  • 694
8 votes
2 answers
5k views

DES — Can I recover the key when I have both ciphertext and the plaintext?

Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?
GregoryComer's user avatar
32 votes
2 answers
37k views

Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?

What are KDFs? What are their main purposes? How they can be used, in other words, what's their drill in a cryptography scheme?
Samuel Paz's user avatar
15 votes
3 answers
1k views

Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?

Like people always say: “Attacks only get worse…” — which is why I'm asking early. I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, ...
e-sushi's user avatar
  • 17.9k
12 votes
2 answers
5k views

Can curve25519 keys be used with ed25519 keys?

Can curve25519 keys be used with ed25519? I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java. ...
user avatar
21 votes
6 answers
2k views

Why does PBKDF2 xor the iterations of the hash function together?

The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively: $U_1 = PRF(password, salt)$ $U_2 = PRF(password, U_1)$ … $U_n = PRF(...
Cameron Skinner's user avatar
16 votes
3 answers
10k views

Are all possible EC private keys valid?

I usually generate a key pair using OpenSSL or Bouncy Castle. I'm using curve secp256k1. The 256bit private keys look fairly random. Do all values of "private ...
Thomas Von Panom's user avatar
9 votes
1 answer
2k views

For a given plaintext-ciphertext pair, how many valid AES keys are there?

For $PT\in \mathbb{M}$ and $CT\in \mathbb{C}$, let $\mathbb{F}=\{f|f:\mathbb{M}\rightarrow\mathbb{C}\}$ be the collection of all functions from $\mathbb{M}$ to $\mathbb{C}$. Then AES encryption under ...
Baruntar's user avatar
  • 327
6 votes
5 answers
3k views

What is the actual difference between security through obscurity and true encryption?

In an abstract sense, aren't both the same? Don't their definitions boil down to the following? security through obscurity: trying to make sure some information cannot be obtained without knowing ...
Tobias Kienzler's user avatar
4 votes
1 answer
2k views

Generating a cryptographically secure, many-time use, symmetric encryption key

I need to generate a 256 bit encryption key described by the adjectives in the title. Currently I intend to create the key using this RNG. Is this a secure manner of creating the key, given that it ...
crawfish's user avatar
  • 483
16 votes
2 answers
8k views

How exactly does key whitening manage to increase security?

Wikipedia states that key whitening increases security: In cryptography, key whitening is a technique intended to increase the security of an iterated block cipher. It consists of steps that combine ...
cHiMp's user avatar
  • 389
11 votes
5 answers
14k views

Two different keys decrypting same content

is there some generally available algorithm which will encrypt a short string and generate two unique keys so that any of the two can be used to decrypt the message again? It doesn't has to be "super ...
Bishonen_PL's user avatar
11 votes
4 answers
6k views

What is the largest performed/possible bruteforce attack to date?

I've read that cracking 128-bit key is currently out of reach of all humanity. However, I can't seem to find any information on what scope of brute force attacks have been performed or are possible at ...
ThePiachu's user avatar
  • 1,679
7 votes
1 answer
741 views

Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
Phil Dann Ward's user avatar
4 votes
3 answers
2k views

Why in one time pad must the key distribution to be truly random

One time pad required a truly random key. Why canwt it be a psudo-random key? For example, if the key distribution is that for each bit the probability to get 1 is 0.6 and the probability to get 0 is ...
NavGino's user avatar
  • 49
2 votes
1 answer
4k views

Is there a way to find $a$ and $b$ keywords in an affine cipher when only ciphertext but no plaintext is known?

I know simple formulas like $$E(x) = (ax+b)\pmod n$$ where $E(x)$ stands for encryption, $$D(y)= z(y-b)\pmod n$$ where $D(y)$ stands for decryption, and $$ax==1\pmod n$$ Assuming someone gives ...
onur cevik's user avatar
1 vote
2 answers
392 views

Is it possible to generate a key from a hash function, being the key larger than the hash function digest output without spliting the seed?

