All Questions
30,402
questions
0
votes
0
answers
32
views
NTT implementation using matrix multiplication
I am trying to implement the NTT as done in this paper, but I keep getting the wrong result even when doing the math by hand. Is formula 9 of the paper wrong ? (I suspect that I am the wrong one but ...
1
vote
2
answers
414
views
Factoring 350 to 400 bits long rsa number with a factor that has a known bitlength… But in less than 5 to 7 minutes and less than $100
the gnfs is the most efficient algorithm for factoring numbers formed of equal composites.
But it’s sequential/Linea Algebra parts mean (If I’m not wrong), that it requires at least 10 minutes on ...
- 208
3
votes
1
answer
315
views
How can I understand the gap between CPA and CCA1?
I have read lots of books about CPA,CCA1,CCA2. I understand how to get an example satisfies CPA but not CCA2. However, I can't find such a scheme which is CPA but not CCA1. What is the extra advantage ...
1
vote
1
answer
67
views
Does encrypting a billion short and similar jsons with known structure make encryption less secure?
Let's say we have a billion short individual json files with same regular structure: {"name": "<name>", "id": <id>}. Each ...
- 23
1
vote
1
answer
80
views
AES-128 ECB Standard Confusion
Forgive my ignorance, but I've run into some confusion in an AES implementation I'm testing.
To the best of my understanding, ECB provides no diffusion, the same plaintext with the same key will yield ...
1
vote
0
answers
107
views
One-more co-CDH assumption in pairing group
I am asking it again because no one answered my previous question with more clarity. I have deleted that question
One more co-CDH in Type three pairing groups $G_1 \times G_2 \to G_T$: means given a ...
- 601
1
vote
1
answer
58
views
What does "gpg: RSA/AES256.CFB encrypted for" mean?
The output of command fortune | gpg -vaer <receipent-id> has a line that begins with:
...
- 23
0
votes
0
answers
13
views
in MA-ABE, what is the diference when prove a scheme is selective or static?
I have read
[1]Decentralized Multi-authority ABE for NC1 from BDH,
[2]Decentralizing Attribute-Based Encryption,
[3]Fully Adaptive Decentralized Multi-Authority ABE,
When I compare security proof in [...
0
votes
0
answers
46
views
What is insecure about adding salt to your plaintext before using RSA? [duplicate]
RSA can't be used securely as is as it is deterministic. So an encrypted "yes" always looks the same. A simple workaround, which is apparently not secure, is to add 100 bits, say, of random ...
- 299
6
votes
2
answers
277
views
Blinding an ECDSA private key without learning the private key
I am looking at ways to blind an ECDSA signing key (and verification key respectively).
Looking at proposed solutions like the IETF KBSS draft, and the IETF ARKG draft it seems that the ECDSA key ...
- 121
1
vote
1
answer
37
views
n-Party Garbled Circuit
Yao introduced a famous notion of securely computing any function between 2 users using a concept of Garbling circuit. How can this idea be extended for n-party case? That is there are n-1 garblers ...
4
votes
1
answer
107
views
Is there any cryptography-based assured data deletion technique currently as a standard?
I've recently read part of a book exploring secure data deletion techniques for many storage mediums. In particular, I read about assured data deletion techniques developed for data outsourced to the ...
- 43
1
vote
1
answer
48
views
Implement reciprocal of a floating point number using Chebyshev approximation in CKKS
I am trying to obtain the reciprocal of a floating point value $x$ using the Chebyshev approximation, where $x$ is mostly in the order of $10^3$ to $10^5$. Subsequently, I am trying to implement that ...
2
votes
2
answers
1k
views
How do RSA implementations avoid cases where the ciphertext and N are not coprime?
I'm trying to better understand RSA. One attack I've read about is when the encrypted message $y$ and $N = p\cdot q$ share a common factor. If this happens, we can easily factor $N$ to obtain $p$ and $...
- 123
4
votes
2
answers
629
views
Utilizing block cipher (AES) while saving bandwith
I'm helping a company to redesign their cryptographic protocol for communication within a network of embedded devices.
So far I have discovered several insecure practices, such as using very short (6 ...
5
votes
1
answer
1k
views
Intentionally craft a 180 to 255 bits Integer that bypass this miller‑rabin test with having a known factor
I’ve a signature system using modular exponentiation where having the exponent being a composite with a known factor allows to forge signatures…
In order to check if the exponent is a prime number, ...
- 208
3
votes
3
answers
870
views
Why is a modulus used in Elliptic Curve Cryptography?
