# All Questions

18,190 questions
5 views

### Elliptic curve as a product of 3 cyclic groups possible?

I'm looking for some kind of 3-dimensional Elliptic curve. As far as I know a normal Elliptic curve like $$y^2 = x^3 + ax + b$$ over $F_p$ consists of one or two cyclic groups $Z_m (\times Z_n)$. ...
63 views

### Is it possible to validate an email address without the user actually revealing the email address?

Say hypothetically I want a service where users express their opinions. But those opinions are heavily dependent upon where they work, and the best way to prove that they actually work at a specific ...
3k views

### Why does the modulus of Diffie–Hellman need to be a prime?

I read a lot about Diffie-Hellman, but there is one thing I dont understand: why does the modulus p need to be a prime? What if it would not be a prime?
49 views

### SHA-1 collision for strings of two symbols

Is it possible to have strings of two (Unicode) symbols with equal SHA-1 hash? For example, smth like "ab", "ba".
887 views

46 views

### Can the Keccak sponge construction be used to create a random permutation of bit strings of length $n$, where $n$ can be any positive integer?

I need an efficient, invertible random permutation of $n$-bit strings, defined by a $128$-bit key. $n$ can be any positive integer from $6$ to $128$. I have no requirements on the security of the ...
66 views

### Choosing good entropy $g$ and $p$ for a classic Diffie-Hellman Key exchange

When selecting $g$ and $p$ for the Diffie-Hellman modular exponentiation: $s= g^x \bmod p$ Which pairs of $g$ and $p$ are considered good nowadays, are recommended by bibliography? What I try ...
78 views

### What is the difference between $\bmod{p - 1}$ and $\bmod p$

I have a doubt in my research work, can anyone tell me; What is the difference between $\bmod {p-1}$ and $\bmod p$
12 views

### Is there an advantage to using a hash in combination with a key-derivation function?

Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap. It is currently recommended by OWASP to use an adaptive key-derivation ...
17 views

### Given a cipher text, How to start the attack on it? How to identify what cipher has been used to encrypt it?

I have a cipher text which contains english alphabets only. How to figure out what method has been used to encrypt it. It doesn't seems a good idea to try all known encryption methods.
38 views

### Strong pseudo random permutation implies CCA-security

Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows: On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
22 views

### AES-256-CBC with random IV - storing same plaintext as same ciphertext

I am encrypting some information stored in a column of a MySQL database. The column can contain repeated values, let's say the table has 7 rows and the column to be encrypted has the following values:...
1k views

### Is there a contingency plan in the event of a catastrophic attack on AES?

NIST selected Rijndael in 2000 to be AES. In a paper from the Serpent authors, they mention that there was the possibility of choosing a second cipher as a backup in the case of any severe breaks: ...
23 views

### One-way function with combination sets as output / image

One-way functions generally operate on bit strings, for the input and the output. Are there any examples of one-way functions that produce a combination set in output? Let's call this function $f$. ...
926 views

### Is ECB mode secure if plaintexts are guaranteed to be unique?

I've got a scenario where I need to encrypt many small (16-byte) plaintexts. I want to use AES-128 in ECB mode. Notably, each plaintext is guaranteed to be unique, though each may differ by only a few ...
919 views

### Is the 'Padding Oracle attack' deterministic?

I'm thinking about the example of Padding Oracle attack in CBC mode with PKCS7 padding given in Wikipedia. It says about the guess of the last byte in the plain text: In the worst case, they need ...
71 views

### AES based question

The minimum key length for the AES algorithm is 128 bit. Assume that a special-purpose hardware key-search machine can test one key in 10 ns on one processor. The processors can be parallelized. ...
35 views

### Why (N+1)sec's mDP Implementation does not check whether all the XORED received $z$ values are 0

In the original mDP protocol once all $z$ values received from each participant the following calculation is being done: If either $XOR(z_1,z_2,...,z_n) = 0$ or received invalid Signature then ...
49 views

### Diffie hellman: fixed modulus a risk?

In DH, are algorithms with fixed modulus p (large safe prime) to be avoided? What if it was changed every x minutes?
225 views

### Decrypting Ciphertext with partial Key Fragment using LFSR and Berlekamp-Massey

Edit Does the state register (the LFSR) always have to remain with 16 bits (I'm assuming yes). If so, are we shifting the register right by one (lfsr>>1) ...
102 views

