55 votes

Is secp256r1 more secure than secp256k1?

The main difference is that secp256k1 is a Koblitz curve, while secp256r1 is not. Koblitz curves are known to be a few bits weaker than other curves, but since we are talking about 256-bit curves, ...
user avatar
  • 31.3k
37 votes
Accepted

Is there a string that's hash is equal to itself?

I restrict to hash functions $H$ with an output of some fixed size $n\ge1$ bit(s), accepting as input some strings, including all $n$-bit strings; MD5 (resp. SHA-1, SHA-256) is an example of such ...
user avatar
  • 125k
34 votes

Digital signature that is only verifiable by one specific person

What you seem to be looking for is deniable authentication. This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
user avatar
33 votes
Accepted

Examples of modern, widely used ciphers that suddenly fell?

This question is quite broad by specifying a sudden fall to cryptanalysis and therefore my answer might not be as complete as you wish it to be. If by "become practically attackable, or close enough ...
user avatar
  • 9,829
26 votes
Accepted

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private ...
user avatar
  • 133k
23 votes

Is secp256r1 more secure than secp256k1?

The curves secp256r1 and secp256k1 have comparable security. If we consider only the best known attacks today, they have very close security. Both curves are defined over prime fields and have no ...
user avatar
  • 6,369
22 votes
Accepted

Does SHA-1024 hash exist?

No, because even SHA-512 was considered overkill from a security perspective. It has 256-bit collision resistance, which is unbreakable. (The link is about keys but a similar argument applies.) If ...
user avatar
  • 31.3k
22 votes
Accepted

Does AES-NI offer better side-channel protection compared to AES in software?

Yes, AES-NI was specifically designed to be constant-time and thus offers better side-channel protection than (some) software implementations. Note however that these day there exist quite fast side-...
user avatar
  • 44.7k
20 votes
Accepted

Developing algorithm for detecting plain text via frequency analysis

As otus suggests in the comments, it's better to first calculate the frequency of each letter in the decrypted message, and then compare the frequency distribution to what would be expected for ...
user avatar
18 votes
Accepted

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

As of now I can think of four different applications for XOFs. Note that some change the padding depending on the requested output size and so the outputs are truly unrelated, Skein does this. ...
user avatar
  • 44.7k
17 votes
Accepted

Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

Informally, a signature scheme with message recovery is one where some or all of the message is embedded in the signature. That can reduce the size of the signed message, sometime by a proportion ...
user avatar
  • 125k
17 votes

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the ...
user avatar
  • 133k
16 votes
Accepted

Is every point on an elliptic curve of a prime order group a generator?

This is true of any group of prime order, over elliptic curves or not. This is due to Lagrange's Theorem which states that the order of a subgroup $H$ of group $G$ divides the order of $G$. Since ...
user avatar
  • 721
16 votes

Does AES-NI offer better side-channel protection compared to AES in software?

With regards to timing-based side channels (those that can potentially be exploited remotely, as opposed to, say, power analysis), the AES-NI opcodes are constant-time. See for instance Intel ...
user avatar
16 votes
Accepted

Is Bruce Schneier Applied Cryptography, Second ed. up to date?

The Applied Cryptography Second Edition goes back to 1996. Although there is a 20th-anniversary edition, 2015, it is not updated as one thought. If you look for Schneier's style, you may look at the ...
user avatar
  • 43.5k
15 votes

Status of Algebraic Eraser key exchange?

The first part of this partial self-answer uses additional information I received from Professor Simon R. Blackburn, one of the author of the recent attack. The method used to generate parameters is ...
user avatar
  • 125k
14 votes
Accepted

Is there an encryption format that preserves length and only outputs alphanumerics?

Both of the other answers tackle the question of encryption in a particular format, but I would argue that neither of them is necessarily a good fit for your use case. You want to be able to generate ...
user avatar
  • 31.3k
14 votes

Digital signature that is only verifiable by one specific person

Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else. A MAC is a good way of doing ...
user avatar
  • 162
14 votes
Accepted

Why cannot I assume that cryptography published in venues/journals handled by the same publishers as prestigious journals is serious?

In addition to the (good) response of kodlu, let me clarify a point which, I think, is the source of the confusion. Springer, IEEE, Elsevier, etc, are publishers. What this means is that they are ...
user avatar
12 votes

Does SHA-1024 hash exist?

The Secure Hash Standard and corresponding FIPS-180/202 do not specify any hash to meet a security requirement above 256-bits (using a 512-bit hash). This is unlikely to change. SHA-2 was built with ...
user avatar
  • 12.7k
12 votes
Accepted

What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did?

What choice did they have? F1 is a bitwise function with three inputs and one output. There are $2^8 = 256$ such functions. Only 70 of them are "unbiased" (i.e. have as many 0 and 1 outputs in their ...
user avatar
  • 31.3k
12 votes
Accepted

Where can I find a description of the SHA-0 hash algorithm?

The reference on SHA(-0) is FIPS 180 (archived scan) of 1993 May 11. The standard itself is referenced on the NIST website, but that links to another scan lacking page 1 and the one before, thus ...
user avatar
  • 125k
12 votes
Accepted

Who is the inventor of the OFB block cipher mode of operation?

It's difficult to be sure of the attribution here, but my best guess would be Carl M. Campbell Jr., from the (later renamed to Mastercard) Interbank Card Association. Soon after the DES was ...
user avatar
  • 11.7k
11 votes

Is there a string that's hash is equal to itself?

Yes, you can create many such functions. For instance, lets build such a function based on SHA512. Generate some random value $m_0$ and generate a hash of it. It is important, because there is no ...
user avatar
  • 2,142
11 votes
Accepted

Opinion from "military institution" about the academic work

Here is a blog where Scott Aaronson wrote about this, including a link to the NSA document. That link is however now broken, but the blog contains all of the needed text. An alternative copy of the ...
user avatar
11 votes
Accepted

Clarification of the provable cryptography controversies

In general, that article seems to be referring to the "Another Look At..." line of work. Many of the papers are collated on this website. There are a number of "controversies" you ...
user avatar
  • 8,677
10 votes

How to encrypt a file for random access

You basically want a full disk encryption mode for a block cipher; XTS mode seems to be the current standard. In your case each "disk block" is actually a file offset. Note that using a stream cipher ...
user avatar
  • 2,217
10 votes
Accepted

Efficiency of oblivious algorithms vs non-oblivious algorithms?

Yes. There is an $\Omega(\log n)$ lower bound on ORAM. Therefore directly using ORAM to transform a non-oblivious algorithm to oblivious algorithm would incur a logN overhead. It is an open problem to ...
user avatar
  • 356
9 votes

Is secp256r1 more secure than secp256k1?

Here's a good amount of hard data on a variety of curves, well-analysed and the findings summarised in a readable way: http://safecurves.cr.yp.to/ The article linked from this answer is not nearly ...
user avatar
  • 191
9 votes
Accepted

What is "witness encryption"?

In very short: Assume you have an NP problem, stated as some condition to be met. Since it is a NP condition, the computational complexity to find a satisfying input (called the witness for the ...
user avatar
  • 12.3k

Only top scored, non community-wiki answers of a minimum length are eligible