Mastercard, Visa, and several other organizations use 3DES to encrypt and decrypt credit card data. The sweet32 attack placed 3DES in the spotlight, but how fragile is 3DES for a very small amount of info, like 16 digit string (the card number) + 3 digit string (the CVV) + 4 digit string (month/y...

As an example, both Classic-McEliece and Kyber KEMs produce 32 byte shared secrets. How convenient since that's exactly the size I need for an AES-256 key! Is this safe to do? My question can be formalized into these (I believe) equivalent questions about the definition of KEMs (I'm mostly intere...

Recently, we have had two questions proposing flawed cryptosystems, with pictures: a would-be AES-256 replacement based on DES,   and a chaos+LFSR-based cipher: The questions have been closed because they ostensibly presented as personal design, which is off-topic. They also could have been home...

In the classic "Applied Cryptography" (20th anniversary edition) book from Bruce Schneier, there is an illustration of a maximal-length LFSR: According to the book, this LSFR uses the tap sequence from the polynomial $x^{32}+x^7+x^5+x^3+x^2+x+1$ which is maximal-length. However, most examples I ...

We know that a collision resistant hash function is also second pre-image resistant. But the converse is not necessarily true. I am looking for the example of a hash function which is second pre-image resistant but not collision resistant. Please help.