All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
3 views

Low-Collision Abbreviation For Public Key Hex Representation

I am writing an application where each client generates its own public/private key pair that uniquely identifies it to other clients. Clients are using the Web Crypto API to generate ECDSA P-384 keys. ...
bren's user avatar
  • 101
0 votes
0 answers
12 views

Homomorphic Max For Two Distances

I have a interesting geometric problem involving distances on a finite plane. I'll provide the unencrypted mathematical background and proof and after that pose the question as it pertains to HE. ...
Isa Watanabe's user avatar
2 votes
1 answer
62 views

How wrong is NIST 800-89's Partial Public Key Validation for RSA step e?

NIST 800-89 Recommendation for Obtaining Assurances for Digital Signature Applications has recommendations for (Explicit) Partial Public Key Validation for RSA which include an example method. It's ...
fgrieu's user avatar
  • 143k
1 vote
0 answers
26 views

Is the quality of hash function essential in HKDF?

Hash functions have a number of properties needed, including the property that no collisions must be able to be found. Generally, if we can find collisions for hash functions, we consider the hash ...
juhist's user avatar
  • 1,361
1 vote
1 answer
55 views

Key size for One Time Pad use with QKD

For a practical QKD implementation where OTP has been chosen for encrypting, how are key sizes determined? Say, for example, Alice wishes to exchange xGB to Bob, then a key management system should ...
Niall Canavan's user avatar
1 vote
1 answer
98 views

fastest prime number check formulae available

which is the fastest prime number check formulae available and that can be used using a scientific calculator easily. you can also refer to a patent if available. looking to use it in a software.
Gary's user avatar
  • 111
5 votes
1 answer
60 views

Why does extractability not contradict zero-knowledge?

I was introduced to the QR-protocol that shows that a number y is a quadratic residue modulo x through an interactive protocol. The protocol is perfect zero-knowledge but it also proves that the ...
Niko Wolf's user avatar
0 votes
0 answers
24 views

How to remap right shift to backslash in Ubuntu 24.04? [closed]

I want to remap Right-Shift to '/' and and Left-Shift + Right-Shift to '?'. I tried to use Input Remapper, Tweak, and XModMap, but their mappings do not work for terminals from some reason. I wonder ...
Ananta's user avatar
  • 31
1 vote
2 answers
191 views

Why using q = (p - 1)/2 for discrete log Diffie-Hellman scalar operations and not p?

As defined in RFC 3526 the prime $p$ and generator $g$ are known. The prime $p$ defined there is a safe prime, which can also be expressed as $p=2q+1$ with $q$ prime. The amount of elements in this ...
ojacomarket's user avatar
0 votes
0 answers
20 views

Can Index of Coincidence be used for ciphertext containing letters, numbers, and symbols? (All characters in cipher are from ASCII table)

I have been trying to figure out how to approach performing cryptanalysis on the following ciphertext, but am stumped on whether I can use classical techniques such as IoC to derive useful information ...
William LoCascio's user avatar
4 votes
4 answers
3k views

Is the XOR of hashes a good hash function?

Definitions: Let $h$ be a hash function with output size $n$ bytes. Suppose the file $F$ can be divided into chunks of size $n$ bytes $F=f_0+f_1+\dots +f_i$ where the operator "$+$" stands ...
Rafael's user avatar
  • 143
2 votes
1 answer
118 views

Can we use Super-Elliptic or Supersingular Elliptic Curves in Cryptography?

I am reading in literature articles and journals about Super Elliptic Curves and Super Singular Elliptic Curves such as this: https://arxiv.org/pdf/1906.02373 I have 2 questions: Do Super Elliptic ...
someone's user avatar
  • 51
7 votes
3 answers
1k views

New causes of side channel

Until recently, my list of what can cause side channels exfiltrating secret data (including data depending on secrets) from code running in a computer was limited to: Hardware emissions: power (e.g. ...
fgrieu's user avatar
  • 143k
0 votes
0 answers
28 views

Is correctness condition of ABE scheme of [BGG+'Eurocrypt2014] right?

