Recent Questions - Cryptography Stack Exchange most recent 30 from crypto.stackexchange.com 2022-10-01T15:16:56Z https://crypto.stackexchange.com/feeds https://creativecommons.org/licenses/by-sa/4.0/rdf https://crypto.stackexchange.com/q/102083 0 Question regarding a subset of p=?np RaisedDjed https://crypto.stackexchange.com/users/104116 2022-10-01T12:15:16Z 2022-10-01T12:15:16Z <p>We consider a language that is {0,1}^n. We consider three variables A, B and K part of that language. A and K are generated through true random generator.</p> <p>We consider not two as is traditional but three Turing machines:</p> <p>-The encrypter. This takes as input a key K and a value A. This output B in polynomial time in the worst case.</p> <p>-The decrypter. This takes as input B and output A. It can call the checker.</p> <p>-The checker. This takes as input I and B and output whether I == A. This computation is in polynomial time in the worst case.</p> <hr /> <p>For the following, we shall consider these instantiations of the Turing machine: -The encrypter compute A XOR K = B. This can be computed in linear time in the worst case. -The decrypter can be anything. It can make as many calls as needed on the checker. -The checker compute (I XOR K) == B. This can be computed in linear time in the worst case.</p> <hr /> <p>Now that we have the definitions, let's discuss the problem.</p> <p>Claim : For this decrypter and checker there is no decrypter that is polynomial in times in the worst case.</p> <p>Proof: As A, B and K are independent of one another, having access to B reveal no information on A (one-time pad has perfect secrecy, see Shannon work on the subject). Therefore, the decrypter must call the checker to get information on A.</p> <p>As each call to the checker only confirm whether the proposed I is A or not, they do not reveal any more information about A than A being in the subset {all possible A} minus {all attempted I}. This is again because of the one-time pad field structure, as any I!=A is independent of A.</p> <p>From this the only way for the decrypter to find A is try various I with the checker (as it's the only way for it to uncover information about A) until they find an I such as I==A (for which the checker returns true). In the worst case, this is 2^n calls to the checker, which is non polynomial in times.</p> <hr /> <p>We can extend this result in such a way that: -The encrypter is a random permutation f such as f(A) = B. The permutation is secret. -The decrypter can be anything. It can make as many calls as needed on the checker. -The checker verify I==A.</p> <p>Because the permutation is random, every potential I is independent of A if I!=A.</p> <hr /> <p>What is the issue in my reasoning here?</p> <p>PS: I hesitated between here and the math stack exchange. Please tell me if I should post this question on there instead. I posted here because this subset of the p=np problem is immediately relevant to cryptography.</p> https://crypto.stackexchange.com/q/102081 1 Building 256-hash function from known 64-bit hash functions Tom https://crypto.stackexchange.com/users/76411 2022-10-01T11:23:49Z 2022-10-01T12:14:01Z <p>There are 64-bit universal or almost universal hash functions, like CLHASH or VHASH:</p> <p><a href="https://arxiv.org/pdf/1503.03465.pdf" rel="nofollow noreferrer">https://arxiv.org/pdf/1503.03465.pdf</a></p> <p><a href="https://eprint.iacr.org/2007/338.pdf" rel="nofollow noreferrer">https://eprint.iacr.org/2007/338.pdf</a></p> <p>Can we create secure 256-bit hash function by concatenation of this hash functions (by using different key for every function)? Similarly like authors of ECHO hash did based on AES (the only paper I found about this is &quot;ASIC Evaluation of ECHO Hash Function&quot;).</p> <p>In fact VHASH family has been proposed for cryptographic applications, and specifically message authentication VMAC:</p> <p><a href="https://en.wikipedia.org/wiki/VMAC" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/VMAC</a></p> <p>I think the same idea was behind CLHASH, because otherwise what is the point of proposing 64-bit hash function in 2015? But these functions seem to be very efficient, so why authors didn't go step further and did not propose 256-bit hash functions (especially computed in parallel), which may be then possibly in line with modern stardands of security?