# All Questions

18,648 questions
65 views

### What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
25 views

### A paper question about the security of hybrid encryption scheme

Why the decryptor can still use K to access the data even when K is updated? QAQ
71 views

### Where can I find open source code for Encryption Switching Protocol?

The concept of Encryption Switching Protocols was introduced in CRYPTO. I was wondering if there is any pseudo-implementation of the protocol available or can I get some insights on how to implement ...
83 views

58 views

### Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
64 views

### If the S-Box is given. How to calculate the affine transformation matrix?

Example using SAGE sage: sr = mq.SR(1, 1, 1, 8, gf2=True) sage: S = sr.sbox(); S (99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71, 240, ...
19 views

### Difference between PMKID and the 4-WAY handshake attack

I am wondering why if you intercept the PMKID in an exchange between the AP and the station it takes more time to break the password (2 times more) if you compare it to crack the password from the 4-...
34 views

### Selection of parameters for Massey-Omura Cryptosystem

I have 4 questions about Massey-Omura Cryptosystem. Are there standards that define these parameters? How to choose a group order? What is better to take the function f? What is the recommended key ...
2k views

### What is the fastest integer factorization to break RSA?

I read on Wikipedia, the fastest Algorithm for breaking RSA is GNFS. And in one IEEE paper (MVFactor: A method to decrease processing time for factorization algorithm), I read the fastest algorithms ...
22 views

### construct parity check matrix from hamming code (3,4) [migrated]

So I have this question. let $${F_4} = \{0, 1 , x, x^2 | x^2 = x + 1 \}$$ Use Ham(3,4), with a parity-checkmatrix having columns in lexicographical order, to decode (a) 1111111 1111111 1111111; (...
59 views

59 views

I am currently reading a research paper that introduces this thing called a butterfly structure. I am confused about the structure of the open butterfly in this paper which has the equation $H^{\... 1answer 156 views ### Difference between RC2, RC4, RC5 and RC6 Can anyone point out the core differences between RC variations? 1answer 63 views ### Differential cryptanalysis tutorial of Howard M. Heys I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ... 0answers 53 views ### Breaking the discrete logarithm problem in subgroups of$G$I need to find the discrete logarithm of 20 modulo 71 where the generator of the group is 7. I need to break the group$|G|=2 \times 5 \times 7$in subgroups$|G_1|=2, |G_2|=5, |G_3|=7$. I am new to ... 1answer 72 views ### Reed Solomon secret sharing and as a one-time symmetric key? Shamir's Secret Sharing is just a special case of Reed-Solomon where only one coefficient is used to store the secret instead of the entire polynomial. McEliece however, suggests that the latter can ... 1answer 58 views ### Upper bound for the length of non-interactive zero-knowledge proofs of knowledge In a hybrid protocol$\pi$for which I want to proof uc-security in the absence of corrupted parties, there is an ideal functionality$\mathcal{F}_{SMT}$for secure message transfer that leaks the ... 2answers 159 views ### Understanding forking lemma and oracle replay attack Many signature schemes use forking lemma to prove security, like scheme in here.In short, that goes through a reduction technique which called oracle-replay attack to solve the difficult algorithmic ... 0answers 43 views ### Crack a polyalphabetic cipher given a pair of (plaintext, ciphertext) encrypted by it The original question only states that a classical cipher is used, and I am going to articulate 1) why I think a polyalphabetic substitution cipher is used AND 2) my attempts so far. The Question <... 1answer 109 views ### Assumptions on one-way functions What are the assumptions we make to propose a one-way function? I only know of some number theoretic assumptions, but what are the other assumptions you can possibly make, which if true, would imply ... 0answers 58 views ### Proofs required to deem Homomorphic Hash-based Digital Signatures secure I just discovered something amaze about homomorphic hashes. With them, we can build hash-based digital signatures so small, fast and without Merkle trees and sort of that. The question is which kind ... 1answer 60 views ### Design a OT-based Private Set Intersection protocol to obtain$A \cap B \cap C$? This is a tutorial question for a Foundations of Privacy computer science course, I'm unsure on how to tackle it because we haven't talked much about these particular topics in class. (a) Assume ... 1answer 691 views ### How to Implement Deterministic Encryption Safely in .NET I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ... 1answer 59 views ### How do i approach file encryption using encrypt-then-mac? [duplicate] I'm programming a cryptographic application that encrypts files, locked with the password the user supplies. It's not intended to be used in production. It's a project for me to learn more about ... 0answers 53 views ### Order of g in Paillier Scheme I'm trying to understand the Paillier Scheme but there's something I can't understand in the keyGen algorithm : Ensure${\displaystyle n}$divides the order of$g$by checking the existence of the ... 0answers 67 views ### padding oracle attacks on AES-CTR [closed] I am newer in crypto and in python also (the only programing language I understand a little bit). And I would know how padding oracle attacks works on AES-CTR. All codes I have found is about padding ... 0answers 30 views ### Proving at most one affine permutation mapping$x$to$u$and$y$to$v$with$x,y \in \mathbb{Z}_n$and$\gcd(x−y,n) = 1$Suppose that$x,y \in \mathbb{Z}_n$with$\gcd(x−y,n) = 1$. Prove that for any$u,v \in \mathbb{Z}_n$there is at most one affine permutation mapping$x$to$u$and$y$to$v$. 2answers 48 views ### Difference between when select x from$\mathbb{Z}_{p-1}$and$\mathbb{Z}_p\$ in discrete logarithm Problem?

Reading "Security Arguments for Digital Signatures and Blind Signatures" paper, I confused by some questions. Q1. when it refers to "El Gamal signature scheme", The key generation algorithm: it ...
111 views

### Cryptographic hash where the hashing function input is similar to the result

I was wondering if there is a cryptographic hash where the resulting hash is identical to the input for the hash function. If this is the case, would it be a weakness in the hashing function?
53 views

### Predicting value of E(k,0) for Block cipher with random and secret key

Some mode of operation of block ciphers rely on the fact that E(k,0) is an unpredictable value when k is random and secret (with 0 denoting the all-zero binary string). Why is this a reasonable ...
27 views

### Randomly initialised global counter used to encrypt the kth message with IV = IV + k mod 2^n

The use of an increasing IV is not secure for a block cipher. That is, using a random IV for the first message then IV + 1 for the second , IV + 2 for the 3rd etc. How can I construct an attack to ...
64 views

### Is this protocol for masking DB ids sound?

Problem Statement I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...