I'm reading page 16 of [BGG+'Eurocrypt2014, Section 4]. Here is the image of the correctness I want to know the upper-bound of the noise vector in the following vector $$\mathbf{c}'_{f}=(\mathbf{c}_{...
user1035648's user avatar
0 votes
0 answers
34 views

Has anyone used Arkworks with Spartan?

I'm trying to use Spartan to produce and verify zkSNARKS. I want to use Arkworks (https://github.com/arkworks-rs) to create custom R1CS instances, but Arkworks does not readily interface with Spartan. ...
Ihyun Nam's user avatar
4 votes
1 answer
118 views

Enhanced Miller Rabin outcome for composite numbers

I'm going through the Enhanced MR test cited in FIPS 186-5, in which it is mentioned that a composite number can be  COMPOSITE WITH FACTOR  or  COMPOSITE AND NOT A POWER OF A PRIME. When I tested this ...
sg777's user avatar
  • 409
3 votes
2 answers
779 views

How do cache-timing attacks determine the secret keys of encryption algorithms?

In cache-timing attacks like prime+probe, attacking programs are able to discover the addresses of a victim program's data in main memory. These attacks are often used to determine the secret keys ...
scha's user avatar
  • 31
-1 votes
0 answers
35 views

Password Manager: Sending stored passwords in API response [closed]

I am building a password manager with client-server architecture. The server will host REST APIs to manage passwords and the client (Web or Mobile) will use these APIs. The server will store passwords ...
Hem Bhagat's user avatar
4 votes
0 answers
76 views
+50

Most simple transport encryption for link-constrained environments

What is the most simple, but yet well-known "protocol" to protect a unidirectional channel over air? Requirements The protocol should provide common properties like privacy, integrity and ...
K. Biermann's user avatar
2 votes
0 answers
27 views

Relation between spectral norm and Euclidean norm of a matrix in [BGG+'Eurocrypt2014]

I'm reading [BGG+'Eurocrypt2014] paper and I doubt that maybe there be a typo in relation between spectral norm and Euclidean norm of a matrix. Here is the part of the paper I think we must have $\|\...
user1035648's user avatar
-1 votes
1 answer
67 views

Is MOV attack against ECDLP fundamentally impossible?

The main idea of the MOV attack is to map EC additive group of order $n$ to multiplicative group in the finite field extension $p^k$. For this, the groups must have the same order, what fully relies ...
Ярослав Ладанов's user avatar
2 votes
1 answer
69 views

Is AES-GCM safe if same key is used for both uplink and downlink, assuming last IV bit tells the direction

I have designed a cryptographical protocol which uses AES-GCM with a single key. I have gone to great lengths to ensure the same initialization vector is never reused. The first bits of the ...
juhist's user avatar
  • 1,361
1 vote
0 answers
37 views

Given powers of tau ; the veryfying and the proving key, how can I find the point [f] resulting from the trusted setup in Groth16?

For each circuits, Groth16 requires to compute a point $f$ such as $f=s×G$. While revealing the scalar $s$ used for computing $f$ would allow to produce fake proofs, $f$ can be exposed to the public. ...
user2284570's user avatar
-2 votes
0 answers
59 views

Project: We're looking for a security / privacy expert to fortify an AI chat application [closed]

Project: We're looking for a security / privacy expert to fortify an AI chat application. Please DM me if you are open to project work. Thank you very much. Adam
hopefloats's user avatar
1 vote
0 answers
51 views

Do Curve448 shared secret need to be hashed?

I am planning to implement key agreement in an application, and Curve25519 offers the right properties for 128-bit security (AES-128). In a question I previously asked (Can Curve25519 shared secret be ...
juhist's user avatar
  • 1,361
0 votes
0 answers
20 views

Unknown specific generator on a non-invertible semigroup homomorphic signature valid?

