# Tag Info

Accepted

### Why do 5G, 4G, etc., use non-conventional algorithms?

These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is ...
• 4,244
Accepted

### NIST Diffie-Hellman prime: how was it picked? Where did it come from?

Is this number specified anywhere? It was formally specified in this RFC as the 1536 bit MODP group (although its use predates that RFC). However, from what I've seen, the 2048 bit MODP group from ...
• 134k
Accepted

### What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private ...
• 134k
Accepted

### Why is the P-521 elliptic curve not in Suite B if AES-256 is?

The real question isn't "Why doesn't Suite B use P-521?" It is, "Why doesn't Suite B use AES-192?" NSA were only interested in 192-bit security for Suite B, but they chose to use AES-256 because AES-...
Accepted

### Why did TLS 1.3 prohibit PGP authentication?

It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place): ...
• 85.9k
Accepted

### Finding flaw in cryptographic protocol

If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute. How about Finding a flaw in cryptographic protocol?! A protocol ...
• 19.2k

### Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

Is there any functional difference on how this process is conducted? One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and ...
• 134k
Accepted

### How are curve names constructed?

The prefix sec stands for "Standards for Efficient Cryptography" (per the eponymous group, in the sense of assembly of experts). Brainpool stands for the name of another assembly of experts. ...
• 125k
Accepted

### How did || come to be used in crypto texts to represent concatenation?

The origin is set theory and not programming languages. In the context of cryptography, I could describe a set that is $$x_1 \parallel x_2 \parallel \dots \parallel x_n$$ as a concatenation of the ...
• 4,244

### Is there a contingency plan in the event of a catastrophic attack on AES?

I'm not aware of any official NIST policy on the matter, so I can only make educated guesses. I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For ...
• 85.9k
Accepted

### What the X stands for in the front of Elliptic curve names like X25519

It is an open standard by IETF.org We can find the details in the mail archive of IETF, D. J. Bernstein's response; It has become increasingly common for "Curve25519" to refer to an ...
• 43.5k
Accepted

### Which cipher is used in the new 5G network?

Ericson's white paper lists them as The strong and well-proven security algorithms from the 4G system are reused. These are encryption algorithms based on SNOW 3G, AES-CTR, and ZUC; and integrity ...
• 43.5k
Accepted

### What's up with unnamed elliptic curves in e-passports?

I don't have any visibility into the BSI standardization process, and so this is a guess; I suspect one of two things happened: This is a potential way to deal with someone figuring out how to break ...
• 134k

### EC Schnorr signature: multiple standard?

Adding to other answers, I note that both schemes are related to (but clearly different from) those standardized in ISO/IEC 14888-3:2016 (non-functional preview): The BSI's EC-Schnorr original ...
• 125k
Accepted

### What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)

If you are seeking a government contract with China, you might be required to use Chinese government standards for cryptography, just like if you are seeking a government contract with the United ...
Accepted

### What weaknesses in Hash_DRBG did NIST find and fix?

Please bear in mind that this information is all secondhand. I have not looked closely at the original drafts of Hash DRBG (although you might find a draft that's early enough if you peruse the FOIA ...
• 331

### Why did NIST select Kyber and Dilithium?

NIST did consider the MATZOV attacks. If we read their Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process, we see in section 4.1.1 on page 29: During the ...
• 11.8k
Accepted

### Source for PKCS#11 Header Files

In May 2015, header files were uploaded to the OASIS PKCS 11 TC document repository by Dina Kurktchi-Nimeh that were versioned v2.40. However, they were uploaded to the "Working Drafts" folder. The ...
• 288

### How did || come to be used in crypto texts to represent concatenation?

Some languages like PL/I and Oracle Database SQL indeed use || for string concatenation. One reason is maybe that + might be ...
• 6,326

### Source for PKCS#11 Header Files

The PKCS#11 standard has transitioned from RSA to the OASIS group: https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=pkcs11 I am not sure why RSA/EMC's site doesn't mention this. I believe ...
• 81

### Is standardizing a modified AES a good idea?

The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe. It's a bad idea! How much scrutiny has it received? Almost none. How much will it ...

### EC Schnorr signature: multiple standard?

The $(r,s)$ version in theory is more secure than $(h,s)$. Bellare, Namprempre, Neven 2004 paper "Security Proofs for IBI and Signature Schemes" showed that Schnorr signature in the form of $(r,s)$ (...
• 91
Accepted

### Where in the FIPS documents is it stated that SHA-1 is not secure?

Much of what NIST publishes about cryptographic algorithms is in Special Publications. In this case it is SP 800-131 (pdf) where they describe transitioning away from old algorithms and key sizes. ...
• 31.3k

### What's up with unnamed elliptic curves in e-passports?

Political reasons likely wins. E.g. France has an own set of domain parameters. Note that when the spec was created that the Brainpool curves where rather new. Generating safe parameters is not ...
• 85.9k

### Notable Non-Western Cryptosystems that have been widely deployed?

Are there cryptosystems that have not been widely adopted in the West, that have been standardized by other major countries? Camellia is a block cipher similar in performance and security to AES. It ...
• 13.5k
Accepted

### Is there a standardized tree hash?

With SHA-3 Derived Functions (SP 800-185, pdf) there is now a standardized parallel hash based on SHA-3, called ParallelHash, appropriately. However, it is not a tree hash, but more of a hash-list-...
• 31.3k
Accepted

### Is there a standard way to use a nonce with HMAC?

Under the assumption that $(K,\text{Msg})\to H_K(\text{Msg})$ is a secure MAC (be it HMAC or any other MAC), and $\text{Nonce}$ does not repeat and is of fixed size, both \$H_K(\text{Msg}||\text{Nonce})...
• 125k

### Is standardizing a modified AES a good idea?

I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the ...