In the eliptic curve cryptography, we use modulus $y^2 = (x^3 + ax + b) \ \ \text{mod} \ \ p$
So using modulus definitely changes the graph points completely - i.e gives a completely different graph ...
3
votes
2
answers
3k
views
What’s the smallest known sha256 hash that was ever produced?
Basically the same question as this one, except in my case the value to be hashed doesn’t have to be a valid Bitcoin block, but is a bytearray of arbitrary length and content (and that my use case is ...
- 208
1
vote
1
answer
99
views
Discrete log problem - does luck exist?
Assume the discrete log problem:
$g^x mod (p) = h$
For sure, $p$ is a prime number and $g$ is its primitive root or generator and assume that Alice sent $h$ to Bob and middle man caught it. So ...
0
votes
2
answers
170
views
sign a JWT with RS256 using a RSA-PSS SHA256 key pair?
Given a private key using algorithm RSA-PSS with SHA256 is it possible to use this key to sign a JWT using algorith RS256 (RSA with SHA256) instead of PS256 (RSA-PSS with SHA256)?
The German ...
- 103
2
votes
1
answer
43
views
How to measure the denseness of Mod-LWR samples in some space?
I tried to understand how dense the Mod-LWR samples are in some space. I tried to see from a view similar to LWE, i.e. using GV-bound(maybe LPN is better example because GV-bound is for codes). But I ...
- 23
1
vote
2
answers
69
views
App for Secure delivery of the gray images using AES, DH, DSA - Help in implemeting the system structure
I have this uni project that I have to implement in code:
"App for Secure delivery of the gray images, encryption-decryption with AES in OFB mode + secret key delivery using Merkle–Hellman ...
0
votes
1
answer
82
views
Dumb question about brute force attacks
Let's assume that the password to be cracked is 15 characters long and consists of numbers (to keep the math simple). Let's assume the attacker has the following information about the password:
It is ...
3
votes
1
answer
91
views
Rigorous Proof on Malicious Zero-Knowledge Property of Schnorr Protocol
Let us recall the Schnorr Protocol, following Chris Peikert's excellent Notes on the Theory of Cryptography.
Protocol. Let $G=\langle g \rangle$ be a cyclic group of order $q$. We consider an ...
- 236
3
votes
1
answer
714
views
Is AES a group?
The question I'm wondering is whether the AES cipher is a closed cipher (which is equivalent to AES being a group). And this question interests me due to the lack of understanding of whether it is ...
- 53
1
vote
0
answers
55
views
Creating a weak BLS
I am exploring the implementation of a cryptographic signature that users can manually input, and I am willing to compromise security to a level where a hacker investing several thousand dollars in ...
- 51
0
votes
0
answers
55
views
What do we mean when we say we need more than polynomial time many cipher texts
What does it mean when we say something like „we need more than polynomial time many cipher texts“? I understand it as „an adversarial can run for polynomial time and try as many messages as possible ...
- 1
1
vote
1
answer
239
views
Zero knowledge proof applied to a chess position
I know next to nothing about cryptography. From what I have understood, anything that is provable can be done so using a zero knowledge proof (the result seems to be known from the 1980's or so, by S. ...
1
vote
0
answers
24
views
Using longer key with PKCS#5 derive_key() function for AES256? [closed]
I have code where someone made the key 64 bytes (32*2) and passes to the derive_key() function. It then uses the key created for ...
- 133
0
votes
0
answers
33
views
Is it possible for a given plaintext and ciphertext to have two different keys? [duplicate]
This has probably been asked before but for a given ciphertext and plaintext pair, is it possible to have two different keys producing said pair? Or there are no collisions in AES, unlike hashing ...
0
votes
1
answer
108
views
How would I go about reverse engineering a hash function given input string and generated hash
I have a wireless capture of data and it's 12 bit hash. I am trying to identify the actual function that would have generated the hash data.
I tried all the generic 12 bit CRC polynomials but none of ...
- 1
3
votes
1
answer
191
views
Can DH be used for privacy-preserving proof of possession?
First time question poster so I hope the below is clear enough :).
Problem summary: Can a Holder and Verifier safely use ECDH for a Challenge-Response protocol where:
the Holder proves possession and ...
- 121
0
votes
1
answer
210
views
Prove RSA scheme is insecure [closed]
Im reviewing my crypto and I would like to prove the following: RSA experiment where the adversary is given N, e, and y. The adversary knows p, q.
I know the RSA scheme is built on the idea that it is ...
- 101
3
votes
1
answer
183
views
equivalence between entropic perfect secrecy and single probability
i'm new to information theory.