</p> https://crypto.stackexchange.com/q/102080 0 Is there a metaverse/application where I can feature my 3D NFTs? [closed] Csabi https://crypto.stackexchange.com/users/104124 2022-10-01T10:29:48Z 2022-10-01T10:29:48Z <p>I was searching for applications where I can make my 3D NFT's available for the public, to increase the value of them, right now I am nearly at 130 <a href="https://opensea.io/collection/bb8-skateboards" rel="nofollow noreferrer">3D and most of them AR comparable Skateboards</a> but I lack the power to draw public eyes to them, I am working hard on developing a game for them, but since I am a &quot;one man rockband&quot;, it is really hard, I try to make my code open source maybe like that I can achieve more success, but since my assets suits as a transportation device, I would be curious if is there a met averse or some games, applications where I can import my NFT's.</p> https://crypto.stackexchange.com/q/102078 0 How to create a CSPRNG seed that can be used to shuffle a deck of cards Kieron Wiltshire https://crypto.stackexchange.com/users/104114 2022-09-30T21:15:58Z 2022-09-30T21:15:58Z <p>I want to generate a seed using CSPRNG. I then want to shuffle a standard pack of playing cards (52) using said seed, however, I want the shuffle to be accurate enough that it covers all the possible shuffle outcomes which is 52 factorial. I read from a blog post online that I need at least 226 bits of entropy to cover this. <a href="https://blog.dandyer.co.uk/2008/04/10/a-java-programmers-guide-to-random-numbers-part-3-seeding/" rel="nofollow noreferrer">Here</a> is the post for more information.</p> <p>How would I go about implementing a CSPRNG seed that can shuffle a deck of cards in the same pattern each time given that the seed is the same? I am happy enough to take pseudo code as an explanation, or NodeJS/TypeScript code if possible.</p> <p>Any help would be greatly appreciated, I'd like to understand exactly how this is achieved. If it is possible, and would still be considered a CSPRNG?</p> <p>Thanks!</p> https://crypto.stackexchange.com/q/102077 0 How do I try a timing attack on a public-key implementation on a general-purpose computer? Pierre Abbat https://crypto.stackexchange.com/users/104111 2022-09-30T20:36:39Z 2022-09-30T20:36:39Z <p>I'm writing a higher-order function in Haskell for use in public-key algorithms; it works equally well for RSA or elliptic curves. I'd like to test it for susceptibility to side channel attacks. How should I do this? The software runs on an ordinary Linux or BSD box; I'm not thinking of hardware implementations.</p> <p>The function computes f(g,n,r), which is the result of multiplying the point g by the number n. The result is independent of r, but the sequence of operations depends on r so as to obfuscate n to side-channel attacks. I'm thinking of writing a program, using a pure Haskell implementation of elliptic curve point addition, which spends a few minutes computing f(g,n<sub>0</sub>,r) for different values of r, then spends a few minutes computing f(g,n<sub>1</sub>,r), while another program tries to figure out what n is.</p> <p>Is there a program that I can run alongside mine that can gather side-channel information?</p> https://crypto.stackexchange.com/q/102076 0 Difference between ElGamal and Schnorr signature Arthur Strong https://crypto.stackexchange.com/users/103401 2022-09-30T18:14:48Z 2022-09-30T18:14:48Z <p>A question about Schnorr group. Am I right that this is basically a protection against discrete-log solvers? So Schnorr signature is better than ElGamal in that sense?</p> https://crypto.stackexchange.com/q/102074 1 512/N-Bit Key AES Rui Gonçalves https://crypto.stackexchange.com/users/104107 2022-09-30T15:18:31Z 2022-09-30T17:15:03Z <p>I am implementing the Advanced Encryption Standard from scratch, but I came up with a question that I was unable to answer.</p> <p>Why does no one implement AES with other sizes?</p> <p>I've searched about that, and some people say it is only because it is not in the standard (which is understandable), but other's says that it was never proved that other numbers (512 for example) were ever cryptographically verified.</p> <p>Personally, the later one does not make sense to me, as the only things that change from key sizes are some values, not the algorithm itself. Is that really a possibility/concern?