Questions tagged [algorithm-design]

Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its name.

Filter by
Sorted by
Tagged with
0 votes
0 answers
27 views

Which algorithm is preferred $A$ or $B$? [closed]

Let me recall that $O(n^{\alpha})$ ($\alpha > 1$) is called polynomial time. I read in many places that polynomial time algorithms are most efficient. Suppose I have two algorithms $A$ and $B$ in ...
user avatar
0 votes
0 answers
21 views

Something like restricted multikey system?

Imagine there are $n$ parties and me. I want to give them each their own secret $b$ bits. So, $nb$ bits in total. They are not supposed to share their secrets. I want them to be able to reconstruct (...
user avatar
  • 115
0 votes
1 answer
82 views

RSA Big prime picking [closed]

Is the random picking of big n-bits random numbers for primality test a time sensitive operation? If so, would an heuristic for limiting the search space (about 5-10x) without missing out on any prime ...
user avatar
  • 103
0 votes
0 answers
14 views

What non-trivial benefit does including a "context"/"signer info" provide in SM2-DSS and EdDSA?

While implementing SM2 DSS and reading RFC-8032 for EdDSA, I noticed that, both families of schemes provide provisions for including a "context" (in EdDSA) or "signer info" (in SM2 ...
user avatar
  • 6,621
2 votes
1 answer
50 views

What is the methodology for selecting symbol bit length and window size when performing Shannon Entropy Analysis?

When performing Shannon Entropy analysis on something like an RNG or a file, you must: Select a symbol bit length and number of samples would will perform analysis on at a time (IE: windows size) ...
user avatar
5 votes
1 answer
252 views

Which is the smallest, cyclic in 3 directions, consistent structure of random values which can be hidden at the adversaries machine? (some comparison)

Or more general each member can be part of up to three 2D locally euclidean planes of 2 different dimensions each. (each of those planes is cyclic in two orthogonal directions, like a torus) Given ...
user avatar
  • 475
0 votes
0 answers
66 views

Using PRF as a building block to build other primitives?

I am doing an independent research in cryptography. I have designed a post-quantum secure pseudo random function. Just constructing a PRF will not help me to publish in reputed journals. I was ...
user avatar
0 votes
0 answers
27 views

Algorithm that solves a system of linear equations over finite fields when a parameter is needed

I was reading Kipnis' and Shamir's paper on Cryptanalysis of the HFE Public Key Cryptosystem by Relinearisation and I wanted to implement the example at the end in Octave without using any additional ...
user avatar
  • 1
4 votes
2 answers
367 views

Difference between FFT and NTT

What are the main differences between the Fast Fourier Transform (FFT) and the Number Theoretical Transform (NTT)? Why do we use the NTT and not the FFT in cryptographic applications? Which one is a ...
user avatar
  • 365
1 vote
0 answers
39 views

Is there something like a node network with more than 2 edges/neighbors in cryptography/encryption?

Many types of encryption can be generalized as using a message $m$ and a key $k$ as input of an encryption function $f$ with a cipher $c$ as output. $$f(m,k)=c$$ As a node graph this could look like ...
user avatar
  • 475
1 vote
1 answer
63 views

Questions on LWE with a repeated secret matrix S

Consider a formulation of LWE where we are given either $(x,S x+e)$ or $(x,u)$ --- where $S$ is an $m \times n$ secret/hidden matrix, $x$ is a randomly sampled $n \times 1$ vector, $e$ is an $m \times ...
user avatar
1 vote
1 answer
67 views

Does generic group black box model prohibit MSB of discrete logarithm?

Black box generic models prohibit calculation of discrete logarithm in groups of order $q=2p+1$ where $p,q$ are random primes to $\Omega(\sqrt{p})$ steps (refer Discrete Logarithm in the generic group ...
user avatar
  • 882
0 votes
0 answers
42 views

Is the kind of definition and analysis of hardness of a problem, using "experiment", standard to complexity analysis of problems?

In Katz's Introduction to Modern Cryptography, there are several hard problems, and for each problem, there is an experiment, where an algorithm generates a problem instance, and another algorithm ...
user avatar
  • 151
0 votes
1 answer
47 views

Are there crypt. methods $f,g,h$ which commute and finding $x$ for given $c=f^ig^jh^k(x)$ is harder than $O(i+j+k)$ but with only $<2^{256}$ values?

Are there any cryptographic methods $f,g,h$ which can be applied in any order to an input $x$ while still resulting in the same result $r$: $$f(g(h(x)))=h(g(f(x)))=ghf(x)=fhg(x)=hfg(x)=gfh(x) = r$$ ...
user avatar
  • 475
2 votes
0 answers
104 views

How did the developers of SHA-2 algorithm come to what we have now?

