I had a quick question for all.  Why do we hash the random challenge in Fiat-Shamir heuristic? If we hash the public key of Prover it should be enough for the verifier to prove non-repudiation?  What is the need for hashing the first random message the prover ($x=g^y$) also?
123504
Peggy would like to prove to Victor that she knows the discrete logarithm of $y$ based $g$; that is, she knows $x$ such that $y = g^x \bmod p$. One round of the interactive proof protocol consists of the following steps.   Peggy picks random $k \in \mathbb Z/(p−1)\mathbb Z$, computes $t = g^k \bmod p$, and sends $t$ to Victor. Victor picks random $h \in \mathbb Z/(p−1)\mathbb Z$ and sends $h$ to Peggy. Peggy computes $r = (k − hx) \bmod (p − 1)$ and sends $r$ to Victor. Victor verifies that $t = g^r y^h \bmod p$.   The interactive protocol can be converted into a noninteractive zero-knowledge proof by choosing and making public a collision-resistant hash function $H$, and changing the second step of the interactive protocol to the following: Peggy computes $h = H(y, t)$. Then the noninteractive proof consists of $(t, h, r)$, which can be verified as follows: $$h = H(y, t), \qquad t \stackrel?= g^r y^h \bmod p.$$   What is the problem if in the non-interactive proof the hash $h$ depends only on $y$? That is, $h = H(y)$, and the proof consists of $(t, h, r)$, which can be verified as follows: $$h = H(y), \qquad t \stackrel?= g^r y^h \bmod p.$$ What is the problem if in the non-interactive proof the hash $h$ depends only on $t$? That is, $h = H(t)$, and the proof consists of $(t, h, r)$, which can be verified as follows: $$h = H(t), \qquad t \stackrel?= g^r y^h \bmod p.$$
32359
Maybe this is a newbie question:  Stream cypher, will XOR message bits with one-time pad bits. Suppose I have a , like a  or something similar. I could use the pseudorandom string to XOR the message. Use the password as the seed of the generator. Same password = same pseudorandom sequence. Could hashing blocks of the pseudorandom sequence create a stronger one-time pad stream?
3908
This Q &amp; A   says that the security of HMAC-SHA1 does not depend on resistance to collisions? Are they are saying specifically with respect to HOTP or for HMAC-SHA1 for any use?     If HMAC-SHA1 is used for verifying the integrity of a document and you can find a collision, you can make changes in the document, right?      Even the RFC says that resistance to collisions is relevant       The security of the message authentication mechanism presented here depends on cryptographic properties of the hash function H: the resistance to collision finding (limited to the case where the initial value is secret and random, and where the output of the function is not explicitly available to the attacker), and the message authentication property of the compression function of H when applied to single blocks    What am I missing here?
52145
I think I roughly understand how the RSA alorithm is working.  However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$.  I vaguely know it has something to do with factorization, but I am kind of lost. So, hypothetical questions.   What would happen if the $N$ was not $pq$, but just a big prime? What if $N$ would be some random composite (that's easy to factor)?   The other parts of RSA would stay the same.
49880
Diffie–Hellman offers secure key exchange only if sides are authenticated. For authentication, sides are using public/private key. So if side A knows the public key of the side B, then A can simply use that key to encrypt the message (or the new session key).  Why bother to use separate key exchange algorithm?
13882
It is possible to find an efficient algorithm for constructing a provably hard to factor number $N$, together with a witness that shows that it is indeed hard to factor. EDIT, since it was not clear: I also want to be sure that even the person that constructed the number cannot factor it.  Of course, a random large enough integer is going to be hard to factor with high probability, but we might be unlucky.  There are also multi-party protocols for shared generation of RSA moduli (such as ), but I would like a non interactive technique.  Motivation: This was suggested by Poncho's answer to
60080
I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic &quot;salt&quot; is, when I might need to use it, and why I should or should not use it. Can I get a very simple and clear (beginner level) explanation? If you know of any references on the topic, those would also be useful.
26807
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.  Alice and Bob each have their public- and private-key pairs ($\left[pub_{A}, pri_{A}\right]$ for Alice and $\left[pub_{B}, pri_{B}\right]$ for Bob) and Alice, Bob, and Cindy all know everyone else's public key.   Alice generates a random $n_{A}$ and sends out $En_{pub_{B}}\left(n_{A}\right)$ ($n_{A}$ encrypted with Bob's public key). Bob generates a random $n_{B}$ and sends out $En_{pub_{A}}\left(n_{B},n_{A}\right)$ and sets the session key to $n_{A}\oplus n_{B}$. Alice sends out $En_{pri_{A}}\left(n_{B}\right)$ and sets the session key to $n_{A}\oplus n_{B}$.   My thinking is, Cindy decrypts message 3 with Alice's public key to obtain $n_{B}$.  Now Cindy has a plaintext, ciphertext pair and the key that decrypts the ciphertext.  My question is, is it possible with this information for Cindy to find $pri_{A}$ in order to decrypt message 2 and find $n_{A}$?