</p> https://crypto.stackexchange.com/q/102070 0 How much Computer Science theory needs to be learnt for learning zkSnarks & what is a good book for it? user93353 https://crypto.stackexchange.com/users/3941 2022-09-30T11:12:22Z 2022-09-30T13:07:44Z <p>My background is that of a reasonably experienced programmer who hasn't learnt Comp Science formally. I am now learning Cryptography as a hobby in my spare time &amp; I think I have learnt a reasonable amount of stuff through self-study.</p> <p>I have learnt Elementary Number, Abstract Algebra &amp; some amount of Algebraic Geometry through self study. I am not great at any of this but I think I have reached a satisfactory amateur level in these subjects.</p> <p>I also have managed to get fair understanding of Cryptographic Hashing, RSA, DH, ECDH, Pairings etc. through self-study. Now I am trying to learn zkSNARKs &amp; I am kind of getting stuck with self study of the non-math parts - i.e. the Comp Science parts - Theory of Computation, Complexity Theory, Circuits, Arithmetization etc.</p> <p>I am looking for self study books which will help me with whatever I need to learn to understand zkSNARKS (&amp; possibly other similar stuff like STARKs, PLONKs etc).</p> <p>I tried a few books</p> <ol> <li><p>Borak &amp; Arora - In &quot;About the book&quot;, they write this book is also meant for Self-Study but this is absolutely not true. I got totally stumped in page 3 or something where I couldn't make head nor tail what they write very casually. May be they assume some prerequesites.</p> </li> <li><p>Justin Thaler's Proof's, Arguments &amp; Zero Knowledge book. I started it but it seems you need to know Computation Theory to understand this book, so this doesn't seem suitable.</p> </li> <li><p>Michael Sipser's book (Introduction to Theory of Computation) - this seems to be a very good book &amp; also possibly suitable for self-study but it's quite a big book &amp; I am wondering if I need to know the whole book? Are there parts I can skip &amp; jump ahead.</p> </li> </ol> <p>So I am wondering if someone can tell me what all I need to learn for understanding zkSNARKs &amp; if there is a better book than Sipser for self study &amp; what parts of the book I need to study? What do I need to learn &amp; what can I skip? I am not going to be giving any exams so I don't think I need an end-to-end knowledge at least to start.</p> https://crypto.stackexchange.com/q/102069 0 How can we construct stationary and non-stationary time locks? Gokul Alex https://crypto.stackexchange.com/users/56273 2022-09-30T06:04:15Z 2022-09-30T09:35:15Z <p>Time locks enables us to encrypt data for a period of time, up to a certain deadline, such that even a computationally powerful adversary is not able to learn any substantial information about the data before the deadline. Time locks received a lot of attention ever since blockchain smart contracts have started using them for various decentralized financial use cases such as flash loans and blockchain interoperability focused bridge smart contracts. I am exploring the possibility of using different types of time locks for use cases such as algorithmic stable coins which requires different types of time locks. What are the possible cryptographic schemes and approaches to construct stationary, linear and non-linear time-locks.</p> https://crypto.stackexchange.com/q/102068 0 Security game between challenger and adversary user104092 https://crypto.stackexchange.com/users/104092 2022-09-30T01:02:09Z 2022-09-30T10:54:31Z <p>In Section 2.1 and Section 2.2 of the paper <a href="https://crypto.stanford.edu/%7Edabo/pubs/papers/strongsigs.pdf" rel="nofollow noreferrer">Strongly Unforgeable Signatures Based on Computational Diffie-Hellman&quot; by Dan Boneh et. al.</a>&quot;, I noticed the paragraphs quoted as</p> <p>&quot;We define the advantage of an adversary A in attacking the signature scheme as the probability that A wins the above game, <strong>taken over the random bits of the challenger and the adversary</strong>.&quot;</p> <p>&quot;We define the advantage of an adversary A in weakly attacking a signature scheme as the probability that A wins the above game, <strong>taken over the random bits of the challenger and the adversary</strong>.&quot;</p> <p>What exactly is the message being conveyed by the condition &quot;taken over the random bits of the challenger and the adversary&quot;? Is this condition a must-have?</p> <p>Can anyone offer me an explanation? Thank you in advance.</p> https://crypto.stackexchange.com/q/102065 0 What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed] Captain_Levi https://crypto.stackexchange.com/users/104084 2022-09-29T16:39:51Z 2022-09-29T17:08:20Z <p>I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods.