Skip to main content
5 votes
Accepted

Why does ECIES use "Key Encapsulation"? Does it?

Now I've always thought that "encapsulation" is almost synonymous with encryption. You protect a pre-established value using a mechanism. This is not how the term has ever been used in the ...
Victual Soup's user avatar
4 votes

Loop back or cyclic nature of secp256k1 curve

Let $n$ be the order of the base point $G$ then we know $$[k]G = [k \bmod n]G \tag{1}\label{1}$$ This is due to the arithmetic fact that is $a\cdot n = 0 \bmod n$ This prevents us from unnecessary ...
kelalaka's user avatar
  • 49k
3 votes

Does a hierarchical key derivation exist? where child keys can decrypt values encrypted by descendants but not vice versa?

an efficient solution is to use Hierchical Identity-Based Encryption, in the line of [BBG05] https://eprint.iacr.org/2005/015.pdf.
PPL's user avatar
  • 31
3 votes

RFC: Approach to CSPRNG

In general, I want to encourage experimentation like this, as long as you aren't using it in a production environment. Everyone needs to start somewhere, and playing with these sorts of toy constructs ...
Robert Quattlebaum's user avatar
3 votes

RSA perfect square phi

Thank you so much @fgrieu for the detailed and understandable answer. I quickly implemented it in python for anyone else interested in this: ...
Anonymous's user avatar
3 votes
Accepted

RSA perfect square phi

We restrict to RSA modulus $n=p\,q$ with $p$ and $q$ distinct primes, thus $\phi(n)=(p-1)(q-1)$. For any given $(p,q)$ such that $\phi(n)$ is a square, there exists $(a,b,g)$ with $p=a^2g+1$, $q=b^2g+...
fgrieu's user avatar
  • 142k
2 votes

What scheme is the best for combining two shared secrets?

As a rule of thumb, when you're combining two values, there's a risk if a simple relationship between the values can be observed in the combination. In your first two schemes, if ...
Gilles 'SO- stop being evil''s user avatar
2 votes
Accepted

Key exchange for encrypted firmware update

The theory is to use a key derivation function after Diffie-Hellman key exchange. A truncated hash would do if a single key is nedded. As DJB puts it (emphasis mine): Given someone else's Curve25519 ...
fgrieu's user avatar
  • 142k
2 votes

Is keccak256 (and similar hash functions) a suitable KBKDF for 256-bit keys?

Typically, when we're using a KDF, we want the output to be uniform and indistinguishable from random, since we want the output to be able to be used as a symmetric key, which should be uniform and ...
bk2204's user avatar
  • 3,476
2 votes
Accepted

Why does Argon2 truncate BLAKE2b outputs?

Emailing all three authors resulted in no reply, but I realised this is done to prevent you computing subsequent blocks from previous blocks. Given the first block of output, you don't want someone to ...
samuel-lucas6's user avatar
2 votes
Accepted

Does the length extension attack apply to KDFs?

Length extension attacks make sense for a key derivation function. For a good KDF, we expect that sub-keys are indistinguishable from randomly generated keys even if the attacker provides the info ...
Marc Ilunga's user avatar
  • 3,338
2 votes
Accepted

Is using KDF more insecure that generating key directly? (AES 256 CBC)

KDF's aren't inherently insecure. However, password based encryption is generally thought to be insecure within many situations. Users do generally not enter passwords that have enough bits to avoid ...
Maarten Bodewes's user avatar
  • 93.2k
1 vote

Does the actual length of a password or salt provide any additional entropy to that contained within them?

does length add anything? Yes. Without the lengths, (password="aqwal", salt="[email protected]") and ...
fgrieu's user avatar
  • 142k
1 vote
Accepted

Deriving the RSA private key

Is there any security issue with my approach? Well, no, there doesn't have to be. One approach would be to seed a cryptorng with $P, Q, salt$, and then use the output bits of your cryptorng as the ...
poncho's user avatar
  • 148k
1 vote

Using parts of the master seed as the salt for HKDF

No, a salt composed from bits of the master seed or IKM doesn't provide much additional security. It is better to choose e.g. an application specific label within the $\mathit{Info}$ parameters (named ...
Maarten Bodewes's user avatar
  • 93.2k
1 vote
Accepted

SHA-512 for ECDH key derivation

TL;DR Unless performance is an issue I'd go for HKDF. Use the functions for what they are designed for unless you have good enough reasons to avoid them. libsodium seems to use a proprietary ...
Maarten Bodewes's user avatar
  • 93.2k
1 vote

Why does ECIES use "Key Encapsulation"? Does it?

It seems clear from the responses that KEM means that some secret is being encapsulated / protected by the algorithm. How this happens within the algorithm itself seems irrelevant. In [the standard &...
Maarten Bodewes's user avatar
  • 93.2k
1 vote
Accepted

How much of SHA3's internal state can be reached?

How does this translate to the maximum number of internal states that are reachable within SHA3? That depends on what you're asking. If you are considering only 256 bit inputs (which the SHA-256 ...
poncho's user avatar
  • 148k

Only top scored, non community-wiki answers of a minimum length are eligible