All Questions
30,402
questions
1
vote
1
answer
417
views
Dividing an encrypted file is secure against classical or quantum
I'm very new to cryptography and this may sound so foolish. Often I read quantum computers will brute force keys. Let's assume this is true (does it depend on key length? or on an algorithm? I don't ...
- 48.5k
1
vote
1
answer
265
views
Reversing an XOR encryption/decryption function
I have a help recommended high-school project that I'm stuck with. To basically explain the problem: I have an encryption function that is used as the decryption function and I need to reverse it to ...
- 462
1
vote
1
answer
351
views
Why are hashing private key in Ed22519 key generation and later the modifications required?
In EdDSA with Ed25519 the algorithm of public key computing is following:
h = hash (privateKey)
h[0] &= 0xF8
h[31] &= 0x7F
h[31] |= 0x40
publicKey = h * B
...
- 462
0
votes
1
answer
60
views
MITM against NTRU
In MITM attacks against the NTRU cryptosystem, we exploit the fact that in the ring of truncated polynomials of degree $n-1$ it holds that $$fg=h\mod q$$ for our secret and public keys $f,h$. The ...
- 22.5k
4
votes
1
answer
88
views
Can voters be authorities at the same time?
There is an encryption scheme where the votes are encrypted with ElGamal and the decryption key is the secret that is shared among the authorities. After everybody voted they publish their part of the ...
CommunityBot
- 1
1
vote
1
answer
146
views
single slot operations on SIMD fully homomorphic polynomial
According to https://eprint.iacr.org/2011/133.pdf and many other papers, there's an isomorphsim between the space of polynomials and its coefficients. So, at least in the BFV scheme, we can do:
$$p(x) ...
CommunityBot
- 1
3
votes
1
answer
194
views
Is Fermat's Factorization Method used in any practical application?
Is there any use for Fermat's Factorization Method in the world of cryptography? I see that several algorithms are based on it, such as the quadratic sieve and general number field sieve. I understand ...
- 22.5k
1
vote
0
answers
132
views
Physical meaning of Negligible and Non-Negligible Functions
I've been itching my head over this for a while despite going through the queries related to the topic. Can someone explain me negligible and non-negligible function in a concise way?
As of my naive ...
- 22.5k
2
votes
2
answers
414
views
Why AND gate is * on Fully Homomorphic Encryption, BFV scheme?
According to Representing a function as FHE circuit, the AND gate for FHE encrypted data is just A*B, in the case that the plaintext has only ...
CommunityBot
- 1
3
votes
1
answer
12k
views
5
votes
1
answer
398
views
Apple "Find My" Key Rotation
Apple's Find My technology is described in this Wired article and explains how Apple, or other third parties, are not able to decrypt location data. It mentions how the keys are rotated every hour:
...
- 22.5k
2
votes
1
answer
303
views
Generate a key with a size bigger than the hash output length/security, is it possible? [duplicate]
Let's suppose I want to generate a 2048-bit key from a hash function with security up to 512-bits (such as Blake2b).
I take 4 high-resolution photos, hash them with a hash output length of 512-bits ...
- 48.5k
1
vote
2
answers
422
views
Is it possible to generate a key from a hash function, being the key larger than the hash function digest output without spliting the seed?
Let's suppose I have a 2MB photo and I want to generate a key from it, and the key should have 2048-bits of size.
A hash function such as SHA3-512 would not deliver a key with with the desired ...
0
votes
0
answers
93
views
How to find $z$ when deserializing elliptic curve?
In §2.3.4 of Standards for Efficient Cryptography 1 (SEC 1), the authors define the following step in deserializing elliptic-curve points that were serialized in the format given in §2.3.3 (emphasis ...
0
votes
0
answers
33
views
Proof of inclusion for odd-valued tree
How would a proof of inclusion be done here as the number of nodes is odd and some hashes don't have a sibling hash?
Normally you would send the sibling for each level to the client.
Here there are ...
1
vote
0
answers
26
views
Help for testing signature model property
I'm new to cryptography and signatures, I've done work that involves a signature model, and now I need to run tests on it.
In this paper [1], a signature model called Linkable Spontaneous Anonymous ...
- 11
1
vote
0
answers
48
views
Accelerating Syndrome-Trellis Codes (STC) for GPU [closed]
From the literature, STC seems to be the current state-of-the-art for the coding part of steganography. From the description of the method, it appears to me it could be parallelized for GPU. Does ...