</p> <p><a href="https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm.decrypt?view=net-7.0#system-security-cryptography-aesgcm-decrypt(system-byte()-system-byte()-system-byte()-system-byte()-system-byte())" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm.decrypt?view=net-7.0#system-security-cryptography-aesgcm-decrypt(system-byte()-system-byte()-system-byte()-system-byte()-system-byte())</a></p> <p>I want to understand what's the use of these fields during Encryption and Decryption process. It doesn't seem to be present in AESCng library. Moreover it doesn't even generate the authentication tag which is generated in AESGcm. Can anybody explain these different fields in both the algorithms and their usage.</p> <p><a href="https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aescng?view=net-7.0" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aescng?view=net-7.0</a></p> https://crypto.stackexchange.com/q/102064 0 Implement cypher algorithm from observation [closed] aDoN https://crypto.stackexchange.com/users/104083 2022-09-29T16:29:11Z 2022-09-29T16:29:11Z <p>I have an interesting challenge that I think I kind of know how it works, but I am not quite sure how to implement it and decrypt strings automatically.</p> <p>It seems that, it starts by: 40 and then, adds +4 characters per letter:</p> <p>e.g:</p> <p>a -&gt; w40= b -&gt; w44= c -&gt; w48=</p> <p>The charset is apparently this: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ123456789</p> <p>It seems apparenty very simple but then, I give you more samples, in case it is a known algorithm or you can see the logic of it:</p> <p>X w7Q= Y w7U= Z w7Y=</p> <pre><code>aa w40G ab w40F ac w40E ad w40D ae w40C af w40B ag w40A ah w40P ai w40O aj w40N aaa w40Gfw== aab w40GfA== aac w40GfQ== aad w40Geg== aaaa w40Gf8Kw aaab w40Gf8Kz aaac w40Gf8Ky aaad w40Gf8K1 aaae w40Gf8K0 aaaf w40Gf8K3 aaag w40Gf8K2 aaah w40Gf8K5 </code></pre> <p>If you need more samples to figure it out, tell me.</p> <p>Regards!</p> https://crypto.stackexchange.com/q/102062 2 Pseudorandom correlation generators for many small tensor products lamba https://crypto.stackexchange.com/users/48273 2022-09-29T14:54:27Z 2022-10-01T09:57:02Z <p>Pseudorandom correlation generators (PCG) exist for tensor products, this is described in Figure 1 of . Basically we want party 1 to hold <span class="math-container">$(x_0, z_0)$</span> and party 2 to hold <span class="math-container">$(x_1, z_1)$</span> such that <span class="math-container">$x_0 \otimes x_1 = z_0 + z_1$</span>. Let <span class="math-container">$n = |x_0| = |x_1|$</span> so the length of <span class="math-container">$z_0, z_1$</span> is <span class="math-container">$n^2$</span>.</p> <p>My understanding is that PCG such as this is only useful for generating a huge amount of correlation. Suppose I want to generate many small tensor product correlations, e.g., <span class="math-container">$n = 10$</span>. Is there a better way than repeating the tensor product correlation protocol many times for small vectors? The only other option I see for the moment is to do a big tensor product correlation and then take square matrices along the diagonal of size <span class="math-container">$n \times n$</span>, but this is quite wasteful since majority of the output is not used especially if <span class="math-container">$n$</span> is small.</p> <p>Ideally the communication cost of generating such a correlation is lower then <span class="math-container">$O(n^2)$</span> where <span class="math-container">$n$</span> is the length of the vector. Otherwise it's possible to just generate multiplication triples.</p> <p> <a href="https://eprint.iacr.org/2022/1035.pdf" rel="nofollow noreferrer">https://eprint.iacr.org/2022/1035.pdf</a></p> https://crypto.stackexchange.com/q/102060 0 Overview over signatures [closed] Titanlord https://crypto.stackexchange.com/users/77517 2022-09-29T09:19:21Z 2022-09-29T09:19:21Z <p>When I started to work with signatures, I realized, that this topic is huge. Besides classical signing, there are a lot of schemes based on the idea of digital signatures archiving additional goals or working in a different context/setup. Some examples: Blind-, Multi-Party-, Unique-, Deterministic-, De-Randomized-, Probabilistic-, Undeniable-, etc.-, Signature.</p> <p>I have now lost the overview. Can someone provide me an overview and shortly explain the listed schemes?