# Tag Info

0

Those are calculated using the "SHA-512/t IV Generation Function", as described in FIPS-180 (pdf, see 5.3.6), the Secure Hash Standard. The procedure is to first modify the normal SHA-512 IV, then calculate the hash of a string describing the truncation mode used, and use that as the IV. Those IVs are essentially just predefined hash outputs and so not any ...

10

This is true of any group of prime order, over elliptic curves or not. This is due to Lagrange's Theorem which states that the order of a subgroup $H$ of group $G$ divides the order of $G$. Since orders are elements of the ring of integers and since this is a principal ideal domain, unique factorization exists and primes make sense. Or put another way, ...

28

This question is quite broad by specifying a sudden fall to cryptanalysis and therefore my answer might not be as complete as you wish it to be. If by "become practically attackable, or close enough that use is strongly discouraged" you imply not an academic breach but assume a weaker attacker such as a single ciphertext attack, then there are quite a few ...

1

In this state we have well known attack that is called invalid-curve attack. Let $E:y^2=x^3+ax+b$ and $E':y^2=x^3+ax+b'$ be two elliptic curves with reduced Weierstrass form. $E'$ is called an invalid curve relative to $E$. Since formulae for adding and doubling points on $E$ does not involve coefficient $b$ thus addition law for $E$ and $E'$ is same. In ...

0

A solution from the top of my head: Bob will end the server $(Enc(m), h(m))$ where $h$ is a collision resistant hash. Now, Bob will interact with the server and provide a zero-knowledge proof that $m$ is the same one in $Enc(m)$ and $h(m)$. We note that this verification is in NP (the certificate for the verification is the key used to encrypt $m$). ...

0

If Bob attaches a digital signature to the encrypted message, and the server knows Bob's public key for the digital signature, The server would know that it is Bob who sent the message. For decrypting the message, if an algorithm such as aes or des is used, the user is able to decrypt the message with any key, although the decrypted message will probably be ...

1

Here is an example of a proof. This proves why CBC mode needs an IV that is random: (fyi many people think a nonce will suffice, but it won't, it needs to be random) Our definition of a probabilistically secure encryption scheme: Imagine two oracles taking two inputs: a plaintext $P$ and initialization vector $IV$. The 1st oracle $Enc_{k}(P, IV)$ performs ...

2

As you point out, there is the DHGV 2010 scheme over the integers based on the approximate GCD problem but asymptotics are not great with this scheme, for eg. one of the parameters for DHGV is around $2^{\mathcal{O}(\theta^{5})}$ where $\theta$ is the security parameter. Of the so called second generation schemes, I would say that BGV has been pretty well ...

0

The homomorphic encryption over the integers variants are much simpler to understand. The idea is that your key is a random odd integer. to encrypt a bit, you add it (0 or 1) to the key multiplied by some integer (to hide the key better) and then add in a random even number to hide the key and value better. To decrypt a bit, you mod by the key, then mod by ...

Top 50 recent answers are included