User Maarten Bodewes

96 votes

1 answer

158k views

What is the difference between PKCS#5 padding and PKCS#7 padding

asked Jul 4, 2013 at 21:18

36 votes

2 answers

26k views

Practical disadvantages of GCM mode encryption

asked Oct 4, 2013 at 22:13

28 votes

2 answers

20k views

Which attacks are possible against raw/textbook RSA?

asked Nov 7, 2014 at 15:59

27 votes

1 answer

3k views

What is hardened SHA-1, how does it work and how much protection does it offer?

asked Feb 23, 2017 at 19:53

25 votes

2 answers

13k views

Is RSA encryption with a private key the same as signature generation?

asked May 4, 2014 at 16:43

20 votes

1 answer

8k views

Reasons for Chinese SM2 Digital Signature Algorithm

asked Aug 22, 2013 at 11:08

18 votes

3 answers

10k views

Modes of operation that allow padding oracle attacks

asked Jul 17, 2014 at 21:27

16 votes

1 answer

5k views

Security of KDF1 and KDF2 (hash based KDF's)

asked Apr 19, 2014 at 16:41

15 votes

2 answers

2k views

Given enough RSA signature values, is it possible to determine the public key value?

asked Mar 12, 2016 at 15:24

13 votes

3 answers

1k views

Counter mode secure hash algorithm

asked Jan 2, 2012 at 16:10

12 votes

1 answer

5k views

Sending KCV (key check value) with cipher text

asked Feb 25, 2012 at 13:10

12 votes

1 answer

6k views

Cryptographic security of PHP mt_rand() function using Mersenne Twister algo

asked Mar 31, 2012 at 13:53

11 votes

1 answer

2k views

How random is the shared secret in the Diffie Hellman key agreement

asked Jul 24, 2013 at 23:45

11 votes

2 answers

3k views

Should HMAC-SHA3 be preferred over H(C(k,M))?

asked May 7, 2016 at 11:51

11 votes

2 answers

3k views

Validating an RSA public key

asked Sep 21, 2022 at 13:16

10 votes

0 answers

180 views

Do CCM and EAX provide key commitment?

asked Jan 25, 2021 at 15:57

10 votes

1 answer

5k views

What is the algorithm behind PasswordDeriveBytes?

asked Jan 9, 2015 at 3:14

10 votes

2 answers

793 views

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

asked Jul 20, 2018 at 12:58

9 votes

1 answer

783 views

Can Whirlpool take advantage of AES-NI?

asked Nov 10, 2016 at 9:52

9 votes

1 answer

2k views

What are the constraints on using GCM with a tag size of 96 and 128 bits?

asked Aug 6, 2015 at 22:17

9 votes

1 answer

868 views

Side channel security of HMAC in software

asked Jan 30, 2016 at 11:15

9 votes

1 answer

2k views

Practical uses of Manipulation Detection Code (MDC) and IGE

asked Jul 23, 2013 at 19:47

8 votes

2 answers

1k views

Given enough RSA ciphertext, is it possible to determine which key was used?

asked Mar 12, 2016 at 14:47

8 votes

2 answers

3k views

BER or DER X9.62 for ECDSA signature

asked Apr 8, 2015 at 22:11

8 votes

1 answer

2k views

Does perfect forward secrecy (using DH or ECDH) imply quantum resistance?

asked Oct 21, 2016 at 8:28

8 votes

1 answer

718 views

Point-at-infinity and error handling

asked Feb 14, 2017 at 18:30

8 votes

1 answer

613 views

Is constant-time compare really required for AEAD ciphers?

asked Aug 26, 2022 at 10:29

7 votes

3 answers

3k views

Formal description of KDF1 and KDF2

asked Feb 13, 2019 at 19:29

7 votes

2 answers

1k views

Is it possible to perform a meet-in-the-middle within a block cipher?

asked Jun 27, 2019 at 12:25

7 votes

2 answers

3k views

How to create an EC point from a plaintext message for encryption

asked Dec 10, 2019 at 23:07

Stack Exchange Network

102 Questions

What is the difference between PKCS#5 padding and PKCS#7 padding

Practical disadvantages of GCM mode encryption

Which attacks are possible against raw/textbook RSA?

What is hardened SHA-1, how does it work and how much protection does it offer?

Is RSA encryption with a private key the same as signature generation?

Reasons for Chinese SM2 Digital Signature Algorithm

Modes of operation that allow padding oracle attacks

Security of KDF1 and KDF2 (hash based KDF's)

Given enough RSA signature values, is it possible to determine the public key value?

Counter mode secure hash algorithm

Sending KCV (key check value) with cipher text

Cryptographic security of PHP mt_rand() function using Mersenne Twister algo

How random is the shared secret in the Diffie Hellman key agreement

Should HMAC-SHA3 be preferred over H(C(k,M))?

Validating an RSA public key

Do CCM and EAX provide key commitment?

What is the algorithm behind PasswordDeriveBytes?

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

Can Whirlpool take advantage of AES-NI?

What are the constraints on using GCM with a tag size of 96 and 128 bits?

Side channel security of HMAC in software

Practical uses of Manipulation Detection Code (MDC) and IGE

Given enough RSA ciphertext, is it possible to determine which key was used?

BER or DER X9.62 for ECDSA signature

Does perfect forward secrecy (using DH or ECDH) imply quantum resistance?

Point-at-infinity and error handling

Is constant-time compare really required for AEAD ciphers?

Formal description of KDF1 and KDF2

Is it possible to perform a meet-in-the-middle within a block cipher?

How to create an EC point from a plaintext message for encryption