</p> https://crypto.stackexchange.com/q/102058 1 Which is the fundamental difference between a signature of a message and a zero-knowledge argument of a signature for that message? Bean Guy https://crypto.stackexchange.com/users/80902 2022-09-29T09:07:17Z 2022-09-29T09:07:17Z <p>Say that I have a signing/verification key pair <span class="math-container">$(sk,vk)$</span> and I generate a signature <span class="math-container">$\sigma$</span> over a message <span class="math-container">$m$</span>. Then, I want to prove to someone else of this fact, which can be done in two different manners:</p> <ol> <li>I directly send <span class="math-container">$(\sigma,m)$</span>.</li> <li>I compute a non-interactive zero knowledge argument <span class="math-container">$\pi$</span> for the statement: &quot;I have a valid signature <span class="math-container">$\sigma$</span> for the message <span class="math-container">$m$</span>&quot;. Notice that the argument does not reveal <span class="math-container">$\sigma$</span>. I send <span class="math-container">$(\pi, m)$</span>.</li> </ol> <p>The question is: which is the fundamental difference 1 and 2? In 2, the verifiers do not learn the signature itself, but the proof <span class="math-container">$\pi$</span> can be used with the same purpose as <span class="math-container">$\sigma$</span>. Are signatures and non-interactive zero knowledge arguments the very same thing?</p> <p>Say that I want to prove that I have written the new Game of Thrones book and I want to authenticate it to a designated verifier. I know that 1 will not work, but what about 2?</p> https://crypto.stackexchange.com/q/102055 1 Does an binary elliptic curve like sect571r1 support a bijective asymmetric operation pair on bytes? If so, is there a self-contained example? user3325588 https://crypto.stackexchange.com/users/12074 2022-09-28T21:45:12Z 2022-09-29T03:29:36Z <p>I'm wondering if a binary elliptic curve (such as sect571r1 aka B-571) supports pairs of asymmetric operations (for example, either sign/verify or encrypt/decrypt) on a fixed bit or byte input size in a way that this operation becomes fully bijective on those bytes/bits (where the inverse operation requires the opposite key).</p> <p>If the alignment of such an operation doesn't fall on a byte (8-bit) boundary (but instead falls on just a bit boundary) then this is an alternate route to finding something similar in spirit, since it would then be possible to perform two, four, or eight similar operations until the extra bits are consolidated in a series of aggregate operations. This is workable, but something like a prime field I believe cannot support bijective operation on bits.</p> <p>This question is also asking for some clarification on the operations of elliptic curves for these pairs of operations (like sign/verify or encrypt/decrypt) that's not the typical Diffie-Hellman key agreement (though maybe there's a simple way to relate that to encrypt/decrypt). Basically, suppose I have an input of &quot;n&quot; bytes, and some key pair (public, private). I'm wondering if it's possible to encrypt that arbitrary input with a public key, and then subsequently decrypt with the private key to fully recover the original &quot;n&quot; bytes - without any additional encoding or exceptional cases/constraints needed on the input/output.</p> <p>The relative cryptographic strength of binary curves versus prime curves isn't part of the question. Although the other aspect I'm wondering about is the most straightforward, succinct, and self-contained example in code that performs these primitive operations without unnecessary elements like padding, wrapping, hashing, and so on. It can be assumed I can find an appropriate fixed size input to match the binary elliptic curve. And then, I presume if the encrypt-then-decrypt with the respective public-then-private key is doable, then so would sign-then-verify with the private-then-public key (similar to RSA).</p> https://crypto.stackexchange.com/q/102052 2 The sum of independent discrete Gaussians is a discrete Gaussian Jackmill https://crypto.stackexchange.com/users/104075 2022-09-28T14:09:31Z 2022-09-29T23:23:24Z <p>I am currently learning about lattice-based cryptography and, reading from <a href="https://eprint.iacr.org/2015/939.pdf" rel="nofollow noreferrer">A Decade of Lattice Cryptography</a> by Peikert, specifically section 2.3, it emerges that</p> <p><em>[...] if the parameter s is greater or equal than the smoothing parameter of a lattice, then the sum of independent discrete gaussians (over that lattice) is a discrete gaussian itself.