# Tag Info

13

Some claim that Curve25519 has 112 bit security, others that it has 128 bit security; which is it? Well, actually, neither - it's actually somewhere in the middle. For a curve without known weaknesses (and Curve25519 doesn't have known weaknesses), then if the curve order has a large prime factor around $2^{2k}$, then the best known attacks against it ...

8

Question: Given $n$ values $v_1=\alpha \cdot r_1 \bmod p,..., v_n=\alpha \cdot r_n \bmod p$ for a large $n$ can the adversary learn the value $\alpha$? Answer: assuming that the $r_i$ values are random (that is, equidistributed and uncorrelated), then the attacker gets absolutely no information about $\alpha$ (other than whether or not it's 0). We can ...

7

If anything can distinguish a blob of random data from an encryption of some (known) data (other than any intentionally added data formats, like a header or a length difference), the encryption algorithm is called broken. (This is one of the variants of the ciphertext indistinguishability criterion for ciphers.) As there are several encryption algorithms ...

5

Most standard-use iterative hash functions (including SHA-512) are build in a way that these types of operation are not possible (without breaking the hash function). They work generally in this way: The message is split in same-size blocks (usually with some padding at the end to fill the last block): $pad(M) = M_0 || M_1 || M_2 ... || M_n$. There is ...

5

Shamir Secret Sharing (SSS) is based on constructing a polynomial of degree $t-1$, whose independent term is the secret $S$. Each share is actually a point of the polynomial. The security of SSS is based on the fact that, when one wants to interpolate a polynomial of degree $t-1$, one needs at least $t$ points of the polynomial. It can be seen graphically ...

4

It is very easy to predict and should not be used as a main cryptographic component on its own. Firstly, many $k-$decimations $s_{kt}$ of LFSR sequences (those with $gcd(k,2^n-1)=1$) are shifted LFSR sequences themselves so this can be used for prediction. If you can find a template $T=\{0,t_1,\ldots,t_{n-1}\}$ (with $0<t_1<t_2<\cdots<t_{n-1}$ ...

4

Take a linear polynomial: $y=mx+b$. If I tell you that the point $(1,5)$ is on the line, can you tell me $m$ and $b$? No, because in fact there are infinitely many lines that pass through the point $(1,5)$. It takes 2 points to uniquely identify a line. In general it takes $t$ points to uniquely identify a degree $t-1$ polynomial. Furthermore, given $t-1$ ...

4

Shamir's $(t,n)$ secret sharing scheme involves picking a random polynomial $p$ (over a finite field) of degree $t-1$, such that $p(0) = s$ is the secret value to be shared (this is easy to do, since $p(0)$ is just the constant term of the polynomial), and then evaluating the polynomial at $n$ distinct non-zero points $x_1, \dotsc, x_n$ to construct $n$ ...

4

I've read about the possibility of inverting the Mersenne Twister after 624 numbers of output. 624 matches the state size of my implementation of the Twister. Coincidence? If the generator only output 623 numbers, i.e. less than the state size, might inversion still be possible with really clever maths? Or is this mathematically and logically impossible? ...

3

I have never heard of this reason, and I don't quite understand it. In general, the security of Diffie-Hellman key exchange is reduced to the DDH assumption. According to this assumption, the result of the key exchange is a group element that is computationally indistinguishable from a random/uniformly distributed element in the group. However, what is ...

3

This is because $t$ shares uniquely defines the polynomial of degree $t-1$. $t-1$ shares still leaves $k$ possible and equally likely polynomials, for $k$ the size of the field, so the secret is information theoretically hidden. Think of a degree 1 polynomial, essentially a line. If you know just one point on the line, you cannot say anything about the ...

2

A single PC CPU core is running at roughly 3 GHz. Both hash functions and stream ciphers exist that operate at around 1 cycle per byte (with long messages). A brute force attack on a key requires computing at least one block, which we can call 128 bits, or 16 bytes. So about 200 million tries per second per core, or call it billion per CPU. A GPU has about ...

2

A single core of a single modern standard CPU is capable of several billion elementary operations per second, where billion = $10^9\approx 2^{30}$, and elementary operation can be addition, rotation, XOR of a word (of say 64 or perhaps 128 bits), or an AES round (on CPUs with hardware support for that). There are Intel x64 CPUs with 18 cores, single-board ...

2

I'd say it depends of value of the assets. If you need to protect data worth let's say $10m, you can assume someone could throw at least money up to that value to get it. Converting money into computational power with AWS or Azure is pretty trivial today, and it can be done by virtually anyone. And of course state-level parties might be interested in your ... 2 How secure is this modified Bazeries Cylinder? That depends on what you expect us to compare it to. I doubt you’re looking for an answer along the lines of “it’s more secure than Scytale, but less secure than AES”. Therefore, I will try to narrow it down a bit by saying that it is safe to assume it can not – in any way – provide the same security levels ... 2 No, that's not possible, as you calculate sha512(F2) without the state of sha512(F1). What you require is compress(mix(compress(mix(IH, F1)), F2)) while what you have is compress(mix(IH, F1)) and compress(mix(IH, F2)). So you would have to undo that last compression, which is obviously not possible. Here IH is the initial state (the values of$h_1$etc.) ... 2 MD5 has a collision probability of$1 / 2^{64}$under the Birthday Paradox. Does this apply to any input given to MD5? As explained in the other answer,$2^{64}$is the birthday bound of messages until probable collision, not a collision probability. For two random messages you'd expect a$1/2^{128}\$ probability of a collision with a 128-bit hash. ...

Only top voted, non community-wiki answers of a minimum length are eligible