- 155
1
vote
0
answers
556
views
For integers, when should I use BFV / BGV / CKKS / TFHE?
When performing homomorphically encrypted computations, when should I use BFV / BGV / CKKS?
It seems BFV / BGV is better suited for integers, and CKKS for floats. It also seems BFV-BGV have some ...
- 111
2
votes
1
answer
76
views
Too many wet positions in Wet-Paper Codes steganography with random H
I am implementing wet-paper codes (WPC) with randomly generated parity-check matrix $H$, based on this paper. As the wet DCT coefficients, I set DCT coefficients with value 0, or with values 0 and 1 (...
- 686
8
votes
3
answers
3k
views
What should the nonce value be for client-side encryption?
I am using the following chacha20poly1305 Rust library to encrypt some data in a desktop application. The user provides the key, which never leaves their device, to locally encrypt some data, and then ...
- 48.5k
1
vote
2
answers
106
views
DCT Steganography - Where to embed the data
Just a quick question about DCT Steganography. Do you embed the data before or after you send the 8*8 block through the quantization table?
- 155
3
votes
1
answer
426
views
Why are vectors approximately orthogonal after Gaussian lattice reduction?
In "An Introduction to Mathematical Cryptography"'s section on lattice reduction algorithms, the authors describe Gaussian lattice reduction and claim:
[...] the angle $\theta$ between $v_1$...
1
vote
1
answer
174
views
What is the problem with having a hash to group function where you can find a discrete log relation between 2 different hashes?
I was reading some notes on a naive hash to a group function.
Consider a cryptographic Hash function $$H: \{0,1\}^{*}\to \{0,1\}^{k}$$
Consider a Discrete Log Hard Group $G$ with a generator $g$. We ...
- 23.8k
0
votes
1
answer
291
views
ECC Public key import understanding
I am working out ICAO verification process (biometric IDs), and here is one of their publicly available certificates:
...
- 5,836
0
votes
1
answer
258
views
Can we force a chosen ciphertext to be decrypted to a chosen plaintext while controlling only $e(=3)$ in RSA? [duplicate]
I have bumped into this challenge from a well known CTF site. I don't want to make a reference to it because I don't want this to be a hint for anyone. And also to avoid giving out the source code of ...
- 23.8k
0
votes
0
answers
141
views
Publishing a paper in cryptography
I have written a mathematical paper in cryptography and I want to publish it but I don't know any professors in the field to collaborate with them. So what should I do and how to get contacts that ...
- 1
-1
votes
2
answers
984
views
Can I 100% trust the PBKDF2(HMAC-SHA256) AES-256 CBC encryption algorithm for file encryption purposes or not, and why? (Winrar) [closed]
I am not an expert in cryptography and therefore I would like to address this problem to people who have been working on this topic for a long time and thus verify the facts from several sources.
I ...
- 48.5k
1
vote
0
answers
122
views
How to write a Zero-Knowledge Proof of Knowledge of input to a one-way function?
I'm having a bit of difficulty understanding how to construct Zero-Knowledge proofs. So given a one-way function $f$ and a secret message $x$ so that $f(x)=y$, $f$ and $y$ being public, how could one ...
- 445
0
votes
1
answer
113
views
Shamir Secret Sharing over an unsecure channel for a protocol design
Let's suppose that we have two parties, $A$ and $B$ that are using a Shamir Secret Sharing scheme with $k=3$. $A$ holds the points $[x_1, f(x_1)]$ and $[x_2, f(x_2)]$ while $B$ holds $[x_3, f(x_3)]$ ...
- 48.5k
0
votes
1
answer
55
views
Is there any way to ensure that a network merge, after a parition, never causes disagreements?
Background: A cryptocurrency, such as Bitcoin, have a global order of all transactions that is guaranteed to be agreed by all participating nodes. With Bitcoin, this is ensured by making the longest ...
- 155
1
vote
0
answers
185
views
2
votes
1
answer
103
views
How to check whether function provides full diffusion or not?
In "The Skein Hash Function Family" paper authors wrote:
The MIX/permute structure has been designed to provide full diffusion in 9 rounds for Threefish-256, 10 rounds for Threefish-512, ...
- 48.5k
6
votes
2
answers
3k
views
Discrete Logarithm: What does it mean to find the discrete logarithm of $a$ to base $g$ modulo $p$?
