User Demi

57 votes

2 answers

20k views

What advantages does Keccak/SHA-3 have over BLAKE2?

asked Jan 4, 2016 at 2:48

28 votes

1 answer

5k views

Examples of modern, widely used ciphers that suddenly fell?

asked May 2, 2016 at 3:30

13 votes

1 answer

3k views

What are the requirements of a key schedule?

asked Mar 24, 2016 at 18:46

13 votes

2 answers

2k views

Is CPU timing jitter a usable entropy source?

asked Jan 3, 2016 at 9:03

12 votes

4 answers

820 views

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

asked May 23, 2016 at 6:15

10 votes

2 answers

7k views

Would SHA1 be broken by sheer brute force, even if it had no weaknesses of its own?

asked May 4, 2017 at 17:51

10 votes

1 answer

457 views

Are there any real protocols secure in the random oracle model that have been broken in practice?

asked Feb 17, 2016 at 7:51

9 votes

1 answer

568 views

Converting NewHope/LWE key exchange to a Diffe-Hellman-like algorithm

asked Jun 10, 2017 at 4:55

8 votes

1 answer

2k views

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

asked Oct 4, 2016 at 2:17

8 votes

2 answers

1k views

Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?

asked Dec 17, 2015 at 6:52

8 votes

1 answer

2k views

How does TLS differ from SSH from a strictly cryptographic perspective?

asked Mar 1, 2016 at 15:37

7 votes

1 answer

411 views

Does "double RC4" exhibit the same weaknesses as standard RC4?

asked Apr 12, 2016 at 15:48

7 votes

1 answer

274 views

IND-CCA2 post-quantum key exchange

asked Oct 1, 2018 at 12:35

6 votes

1 answer

735 views

Can RSA-PSS signing be made deterministic without loss of security?

asked Apr 14, 2016 at 16:24

6 votes

1 answer

6k views

What happens if a nonce is reused in ChaCha20-Poly1305?

asked Jan 21, 2016 at 6:00

6 votes

1 answer

473 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

asked Jan 27, 2016 at 6:53

5 votes

1 answer

335 views

Block cipher mode of operation with beyond-birthday-bound security

asked Feb 17, 2016 at 7:34

5 votes

1 answer

2k views

Is ChaCha12 considered 256-bit secure?

asked Feb 22, 2016 at 8:28

5 votes

1 answer

243 views

Does length-prepending stop length-extension attacks?

asked Feb 22, 2016 at 16:21

5 votes

2 answers

3k views

Is there any reason to use RSA or DSA when we have ECC?

asked Feb 24, 2016 at 7:44

5 votes

0 answers

215 views

Can an analog of ChaCha with 64-bit words be defined, and would it be secure? [duplicate]

asked Mar 30, 2016 at 5:03

5 votes

1 answer

346 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

asked May 24, 2016 at 2:22

5 votes

1 answer

499 views

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

asked May 5, 2016 at 21:21

5 votes

1 answer

207 views

Can one make a secure AEAD from any secure cipher and any secure MAC?

asked May 15, 2016 at 3:42

4 votes

1 answer

232 views

Using a round function intended for an SP network in a Feistel network?

asked May 22, 2016 at 5:05

4 votes

1 answer

191 views

Padding schemes for asymmetric encryption with provable security in the standard model

asked May 22, 2016 at 18:29

4 votes

0 answers

551 views

Why is this scheme not IND-CCA2 secure

asked Jun 15, 2017 at 0:52

4 votes

1 answer

382 views

Is this a good choice of a digital signature scheme?

asked May 25, 2016 at 16:23

4 votes

1 answer

542 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

asked Jul 30, 2017 at 4:26

4 votes

0 answers

612 views

Password hashing in embedded systems

asked Mar 3, 2016 at 17:58

Stack Exchange Network

99 Questions

What advantages does Keccak/SHA-3 have over BLAKE2?

Examples of modern, widely used ciphers that suddenly fell?

What are the requirements of a key schedule?

Is CPU timing jitter a usable entropy source?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Would SHA1 be broken by sheer brute force, even if it had no weaknesses of its own?

Are there any real protocols secure in the random oracle model that have been broken in practice?

Converting NewHope/LWE key exchange to a Diffe-Hellman-like algorithm

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?

How does TLS differ from SSH from a strictly cryptographic perspective?

Does "double RC4" exhibit the same weaknesses as standard RC4?

IND-CCA2 post-quantum key exchange

Can RSA-PSS signing be made deterministic without loss of security?

What happens if a nonce is reused in ChaCha20-Poly1305?

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Block cipher mode of operation with beyond-birthday-bound security

Is ChaCha12 considered 256-bit secure?

Does length-prepending stop length-extension attacks?

Is there any reason to use RSA or DSA when we have ECC?

Can an analog of ChaCha with 64-bit words be defined, and would it be secure? [duplicate]

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

Can one make a secure AEAD from any secure cipher and any secure MAC?

Using a round function intended for an SP network in a Feistel network?

Padding schemes for asymmetric encryption with provable security in the standard model

Why is this scheme not IND-CCA2 secure

Is this a good choice of a digital signature scheme?

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

Password hashing in embedded systems