There's a quantum polynomial time algorithm to solve DLPs in semigroups, without inverses, so apparently there's nothing to research with those semigroups. I don't know if this is an area of research ...
daniel's user avatar
  • 565
5 votes
2 answers
797 views

Can Curve25519 shared secret be safely truncated to half its size?

I am planning to use a key agreement mechanism in an application needing ephemeral keys, and Curve25519 looks promising, specifically because it offers 128 bits of security, just fine for AES-128 ...
juhist's user avatar
  • 1,361
2 votes
0 answers
44 views

3-Coloring Zero-Knowledge Proof: rational verifier?

I'm studying the application of Zero-Knowledge Proofs (ZKP) to graph 3-colorability. I haven't fully understood the need for randomness in the verifier's choice of the edge to challenge the prover ...
Tom_tomato's user avatar
1 vote
1 answer
65 views

Definition of "verification"?

I am trying to better understand the concept of verification in cryptography. Verification algorithms are commonly used in message authentication codes (MACs) and digital signatures to confirm the ...
Titanlord's user avatar
  • 2,327
3 votes
0 answers
84 views

A highly space-efficient embedding of prime factorization problem using the Ising model

I hope this is not off-topic for this SE, as it directly relates to the RSA problem. My background is in quantum information and computation, so please excuse me if my notation doesn't match your ...
Amirhossein Rezaei's user avatar
1 vote
1 answer
119 views

How to Generate Low-Order Generator Points on Elliptic Curves

How can one generate a 'Generator Point' on an elliptic curve that has an extremely low order. Take this Elliptic Curve from HTB Cyber Apocalypse 2024. The order of G is 11. How can one replicate this ...
PotatoTomato's user avatar
2 votes
1 answer
171 views

Trapdoor for SIS

I am new to lattice cryptography. May I ask why, if one has a trapdoor for SIS, i.e., can compute a short $x$ that satisfies $Ax=0$, then one can have a trapdoor for $Ax_{2}=y$? TIA
js wang's user avatar
  • 361
2 votes
1 answer
226 views

RSA like problem with unknown e and d

I have encountered a strange source code part in a soon-to-be-decommissioned legacy app, which uses an RSA-like scheme for "one-way hashing" data. It works like this: base^input mod N = hash ...
Bill Perry's user avatar
1 vote
1 answer
42 views

How to modify a positive scalar in scalar multiplication in order to get the additive inverse on twisted Edwards curves?

I know this is something possible because of Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used? ...
user2284570's user avatar
3 votes
1 answer
74 views

Certificateless public key cryptography

In the Wikipedia article on Certificateless Public Key Cryptography https://en.wikipedia.org/wiki/Certificateless_cryptography, it states, "For tight security, a certificateless system has to ...
Rabindra Moirangthem's user avatar
0 votes
1 answer
45 views

Are polynomial hash functions over prime order fields ZK-friendly?

"Traditional" hash functions such as SHA2/SHA3 are not considered ZK-friendly because their translation in the native prime fields of the ZK-proof system leads to a large number of ...
Raoul722's user avatar
  • 2,858
2 votes
1 answer
121 views

Is it possible to use abstract groups to generalize DSA, ECDSA and EdDSA signature creation and verification?

It is known, that DSA algorithm is defined as: Bob Creates private $x$ and public $Y=G^x\bmod p$ keys, where $G$ - generator, $p$ - group prime order Selects random value $k$ from $1 \le k\le q-1$ $...
Azii's user avatar
  • 77
0 votes
0 answers
25 views

A serious security issue in remote data storage

In order to ensure the integrity of remote data, Ateniese et al. first proposed the idea of provable data possession (PDP). In this proof, the data are computed as elements on a G-group in the form of ...
nan gan's user avatar
1 vote
0 answers
39 views

Difference between TFHE and CKKS?

