# All Questions

18,453 questions
63 views

### SHA1 calculation for millions of strings having common prefix

I have a function in which I need to calculate SHA1(common_prefix + random_string). I am calling this function many times so that calculation of SHA1 slows down the performance of the function. As for ...
28 views

I am studying about additive differential probability. And I show a paper that is V.Velichkov et al., The Additive Differential Probability of ARX. I have a question in chapter 5.2. V.Velichkov et ...
49 views

### What is the difference between the 23 bi-affine and the 39 fully quadratic equations of the rijndael sbox?

In Cryptanalysis of Block Ciphers with Overdefined Systems of Equations Nicolas Courtois and Josef Pieprzyk define 23 so called bi-affine equations (in Appendix A of the paper) between the input x and ...
2k views

### What does the symbol $W_t$ mean in the SHA-256 specification?

I'm really confused about the computation about SHA 256. W_t = \begin{cases} M_t^{(i)} & 0 \leq t \leq 15 \\ &\\ \sigma_1^{256}(W_{t-2}) + W_{t-7} + \sigma_0^{256}(W_{t-15}) + W_{t-16} &...
38 views

I'm studying about Additive differential of XOR I saw two papers that are "H.Lipmaa et al., On the Additive Differential Probability of Exclusive-or" and "V.Velichkov et al., The Additive ...
34 views

### Does the AES-KW (Key Wrap Algorithm) perform authenticated encryption?

The RFC for AES-KW doesn't actually mention authentication, only integrity, where the unwrapping/decryption process should produce an identical IV of ...
52 views

Why is it that a one time pad is vulnerable is the key is shorter than the message? I know that if a key is reused across multiple plaintexts, you can XOR two existing ciphertexts to get the pad, but ...
55 views

### Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
28 views

### What is a rank-1 constraint system?

Why not rank-2 constraint system or rank-3 constraint system? How do rank-1 constraint systems link to circuits?
64 views

### Codes of “SAS und Chiffrierdienst”

The german site "SAS und Chiffrierdienst der DDR" http://scz.bplaced.net has some interesting content under point 11.3 in the category "manuelle Verfahren" I found ciphers named from A to D. But I ...
44 views

### Are key files good authentication?

Let's say $p$ is the pool of files in a folder. And $k$ is the files in the pool that are "key files" for authenticating in a service. Note: The order of the key files matter. Then we have $c$ which ...
15 views

### Strategies for fast integrity attestation over multi party computation for large messages

I am looking for ways to efficiently perform integrity attestation over large messages using multi party computation. While, hashing (SHA1, 256...) is one alternative but it's painfully slow and grows ...
55 views

### The role of IV when AES is used as $PRF$

We want to use AES as a pseudorandom function. Given a random master key, we want to derive a set of pseudorandom values/keys, e.g say $n$ keys. Then from each of those derived keys, we want to derive ...
34 views

### Is chosen ciphertext attack used to obtain a key? [duplicate]

I don't understand what the goals are of a Chosen Ciphertext Attack. What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses. However, I ...
53 views

### Simple One time Pad Probability

We have a one time pad where: We have 8 bits. probability that a bit=0 is p. The key is common for all 8 bits. It can have a value of 0 or 1 with equal probability. After applying the XOR operation ...
56 views

### Cost of upgrading to PQCrypto

We already have recommendations on what PQCrypto to use: PDF (page 11) Symmetric encryption Thoroughly analyzed, 256-bit keys: AES-256 Salsa20 with a 256-bit key Symmetric ...
48 views

### Is this an error in the Pinocchio Protocol paper

I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which ...
19 views

### How to find efficient hardware implementation of sbox of lightweight block ciphers? [migrated]

Lightweight block ciphers are usually optimized for compact hardware implementations and sbox values are computed by implementing circuit using basic logic gates(AND, XOR, OR, NOR etc). What is the ...
64 views

### Is one time pad cipher reuse and random key secure?

The sender and receiver share two different secret keys: s1 and s2 both y bit values. 'x' is a randomly generated y bit value. The reader sends to the tag a challenge y = x ⊕ s1, and the receiver ...
65 views

### Formal definition of collision resistance for hash function

In my cryptography class, the professor said that collision resistance for a fixed hash function is not a "precise" definition. The reason is since a fixed hash function is a single instance of a ...
8 views

