# All Questions

18,934 questions
15 views

### SHA1 padding on length extension attack

I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
24 views

### How long does it take to crack RSA 1024 with a PC?

Using an Intel Core i5 CPU, how long does it take to crack RSA using a key size of 1024 bit (generated using a secure key pair generation function)? Suppose for instance that we have thousands of ...
103 views

### private-key can't be traced (GPG)?

I am very new to cryptography. I was reading about GPG/PGP Basics, and I have a doubt: As per my understanding, Everyone knows the algorithm (GPG) with which I generated my key pair. And If I give my ...
9 views

### BIP39 Path in ledger nano s [migrated]

On ledger nano S, you are given a BIP39 24 word mnemonic. What is the path to the address used? Is it m/44'/144'/0'/0/0 ? Say for example I use the address generated by the ledger nano s to store ...
57 views

### Decryption an arbitrary cipher with XOR and rotation [on hold]

I'm trying to find hidden 8-length long key from following XOR and Rotation based cipher. ...
15 views

### How to calculate RSA group signatures

RSA group/ring signatures, how are they calculated?
31 views

from Can I clone a LUKS container? You can, but it breaks security, because the cloned container has the same header and hence the same master key. You cannot change the master key on a LUKS ...
32 views

### Root Certificate Authority of National Identity Cards [on hold]

We're collecting a list of all the Root Certificate Authorities of National Identity Cards but due to language issues and the relative obscurity of the government pages on which they are listed, we're ...
10 views

### Attack Scenario for mutual key authentication protocol based on a Symmetric key cryptography algorithm

Here, the R is a challenge and KAB is a key known only by Alice and Bob. The +1, in R+1 is a nonce. I need to find 2 attack scenarios on how the protocol can be broken. I have been able to find one, ...
15 views

### Choice between appending or prepending nonces to ciphertexts

I understand that when using CTR mode, it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant. However, ...
85 views

### How to define the statistical distance between two probabilistic algorithms?

Let \begin{aligned} F_{i} \colon \{\, 0,1 \,\}^* \times \{\, 0,1 \,\}^* &\to \{\, 0,1 \,\}^* \\ (k, x) &\mapsto y \\ \end{aligned} for $i \in \{\, 1,2 \,\}$. As we known, for every ...
26 views

### Cost model for different curve models

Is there a cost model for each curve model and their conversions? For example: Take the curve models: Projective, Completed, Extended, Affine. Is there a table which shows how many multiplications, ...
113 views

### How does PUF hardware help in software activation?

I have read that one of the PUF's application is software licensing, but do not know how. I have been reading different articles and forums (such as here), but still not clear for me. One vague point ...
62 views

### Do Weil, Tate, and Ate pairings exist on all elliptic curves?

I don't know much about the math behind elliptic curves. Do Weil, Tate and Ate pairings exist on all elliptic curves? If the answer is negative, then what pairings do MNT, BN and SS curves have? ...
51 views

### Is there a concept of embedding degree for non-pairing based elliptic curves?

From this post, I learned the concept of embedding degree. Intuitively, if embedding degree of an elliptic curve $E(F_p)$ is $k$, it means there is a way to transform points in $E(F_p)$ to $F_{p^k}$. ...
105 views

### Can Reed Solomon parity blocks be used as an all-or-nothing transform?

Consider the following scheme: Perform an (N,N) Reed-Solomon encoding (i.e. N data blocks, N parity blocks) Drop the N data blocks and keep only the N parity blocks. Are these N parity blocks an all-...
134 views

### Cipher Block Chaining - How do you change the plaintext of all blocks?

I've just read about CBC encryption and decryption and was wondering how you can change every plaintext block? Let's say you have an initialization vector, 3 ciphertext blocks, know each block-cipher-...
42 views

### what is the difference between a prime field $F_p$ and binary field $F_{2^m}$ in the elliptic curves

i am using elliptic curves to encrypt a voip application but i can not understand the difference between using an algorithm based on the binary field or the primary field I wish that any one can ...
24 views

### IETF Recommendations for preparation for PQC- clarify in what way they are referring to bits [on hold]

In the IETF mtg in 2017, in the recommended actions, are they saying leave enough flexibility in terms of bit usage for key sizes to throw in/switch out anything NIST picks out, or sufficient key ...
50 views

### Preferred SHA-2 hash algorithm for MGF1 in RSA

Does it make any difference to the security and efficiency if we use SHA-256 or SHA-512 for the Mask Generation Function MGF1 that generates the masking / padding within the OAEP encryption scheme and ...
247 views

### Create a CR hash function where truncating one bit leads to collisions

I was reading Boneh and Shoups's A Graduate Course in Applied Cryptography, when I stumbled upon the following exercise (I have changed the array indices to start at 1 instead of 0): 8.1 (...
28 views

### Where does the certification come from

In the book : applied Cryptography 2nd(Bruce Schneier), chapter 2 I don't understand step(5), the 'certification' didn't mention in previous steps. does it mean 'a statement that he has received this ...
136 views

### Where shall we use an authenticated encryption mode?

I learned from Wikipedia that authenticated encryption modes include OCB, CCM, EAX, GCM, and so on. Does this mean that when we want to use authenticated encryption we shall use these modes? But these ...
44 views

### Usage of the nth-root function in cryptography

Having offered a fast integer nth-root algorithm to a bigint library that is also used for cryptography I was asked if it does its work in constant time, so I took a look at the literature to see how ...
85 views