After a bit of research, I finally understand what's the step by step algorithm of SHA-2 (however, of course, I won't remember it myself). But I don't understand what's the idea behind it. Did the ...
user avatar
  • 121
0 votes
0 answers
65 views

Difference between WhatsApp and Signal implementation of the Open Whisper Protocol

WhatsApp has taken the step of using the Open Whisper Protocol for their message encryption, borrowed from the Signal application. I was wondering if there was any obvious, high level, difference in ...
user avatar
2 votes
1 answer
107 views

Are there any cryptographic methods $f,g,h$ with $f(g(h(x)))=h(g(f(x)))=g(h(f(x)))$ and finding $x$ for given $c=f^ig^jh^k(x)$ harder than $O(i+j+k)$?

Are there any cryptographic methods $f,g,h$ which can be applied in any order to an input $x$ while still resulting in the same result $r$: $$f(g(h(x)))=h(g(f(x)))=ghf(x)=fhg(x)=hfg(x)=gfh(x) = r$$ ...
user avatar
  • 475
3 votes
1 answer
143 views

Distinguishing points in elliptic curves over binary extension fields using Trace

Let $E$ be an elliptic curve curve $𝑦^2 + xy ≡ 𝑥^3+𝑎𝑥^2+𝑏$ (a Weierstrass curve) (in this case, with characteristic 2) over a binary extension field $𝐺𝐹(2^{m})$ with constructing polynomial $𝑓(...
user avatar
1 vote
1 answer
45 views

Single-party encryption, multi-party and single-party decryption

Let’s say person A encrypts a message. Now I want both person A and persons B, C, D – A as a single individual – and B, C, D only as a group, to be able to decrypt the encrypted message. The ...
user avatar
  • 13
14 votes
5 answers
2k views

Cryptographically safe lookup of value in a set

I'm looking for an elegant solution to the might-seem-trivial problem of looking up for specific value in a known set of values without disclosing what value we look for. Let me describe it in a ...
user avatar
  • 266
1 vote
1 answer
76 views

Understanding the algebra behind GCM's security

I would like to understand the algebra behind GCM's security. Before I ask my questions, let me state my understanding of the math behind GCM. If correct, my questions are at the end; if incorrect, ...
user avatar
1 vote
1 answer
75 views

Converting a 32-bit ARX cipher to a 64-bit one, should the rounds be increased?

I read about using 64-bit words in PRF functions. I want to convert the 32-bit ARX cipher Chacha into a 64-bit version, with key/block size of 1024-bits (512*2=1024-bits) My question is: Should I add ...
user avatar
0 votes
1 answer
75 views

Objective block cipher round function measures of security

One issue that may arise when attempting to evaluate the security of a round function for a block cipher is that the analysis of the round function does not treat the round key space and the message ...
user avatar
1 vote
1 answer
77 views

Using one seed to create signing key pair and encryption key

I'm working on creating a secure digital vault. I'm using mnemonic to generate a seed. The seed is used to generate a signing key pair for identity verification. However I want to also encrypt the ...
user avatar
  • 97
5 votes
1 answer
1k views

Can a series of triangle reflections be used for cryptography?

(I guess no but why is this the case? Any way to make it possible?) Out of a given equilateral triangle T1 (with his 3 vertices A,B,C lying in a finite Field $\mathbb F_N^D $) another equilateral ...
user avatar
  • 475
1 vote
0 answers
48 views

Algorithmic game theory and protocol design for communication

There is a field of exchanging information that combines cryptography and game theory. I am interested in understanding this field, but it's a little complex for me. To begin with there is a paper of ...
user avatar
6 votes
2 answers
3k views

Can we use LEGO bricks to construct a cipher algorithm?

I read a paper titled "On the entropy of LEGO", which explains how to calculate the number of ways to combine $n$ $b\times w$ LEGO blocks of the same color. For example, six $2\times4$ ...
user avatar
  • 186
0 votes
1 answer
47 views

BA protocol soundness explanation

I was reading the following paper BA-made it trivial and when talking about BA agreement protocol in page 3, I didn't understand what it meant by soundness here. A protocol P is an arbitrary-value (...
user avatar
  • 117
0 votes
0 answers
45 views

Is it better to XOR rounds or just to make round by round in cipher?

Let's consider we have keyed PRNG's and we want to build a cipher. What is better: to xor let's say ten such generators with some input as a plaintext (every generator got different key, but the same ...
user avatar
  • 969
0 votes
0 answers
29 views

Besides block-cipher which other methods can only be computed step-by-step even with known secret (but fast per step) and can be inverted?

Depending at the cryptographic function used applying it $i$-times to a given input can be computed in different complexity classes (based at their input size). $$f^i(m_0) = c_i$$ For example for most ...
user avatar
  • 475
0 votes
0 answers
62 views

How can a concatenation of $N$ block-cipher with known keys be more secure?

General problem / Intro: encrypting the (computable) relation in between two random numbers which are members of a as small as possible set while anything except the order of execution is known to the ...
user avatar
  • 475
1 vote
0 answers
44 views

Hash function producing cycles with expected max length

Is there a known hash function $H_k: X\to X$ such that: $\forall{x\in{X}},\exists{n\in{\mathbb{N}}}, n<k \land H^n(x)=x$ === EDIT === By hash function I mean ...
user avatar
2 votes
1 answer
140 views

How do we pick random elements in cryptography?

