## Top new questions this week:

### What is a "freestart collision"?

In their work on SHA-1 collisions (cf. the currently unpublished paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...

hash cryptanalysis collision-resistance terminology

### How to protect key in software

I need to encrypt/decrypt data from my software by AES, the problem is how to make the AES key secure, there is no HSM, should I hard code the key in my code? It seems that a hacker can read the key ...

aes keys white-box

### How have MD5 constants been determined?

For instance, the per round shift amounts, r[ 0..15] := {7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22} r[16..31] := {5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20} ...

hash md5 constants

### Weakness of SRP after server compromise

From SRP section 3: The host stores user passwords as triplets of the form { <username>, <password verifier>, <salt> } Password entries are generated as follows: ...

cryptanalysis srp

### Encoding scalar values to points on Ed25519

I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519. ...

elliptic-curves ed25519

### Is it possible to find a Mersenne Twister seed given only the first output?

Suppose I have a Mersenne Twister seeded with some unknown value, and I’ve been given the first output. Given only this first output, and no other information, is it possible to derive the unknown ...

cryptanalysis random-number-generator

### Are HTTPS web sessions non-repudiable?

(This is probably a basic question, and may be a duplicate; if so, just let me know.) Suppose there are two clients A and B, and some server C. Suppose B and C establish an HTTPS tunnel, and C sends ...

tls non-repudiation

## Greatest hits from previous weeks:

### How do we know a cryptographic primitive won't fail suddenly?

It took more than a decade from when MD5 looked like it was going to break to the point when it was actually broken. That's more than a decade of warning. How can we be sure that when our ...

algorithm-design

Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...

### Best way to implement secure client/server communication in Python

For a college programming assignment I have to implement a secure communication protocol between a server and one or more clients. Upon instantiation of the server program, a file is generated, call ...

encryption

### Are there MD5 collisions for inputs of different length?

There are many examples of MD5 collisions (some of them can be found here Are there two known strings which have the same MD5 hash value?). But as far as I know two inputs should have the same length ...

hash collision-resistance md5
Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm ...