Skip to main content

# Questions tagged [algorithm-design]

Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its name.

890 questions
Filter by
Sorted by
Tagged with
0 votes
0 answers
47 views

### Multi-signature scheme with support for aggregating signatures of multiple data

If a piece of data belongs to more than one person, we can use a multisignature to sign the data and generate a signature. There are two pieces of data, $\mathrm{data}_1$ and $\mathrm{data}_2$, and ...
0 votes
0 answers
47 views

### What is a generalized algorithm to find five $z$-bit words for the inverse of $\theta$ function in the Keccak-$f$ permutation?

This implementation of the inverse of the Keccak-$f$ permutation contains five 64-bit words (called “inversePositions64” in the code) for the inverse of $\theta$ function: ...
• 1,347
2 votes
1 answer
70 views

### How to design a reversible shifted XOR with an S-box?

According to this post, S-boxes are invertible. Inverting S-boxes can be very easy: you simply create a lookup table that reverse all the possible substitutions of the S-box. E.g. if the S-box maps ...
• 123
-1 votes
1 answer
71 views

### Is security of Manuel Blum's Mental Hash function dependent on Security Through Obscurity for it's effectiveness?

I have been practicing using Manuel Blum's Mental Hash Function for personal use, described in the link below: Mental Cryptography and Good Passwords However, Rob Shearer has shown that the function ...
0 votes
0 answers
42 views

### Can I recover the seed used to generate the internal state of MT19937 using the state itself?

Is there any way to extract the seed that has been used to generate the state in python or any other language? I tried to find the implementation of the random.seed ...
2 votes
1 answer
89 views

### Is there any bijective obfuscation scheme which maintains a byte order (e.g. sorted) or does so after not too many trials? (for 128bit = 16 byte)

We have given 16 bytes and apply some order to them. For example sorting them by their absolute value. We want to obfuscate them as best as possible while maintaining their order. That means if we ...
• 453
0 votes
2 answers
70 views

### New Service to Service Protocol Presented for Public Scrutiny (Time-based Token Signing), Is it Safe?

I came up with the following protocol to provide a life-time for JWT tokens while differentiating services to communicate securely with web services (service-to-service) using symmetric key signing ...
0 votes
1 answer
69 views

### wrting algorithm for torsion group elements

Yesterday,I took an exam. There are two questions I received very low points. I will write the first question in this post. The question says let $E:y^2:x^3+kx+1$ in GF(p) be an elliptic curve where p ...
1 vote
0 answers
57 views

### Choice of algorithm for ECDLP when you have information regarding private key

Okay, I have a ECDSA public key $P$. The curve is arbitrary and not necessarily secure. The finite field of curve, $q$, is a $315$ bit prime. I know the following information regarding key: The ...
• 662
2 votes
0 answers
90 views

### Fast algorithm for finding parity of an RNS number

Does anybody have a library of fastest parity finding algorithms in RNS representation? By parity I mean $x \bmod 2$ where $x$ is the number between $0$ and $N=\Pi m_i$ and all moduli are odd. I have ...
2 votes
1 answer
186 views

### How to identify if a legacy encryption algorithm used in my programming language is secure?

I used an open-source programming language called Lucee / Cfscript that is closely related to Adobe Coldfusion. The default function that developers use to encrypt and decrypt data (usually for ...
• 123
3 votes
1 answer
194 views

### Testing whether the Euler Totient of a number equals to certain value

I have solved a problem in Project Euler. My solution was based on the finding the all numbers whose Euler Totient value equals to $13!$ However, while I was working on the problem, I thought that: &...
• 640
0 votes
0 answers
34 views

### Implementing Secret Sharing Among Multiple Parties

I'm working on a scenario where a safe has a lock code '42', and this code needs to be shared securely among four individuals. The goal is to set up a system where at least two out of these four ...
1 vote
0 answers
39 views

### Grow-only set homomorphic hash function from semigroup?

I have been exploring Bellare and Micciancio's "randomize-then-combine" paradigm for deriving set homomorphic hashing functions. I am particularly interested in grow-only sets, such that ...
0 votes
0 answers
68 views

### Key-dependent cipher generation

Is there any cryptanalysis possible if the cipher itself is deterministically derived from key material? For example, suppose you have n building blocks (ARX primitives, AES ops, other primitives) and ...
-2 votes
3 answers
169 views

