User A. Hersean

221 votes

8 answers

104k views

How much would it cost in U.S. dollars to brute-force a 256-bit key in a year?

John Fischer

2,313

asked Nov 8, 2011 at 10:51

139 votes

6 answers

99k views

Should we sign-then-encrypt, or encrypt-then-sign?

David Cary

5,384

asked Nov 22, 2012 at 16:55

114 votes

4 answers

75k views

How should I calculate the entropy of a password?

this.josh

1,887

asked Aug 11, 2011 at 6:03

86 votes

10 answers

18k views

In end-to-end encryption, doesn't the server need to be trusted?

AV94

979

asked Dec 19, 2017 at 14:30

62 votes

1 answer

28k views

Easy explanation of "IND-" security notions?

SEJPM

44.8k

asked Jul 3, 2015 at 11:03

55 votes

3 answers

25k views

Why Curve25519 for encryption but Ed25519 for signatures?

Simon

651

asked Sep 1, 2015 at 22:16

54 votes

2 answers

12k views

Timing attack and good coding practices

asdfasd

541

asked Nov 21, 2016 at 6:52

40 votes

4 answers

7k views

After 20 years of AES, what are the retrospective changes that should have been made?

b degnan

4,274

asked Jan 18, 2021 at 13:47

35 votes

2 answers

28k views

Is AES-256 a post-quantum secure cipher or not?

AES256

367

asked Mar 16, 2013 at 15:28

34 votes

1 answer

14k views

ECDSA, EdDSA and ed25519 relationship / compatibility

Rafael Korbas

443

asked Apr 15, 2018 at 22:00

34 votes

2 answers

5k views

What are recommended, general strategies to start block-cipher design and/or analysis?

SEJPM

44.8k

asked Sep 5, 2016 at 19:49

30 votes

2 answers

6k views

AES-GCM Disadvantage

user2035863

407

asked Jul 31, 2014 at 19:25

28 votes

4 answers

5k views

Why is FIPS 140-2 compliance controversial?

Newbyte

407

asked Nov 21, 2021 at 20:11

26 votes

1 answer

6k views

Is a hash a zero-knowledge proof?

vrwim

398

asked May 28, 2019 at 18:58

26 votes

2 answers

9k views

Elliptic curve ed25519 vs ed448 - Differences

Nathan Aw

2,129

asked Feb 20, 2019 at 10:00

24 votes

2 answers

6k views

Does the Balloon hashing paper deprecate Argon2?

rmalayter

2,217

asked Sep 15, 2016 at 5:35

24 votes

1 answer

16k views

What are the odds of collisions for a hash function with 256-bit output?

Max

387

asked Aug 27, 2016 at 16:54

18 votes

2 answers

2k views

Why was the winner of the AES competition not a Feistel cipher?

fgrieu♦

126k

asked Sep 29, 2013 at 17:23

18 votes

3 answers

3k views

UMAC: to what extent is it in use today?

user46

asked Jul 25, 2011 at 20:43

13 votes

1 answer

4k views

Security considerations on "expand 32-byte k"-magic number in the Salsa20 family of stream ciphers?

Pascal

233

asked Oct 21, 2013 at 10:51

13 votes

2 answers

9k views

How safe are Libsodium Crypto Boxes?

Vincent Mertens

321

asked Nov 7, 2017 at 9:41

13 votes

3 answers

2k views

How are points on an elliptic curve discretized?

QuartzCrystal

133

asked Aug 10, 2020 at 4:56

12 votes

1 answer

4k views

Curve25519 over Ed25519 for key exchange? Why?

OughtToPrevail

304

asked Mar 19, 2019 at 10:25

12 votes

1 answer

5k views

Relation between entropy and min-entropy

graphtheory92

723

asked Nov 8, 2018 at 11:14

11 votes

7 answers

2k views

In search of a pedagogically simple example of asymmetric encryption routine?

Travis Griggs

211

asked Sep 27, 2019 at 15:28

11 votes

1 answer

6k views

Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

OnTarget

413

asked Jun 20, 2014 at 13:46

10 votes

2 answers

427 views

What role plays Quantum Fourier Transformation in Shor's integer factorization algorithm?

BoFatom

171

asked Oct 15, 2013 at 21:21

9 votes

2 answers

906 views

What do NM-CPA and NM-CCA mean?

starbeamrainbowlabs

193

asked Mar 15, 2019 at 17:05

7 votes

2 answers

625 views

Why ECDSA has its form?

HOANG GIANG

73

asked Dec 13, 2018 at 3:44

7 votes

9 answers

921 views

Soft question: What are examples of beautiful proofs in cryptography? [closed]

Snoop Catt

1,297

asked Jun 4, 2019 at 15:17

Stack Exchange Network

36 Bookmarks

How much would it cost in U.S. dollars to brute-force a 256-bit key in a year?

Should we sign-then-encrypt, or encrypt-then-sign?

How should I calculate the entropy of a password?

In end-to-end encryption, doesn't the server need to be trusted?

Easy explanation of "IND-" security notions?

Why Curve25519 for encryption but Ed25519 for signatures?

Timing attack and good coding practices

After 20 years of AES, what are the retrospective changes that should have been made?

Is AES-256 a post-quantum secure cipher or not?

ECDSA, EdDSA and ed25519 relationship / compatibility

What are recommended, general strategies to start block-cipher design and/or analysis?

AES-GCM Disadvantage

Why is FIPS 140-2 compliance controversial?

Is a hash a zero-knowledge proof?

Elliptic curve ed25519 vs ed448 - Differences

Does the Balloon hashing paper deprecate Argon2?

What are the odds of collisions for a hash function with 256-bit output?

Why was the winner of the AES competition not a Feistel cipher?

UMAC: to what extent is it in use today?

Security considerations on "expand 32-byte k"-magic number in the Salsa20 family of stream ciphers?

How safe are Libsodium Crypto Boxes?

How are points on an elliptic curve discretized?

Curve25519 over Ed25519 for key exchange? Why?

Relation between entropy and min-entropy

In search of a pedagogically simple example of asymmetric encryption routine?

Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

What role plays Quantum Fourier Transformation in Shor's integer factorization algorithm?

What do NM-CPA and NM-CCA mean?

Why ECDSA has its form?

Soft question: What are examples of beautiful proofs in cryptography? [closed]