My understanding is that $a=g^x\bmod p$ is the discrete logarithm problem. Given the question is worded this way, are we trying to find $x=\log_g a\bmod p$ ?
For instance, if we are trying to compute ...
- 141k
6
votes
1
answer
3k
views
Generating a random point on an elliptic curve over a finite field
I have coded an implementation of elliptic curves in order to apply some of the ECC algorithms. However, in most of them, Alice needs to choose a point P on a given curve. What is the general ...
- 48.5k
6
votes
1
answer
589
views
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI
What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll)
Could someone provide details?
- 453
0
votes
0
answers
132
views
Using OpenSSL to emulate LTO 4 tape encryption
I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
- 101
2
votes
1
answer
81
views
Efficient peer to peer untrusted signature aggregation
Suppose I had a peer to peer system, there are a few writers with the same signing key, and all readers have the verification key.
A naive system is that each document $d_1..d_n$ gets signed $s_i=sign(...
CommunityBot
- 1
13
votes
5
answers
3k
views
Hash paradox in an image file that contain hash text?
Is it possible to include a hash digest visibly in an image, such that the hash of the image itself is that same digest?
When we draw the text of the hash in the image, we will of course change the ...
- 441
1
vote
2
answers
2k
views
Calculating minimum number of messages hashed a 50% probability of a collision (Birthday Paradox)
I encountered this while solving a crypto puzzle. This is the puzzle.
...
- 101
1
vote
1
answer
122
views
value bound of r⋅e for LWE Decryption correctness
For LWE decryption, Someone told me that If we can bound r⋅e by q/4 then we can retrieve M by checking if this is closer to <...
- 13k
7
votes
3
answers
2k
views
Statistical properties of hash functions when calculating modulo
When using SHA-1 to hash an input, the result is a pseudo-random number in the numeric ID space $\{0\dots2^{160}-1\}$. Do I loose any statistical property in the result if I use modulo to restrict the ...
- 141k
1
vote
0
answers
64
views
BLS Rogue attack: how does e(x^b, y)=e(x, y^b)? [duplicate]
In aggregated BLS Signatures, there's a known attack which allows an adversary to forge a valid signature for a message $m$ knowing only the victims public keys.
Reading about the maths behind it, ...
- 111
0
votes
0
answers
110
views
Finding $a$ in $g^a\bmod p$ in Diffie-Hellman [duplicate]
This might be a silly question but I am unable to wrap my mind around it. In Diffie-Hellman can we find $a$ when $A = g^a\bmod p$, given we know $A$, $g$ and $p$?
- 141k
2
votes
1
answer
152
views
Significance of having remainder $3$ when divided by $4$ for both $p$ and $q$ in BBS
In the Blum Blum Shub random number generator, we take two random prime numbers $p$ and $q$ such that both have a remainder of $3$ when divided by $4$. My question is why can't we just take any $2$ ...
- 2,595
1
vote
0
answers
115
views
How to factorize RSA modulus while given two Public Exponents and the difference between two Private Exponents?
The RSA modulus is the product of two $2048$-bit primes.
And the two Public Exponents are both $16$-bit.
I also got the difference between two Private Exponents $\left | d_1-d_2 \right |.$
Is there ...
- 59
4
votes
2
answers
2k
views
How secure is the E0 stream cipher used in Bluetooth?
The question is about E0, the stream cipher used to secure Bluetooth communication. The impression I get is that it's more secure than A5/1. Also, why wasn't AES used instead?
- 121
1
vote
0
answers
42
views
Which data is communicated between participants in Distributed Key Generation
I was asked recently if it is somehow possible to use already existing keypairs stored in HSMs for, e.g. ped-DKG.
Which ultimately led me to the question, which data is actually exchanged between ...
CommunityBot
- 1
8
votes
1
answer
1k
views
Would an encryption-only block cipher be useful at all?
I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB.
...
- 48.5k
2
votes
1
answer
186
views
Could anyone explain what Two Oracle Diffie-Hellman assumption is?
I am really new to cryptography and I have asked a similar question which is about Decisional Diffie-Hellman assumption (What's the meaning of asterisk and PPT in this paper?) and it is already ...
CommunityBot
- 1
3
votes
0
answers
310
views
Fast polynomial multiplication over finite field GF(2^n)
I wonder if there is a more efficient polynomial multiplication than Karatsuba over the finite field $\operatorname{GF}(2^n)$. Brief research on this topic gave me a few results on fast multiplication ...
- 22.5k