### Is this paper's technique for factoring RSA 2048 with noisy qubits realistic?

A paper titled How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits has just come out which proposes a technique to factor RSA keys with moduli up to 2048 bits with a design ...
102 views

### Key-Bijective Secure Symmetric Encryption Methods

In AES, an N-bit message is mapped 1-to-1 message-to-output (for a fixed key). If we use a key with N bits, however, the key is not mapped 1-to-1 key-to-output (for a fixed message). So, is there any ...
7 views

### What state does a qbit look like before it collapses [migrated]

Which is the correct depiction of a qbit state showing the possibilities before it collapses? Is it like: MODEL 1: 1000 0100 0010 0001 MODEL 2: 1000 0100 0010 0001 0111 1011 1101 1110 MODEL 3: ...
27 views

### design a secret sharing scheme [on hold]

Suppose you are an army cryptographer. In the army there are one General and five Lieutenant Generals. Your mission is to design a secret sharing scheme allowing one General and one Lieutenant General ...
235 views

### Enumerating the bias of NIST and Pearson randomness extractors

The following is an extract from a paper about using your mobile phone as a true random number generator (TRNG). The mobile phone bit is incidental to this question though. I'm interested in the ...
7k views

### How to XOR two hexa numbers by hand fast

I have an upcoming exam where I can use a simple Calculator. On some sample questions they ask us to XOR two values (for AES round key) and I know how to write it out by hand but is there any other ...
51 views

### What makes the quadratic residuosity problem hard?

The quadratic residuosity problem is the problem of determining whether, for given $r$, $m$, $\exists a.a^2\equiv r\mod m$. This problem's believed to be hard to solve in general (e.g. an efficient ...
31 views

### Why does ε-differential privacy protect the subset of 1/ε edges in terms of graphs?

In the book The Algorithmic Foundations of Differential Privacy by Cynthia Dwork, Aaron Roth on page 24, databases that take the form of graphs are discussed. We could on the other hand consider ...
41 views

### Signal Protocol Header key encryption initialization vector

In Signal Protocol when you use a Double Ratchet you have 2 options: Normal encryption = header + ciphertext Encrypted header encryption = ...
34 views

### how to conver a raw public key to DER or PEM? [on hold]

Looking for a way to convert a raw key to DER or PEM format. below is the ECDSA(p256) public key which needs to be converted to PEM format or dER. ...
57 views

### How to actually compute the statistical distance?

I have an algorithm for discrete sampling that I've defined. This is to say that $A$, upon input some pdf $p(x)$, outputs samples from the pdf $p(x)$. There are some nuances (you have to make the ...
40 views

### What does the number 256 in pairing curve BN256 indicate?

There are many pairing based elliptic curves like MNT curves, BN curves, SS curves etc., When we say BN256 curve, what does the number 256 indicate? Is it some group order or number of bits required ...
136 views

### How to prevent accidental nonce reuse with AEAD cipher

I'm trying to correctly implement ChaCha20-Poly1305 in my node.js app (...crypto is hard). I understand that the cipher requires a unique key/nonce pair for each message or the security breaks down. ...
47 views

### “Work factor” and “iteration count” nomenclature in adaptive functions

In adaptive functions like PBKDF2 / bcrypt I often read people refer to "iteration count" and others refer to "work factor", and they seem to be used interchangeably (even though they're not - the ...
13 views

### How would I get the issuer's public key from two RSA-signed certificates? [migrated]

I'm trying to get the issuer's public key from two SSL client certificates signed with a 2048-bit RSA key, SHA-256 hashing and PKCS#1 padding, as I only know the issuer's DN and I wish to verify all ...
80 views

### ZKP: Asymmetric encryption with confidential message and known hash

I'm searching for a ZKP package that supports asymmetric encryption so I can implement the following scenario: Carol encrypts message $m$ with Alice's public key and sends the ciphertext to Alice. ...
14k views

### Why is the P-521 elliptic curve not in Suite B if AES-256 is?

In the NSA's document, "The Case for Elliptic Curve Cryptography" (archived), we have ...
582 views

### Are there any symmetric cryptosystems based on computational complexity assumptions?

Are there any symmetric cryptosystems which are provably secure in the sense that there exists a reduction from their security to the hardness of some underlying hard problem such as integer ...
9 views

### Using Chameleon-HF-enabled security in practice

If one were to implement a digital signature scheme that is only EUF-CMA-secure when using Chameleon Hash Functions, would one actually use a Chameleon Hash Function or a standard cryptographic hash ...
36 views

### Construction PRF from PRG

As discussed here, a classic and secure construction of PRF from PRG is: $F_k(x_1x_2\cdots x_n) = G_{x_n}(\cdots(G_{x_2}(G_{x_1}(k)))\cdots)$ where $G$ is a secure pseudorandom generator. I was ...
90 views

### What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?

It is mention in the paper " Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
50 views

### Are there a way to progress or age key pairs

I am searching for a way to make the noise X pattern fully forward secret. The X pattern is a way to encrypted and authenticated messages. As a building block to achieve this I started pondering if ...
475 views

### What is the size of codomain of a function $G(x) = F^A(x) \oplus F^B(x)$, where $F(x) = \text{Keccak-}f[1600](x)$?

Assuming that $m$ is a multiset of bitstrings where all bitstrings have the same length, let $D(m)$ denote the number of distinct elements in $m$. That is, $D(m)$ is equal to the dimension of $m$. For ...
58 views

### Is NIST testing all the round 2 submissions to quantum-resistant crypto?

Is NIST confirming the self-published quantum-resistant crypto round 2 data and do they make that available to the public when they do?