# All Questions

18,184 questions
3k views

### If Kerckhoff's Principle holds, why do we need a cipher at all?

I understand Kerckhoff's principle, in a very practical sense, that the best attack that can be performed on a given cryptographic algorithm should be only as practical, if not less practical, than an ...
212 views

Is using Argon2 for both password storage and key derivation secure? I'm planning on using different salt values, of course. The basic concept is something like this: Alice has some secret data ($... 2answers 129 views ### How close is AES to random oracle model? I'm wondering if there are any guarantees about AES's randomness in comparison to Random Oracle, but I couldn't find any papers nor publications about it. Let's say I have a blackbox B which for any ... 0answers 22 views ### NIZKP that El-Gamal ciphertext is encryption of a prime number among a predefined set of prime numbers I am working on designing an open source blockchain-based voting platform. Users receive a common public key$K_{pub}$. They cast their ballot, encrypt it with$K_{pub}$and an ephemeral key$k$(El-... 3answers 1k views ### Homomorphic encryption - Why does addition not imply multiplication? As far as I know: There are some partially homomorphic encryption (PHE) systems that support either addition or multiplication. A fully homomorphic encryption (FHE) system can do addition as well as ... 0answers 33 views ### Is there a common unit of measurement for comparison of computing power used to solve mathematical puzzles? I just wanted to make sure if I'm reasoning correctly. So, if two computers are solving the same mathematical puzzle i.e. SHA-256 function of Bitcoin (finding nonce that satisfies difficulty target), ... 1answer 55 views ### Digital signature I learned that a digital signature is encrypted using private key and is decrypted using public key. How does the verifier gets the public for verifying the signature? If a person has to request ... 1answer 43 views ### How to make my hash more robust to the brute force? I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret. I want to increase the cost of brute forcing the passphrase I use to generate the secret. I'm thinking of using scrypt after ... 1answer 58 views ### Why SM2 ECC parameters does not specify cofactor h? Recently I've been studying the ECC with the Chinese SM2 standard. One question is on standard part 5, parameters definition, it only defines$p, a, b, n, XG,$and$YG$, but not cofactor$h$. I found ... 1answer 134 views ### Do AEADs also authenticate the nonce? I'd like to include an authenticated timestamp in my messages. I'm wondering if I can save a little space by putting the timestamp in the nonce. Concrete example: Let's say I'm using XChaCha20-... 1answer 42 views ### Two-way secret sharing for authentication? Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret. For authentication, the secret can be a user ID. A client with a logged-in user can ... 1answer 109 views ### Encryption using matrix transformations I have been thinking lately about a block cipher which takes a block of bits and arranges them in a square matrix. Then defining transforms on submatrices of the square matrix to scramble the bits. ... 0answers 28 views ### What is connection between curve used for ec_keypair generation and ClientHello extension? Im currently experimenting setting up my first SSL server and don't understand the following scenario: My server has a generated ECC keypair with group identifier$A$(e.g Brainpool256r1). During TLS ... 0answers 22 views ### Implememtning GKE+P Group Key agreement protocol on nodejs [migrated] I try to implement the GKE+P protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David Pointcheval ... 0answers 33 views ### What are some shuffling algorithms I can implement? I am building a mixnet and right now I am looking for an algorithm that can give me a random, secret permutation when applied to the corresponding inputs. The correspondence of the inputs and outputs ... 2answers 91 views ### Safely erasing encrypted data My secret message is encrypted in a byte buffer with AES-128 in CBC mode. The first 16 bytes are the IV and the message follows contiguously. If I want to securely delete this message is it enough ... 0answers 38 views ### Random Primes Conjecture [closed] I know it is believed that primes appear to be randomly distributed among the integers. Is there a formal conjecture or theorem that expressly states that the occurrence of the prime numbers is ... 1answer 67 views ### What is an accurate definition for a 'Monoalphabetic substitution cipher' and why does it provide a poor level of security From my research online, I am confused about the difference between a 'monoalphabetic cipher' and 'monoalphabetic substitution cipher'. However, I have got my answer from the websites Kifanga and ... 1answer 109 views ### Why is Diffie-Hellman Insecure If Order of the Generator Has Only Small Prime Factors? In this post from security SE, Tom Leek mentioned that, for Diffie-Hellman to be secure order of the group$g$should have a prime factor at least$2k$bits long, where$k$is the security parameter. ... 0answers 19 views ### How does libgcrypt increment the counter for CTR mode? [migrated] I have a file encrypted with AES-256 using libgcrypt's CTR mode implementation. I want to be able to decrypt the file in parts (e.g. decrypting blocks 5-10 out of 20 blocks without decrypting the ... 1answer 73 views ### How can I generate large primes for Pedersen commitment? I want to make a commitment on Shamir's Secret Sharing, based on the work of Pedersen, "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing". To implement the commitment ... 1answer 65 views ### Security of Fast Two-Party ECDSA Signing The paper "Fast Secure Two-Party ECDSA Signing" by Yehuda Lindell describes a system in which two parties,$P_1$(with 1/2 of a share of a long-term ECDSA signing key$x_1$) and$P_2$(with the other ... 0answers 34 views ### What is difference between Unipartite Secret Construction, Bipartite Secret Construction and Multipartite Secret Construction In this paper authors extend Asmuth–Bloom and Kaya schemes to bipartite access structures and further investigate how SSSs realizing multipartite access structures can be conducted with the CRT. The ... 1answer 189 views ### Point halving on elliptic curves of even order I am trying to understand how point halving on elliptic curves of even order works. Specifically: suppose$g$is an elliptic curve, and$G$is a generator point on this curve. The order of group ... 1answer 45 views ### Public key on Server Key Exchange Generation vs Public key on Server's Certificate To understand the distinction between TLS 1.2 and TLS 1.3. I am stuck in the past understanding for TLS and the current reference I am studying: As I know certificate goes with owner's public key, ... 1answer 236 views ### Decrypting Ciphertext with partial Key Fragment using LFSR and Berlekamp-Massey Edit Does the state register (the LFSR) always have to remain with 16 bits (I'm assuming yes). If so, are we shifting the register right by one (lfsr>>1) ... 1answer 86 views +50 ### Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes) As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ... 0answers 62 views ### Proving that a point on elliptic curve is smaller than half of group's order Let's say I have an elliptic curve where generator$G_1$has prime order$q$. Let's also say I have committed to a point$A_1 = a \cdot G_1$. Could I use the scheme below to prove that$a < \frac{q}...
Let $H_{min}$ = Min-entropy and $H$ = Shannon entropy. Unless you're gaming the system or deliberately trying to be obtuse, very rarely is $\frac{H} {H_{min}} > 10$ from any conceivable ...