# All Questions

18,648 questions
81 views

### RSA encryption extremely large public exponent

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...
89 views

### Methods of Learning Cryptography [closed]

We're currently approaching the end of our semester, but I've found that our homework is starting to consist more of encrypting and decrypting using different types of algorithms instead of learning ...
25 views

32 views

### Lenstra's ECM Algorithm - field requirement

In Lenstra's ECM algorithm, $\#E(\mathbb{F}_{p})$ is required to have small prime factors. Why is this so? I understand that the p-1 method is efficient for factoring N with small factors. The ECM ...
203 views

### Is there a crypto system doing sqrt during encryption?

This is a theoretical question to solve an argument with a friend.. Is there a working cryptographic system that do square root operations during the encryption process? "Working" means that it is ...
27 views

### In W-OTS, is it trivial to forge smaller N values?

Just read about W-OTS, since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller vale for N when having access to original signature? I.e. just hash ...
73 views

### Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
56 views

### DSA: why using mod p mod q and not just mod p

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...
44 views

### Formal security-definition reference

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
26 views

### When looking for collisions of MD4, how does the 'Multi-step Modiﬁcation' work in the paper of Wang et. al?

In part 4.2 of this paper, the writers introduced a technique called 'Multi-step Modiﬁcation', here I got some questions. How does the Multi-step Modification ensure that we will not change any ...
230 views

### Can not use big prime number for pair of key of RSA Algorithm [closed]

I'm new to cryptography. I have a binary image with 64x64 pixel in size. I perform an encryption to the image using RSA Algorithm. I wanna ask something bothering me, why can I not use big prime ...
17 views

22 views

### XOR operation to uncover plain-text out of given cipher-texts [duplicate]

I have a set of 11 hex coded strings that have been encrypted using XOR operation each with the same stream cipher key. How do I decrypt the 11th hex-coded string to arrive at the plain-text without ...
40 views

### Beginners question regarding ElGamal

How to motivate, that in ElGamal Alice the recipient keeps her keys fixed, while Bob the sender changes the key each time - why not both of them change their keys each time?
39 views

### finding sha256 preimage or secp256k1 private key, which is harder?

Is finding a public key that matches hash of pre-commited public key (second layer security) more computationally hard than finding private key to a known public key (attacking secp256k1)?
951 views

### RSA: Danger of using p to create q

Assume my prime generation is as follows: Pick a number $p$ between 1000 and 9999. $p=abcd$. Make sure $p$ is prime Construct $q$ such by taking the last 2 digits of $p$ and the first 2 digits of $p$,...
87 views

### What is the Risk of Rotating Keys

This may be a difficult question So, C1 = Aes-GCM(k1, nonce, message) where nonce = HMAC(key,message). C2 = Aes-CBC(k2, iv, C1). Now, a security breach occurs. The adversary obtains k1 and C2 ...
41 views

### When do clients use TLS in PSK mode?

The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
82 views

### Hash collisions in sha512 hash of secp256k1 public keys

For a sha512 hash of a secp256k1 public key, how many other public keys could generate that hash? I would assume zero since the key size is equal to the hash length (secp256k1 public keys are 64 bytes,...
66 views

### Is Quadratic Arithmetic Program NP-complete?

I'm reading this paper: Quadratic Span Programs and Succinct NIZKs without PCP Is QAP NP-complete? as same as QSP?
133 views

### What is the difference between information-theoretic and perfect types of security?

I'm having a hard time pinning down an exact definition of the difference between information-theoretic and perfect types of security. A rigorous definition seems elusive... A. Wikipedia puts the ...
37 views

### Why is ethereum not using threshold signatures like dfinity for randomness? What's the drawback?

So Ethereum goes for RANDAO. The disadvantage with RANDAO is that the last validator in the commit-reveal scheme is able to hold his contributed value back and thereby influence the random outcome. ...
3k views

### AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?

I'd like to encrypt Text with AES/CTR and a password defined by the user in java. I already checked the internet (and stackoverflow) for answers. The most used version is to hash the user password ...
27 views

### Computational hardness in two different cryptographic problems [closed]

What is computationally hardest, finding the private key corresponding to a given public key, or, finding a pre-image that hashes to a public key for a key pair (any pair) where you control the ...
57 views

Let's assume all operations are done on $\mathbb{Z}_p$ where $p$ is a large non-prime number. To mask a value $a$, we do the following: Pick a uniformly random value: $r$, from the ring. Do as ...
In their 2015 paper "More Rounds, Less Security?" Guo, Jean, Mouha and Nikolić claim in section 5.4 that one can recover a password $P$ given hashes of $D$ different passwords generated from $H^k(P)$ ...