</em></p> <p>I am looking for the formal statement (and proof) of that fact without any success. Is anyone able to point me to the appropriate reference?</p> <p>EDIT: added link to the paper</p> https://crypto.stackexchange.com/q/102021 1 Secure storage of encryption key in offline device BenjaminK https://crypto.stackexchange.com/users/104032 2022-09-26T06:45:49Z 2022-09-30T15:15:07Z <p>I'm developing a device where I need to store a symmetric key that the customer uploads to the device. The device is offline at all times, so centralized storage in HSM is not an option. The device does not have a key-pad. The key is used for data encryption/decryption when the device is active. The key cannot be stored in clear text in flash.</p> <p>I'm just learning about cryptography, so bare with me :) My thinking is that I need to key-wrap the symmetric key to securely store it in flash and unwrap to RAM when in use. To have a secure key to key-wrap with, my thinking is to use a TPM 2.0 chip, <a href="https://www.st.com/en/secure-mcus/st33tphf20spi.html" rel="nofollow noreferrer">like this one</a>, on the device.</p> <p>My questions are:</p> <ul> <li>What would a common approach to this issue be?</li> <li>If my approach is feasible, how secure is it exactly? What would prevent an attacker from soldering of the TPM chip and use it to unwrap the symmetric key?</li> </ul> https://crypto.stackexchange.com/q/101971 11 Validating an RSA public key Maarten Bodewes https://crypto.stackexchange.com/users/1172 2022-09-21T13:16:38Z 2022-09-29T14:25:27Z <p>What kind of tests can be performed on a public key to check if it is <em>likely</em> a valid key? The tests should be relatively fast - i.e. not computationally intensive - and not include modular exponentiation.</p> <p>I'm asking this question as developers generally work (or should work) on the principle of <em>fail fast</em>, in which an error is thrown as soon as it can be detected.</p> <p>As an example I could indicate that the public key should not include negative integers for the modulus and public exponent. Please assume that the RSA public key consists of two integer values; encoding related problems should be ignored.</p> https://crypto.stackexchange.com/q/99953 0 Giving a continuous fractional (e.g. irrational) part of a secret to someone chausies https://crypto.stackexchange.com/users/61885 2022-05-04T03:06:50Z 2022-10-01T06:03:40Z <p>In secret sharing schemes, we usually give rational fractional parts of a secret out. E.g. Alice gets 4/10ths of the secret, Bob gets 7/10ths, Charlie gets 5/10ths, David gets 1/10th, etc., and you need 10/10ths total to unlock the secret.</p> <p>My question is: is there a scheme that allows for an irrational fraction of shares to be distributed to someone? E.g. Alice gets <span class="math-container">$\frac{1}{\pi}$</span> shares, Bob gets <span class="math-container">$\frac{2}{e}$</span> shares, etc.. I know that you can approximate these values with a rational fraction to arbitrary accuracy, but I want a scheme that can truly allot someone an irrational fraction of the secret.</p> <p>My thought is that the answer might be similar to how binary 50-50 coin clips can be used to simulate any arbitrary probability <span class="math-container">$p$</span> (like <span class="math-container">$\frac{1}{\pi}$</span>) exactly by considering the binary expansion of <span class="math-container">$p$</span></p> https://crypto.stackexchange.com/q/97946 0 Key Derivation/Hashing Function with Fast Comparison gabriel.hayes https://crypto.stackexchange.com/users/99190 2022-01-04T00:51:54Z 2022-10-01T04:05:15Z <p>Is there a key derivation/hashing function (that has any real value) that fulfills both of these criteria:</p> <ul> <li>Slow to compute the hash</li> <li>Fast to verify the hash based on the input string (not given a second, existing copy of said hash)</li> </ul> <p>I know in general key-derivation is used to prevent brute-forcing of passwords, but that's typically to protect passwords against internal users.</p> <p>I'm looking to set up an authentication system where a user must provide a username, password <em>and</em> a Proof of Work hash of the password, except.. I'd like to not have to do the work myself to quickly check.