Conrado
  • Member for 10 years, 4 months
  • Last seen this week
What data is saved in RSA private key?
Accepted answer
33 votes

You can print the data with (change PEM to DER if required): openssl rsa -in Alice.key -text -inform PEM -noout The following data is stored: Modulus ($n = pq$) Public exponent ($e$) Private ...

View answer
How does the MOV attack work?
Accepted answer
30 votes

Most cryptosystems based on elliptic curves can be broken if you can solve the discrete logarithm problem, that is, given the point $P$ and $rP$, find the integer $r$. The MOV attack uses a bilinear ...

View answer
If hash functions append the length, why does length extension attack work?
Accepted answer
18 votes

Let hash be the raw hash function, as you're referring to. You mentioned that the attacker knows hash(message || length), but to be more precise, they know hash(message || padding || length). Let ...

View answer
Could quantum computers "break" symmetric crypto-systems (e.g. AES)?
Accepted answer
12 votes

With Grover's algorithm, quantum computers can brute-force a block cipher with $n$-bit keys using $2^{n/2}$ steps, which is much smaller than the regular effort ($2^n$). This means, for example, that ...

View answer
Can one implement AES on 4-bit microcontroller?
12 votes

The paper Enabling Standardized Cryptography on Ultra-Constrained 4-bit Microcontrollers (page 255) describes such an implementation.

View answer
Does XOR'ing a random number with its inverse reduce its security if the result is a palindrome?
Accepted answer
10 votes

The xor of two random strings is a random string, so you're basically generating a 128-bit random string from a 256-bit random string. Yes, it reduces security compared to a pure 256-bit random ...

View answer
"Probability" of an ECDSA signature
Accepted answer
9 votes

It's the probability that an ECDSA signature (over the Bitcoin curve, secp256k1) will have the corresponding size. In other words, 25% of the secp256k1 ECDSA signatures have 73 bytes, 50% of them have ...

View answer
Practical sources of entropy on an Android device?
9 votes

Just use SecureRandom and let the OS take care of it.

View answer
Raw curve25519 public key points
Accepted answer
8 votes

The leading 04 byte is specified by the SEC standard (which is based on the ANSI X9.62 standard). It indicates that the public key point is not compressed. If the key is compressed, it uses 02 or 03 ...

View answer
Can CBC-encrypted files be modified in-place?
Accepted answer
8 votes

If you could use the same IV, then yes, you would need to rewrite everything after the modified block. But you shouldn't do that; every time the contents change, you should generate a new IV, which ...

View answer
AES confused about how ShiftRows() step works
Accepted answer
7 votes

The entire AES algorithm uses column-major order. So the first four elements are actually the first column, and not the first row.

View answer
Why is RSA secure if I can solve the equations for it using a math solver?
7 votes

Your N value, 209, has 8 bits. In practice, RSA uses N values larger than 2048 bits, which can't be factorized in reasonable time in a math software or any other software.

View answer
Is it safe to reuse the password when using AES-CTR with scrypt?
Accepted answer
7 votes

CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero ...

View answer
Security of pairing-based cryptography over binary fields regarding new attacks
7 votes

Antoine Joux announced the computation of discrete logarithm over $\mathbb{F}_{2^{257 \times 24}}$, which is now pretty close to what was being used in pairing-based cryptography. According to Joux, "...

View answer
Current situation of bilinear pairing protocols
Accepted answer
6 votes

That paper is misleading in several ways: The DSA vs BB comparison: it is unfair because it compares DSA with the "full" BB scheme, which does not produce shorter signatures. The same BB ...

View answer
Order of Edwards curve and its twist
Accepted answer
6 votes

Regarding the [B] and [C] parts of the question per the comments: I'm not sure how exactly did Mike Hamburg find the curve, but from what I know it's usually easier to find the order of the matching ...

View answer
Mapping the hash of message to a point of elliptic curve for signature
Accepted answer
6 votes

That's insecure. In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because: $e(T, ...

View answer
Elliptic curve ed25519 vs ed448 - Differences
6 votes

The Ed25519 prime has $p \equiv 1 \pmod 4$, while Ed448 has $p \equiv 3 \pmod 4$. This influences the square root algorithm. The $a$ elliptic curve parameter is $-1$ in Ed25519, and $1$ in Ed448. This ...

View answer
Are Barreto-Naehrig Curves suitable for pairing-based cryptography?
6 votes

You can, with the right parameter sizes (384-bit prime instead of the older 256-bit). Pairings can be attacked in two fronts: the elliptic curve or the extension finite field. The security of the ...

View answer
Elliptic curve and "vanity" public keys
Accepted answer
6 votes

Maxwell's vanity public key is a result of how the generator of the secp256k1 was chosen; as explained by Maxwell himself. For some reason, the generator $G$ is the double of the point: x = ...

View answer
Does GHASH use XOR or addition?
6 votes

GHASH operates on polynomials with coefficients in the two-element finite field $\operatorname{GF}(2)$ (which you can interpret as numbers modulo 2). Each coefficient is represented as a bit. To add ...

View answer
Why are there $2^{56}$ possible DES keys when there are 64 key bits?
6 votes

Each 56-bit key has a unique 8-bit parity value. For this reason there are only $2^{56}$ keys.

View answer
Why is ECIES complex?
6 votes

ECIES may seem complex, but if you try another approach, you would end up with something very much like it. If you only encrypt with AES, then you are not authenticating, which is most cases you also ...

View answer
DSA, RSA, ECDSA etc - which one is cheapest for signing?
6 votes

From these three, ECDSA is faster - it does arithmetic with smaller numbers, and is thus faster. (RSA verification is faster than ECDSA, even though it uses larger numbers, because it computes a ...

View answer
Diffie-Hellman Primitives in SP800-56A
Accepted answer
5 votes

A group is a set of elements and some operation that satisfy some requirements. This operation is usually called "addition" or "multiplication", depending on the group, even though ...

View answer
I don't understand RSA encryption (specific questions)?
Accepted answer
5 votes

Why do we choose the value of e such that e is relatively prime to the totient (as opposed to just being relatively prime to n?) The final goal of RSA encryption is to have $m = c^d \bmod n$, which ...

View answer
What does the number 256 in pairing curve BN256 indicate?
Accepted answer
5 votes

It's the size of the prime number of the underlying field in G1, G2 and GT. In BN256, G1 is $E(\mathrm{GF}(p))$, G2 is a subgroup of $E(\mathrm{GF}(p^{12}))$ (or $E'(\mathrm{GF}(p^{2}))$ when using a ...

View answer
How are Elliptic Curve Cryptography and Pairing Based Cryptography related?
Accepted answer
5 votes

Most pairing-based cryptography (PBC) schemes are based in elliptic curve cryptography (ECC). The main function in PBC is the pairing, which is a function $e$ with two parameters, e.g. $r = e(P, Q)$. ...

View answer
Modulus for elliptic curve point multiplication
5 votes

It's the prime of the prime field. (Note that, if you're also using the curve for pairings, you'll need arithmetic over both $\mathbb{F}_p$ and $\mathbb{F}_{p^{12}}$. The first can be viewed as ...

View answer
Would it be secure to use random numbers from random.org in a cryptographic solution?
5 votes

It would be secure only If you trust the connection to random.org (and as you said, it is unsecured) If you trust random.org itself (it could e.g. log the generated data along with your IP) So I'd ...

View answer