15506
It's been over 30 years since Rivest, Shamir and Adleman first  described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for around 40 years&mdash;possibly longer.  It's fair to assume that, during those 40 years, certain three-letter organisations have employed their vast resources toward "breaking" RSA.  One brute-force approach may have been to enumerate every possible key-pair such that, upon encountering a message known to be  encrypted with a particular public-key, they need merely lookup the associated private-key in order to decrypt that message.  Signatures could be forged similarly.  How reasonable is this hypothesis?  How much computing resource would have been required over those 40 years to enumerate every possible {1024,2048,4096}-bit key-pair?  I think it best to avoid discussion and leave the question of whether the spooks could have harnessed such resource as an exercise to the reader.
102177
I'm back again So there's another problem that I can't get to prove  If we take 21 numbers randomly from $1, 2, 3, ..., 40$ then between those $21$ numbers we will be able to find two numbers, of which the smaller one will divide the bigger one  I've been reading james hein "discrete structures, logic and computability" but still can't get to think logically myself. I would be very grateful if I could get some directions/tips/hints or anything, thanks in advance
16417
When choosing the public exponent e, it is stressed that $e$ must be coprime to $\phi(n)$, i.e. $\gcd(\phi(n), e) = 1$.   I know that a common choice is to have $e = 3$ (which requires a good padding scheme) or $e=65537$, which is slower but safer.  I also know that for two primes $p,q$, we have $\phi(pq) = (p - 1) (q - 1)$  Now, let me give a (simple) example:  Say I choose $e = 3$, and two random primes $p = 5$ and $q = 13$.  I can now compute $\gcd(3, \phi(5 \cdot 13)) = 3$.  This reveals that $3$ and $\phi(n)$ are not coprime. I assume this could also happen for large values of $p$ and $q$, and likewise for another $e$. I therefore assume that the RSA algorithm must check that $\gcd(e, \phi(pq)) = 1$. But let's assume it doesn't.  How does RSA become vulnerable if $\gcd(e, \phi(pq)) \neq 1$?
101961
If one were to create a SHA256 hash using 256 coin flips converted to hex (which, as I understand it, is as "entro-phized" as one can capture in SHA256) then take that hash as a string, combine that with a hash of the word "cat" and hash the resulting 512 character string, would the resulting hash from that exercise be any less random than our "perfect" hash we began with?  My thinking is the final string would capture the same amount as the original randomness as what we started with because the "extra" entropy can not be captured and is lost. Is this the case and am I thinking about this correctly? Would hashing something with high entropy with something simpler ever cause a lower amount of randomness or does it only go up?  Thanks to anyone who can help explain this a little better.
113251
The sender and receiver share two different secret keys:  s1 and s2 both y bit values. 'x' is a randomly generated y bit value. The reader sends to the tag a challenge y =  x ⊕ s1, and the receiver  responds with z = x ⊕ s2 after recovering x = y ⊕ s1.   s1 and s2 never change, x is randomly generated each complete transaction. Can you determine s1 and s2 through a single transaction? After multiple?
70632
Gilbert, MacWilliams, and Sloane defined a solution to "perfect integrity" in , unconditionally secure message authentication, not vulnerable to any cryptanalysis on its own even by an adversary with unbounded computational power, provided you have a key chosen uniformly at random the same length as the message. It sounds counter-intuitive that a MAC could have perfect integrity, any hash function can be broken with enough computational power. How does their solution have "perfect integrity"?
73419
Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure?  See this . In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\mathbin\|m)).$$ Why don't we use $$H(k\mathbin\|H(k\mathbin\|m)),$$ which has only one key?
71304
I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers.  First, I was recently demonstrating to a 12-year-old how encryption works. I created some basic cyphers and had him figure them out. (I recommend this; it's quite fun.) Wanting to up the ante, I looked for ways to send messages back and forth using public-private key encryption, and I failed with flying colors.  Second reason for wanting this is that it would really help me understand how asymmetric encryption works. At the moment, I can't figure out a way to do solve this on my own, and I feel that betrays my lack of understanding in the subject.  Finally, (this one may be a stretch) I'm writing a fantasy story, and I'd like to do something unique with the form of exchange. One thought was to have a memorized key that the owner held, which she would use to sign her (paper) payment of 30 units for a loaf of bread, or whatever, combining her key with the shopkeeper's public key. (UPDATE: Note that this gets into digital signatures, rather than asymmetric key encryption. I'm hoping they are related, but if they're not, forget it.)  Any ideas how to accomplish this? If it's simply not feasible, I would appreciate an explanation as to why.  There are two similar questions on this site, but neither of them address asymmetric key encryption, unless I'm more misinformed than I thought:
3848
I read ampersand's question , where he asked why Shamir's Secret Sharing Scheme uses arithmetic in a finite field of prime order.  The answers to that question explain that a prime field is not necessary for Shamir's scheme, but, rather, that any finite field can be used.  However, they don't really address the other part of the question, namely why do we need a finite field at all?  Couldn't we just use, say, ordinary integer arithmetic instead?  Can someone please explain (in the simplest possible manner) the reason that Shamir's Secret Sharing Scheme uses finite field arithmetic?