</p> <p>The hash is not being compared against the actual hash in the database (e.g., it should be a different hashing algorithm than the one in the database.. PBKDF2), this is simply to discourage brute forcing while also not creating some endpoint on my server where a malicious actor can make my server do some hard work... for nothing.</p> <p>Is this even possible? I know it's not necessary, but if it's possible it seems like a simple measure I could take to secure my web servers.</p> https://crypto.stackexchange.com/q/97923 0 SSLv3 ServerKeyExchange SIgnature struct mismatch g0rbe https://crypto.stackexchange.com/users/58498 2022-01-02T11:48:21Z 2022-09-30T03:04:15Z <p>Im playing with implementing SSLv3 in Go according to <a href="https://datatracker.ietf.org/doc/html/rfc6101" rel="nofollow noreferrer">rfc6101</a>.</p> <p>I can deserialize ServerKeyExchange until ServerKeyExchange.signed_params.</p> <p>The cipher suite is <code>TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003)</code>.</p> <p>The Certificate signature algo: <code>1.2.840.113549.1.1.5 (sha1WithRSAEncryption)</code>.</p> <p>According to the RFC the structs should look like this:</p> <pre><code> struct { select (KeyExchangeAlgorithm) { case diffie_hellman: ServerDHParams params; Signature signed_params; case rsa: ServerRSAParams params; Signature signed_params; case fortezza_kea: ServerFortezzaParams params; }; } ServerKeyExchange; </code></pre> <pre><code> digitally-signed struct { select(SignatureAlgorithm) { case anonymous: struct { }; case rsa: opaque md5_hash; opaque sha_hash; case dsa: opaque sha_hash; }; } Signature; </code></pre> <p>but i got a different response form the server:</p> <p><a href="https://i.stack.imgur.com/WwhCJ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WwhCJ.png" alt="enter image description here" /></a></p> <p>What i am missing?</p> <p>Thanks!</p> https://crypto.stackexchange.com/q/89359 2 Multiplication encryption with a small number Wanyu https://crypto.stackexchange.com/users/81447 2021-04-13T04:23:13Z 2022-09-29T06:13:34Z <p>Given a big number <span class="math-container">$x$</span>(1024 bits) and a large prime <span class="math-container">$N$</span>(<span class="math-container">$N&gt;x$</span>), I want to encrypt it with a smaller number <span class="math-container">$y$</span>(128 bits).</p> <p><span class="math-container">$$Enc(x) = xy \mod{N}.$$</span></p> <p>Is it safe? If not, how do I evaluate its leakage?</p> https://crypto.stackexchange.com/q/87402 0 Suitable hybrid encryption approach? kselight https://crypto.stackexchange.com/users/86067 2021-01-07T16:46:24Z 2022-09-29T22:01:45Z <p>I need help for my bachelor thesis. I have a general question regarding hybrid encryption in different ransomware. The hybrid encryption often uses symmetric and asymmetric encryption techniques.</p> <p>During an infection the symmetric key will be generated on the system. This symmetric key will be encrypted with the public key of the asymmetric key pair. The public key can be hardcoded in the source code of the ransomware. Now I read an article that says this is an bad approach, because if one victim will pay the ransom he can share the private key. That is right, but is it possible that the victim send me his encrypted symmetric key and I will send the decrypted key back?</p> <p>Have I overlook something?</p> <p>I hope someone could help me to clarify this understanding problem.</p> https://crypto.stackexchange.com/q/85947 1 Hill cipher concepts Arth https://crypto.stackexchange.com/users/84613 2020-11-02T11:36:44Z 2022-09-29T09:14:54Z <p>I have some questions about the Hill cipher.</p> <ol> <li><p>There is a rule for key K: <code>Determinant of matrix and number of characters of the alphabet must be coprime.</code> What does this rule say? Why it must be like this? So If I had determinant 5 and characters 30, it would not work?</p> </li> <li><p>Let's assume I have key K which should be 3x3. I would get the key: ENCRYPT. I would create trigrams like ENC RYP T?? - now the last trigraph is missing two characters. Should this input key be REFUSED by application for example or should I fill it with some values like #?(# alphabet must contain this char). Or how should the application behave when this happens?</p> </li> <li><p>Let's assume I have plain text T which is: textabcd - again the same question (as 2.). I have TEX TAB CD? - (should I again insert something in that empty space (?) (for instance #) ?</p> </li> <li><p>Should HILL cipher accept MATRICES (input as matrices) or as alphabet key like ABCD?