Henno Brandsma
  • Member for 10 years, 5 months
  • Last seen this week
XOR cipher with three different ciphertexts and repeated key, key length known. How do I find the plaintexts?
Accepted answer
3 votes

You're using bytewise xor, and three plaintexts $x,y,z$ with a small alphabet (A-Z, which I assume means ASCII values 0x41-0x5a). Then knowing $a \oplus x$, at a certain index, we know all possible ...

View answer
PKI Infrastructure
Accepted answer
0 votes

The whole point of public key cryptography is that there is a secret key, which, if the system is to be any good, cannot be easily computed from the public key, but is known to the legitimate owner of ...

View answer
How to implement the Salsa20 hash function?
Accepted answer
2 votes

You are right about the interpretation of the power 10: it's a tenfold iteration. So we apply the function 10 times, starting with $x$, feeding the output as input for the next step. So C-like (I ...

View answer
Why do we need to compute message digest of a message first while signing it?
1 votes

Alongside the other arguments: signing (with RSA) means exponentiating it modulo $N$ (with power $d$, the secret exponent). So anything you sign that way must be of bitsize smaller than $N$, and ...

View answer
Why is g is less than p in Diffie-Hellman?
5 votes

It's an element of the field of all integers modulo $p$, and these are represented by the numbers $0,\ldots, p-1$. And $g$ will be one of them.

View answer
Why verify padding at all?
Accepted answer
3 votes

First of all, a more usual padding scheme would add 5 times the same byte 0x05 (in your example) so the check not just removes 5 bytes, but also checks that the 4 bytes before it have the same value. ...

View answer
Cipher Feedback Mode
5 votes

To address the other issue (with the CFB-1, CFB-8, registers, etc.): Note that in the picture we encrypt whole blocks of the previous ciphertext, and xor the result with the next plaintext block, to ...

View answer
Question on RSA trapdoor permutation
1 votes

Consider Shor's algorithm, which solves RSA in polynomial time on a quantum computer and the fact that there is publicly available software that could factor a 512 bit modulus on a modern PC in a few ...

View answer
Number of possible keys in a Play fair cipher
Accepted answer
1 votes

The Playfair cipher has a key consisting of a square of $5 \times 5$ letters (usually the J is not used, or I/J are considered one letter). Filling the square can be done in $25!$ ways (pick a ...

View answer
How to decrypt 3DES in ECB mode (using a wordlist)?
2 votes

After base64 decoding we get (hex) 5d f8 be 87 82 2b ea 5e f3 5c 23 fe 37 81 0f bd which has a size of two blocks. Of your small word-list, only marketing has so many letters that it needs two ...

View answer
How is LUKS dm-crypt secure if the key is stored with the encrypted data?
Accepted answer
13 votes

The key is not stored with the encrypted data, the encrypted key is. This is part of the header. In short, when the volume is created a random key (the master key) is generated and this random key is ...

View answer
OpenSSL PBKDF2 documentation
2 votes

There is only one, it's declared in <openssl/evp.h>. This post from 2009 names it as yet to be documented, and this seems to be still true. It does have a man page on my Linux systems. BTW recent ...

View answer
AES column mixing and S-Box confusion
Accepted answer
6 votes

You should think of Rijndael's S-box as a function that maps bytes to bytes, where a byte (octet) is considered to be a member of a finite field of size $2^8$ (with xor as addition). It's not seen as ...

View answer
iOS Data Protection: What is the Input of the LFSR?
1 votes

According to this source, which looked at it in detail, and they also implemented tools to do it, it works as follows (roughly): Every protected file has a metadata entry that contains its encrypted ...

View answer
How to choose the appropriate public (i, m) and private (j, m) keys?
Accepted answer
2 votes

I assume that $m = pq$ (85) is the modulus, and the number you computed (64) is $\phi(m)$. Now we must choose the exponents ($i$ for public, $j$ for secret? , weird notation) in such a way that $ij = ...