### What is the length of ciphertext for AES encryption using C#? [migrated]

From: Can we calculate AES ciphertext length based on the length of the plaintext? I see: output_size = input_size + (16 - (input_size % 16)) But this does not seem to correspond with what I see ...
39 views

### What information can be gleamed by using a OTP twice with the same message?

So... C0 = K0 ⊕ M and C1 = K1 ⊕ M where K0, K1 are different random numbers. What information can you discern about the K0, K1 and M, if any? Could you use K0,K1 again with another different message ...
35 views

### HKDF: Difference between salt and info

I want to do generate individual AES keys for a number of smart cards, based on a random master key (key diversification) and the serial number of the card. According to the answers to this question ...
84 views

### Why does Carter-Wegman (and AES-GCM) use different keys for PRF and keyed-hash

So. As I understand, Carter-Wegman transforms a one-time MAC (which must be a difference unpredictable function (DUF)) by encrypting it with a PRF. The DUF and the PRF use two different keys, which ...
74 views

### Is a 2 bit one time pad just as secure as a 128 bit one time pad?

Obviously, it would be easier to stumble across the answer, but you still couldn't be sure it's correct. So it's still theoretically secure?
36 views

### Use exported certificate with private key to logon using Kerberos

First I just would like to mention, that my knowledge in windows authentification methods are very limited. So my question: Is it possible to use custom credential provider in windows to log on, that ...
272 views

### Any ideas to make an Electronic Voter Machine more secure? [closed]

EVMs are not secure they say. So how can we make it more secure tham the existing one using cryptography?
62 views

### In Diffie-Hellman, are $g$ and $p$ universal constants or are they chosen by one party according to a set of rules?

I can't find any clarity on this. In textbooks, what I'm reading suggests there's already a standardized $g$ and $p$ that everyone uses, but I can't find what they are. The closest I've come to is ...
76 views

### Is OTP with homomorphic encryption trivial?

If my key size is as large as the data I'm encoding, is it trivial to devise a theoretically secure homomorphic encryption scheme for integers (or else any finite/infinite group with order) that ...
39 views

### Encrypt challenge instead of storing it on the server

My server and my smartcard (MIFARE DESFire) want to establish that they have the same shared AES key. They want to do that with an untrusted client in the middle. Usually it works like this: Now ...
115 views

### What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message

A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server. The financial information will be stored as plain text on the ...
60 views

### How should one refer to the smallest remainders generated by a modulus within DH or DLP?

It's my understanding that the integer base and exponents chosen to create the initial public keys in DH are from the remainders of a modulus. For example, if the value of the modulus is $N=11$, a ...
214 views

### How to prove that finding a cycle in a cryptographic hash function is hard?

I want to show that finding cycles in a cryptographic hash function is hard. My thought: assume there a black box, that given a cryptographic hash function $h$, finds some $x$ and $r$ in polynomial ...
24 views

### Is there a way to make a non-specific algorithm to decypher substitutions with “anti-frequency analysis” measures?

There's a code I'm trying to decypher. What I know is that it's a simple substitution, with just a few added rules intended to make frequency analysis and other super classic method a little less ...
106 views

### Would a HMAC digest make sense in an RSA / ECDSA signature?

When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
71 views

### How 'safe' is a 12-digit alphanumeric key?

To Access my data over a Portal i got a 12-digit alphanumeric key like: VGW8-U98T-TXLV How safe is this key? I don't want to know the chance to win with brute force. I want to know there are several ...
64 views

### Is AES resilient to chosen plaintext with access to related keys (key expansion primitives)?

I'm interested in knowing whether a cryptosystem is broken given access to a few primitives. $\DeclareMathOperator{\KEYEXP}{KEY\_EXP}$ $\DeclareMathOperator{\E}{E}$ Suppose that you have access to an ...
36 views

### Does the Richard Sorge cipher still provide good security?

Is the cipher used by soviet spy Richard Sorge still sufficiently secure nowadays?
41 views

### Effect of block size on diffusion rate

I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The ...
43 views

### How secure is Firestore / Google Cloud server-side encryption?

We use Firestore. On their Google help page they say it is AES encrypted. https://cloud.google.com/firestore/docs/server-side-encryption But this means in the moment a user is logging in, the data ...
164 views

### How did I get a nonuniform distribution of UUID4s across MD5 space?

We have a system that processes data. Each entity has an ID that is generated using uuid4() in Python. Later, that ID is used as a partition key for AWS Kinesis. ...
40 views