## Top new questions this week:

### "Memory-Hard" vs. "Memory-Bound" Functions?

One of the approaches in order to prevent Sybil or DoS attacks is CPU-bound PoW. However, because of the influence of Moore’s law, the memory-based approaches are suggested. As actually there are two ...

proof-of-work memory-hard

### Are these two methods of differential cryptanalysis different?

I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round ...

cryptanalysis differential-analysis

### Repeated modular square roots to recover original base

I'm given a large prime $p$ and $c \equiv m^e \pmod p$, and $e = 2^{64}$. Typical RSA rules don't apply here, since $\phi(p) = p - 1$ is even, and $e$ is a power of two, so they share a common factor, ...

rsa modular-arithmetic prime-numbers

### Questions regarding the one-wayness and collision-resistance of a hash function based on RSA-like problem

Problem statement: "Bob is a paranoid cryptographer who does not trust dedicated hash functions such as SHA1 and SHA-2. Bob decided to build his own hash function based on some ideas from number ...

hash collision-resistance one-way-function

### Curve25519 choice of the prime

In the paper for curve25519 is described how the prime was chosen. But I don't understand why the biggest 255-Bit prime was chosen instead of a 256 Bit prime. Can someone explain this to me?

elliptic-curves

### Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...

tls sha-3 keccak sponge

### Mapping the hash of message to a point of elliptic curve for signature

Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle$. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...

elliptic-curves signature hash-signature bls-signature

## Greatest hits from previous weeks:

### How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?

RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large (encrypted) message. How can I do this?

encryption rsa public-key

### How do ciphers change plaintext into numeric digits for computing?

For example, in RSA, we use this for encryption: $ciphertext = (m^e \mod n)$ and for decryption. If our message is "hello world", then what number do we have to ...

rsa

I found this example online: In the elliptic curve group defined by $$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$ what is the discrete logarithm $k$ of $Q = (4,5)$ to the base $... elliptic-curves  asked by Keith Lau Si Keit 14 votes ### Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid When given$p = 5, q = 11, N = 55$and$e = 17$, I'm trying to compute the RSA private key$d$. I can calculate$\varphi(N) = 40$, but my lecturer then says to use the extended Euclidean algorithm to ... rsa number-theory modular-arithmetic  asked by DougalMaguire 35 votes  answered by Thomas 40 votes ### What is the "shared secret" used for in IPSec VPN? Can somebody explain what the "shared secret" and "password" do when opening/creating a VPN tunnel? In this specific case I setup a VPN to my Fritz!Box and I had to provide a shared secret (which was ... key-exchange transport-security ipsec  asked by Krumelur 8 votes ### Impacts of not using RSA exponent of 65537 This RFC says the RSA Exponent should be 65537. Why is that number recommended and what are the theoretical and practical impacts & risks of making that number higher or lower? What are the ... public-key rsa  asked by goodguys_activate 65 votes  answered by fgrieu 60 votes ### 7zip : Why does encrypting the same file with AES-256 not give the same output? Using 7-zip 19.00, on Windows 10 1909, build 18363.592, I encrypted a text file with the contents "hello there" using AES-256 and the password "123". I did this two times, the exact same procedure, ... encryption aes cbc  asked by super 31 votes  answered by kelalaka 44 votes ## Can you answer these questions? ### Is there an interactive proof protocol for proving that a preimage in a map$g: Z_{q}^{n} → G_{T}$is mapped to a given public value, say y? There already exist interactive proof protocols with logarithmic communication for proving that a secret multi-exponent$x ∈ Z^{n}_{q}$for a public multi-exponentiation$P = \textbf{g}^{\textbf{x}} ∈ ...

protocol-design

### Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...

elliptic-curves paillier elliptic-curve-generation

### Importance of supersingularity of elliptic curves

I'm struggling to understand the high-level idea of "Verifiable Delay Functions from Supersingular Isogenies and Pairings" (https://eprint.iacr.org/2019/166.pdf) by De Feo et al. I will ...

elliptic-curves pairings
 asked by Max Beikirch 1 vote