I know the standard perfect secrecy definition:
$$
P(M=m|C=c) = P(M=m) ,
$$
for all $m$ and $c$, respectively the message and the cypher.
Now, i can use the entropic ...
- 33
0
votes
1
answer
50
views
TLS 1.3 digital certificates and ephemeral Diffie Hellman
There is a lot of confusing information out there regarding the role of digital certificates and the use of Ephimeral Diffie Hellman in how TLS 1.3 operates.
Would it be correct to state that the the ...
- 1
1
vote
2
answers
47
views
In order to achieve differentially private machine learning can one simply apply the Laplace mechanism after an SGD scheme? If so does it work well?
Consider a standard supervised machine learning problem on private data. Instead of using DPSGD, suppose that one uses a non-private SGD scheme to produce optimal model parameters $\theta$ (done in ...
- 123
4
votes
1
answer
105
views
In Zero Knowledge Proofs (ZKP) why does the simulator and extractor get the power to rewind "time" and not some other superpower?
Why was the simulator/extractor specifically given the power to rewind "time" instead of a different super power?
Was it defined in the first ZKP paper that the simulator and extractor would ...
- 141
0
votes
0
answers
40
views
Security of using predefined shares in Shamir's Secret Sharing
This is related to Is it possible to create a mix of predefined and generated shares for Shamir's Secret Sharing?, but I have unfortunately lost access to that question and can't merge accounts ...
- 23
0
votes
0
answers
35
views
Why is firmware implementation not preferred for more lfsr based encryption schemes?
Given that an algorithmic implementation of a linear feedback shift register based encryption scheme is (much?) more secure against side channel attacks; why are hardware platforms usually used?
I get ...
- 1
2
votes
0
answers
74
views
Fast algorithm for finding parity of an RNS number
Does anybody have a library of fastest parity finding algorithms in RNS representation? By parity I mean $x \bmod 2$ where $x$ is the number between $0$ and $N=\Pi m_i$ and all moduli are odd.
I have ...
- 21
1
vote
1
answer
97
views
Cryptographic assumptions with bilinear pairings
I have two statements which I think are correct:
$\beta, s$ are unknown.
Only $g^\beta$ is known to the prover but not any of $g^{\beta s^i}$ for $i \ge 1$.
If the prover is able to find group ...
- 111
0
votes
0
answers
76
views
Can we be certain that Signal doesn't log metadata (e.g. message graphs)?
I know Signal uses public/private key E2E encryption to ensure it's impossible for them to read the contents of messages. WhatsApp does too, hence Signal's main attraction is that it additionally ...
2
votes
1
answer
75
views
Signature Chains: Ensuring Authenticity and Trust
I'm studying for an exam and came across this question:
When an electronic signature of a message claimed to be produced by
Alice is verified we typically verify (at least the first time):
that the ...
- 35
1
vote
1
answer
101
views
Is it secure for A to allow B to run a garbled circuit twice with different inputs? [duplicate]
I was reviewing past exam questions and came across this one:
Is it secure for A (the garbler) to allow B (the evaluator) to
run a garbled circuit twice with different inputs? They
aim to compute the ...
- 35
0
votes
1
answer
95
views
Do I need to use unique IVs if all encrypted data is unique?
I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
- 103
1
vote
1
answer
73
views
Is a Shift Cipher with Random Insertions Unbreakable?
Imagine an Encryption Algorithm which applies a classic Shift Cipher (also called Caesar or ROT-X) to a text (with only lowercase [a-z] and the space ...
2
votes
1
answer
171
views
How to identify if a legacy encryption algorithm used in my programming language is secure?
I used an open-source programming language called Lucee / Cfscript that is closely related to Adobe Coldfusion. The default function that developers use to encrypt and decrypt data (usually for ...
- 123
1
vote
0
answers
64
views
Encryption + EUF-CMA => SUF-CMA
Does there exist a proof (paper reference welcome) that if a signature scheme is EUF-CMA, and the signatures are always encrypted, then the resulting signature scheme is SUF-CMA?
That is: let SIG be ...
- 31
1
vote
1
answer
106
views
GKR Protocol - is it one Sum-Check per layer or is it one Sum-Check per gate?
I am reading about GKR protocol from Justin Thaler's book - Proofs, Arguments & Zero Knowledge
On Page 59,
In the first message, $P$ tells $V$ the (claimed) output(s) of the circuit. The protocol ...
- 2,211
0
votes
0
answers
24
views
Resources for Private Information Retrieval
I'm studying Private Information Retrieval for my class. I couldn't find any good resources online apart from various papers written on it. Can somebody recommend a textbook, lecture or any other good ...
