Latest Crypto related questions

Score: 0
Ruthie avatar
Is it possible to create an algorithm for identification and key exchange using the diffie hellman algorithm with exactly three messages?
ke flag

Suppose I want to create a new protocol for communication between two sides, I want to use the Diffie hellman protocol for exchanging keys & also want to do a few more steps later so that the sides can communicate with each other. I want this protocol to contain exactly 3 messages Is it possible?

Score: 3
Steven Yang avatar
What does j9T mean in yescrypt (from /etc/shadow)?
nl flag

For example I have a shadow string

$y$j9T$PaFEMV0mbpeadmHDv0Lp31$G/LliR3MqgdjEBcFC1E.s/3vlRofsZ0Wn5JyZHXAol5

There are 4 parts

  • id : y (yescrypt)
  • param : j9T
  • salt : PaFEMV0mbpeadmHDv0Lp31
  • hash : G/LliR3MqgdjEBcFC1E.s/3vlRofsZ0Wn5JyZHXAol5

What does j9T in param field mean? Are there other options in this field?

Score: 1
Andy avatar
Can other modes be applied in OpenPGP (not using CFB mode)?
pe flag

According to https://www.rfc-editor.org/rfc/rfc4880.html#section-13.9 -> OpenPGP only mentioned about CFB mode.

According to https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3729.pdf (section 2.1 and 3.10) -> AES GCM mode is also approved to use

I am going to implement an application follow RFC 4880 My question is: why RFC 48 ...

Score: 2
Encryption with AES128 (ECB) and Key validation
cn flag

In my new challenge-project my server once upon a time is broadcasting an "onion" made of three layers encrypted with AES128 (ECB) - 16 bytes long over WiFi.

I am using a WiFi Beacon Frame, to transfer the Onion over the air.

The "Onion" looks more or less like the picture below

enter image description here

Each layer is encrypted with a different key. The keys to each layer are known only to the server and devices which are to  ...

Score: 0
Martin avatar
AES Key vs RSA Key
in flag

I am compeletely new to cryptography and recently tried to understand it a bit more thoroughly. My question is: How does the Generation of keys differ in the case of AES and RSA. I understood, that the public and private key of RSA can be derive straight-forwardly with some modulo-magic.

What I did understand (at least i hope) is the following:

The key-pair (private and public) is tightly connected to  ...

Score: 0
TLS sanity check
pf flag

I know there are some tools to check if a certificate is according to the standards like zlint or if the certificate has been logged. But are there tools that work on the rest of the connection like handshake? Normally it is up to the application or library to check for correct values but consider you have some packet dump and maybe the SSL keylog file. Is there some way to use some other application t ...

Score: 0
Is it possible to generate ECDSA signature without nonce?
br flag

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature without Nonce or 'K' when I have private key(priv) and a selected r and an hash of message?

Score: 1
stacksonstacksonstackoverflow avatar
Why do we use asymmetric key cryptography to then just generate a symmetric key to use?

I'm learning about public key cryptography (asymmetric key cryptography), but from what I've gathered, we basically use public key crypto to just move directly onto private key cryptography (symmetric key cryptography).

Why not just always use asymmetric? (Note: I'm a software developer but not a cryptography expert. I'm just learning and find it fascinating. Thank you)

Score: 1
Paul Uszak avatar
Where should MAC keys come from in a one time pad situation?
cn flag

I refer to questions For a one-time pad, which MAC method is information-theoretically secure?, Seeking clarification of OTP & MAC discussion and this page illustrating various MACi. And the question context is authentication of true one time pads.

The MAC requires one or two secret keys depending on the algorithm. Where should these keys come from in a OTP environment? Should they come direct ...

Score: 0
Is it safe to re-use a key with Fernet?
in flag

Fernet is a supposedly idiot-proof, AES-based symmetric encryption scheme that was (again, supposedly) carefully designed to avoid any pitfalls that might compromise security.

I want to use the same key to encrypt multiple files, including modified versions of the same file.

I'm aware that many encryption schemes, especially home-brewn ones, become vulnerable to cryptoanalysis when keys are re-used (si ...

Score: 0
Evan Su avatar
XChaCha20 With a Zeroed Nonce?
be flag

We know that for ChaCha20 and XChaCha20, the same key can never be used with the same nonce. But let's say I use a random 256-bit key every time... Then the nonce can be whatever because the key is always different. Let's say I set the nonce to be all zeros. As long as the 256-bit key is random, then this setup should be secure since 256-bits is large enough to not be bruteforced or be reused.

No ...

Score: 1
Blanco avatar
The existence of OWFs vs $\mathbf{EXP} \neq \mathbf{BPP}$
us flag

In CRYPTO 2021, Liu and Pass published a paper with title "On the Possibility of Basing Cryptography on $\mathbf{EXP} \neq \mathbf{BPP}$.

One of the main results of this work can be interpreted as an indication that the existence of OWFs is equivalent to $\mathbf{EXP} \neq \mathbf{BPP}$. $\mathbf{EXP} \neq \mathbf{BPP}$ is a weak assumpation, what is the relation between this assumpation and the av ...

Score: 0
Freddy Maldonado Pereyra avatar
Avoid MITM Attack in ECDH Without HTTPS or a Third Party Certificate Authority
cn flag

My context: I have a ECHD protocol, my main concern is MITM attack, it doesn't matters if you do HMAC or anything else in future to sign requests if your key exchange is compromised,

Far from https and third party certificate authority, is it possible to protect this channel, taking in account (supposing https is not safe, and we don't have a certificate authority) from MITM attacks?

What I have in  ...

Score: 0
phantomcraft avatar
Is multiple encryption with XTS mode susceptible to Meet-in-the-middle attacks?
pf flag

Let's suppose I encrypt something with AES-256 in XTS mode two times (there will be 4 four keys, 2 for each encryption operation), wanting to achive 512-bits of security.

Will this scheme be susceptible to Meet-in-the-middle attacks?

I'm asking this because there are more operations on XTS mode than only directly encrypting the plaintext.

The Stunning Power of Questions

Much of an executive’s workday is spent asking others for information—requesting status updates from a team leader, for example, or questioning a counterpart in a tense negotiation. Yet unlike professionals such as litigators, journalists, and doctors, who are taught how to ask questions as an essential part of their training, few executives think of questioning as a skill that can be honed—or consider how their own answers to questions could make conversations more productive.

That’s a missed opportunity. Questioning is a uniquely powerful tool for unlocking value in organizations: It spurs learning and the exchange of ideas, it fuels innovation and performance improvement, it builds rapport and trust among team members. And it can mitigate business risk by uncovering unforeseen pitfalls and hazards.

For some people, questioning comes easily. Their natural inquisitiveness, emotional intelligence, and ability to read people put the ideal question on the tip of their tongue. But most of us don’t ask enough questions, nor do we pose our inquiries in an optimal way.

The good news is that by asking questions, we naturally improve our emotional intelligence, which in turn makes us better questioners—a virtuous cycle. In this article, we draw on insights from behavioral science research to explore how the way we frame questions and choose to answer our counterparts can influence the outcome of conversations. We offer guidance for choosing the best type, tone, sequence, and framing of questions and for deciding what and how much information to share to reap the most benefit from our interactions, not just for ourselves but for our organizations.