### Can a very efficient RSA factoring algorithm be worth money?

If someone had a very efficient RSA factoring algorithm, would a company or government entity be willing to purchase it? What factoring time would be considered fast, months, days, hours, minutes? ...
• 11
2 votes
1 answer
68 views

### Rationale for BLAKE2 message schedule?

BLAKE2 uses a message schedule I did not see before. It uses permutations of pieces of the message block. The BLAKE2 book did not state the rationale for such a choice and how it contrasts with the ...
0 votes
1 answer
529 views

### How do bad actors manipulate game results in real time within 'provably fair' gaming systems?

Ive been assigned research involving online gaming companies and their use of cryptographic algorithms to produce 'provably fair' results. The largest player in the industry uses a method involving a ...
1 vote
1 answer
207 views

### Truncating ciphertext as encryption and to decrease bandwidth in code-based PKEs

Since code-based PKEs work by correcting error introduced into the ciphertext, and since truncating ciphertext constitutes both saving in bandwidth and introducing "errors", my question ...
• 9,421
1 vote
0 answers
82 views

### Can the requirement to increase rounds with key size be bypassed?

When taking AES for example, the number of rounds increases as the key size increases. This is done in order to adequately diffuse key bits into the state of the cipher. Suppose you replace the AES ...
1 vote
1 answer
112 views

### Construction of Blake2 and Cha Cha

Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
2 votes
1 answer
95 views

### Oribatida masking question

Why Oribatida uses previous capacity $V_{a+m-1}$ instead of current capacity $V_{a+m}$ for rate masking? EDIT: I have asked this one of the authors (Arghya Bhattacharjee) and he replied: Let's say ...
• 1,649
1 vote
1 answer
168 views

### Double- and -add algorithm

I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
• 11
3 votes
3 answers
1k views

### Why is SHA-2 considered an ARX construction when it also uses non-ARX operations?

SHA-2 makes use of non-ARX non-linear operators such as the Choice and Majority functions: \begin{align} \mathsf{Ch}(E,F,G) &= (E \wedge F) \oplus (\neg E \wedge G)\\ \mathsf{Ma}(A, B, C) &= (...
0 votes
1 answer
79 views

### Is it possible for XTS to use two different key sizes?

As an example could be XTS with a 512-bit key that treats the key as one 128-bit key and one 348-bit key. As to why I'm asking it's because XTS runs on one large key that it treats like two keys. ...
0 votes
0 answers
68 views

### Open-Source Shamir Secret Sharing Hardware Implementations in GF

Is there any hardware implementation of Shamir's secret-sharing method available? I have only go the following two implementations in the existing literature. Paper 1 Paper 2 Anything more in the ...
0 votes
0 answers
110 views

### What is the AEGIS design rationale for one way rounds and slow diffusion?

The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation. As you can see the previous state is XORed with AES applied to itself ...
1 vote
0 answers
139 views

### Can a Full-State Keyed Sponge be used as AEAD by using XEX?

Full-State Keyed Sponge (aka Donkey Sponge) is when a message is absorbed into the full state of the sponge. Such an approach to MAC construction is considered secure. 1 However for an AEAD or a ...
0 votes
1 answer
93 views

### Does ISAAC really guarantee a cycle length of at least 2**40?

I just noticed that the FSE 1996 conference paper which defines ISAAC mentions a counter variable cc. This variable is said to be the reason why ISAAC has a ...
2 votes
0 answers
69 views

### Is ISAAC+ actually an improvement over ISAAC?

I just tried to implement ISAAC from scratch, using the Jean-Philippe Aumasson paper from 2007 as a reference. This paper gives a definition of the original ISAAC algorithm as well as the improved ...
1 vote
1 answer
88 views

### DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
0 votes
0 answers
9 views

### Lower bound on additive error when releasing vector of values differentially privately

I have a vector of $n$ elements where each entry is a non-negative integer. Neighboring vectors differ in one element where the absolute value difference between the elements that differ is $1$. I ...
1 vote
0 answers
36 views

### How are elliptic curves designed for encryption purpose? [closed]

Why can't we use any random elliptic curve? What are the properties that need to be satisfied?
2 votes
1 answer
76 views

### Which reordering should I use for an 8-bit S-box?

I'm designing a cipher which has key-dependent S-boxes. The procedure is like this: Transform the key (a string of bytes) into 96 16-bit words (the high bits are ignored, but make a difference when ...
• 221
1 vote
2 answers
85 views

### Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?