What are the differences in parameters while implementing CKKS vs TFHE? For example modulus size, ring dimensions, bit security. Any pointers to literature would be appreciated
user118184's user avatar
0 votes
0 answers
13 views

Is there any bound on the size of ring dimension for Torus FHE?

I see that all implementations of TFHE in opensource supports 2^10 to 2^12 size of ring dimensions. Is there any specific reason (crypto) behind choosing the value or can we choose higher dimensions (...
Green Amber's user avatar
0 votes
0 answers
20 views

Question regarding post-processing Property of Approximate Differential Privacy

I am currently working with differential privacy and have a question regarding the composition of two DP mechanisms. In particular I am considering the following problem: consider having obtained a ...
ABCCHEM's user avatar
6 votes
1 answer
268 views

Find unknown primes from two RSA modulus

Suppose that $𝑝$, $𝑞$, and $𝑟$ are $512$-bit primes and for some integer $𝑎 < 10^5$, $𝑝 + 𝑎$ is also prime. We know the moduli $𝑛_1 = 𝑝 × 𝑞$ and $𝑛_2 = ...
Lisbeth's user avatar
  • 557
0 votes
1 answer
56 views

What techniques other than zero-knowledge proofs can prove consistency in one-to-many scenarios?

Assuming that there is a sender and multiple receivers, the sender will send the signature $\sigma$ of a certain message $m$ to all receivers, and the signatures $\sigma$ received by these receivers ...
Anja's user avatar
  • 11
0 votes
1 answer
79 views

Source code of generating private exponent for RSA?

I'm learning math of RSA. I'm interesting about realisation of computing private expoinent in source code. Where can I read a well made implemenation? (I prefer Python or Go implementation) I tried to ...
Andrew's user avatar
  • 1
1 vote
0 answers
51 views

IV for AES-GCM with AAD only [duplicate]

is it required to use a unique IV+key combination with AES-GCM for every authentication operation when there is only AAD data, and nothing to encrypt? Is it safe to use an IV with all zeros?
joe's user avatar
  • 21
0 votes
2 answers
63 views

benefits of a common session key over a common password

Password-authenticated key exchange (PAKE) is a method in which two or more parties, based on their knowledge of a shared password, establish a cryptographic key using an exchange of messages, such ...
yolooow's user avatar
  • 11
0 votes
0 answers
37 views

Upgrade to BouncyCastle 1.76 causing "CMSException: exception unwrapping key: cannot initialise algorithm parameters" [closed]

Upgrade to BouncyCastle 1.76 causing "CMSException: exception unwrapping key: cannot initialise algorithm parameters: LunaIvParameters: Unsupported engineInit method" error in RSAES-OAEP ...
user118092's user avatar
0 votes
0 answers
34 views

Linear attack on Stickel's key exchange scheme by Shpilrain

I tried to solve the system of equations $$xa=ax$$ $$yb=by$$ $$xy=u$$ where $a,b,u$ are known invertible matrices and x and y are unknown matrices. I tried Mathematica and Python but couldn't get it ...
Ahmad's user avatar
  • 1
2 votes
2 answers
94 views

Groth16 - Since the Circuit Specific Trusted Setup requires knowledge of the QAP, how does it not leak knowledge?

In the Groth16 paper, Page 14, the terms below have to computed as part of the circuit specific trusted setup $$ \left ( \frac{\beta u_i(x)+ \alpha v_i(x)+ w_i(x)}{\gamma} ^{\ell}_{ i=0}, \frac{\beta ...
user93353's user avatar
  • 2,200
0 votes
0 answers
24 views

Does the use of OPRF or OT remove the need of HE in PSI?

I was reading a systematic literature review on Private Set Intersection (PSI) protocols (https://www.sciencedirect.com/science/article/pii/S1574013723000345#sec8), which mentions that the main ...
Jayce's user avatar
  • 1

15 30 50 per page
1
2 3 4 5
615