11
And in which case would it be more interesting to use one or another?
So SHA3-$n$ offers $n$ bits of security against preimage and second-preimage attacks and $n/2$ bits of security against collision attacks.
On the other side SHAKE-$n$ offers at $n$ bits of security against preimage and second-preimage attacks and also $n$ bits of security against ...
7
You can't have two different public keys for the same RSA private key. That's just not how RSA works.
Well, almost. There's a minor technical loophole, and it's the fact that RSA has equivalent keys. In particular, the public keys $(n, e)$ and $(n, e + \lambda(n))$ are equivalent, in the sense of producing the same ciphertext for the same (padded) ...
4
The Salsa20 core is defined on a $4\times4$ matrix $x$ of 32-bit words by $\operatorname{Salsa20}(x) = \pi(x) + x$, where $\pi$ is a permutation.
Consider a matrix:
\begin{equation}
x =
\begin{pmatrix}
A_0 & B_0 & C_0 & D_0 \\
A_1 & B_1 & C_1 & D_1 \\
A_2 & B_2 & C_2 & D_2 \\
A_3 & B_3 & C_3 &...
4
You should generally just use SHAKE128, but you should make sure that within your application, you don't use the SHAKE128 hash (to any length) of the same data for two different purposes. For example, prefix each message you hash with an unambiguous description of the purpose for which you are hashing it: $\operatorname{SHAKE128-256}(\text{‘file hash:’} \...
3
Fix a group $G$ of order $q$ in which discrete logs are hard, and fix a standard base point $g \in G$. Fix an authenticated cipher $E_k$ of bit strings.
In (EC)IES, roughly: A public key is a point $h \in G$.
To encrypt a message $m$, the sender:
picks an exponent $y \in \mathbb Z/q\mathbb Z$ uniformly at random,
computes an ephemeral public key $t = g^...
2
Military encryption often focuses on radio and satellite communications, but it depends on what country one is talking about. For some it might just be radio. Authentication is extremely important; metacontent is too, according to the news.
The adversarial nature of cryptography, its essence, is clearly seen in military conflict, as is its vital importance.
...
1
Not necessarily. Let $M$ be a secure deterministic MAC like HMAC-SHA256. Define the randomized MAC $M'_{k, \rho}(m) := M_k(m) \mathbin\| \rho$; that is, $M'$ just appends the randomization to the MAC. Then encrypt-and-authenticate with $M'$ still leaks message equality, even though the MAC is technically randomized.
1
I spent about 400 hours in paint to make an illustration of this, hope it helps!
Only top voted, non community-wiki answers of a minimum length are eligible