</p> </li> </ol> https://crypto.stackexchange.com/q/74336 2 BGV for three multiplication level/depth Blessyn01 https://crypto.stackexchange.com/users/62704 2019-09-16T03:30:04Z 2022-09-30T23:05:05Z <p>Can BGV homomorphic encryption scheme support three multiplication level/depth with the help of key switching and modulus switching?</p> <p>If Yes, how does one set up the parameter to achieve that?</p> https://crypto.stackexchange.com/q/66572 0 One-way function with combination sets as output / image Fraktal https://crypto.stackexchange.com/users/29921 2019-01-17T22:04:49Z 2022-09-29T16:02:20Z <p>One-way functions generally operate on bit strings, for the input and the output.</p> <p>Are there any examples of one-way functions that produce a combination set in output? Let's call this function <span class="math-container">$f$</span>. The function would take one bit string in input, of size <span class="math-container">$p$</span>, and would produce a combination (<span class="math-container">$k$</span> elements among <span class="math-container">$n$</span>). <span class="math-container">$n$</span> is a power of <span class="math-container">$2$</span>.</p> <p>Concrete example of combinations set: 64 elements among 256. The size of this set is 1.9E+61 (204 bits)</p> <p>I have an algorithm to generate a combination through a hash function: the hash function is used to generate a pseudo random bit string, then the bit string is split into sub-strings of size <span class="math-container">$\log_2(n)$</span> whose value represents the position of the element in the set of size <span class="math-container">$n$</span>. If the value was already selected, to check the next value. If the hash function has good properties the loop will stop after some iterations. </p> <p>I would like to know whether there are constructions considered as primitives for this problem.</p> https://crypto.stackexchange.com/q/64721 6 Proof of membership in an aggregated BLS signature irakliy https://crypto.stackexchange.com/users/57663 2018-12-09T23:12:00Z 2022-09-29T19:39:47Z <p>Is it possible to prove that a given signature is a part of an aggregated BLS signature? Specifically, given:</p> <ul> <li><span class="math-container">$m_1...m_n$</span> are <span class="math-container">$n$</span> distinct messages</li> <li><span class="math-container">$p_1...p_n$</span> are private keys with <span class="math-container">$P_1...P_n$</span> being the corresponding public keys</li> <li><span class="math-container">$S_1...S_n$</span> are BLS signatures such that <span class="math-container">$S_i = sig(m_i, p_i)$</span></li> <li><span class="math-container">$A = S_1 + S_2 + ... + S_n$</span> is the aggravated BLS signature</li> </ul> <p>Is it possible to prove that a signature <span class="math-container">$S_i$</span> is contained within <span class="math-container">$A$</span> using only publicly available data: <span class="math-container">$A$</span>, <span class="math-container">$S_i$</span>, <span class="math-container">$P_i$</span>, and <span class="math-container">$m_i$</span>?</p> https://crypto.stackexchange.com/q/52325 15 Overview of relations between cryptographic primitives? mti https://crypto.stackexchange.com/users/39104 2017-10-17T14:26:11Z 2022-09-29T20:34:47Z <p>Is there a web page that gives a graphical (or, alternatively, a textual) overview of <strong>known implications and separations</strong> between cryptographic primitives?</p> <p>More specifically, I am looking for something like the following, but more comprehensive and with references to the respective works. (The following graphic is taken from a set of slides by Danny Harnik and Moni Naor that I found on the Internet.) <a href="https://i.stack.imgur.com/AUpWX.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/AUpWX.jpg" alt="Cryptomania and Minicrypt"></a></p> https://crypto.stackexchange.com/q/37563 0 PAN authenticatable irreversible tokenization algorithm user1563721 https://crypto.stackexchange.com/users/23303 2016-07-07T20:45:19Z 2022-09-29T15:01:05Z <p>I need to implement algorithm to create authenticatable irreversible tokens from PAN, without using any secrets.</p> <p>Is it possible? Is there any standards for that from associations?</p> <p>I was thinking about HMAC but it needs to distribute secret symmetric key to all relevant parties. How to do it without distributing cryptographic key? Also it should prevent to create an oracle.</p>