### What exactly is the contents of the LDAP userSMIMECertificate attribute?

I'm trying to setup an LDAP with user certificates. I have already learned that certificates can be stored in either the userCertificate attribute in DER format, or ...
631 views

### Concrete evidence for the asymptotics of $\lambda_1(\Lambda^\perp(A))$?

A recent eprint paper claims to bound $\lambda_1(\Lambda^\perp(\mathbf{A}))$ for $\mathbf{A}\in\mathbb{Z}^{n\times m}$, a uniformly random matrix, by $O(1)$, specifically by $4$. This has applications ...
141 views

### How to encrypt the truth table in garbled circuits?

I'm learning about garbled circuits, and I'm using the following tutorial: Yao's Protocol. I have a questions regarding to construction (encryption) of truth table in garbled circuits. Slide 14 says:...
269 views

### RSA - factorizing $N$ to get $p$ and $q$

I need to decrypt a message encrypted using RSA. I only know the public keys $n$ and $e$. I need to get the private key $p$ and $q$ in order to get the decryption exponent $d$. Now to do so, I know ...
1k views

### HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using ...
17 views

### Which Auxiliary Hash Function to use for Pointcheval's mDP protocol

I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David ...
34 views

### SEAL - binary encoded ciphertext

In SEAL, am I able to convert a ciphertext that is encoded with polynomial to a ciphertext that is encoded as binary?
14 views

### Temporal or spatial digital signatures

Digital signatures allow authentication of content based on a secret held by the signing entity. Are there any existing schemes, proposals or even services for letting "location" or "time" sign the ...
769 views

### Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
31 views

### Plaintext Size Limit for ECIES with AES-128 CBC mode

Using the ECIES (Elliptic Curve Integrated Encryption Scheme), is there a limit size of plaintext? (what is the maximum allowed number of bytes to be encrypted with ECIES).
55 views

### One-Time-Pad with multiple keys?

Would it be more secure if we used multiple keys in a One-Time-Pad encryption?
79 views
+50

### Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ...
28 views

### Store the public key and private key [on hold]

i want to implement digital signature scheme in my form sign up in my web, and i read all PKCS from PKI but it made me little confused. i have many questions, where i store my public and private key ? ...
143 views
+100

### Proving that the least significant bit of an elliptic curve discrete logarithm is $0$

Suppose I have a secret value $a$ which maps to a public point on an elliptic curve $A = a \cdot G$, where $G$ is a generator of the elliptic curve of primer order $q$. Can I prove to someone that ...
21 views

### RSA-based encryption scheme and random oracle

I don't really get how this problem should be solved. My main issue is with the random oracle generally, a short explanation of ROs and how they are used in such proofs maybe with this example will ...
19 views

### is a safe prime subgroup length important?

For most cryptographers, my question may appear silly. Context: Diffie Hellman. Object: finding good primes. Code: given that NodeJS program: ...
32 views

### ElGamal variant

I came across this problem, while currently reading "Introduction to Modern Cryptography" by Katz and Lindell. I am new to crypto and just trying to go through the book and solve the exercises, ...
30 views

### Secure comparison protocol

I want to implement the existing comparison protocol using SEAL. For private comparison checking the existence of a 0 is possible with DGK scheme. Is there any other way to do it without DGK scheme? ...
21 views

### How to select best safe primes for DH <-> subgroups?

I run a test on some safe primes. Here is the code: ...
13 views

### Is my method of identifying remote ZMQ clients secure?

ZMQ provides a CURVE based authorization / encryption system based on certs/keys. After endpoints are authenticated to the server, they can send an "identity" with each request. Unfortunately they ...
34 views

### Verification of the NI-ZK Proof

I'm currently learning about ZKP and Non-interactive zero knowledge (NI-ZK) but I'm confused in the process of NI-ZK verification. I have taken the following example to learn about NI-ZK from this ...
7k views

### How many possible Enigma machine settings?

I'm trying to calculate the amount of settings the enigma machine has. I have found several sites regarding this topic, but it seems like there are two answers to my question. The first answer is 158,...
In this paper of Asmuth–Bloom threshold SSS, the algorithm is as follows: Shares Distribution To distribute n shares of a secret $K$ among the set of participants $P = \{ p_i : 1 ≤ i ≤ n\}$, the ...