View answer
How does Scrypt use Salsa?
2 votes

IMHO it's just a warning to the reader that this is not a standard hash-based design like BSD-crypt or PBKDF2, which are traditional choices. They use the Salsa20/8 Core mixing function because its ...

View answer
What does "message schedule" mean in SHA-256?
1 votes

You are looking at the SHA-1 specification, not the SHA-256 one. You are quoting pages 15,16 in the PDF you linked to. The remarks Thomas made also apply to SHA-256 though: the message block of 16 32-...

View answer
IV Security Clarification
Accepted answer
3 votes

Keeping the (initial) IV secret only adds security for the first block of your cipher text. The IV for the second block is by definition the first cipher text block, and so on. So if we would have the ...

View answer
reduces the coefficients of a modulo 3 on NTRU
2 votes

Reducing mod 3 means indeed reducing each coefficient mod 3, and again we choose the representatives symmetrically around 0, so each coefficient becomes -1,0 or 1 (instead of, which is also possible, ...

View answer
Finding roots in $\mathbb{Z}_p$
4 votes

Yes, there is. There is a polynomial algorithm for solving general polynomial equations, like $x^n - a \mod{p}$ in a finite field. And for simple powers, its even easier. So I wouldn't use this for a ...

View answer
RSA private key format for Mega
3 votes

The format is not an official standard, but it is pretty straight forward. There are indeed 4 fields, in order $p$, $q$, $d$ and $u$ (I'm not quite sure what the function of the $u$ is?, it's not the ...

View answer
Why is Blum-Goldwasser not IND-CCA-2 secure?
Accepted answer
2 votes

The randomness is not enough for IND-CCA-2. If we get a message (so $L$ bits of data plus the $y$ to reconstruct the random seed), we can modify it, say flip the first bit, and ask the decryption ...

View answer
RSA Certificate Owner and Issuer line meanings?
Accepted answer
1 votes

CN is common name, OU is orginizational unit, O = organization. So we could have CN="John Johnson", OU="Sales", O="Acme Corp." or something like that. http://docs.oracle.com/javase/1.4.2/docs/...

View answer
When is each key used when encrypting an email using OpenPGP?
Accepted answer
5 votes

Let Alice have a key pair (PubKeyA, PrivKeyA), where the first is public, the second private, and similarly for Bob (PubKeyB, PrivKeyB). Alice and Bob know each other's public keys in a reliable way (...

View answer
What are the main weaknesses of a Playfair cipher, if any?
9 votes

Some additions to the other answer: any given letter can only correspond to a fairly limited number of ciphertext letters: only the ones in the same column or row, and never to itself. So a highly ...

View answer
Cryptanalysing Affine cipher
1 votes

Once you know (you didn't question that) that $a = 3$, then knowing 4 goes to 17, using $f(x) = 3x + b$, we just substitute $x = 4$ to get $3 * 4 + b = 12 + b = 17 \mod 26$, where we can easily see ...

View answer
What are preimage resistance and collision resistance, and how can the lack thereof be exploited?
6 votes

Often the hash (iterated and salted mostly) of a password is saved in a database, instead of the password. If a user logs in, the hash is computed and compared against the stored hash value. This way ...

View answer
Is it reasonable to assure that p-1 and q-1 aren't smooth?
4 votes

I'll leave the probability to someone else, but to ensure the non-smoothness of $p-1$ most libraries (including OpenSSL) will generate a prime $p'$ such that $2p' + 1$ is also prime, and then ...

View answer
How to attack a classical cipher using known partial plaintext?
11 votes

As the other poster rightly pointed out, it's a Playfair cipher. Even without the known plaintext, the program "playn" here will give the right text in less than a second. (you can compile it ...

View answer
How to forge Schnorr signatures if you can guess the challenge
5 votes

Suppose that we have Eve, that knows what $e$ is going to be, and does not need to know the prover's private key $s$, just the public one $v$. She then sends $g^k \cdot v^{-e}$ as her first "move", ...

View answer