Cryptography Weekly Newsletter

Cryptography newsletter

Top new questions this week:

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...

algorithm-design salsa20 chacha  
asked by otus 5 votes
answered by CodesInChaos 2 votes

Attacks on elliptic-curve based cryptosystems through solving the Decisional Diffie-Hellman Problem with the Weil Pairing

Are there any examples of practical attacks on cryptosystems set over elliptic curves which utilize the easiness of DDH for certain choices of curves $E(\textbf{F}_q)$, and as such their lack of ...

elliptic-curves semantic-security  
asked by Samuel Judson 4 votes

What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...

cryptanalysis chosen-plaintext-attack chosen-ciphertext-attack  
asked by SEJPM 3 votes
answered by yyyyyyy 6 votes

Example: pre-image resistance to second pre-image resistance

It is possible to convert a pre-image resistant function $f:\{0,1\}^{n}\rightarrow \{0,1\}^{n}$ to a second-preimage resistant function? I am thinking to use a pseudo-random generator and construct ...

asked by juaninf 3 votes

Signature and hash function properties

I understand the need for the hash function to be collision resistant and second pre-image resistant. For what reason, exactly, does a hash function need to be pre-image resistant? If this property ...

hash signature preimage-resistance  
asked by Dingo13 3 votes
answered by Yehuda Lindell 4 votes

Is there a signature scheme for the Cramer-Shoup cryptosystem?

I have a project that I have to use cryptosystem and signature scheme for it. I've read about Cramer-Shoup cryptosystem and I want to use it since it is more secure the ElGamal cryptosystem, but, I ...

encryption authentication  
asked by Бассел Жаббор 3 votes
answered by Yehuda Lindell 3 votes

What is the advantage of AEAD ciphers?

What is the advantage of AEAD ciphers? Why is the TLS working group pushing for them? I thought modern cipher suites require SHA256 for authentication. What advantage is there to including Poly1305?

asked by user3201068 2 votes
answered by Thomas M. DuBuisson 3 votes

Greatest hits from previous weeks:

What is safer: ZipCrypto or AES-256?

Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with ...

aes file-encryption compression  
asked by alex 19 votes
answered by mikeazo 20 votes

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...

elliptic-curves diffie-hellman tls forward-secrecy  
asked by Clay Freeman 21 votes
answered by Reid 20 votes

Can you answer these?

Prove that certain amount of data was stored

I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ...

reference-request zero-knowledge-proofs proof-of-work  
asked by Luca Matteis 1 vote

search of patterns in key schedules

I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...

encryption cryptanalysis algorithm-design key-schedule  
asked by Yuri Waki 2 votes

ElGamal signatures systems

Let $p$ prime number $q/p-1$ prime and $g\in (Z/pZ)^*$ element of order $q$.Also $a\in \{1,...,q-1\}$ the private key and $y\equiv g^a\pmod p$ the correspoding public key.For each of the following ...

elgamal-encryption elgamal-signature  
asked by Legolas 1 vote
Subscribe to more Stack Exchange newsletters

Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3