There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
• 814
0 votes
0 answers
50 views

### Is combining Elgamal algorithm and RSA algorithm for key generation and AES+RSA algorithm for encryption and decryption a novel approach?

Key generation: Key Generation Firstly, the RSA algorithm will be used to generate a public and a private key. Generate two random prime numbers p, q. Select RSA public key, P k such that gcd(P k, Φ)=...
0 votes
0 answers
49 views

### Does randomization make a big difference in the output of the BKZ algorithm?

We all know that block Korkine-Zolotarev (BKZ) algorithm is essentially a deterministic lattice reduction algorithm. However, in the actual implementation, the BKZ algorithm contains some ...
• 311
2 votes
1 answer
279 views

### Is Python secrets module using a unsafe RNG on Windows?

The Python secrets module claims to produce cryptographically secure random numbers. I did some research on which random number generator is used when you call the secrets module on Windows. I found ...
• 221
0 votes
0 answers
87 views

### Why is decryption algorithm usyally deterministic?

For security against Chosen Plaintext Attack (CPA), we need randomized algorithms for encryption. But in some schemes (maybe almost all of them) take decryption algorithm deterministic. This procedure ...
• 460
1 vote
2 answers
304 views

### State recovery algorithm for Xorshift128 given modular outputs

I am researching the Xorshift128 PRNG. I am particularly interested in recovering the state given a set of outputs that have the remainder taken with different values. A common way to take a unsigned ...
1 vote
1 answer
133 views

### Enigma Questions: Eliminating the can't encode to itself flaw? Maybe not a flaw

I am currently writing a paper in my old age for the fun of it. I feel that the enigma machine had gotten a bad wrap for some of its flaws. I decided to write a machine simulation to see if I can ...
1 vote
0 answers
40 views

### Is there a type of method where multiple keys are involved, and final key produces invalid results unless all prior keys are used?

I'm looking for a mechanism for a type of cert/key signing, where multiple keys need to sign/encrypt something, and a final key/method does not product a valid confirmation unless all those keys did ...
1 vote
0 answers
72 views

### Is there a good website to circulate RFCs [closed]

I'm drafing an RFC for a low computation crypto algorithm, intended for low power bluetooth communication. Likely without a connection using advertisements only. It's going to include raw C code ...
1 vote
1 answer
89 views

### What is the name of this kind of cipher? (algorithm and description provided)

I have a cipher algorithm that doesn't seem to be one of the "well known" ones I could find. I expect someone has already come up with this and I just don't know the name. Hoping one of you ...
• 113
1 vote
3 answers
160 views

### Given the existence of provably-hard-to-solve problems, why do we routinely rely on conjectured-to-be-hard problems for encryption?

Let $(X, Y, Z)$ be a set of binary strings of length $n$. Let random $X$ be the private key for encoding (or decoding) message random $Y$ as $Z$. Let the encryption algorithm $m$ be a matching ...
• 139
13 votes
2 answers
2k views

### What can make an implementation of a large integer library unsafe for cryptography

Unfortunately, I don't have any references, but I remember people mentioning that some large integer libraries can be unsafe to use for writing cryptographic algorithms such as the RSA. That made me ...
• 233
3 votes
1 answer
205 views

### Why in authenticated encryptions do we need separate keys for cipher and MAC?

As asked, I suppose this must have been answered before, even if not in the form asked here. The most notable AEAD schemes GCM-AES and ChaCha20-Poly1305 do this. Also, even outside AEAD, ad-hoc ...
• 9,421
1 vote
1 answer
92 views

### Constant-time decompression on an elliptic curve

Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
5 votes
1 answer
187 views

### Cryptographically obfuscating IP addresses while preserving locality

In an online community, you sometimes have to ban certain IP addresses or even entire IP ranges due to abuse. You may hire moderators to help you with this, but you might not trust them enough to show ...
• 53
1 vote
0 answers
50 views

### Can new decryption keys be issued without modifying the encrypted contents? [closed]

I'm curious if there's an encryption scheme where content may be encrypted to a public key where the associated private key can generate new decryption keys for the same content. The goal is to ...
• 11