While reading papers on cryptography, a lot of time I have seen that people pick random elements $x\in \mathbb{Z}^*_q$ to do something (like setting secret key and all). How does one randomly pick ...
user avatar
4 votes
2 answers
158 views

What would be the requirements for a new-age cipher standard?

While nowhere near being broken, AES has known attacks like reading from the substitution table, memory-based attacks, etc. If we keep getting better at breaking ciphers and we eventually get close to ...
user avatar
2 votes
1 answer
126 views

Hash functions, bijectiveness, and entropy

For those who don't know, a bijective function is one for which each input yields one and only one output. A block cipher, for example, is guaranteed to be bijective or you could not decrypt. When a ...
user avatar
1 vote
1 answer
162 views

Is it possible to create a Dilithium Prime or Falcon Prime?

In the NTRU Prime submission, principle author, the well-known DJB is adamant that [the] primary objective [of NTRU Prime] is to eliminate unnecessary complications in security review So much so, to ...
user avatar
  • 6,621
1 vote
2 answers
62 views

RC6 Integer operations in modulo 32 between two 32-bit blocks

I am new to cryptography and I am trying to code the RC6 (Rivest cipher 6) algorithm. The algorithm requires addition, subtraction and multiplication in modulo 232. If I am performing these operations ...
user avatar
  • 21
0 votes
1 answer
57 views

Is there any link between group signature and multi-signature

Are both of these concepts related in someway. Can a group signature scheme be transformed into a multi-signature scheme?
user avatar
0 votes
1 answer
82 views

Understanding non-linearity in Salsa20 over various rings

In his design of Salsa20, Bernstein writes to ensure non-linearity he chose 32-bit addition (breaking linearity over $Z/2$), 32-bit xor (breaking linearity over $Z/2^32), and constant-distance 32-bit ...
user avatar
3 votes
2 answers
84 views

How are the instantiations of RSAES-OAEP and SHA*WithRSAEncryption different in practice?

For the spare-time project I had been working on, I'm evaluating the PKCS#1 padded RSA schemes for implementation. For PKCS#1 v1.5, encryption doesn't seem to require a hash function, and the ...
user avatar
  • 6,621
1 vote
0 answers
78 views

Encryption of data with multiple possible decryption keys

I'm new to the Cryptography Stack Exchange, so my question might be very naive. What encryption algorithms are out there that will allow different decryption keys to decrypt the same piece of ...
user avatar
1 vote
1 answer
78 views

Extracting genome from a Ciphertext [closed]

Is it Probable to extract the ciphertext's genome and Visualizing it ? Converting this: ...
user avatar
  • 1,854
17 votes
3 answers
11k views

How Unique is a "NeuralHash"?

I was doing some reading today about a major tech company planning to implement a new system for automatically detecting and reporting CSAM in users' photos. Overall, the system as described in their ...
user avatar
  • 193
3 votes
2 answers
357 views

Recognize whether two random values are raised to the same power

Alice selects two random numbers from a finite field $Z_p$ : $a$ and $b$. Bob does one of the two following steps randomly (sometimes he does step 1; sometimes step 2): He chooses a random number $r$ ...
user avatar
1 vote
1 answer
59 views

How do we say that one cryptographic primitive is stronger than another?

Can anyone help me understand this: How do we say that one cryptographic primitive is stronger than another?
user avatar
  • 31
2 votes
0 answers
91 views

What motivated CCM's monstrous design?

The formatting function in Appendix A of NIST-SP-800-38C is a monster enabling CCM to support variable-length nonce from 7-13 bytes, variable-length encoding of the length of the payload. Also, the ...
user avatar
  • 6,621
0 votes
0 answers
65 views

Are there any block ciphers (like AES) which are (or can be) commutative under composition for different keys?

Let $BC$ be a block cipher with similar security as AES (in ECB mode). This $BC$ is applied to a message $m$ of same bit size. The result is a cipher $c$. e.g.; $$BC(key_A,m) = c_A$$ $$BC(key_B,m) = ...
user avatar
  • 475
-1 votes
1 answer
115 views

Padding and the MD5 algorithm

In MD5, if M=100, how can we perform padding on it and how many blocks are needed in each round? These are general questions for understanding padding and rounds.
user avatar
3 votes
3 answers
168 views

Can you create an encryption algorithm from a signing algorithm, or vice versa?

I remember reading, a few years ago, that you couldn't prohibit encryption without prohibiting signing, as you can always make a public key encryption algorithm from a signing algorithm. (It might be ...
user avatar
  • 711
1 vote
1 answer
29 views

Encryption algorithm by a vectored key and the error is Proportional to the difference between input key and real key

I want to find an encryption algorithm which provides the functionality described below. Given a key (a vector Vkey) and a data (an image), use this key to encrypt the image; the encrypted image can ...
user avatar
  • 111

1
2 3 4 5
17