Let's suppose I have a 2MB photo and I want to generate a key from it, and the key should have 2048-bits of size. A hash function such as SHA3-512 would not deliver a key with with the desired ...
phantomcraft's user avatar
47 votes
1 answer
16k views

Why do all SSH-RSA Keys begin with "AAAAB3NzaC1yc"?

My friend and I have been generating a few SSH2 RSA keys and noticed all the public keys begin with AAAAB3NzaC1yc, with the similarity extending to ...
Lord Loh.'s user avatar
  • 685
10 votes
1 answer
2k views

How does GPG verify succesful decryption?

How does GPG (or other programs using the OpenPGP file format) verify that it has succeeded with decryption (for symmetrically encrypted data)? Is something appended to the clear text so there exist ...
Christopher's user avatar
9 votes
2 answers
10k views

How to calculate an IV when I have a shared private key?

I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
Robin Rodricks's user avatar
8 votes
2 answers
978 views

How to find fixed points for DES weak keys

Can someone explain me this please I am a bit confused? It's from a texbook I am reading (block cipher companion) it says that: each weak key has $2^{32}$ fixed points $m$ where $\operatorname{...
esra's user avatar
  • 869
7 votes
2 answers
744 views

Entropy preservation through cryptographic hash function

Background First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
Gratis's user avatar
  • 187
6 votes
2 answers
3k views

Using bad generator in ElGamal Encryption

Suppose Alice chooses a random Prime $p$ and a random private Key $a \in \mathbb{Z}^*_p$. By accident, she also chooses a random number $g \in \mathbb{Z}^*_p$, which is not a generator of $\mathbb{Z}^*...
Patrick Oscity's user avatar
6 votes
1 answer
1k views

What is 'key agility' in relation to symmetric-key encryption?

I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
pg1989's user avatar
  • 4,636
6 votes
1 answer
2k views

Do any one-key-of-many cryptographic schemes exist?

I'm pretty sure I understand how public/private key cryptography works. Anybody can encrypt a message using a well-known public key, but only the person who holds the private key can decrypt it. My ...
Claudiu's user avatar
  • 223
5 votes
2 answers
3k views

How common are weak RSA keys?

There exist certain attacks that can be used against RSA keys whose prime factors are of specific forms, such as one by Coppersmith. How common are these RSA keys? If you generate primes randomly, ...
Myria's user avatar
  • 2,575
5 votes
3 answers
464 views

Can an arbitrary physical image be a key?

Assume an arbitrary secret physical image¹, such as a privately made chemical Polaroid™ similar to this Is there a feasible and secure way that this physical image could be used as cryptographic key, ...
fgrieu's user avatar
  • 140k
4 votes
2 answers
425 views

Is there a theoretical maximum useful keysize given the block-size?

Consider a block-cipher $F$ with a $N$-bit block-size and a $M$-bit key-size. That is, if $k$ is a $M$-bit key, $p$ is a $N$-bit block of plain-text and $c$ is a $N$-bit block of cipher-text, then: $$...
Avijit's user avatar
  • 143
4 votes
2 answers
620 views

Is it safe to initialize secret keys by just reading /dev/random on Linux?

For a software, I don't want the user to choose weak keys, so I plan to just read the needed number of bytes from /dev/random to create the needed secret keys. Is it safe to do so?
daruma's user avatar
  • 385
4 votes
2 answers
8k views

Why is a Diffie-Hellman key exchange required when RSA is already being used for key exchange in TLS?

Specifically with TLS, What is RSA used for during key exchange? What is Diffie-Hellman used for? Since RSA already provides authenticity and confidentiality, why is Diffie-Hellman used during the ...
wispi's user avatar
  • 203
3 votes
2 answers
730 views

Probability of false positive key matching two plaintext/ciphertext pairs

Given a keyspace of $ 2^{80} $ and plaintext space of $2^{64}$. And two plaintext and ciphertext pairs $(x_1, y_1)$ , $(x_2, y_2)$. Now we have $2^{80}/2^{64} = 2^{16}$ keys that encrypt $x_1$ to $y_1$...
KMG's user avatar
  • 403
3 votes
2 answers
292 views

How are private keys handed to users in Identity-based Encryption?

I'm using IBE in my applied-crypto project in primitive form. I saw many articles about IBE, but didn't find how user can get private key is generated by PKG after EXTRACT method. So, my question: ...
Nick's user avatar
  • 31
3 votes
2 answers
3k views

Determine if a public key point y is negative or positive, odd or even?

Take an elliptic curve cryptography public key (x, y) and its additive inverse (x, -y). How do you identify which is the positive point and which is the negative point? Examples: Private key 1 -> (x,...
Prabu r's user avatar
  • 167
2 votes
1 answer
548 views

Key Derivation Function (KDF): Can a key derived from KDF be considered as a secure key?

Consider a case where we have a master key MS that is used in pseudo-random function to generate a set of pseudo-random values. Then we use key derivation function to derive a key from each of pseudo-...
user153465's user avatar
  • 1,583
2 votes
2 answers
973 views

Why can we always assume that $Gen$ algorithm choose key uniformly?

Disclaimer: This is exercise 2.1 in Katz-Lindell book. Given a (symmetric) encryption scheme $\Pi=(Gen,Enc,Dec)$ where $Gen$ takes the security parameter $1^n$ as input and generates a key $k$ of ...
Bush's user avatar
  • 2,130
2 votes
0 answers
421 views

Proper way to generate symmetric keys [duplicate]

I'm trying to educate my self in key management, how to store them, how to generate them, how to use them properly. I've been trying to find how you would generate a key for symmetric encryption (say ...
Vincent's user avatar
  • 966
2 votes
2 answers
2k views

Encrypting and MACing different data with same key

It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
pg1989's user avatar
  • 4,636
2 votes
1 answer
607 views

Ciphertext to different plaintext

Is there any algorithm for generating the same ciphertext from different plaintexts, depending on the key used? This seems similar to Honey Encryption, but I don't need to have every key give ...
SkippyNBS's user avatar
  • 123
1 vote
1 answer
770 views

Choosing primes in the Paillier cryptosystem

In the first step of key generation phase in Paillier cryptosystem given here. It's given that $$\operatorname{length}(p) = \operatorname{length}(q) ) \implies \operatorname{gcd}(pq,(p-1)(q-1))=1$$ ...
hanugm's user avatar
  • 499
1 vote
1 answer
2k views

Euler's totient function and Carmichael's totient function in RSA [duplicate]

I'm a high school student taking IB and I'm doing my EE on Maths, more specifically on the effectiveness of Euler's totient function and Carmichael's totient function in RSA. Am I right in thinking ...
dkssud10's user avatar
  • 125
1 vote
1 answer
671 views

How to calculate number of possible key pairs in RSA

What determines the number of possible RSA key pairs for a given $n$? Is it because $\varphi(n)$ produces the number of values that are less than $n$ and coprime with $n$? Is it as simple as $\varphi(...
kingly's user avatar
  • 11
1 vote
1 answer
619 views

Is there a feasible way to generate an RSA key manually the same way as it is for an ECC one?

In elliptic curves, a private key is just a random number, and one relatively small compared to other crypto systems (256 bits for ECC vs 4096 bits for RSA for example). Suppose I don't trust ...
Guerlando OCs's user avatar
1 vote
1 answer
110 views

Hashing a seed together with a block counter and using as a encipherment scheme: Will this have the same security in bits as the seed used?

A user of this forum said that the whole entropy of a seed goes to the hashed result if using a counter and also that is suitable for key generation even if the internal state or digest size of the ...
phantomcraft's user avatar
0 votes
1 answer
254 views

How to find the round key in AES 256

Can anyone explaine how to find the every 15 round key by the 64 hex digit master key of AES 256 please. I will be really greatfull
james's user avatar
  • 1