Questions tagged [algorithm-design]

Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its name.

Filter by
Sorted by
Tagged with
0 votes
0 answers
52 views

Does diffusion also include the reducibility inability of the $n$-times appliance of an encryption scheme? Or has this another name? Any proof for it?

With optimal diffusion the change of a single input bit should change every single output bit equally likely with a chance of 50% each (in mean). But this does not necessarily mean it makes it ...
UncleBob's user avatar
3 votes
1 answer
172 views

Testing whether the Euler Totient of a number equals to certain value

I have solved a problem in Project Euler. My solution was based on the finding the all numbers whose Euler Totient value equals to $13!$ However, while I was working on the problem, I thought that: &...
NB_1907's user avatar
  • 610
0 votes
0 answers
31 views

Implementing Secret Sharing Among Multiple Parties

I'm working on a scenario where a safe has a lock code '42', and this code needs to be shared securely among four individuals. The goal is to set up a system where at least two out of these four ...
Iman Mohammadi's user avatar
1 vote
0 answers
30 views

Grow-only set homomorphic hash function from semigroup?

I have been exploring Bellare and Micciancio's "randomize-then-combine" paradigm for deriving set homomorphic hashing functions. I am particularly interested in grow-only sets, such that ...
Carson Farmer's user avatar
0 votes
0 answers
66 views

Key-dependent cipher generation

Is there any cryptanalysis possible if the cipher itself is deterministically derived from key material? For example, suppose you have n building blocks (ARX primitives, AES ops, other primitives) and ...
user avatar
-3 votes
3 answers
150 views

Can a very efficient RSA factoring algorithm be worth money?

If someone had a very efficient RSA factoring algorithm, would a company or government entity be willing to purchase it? What factoring time would be considered fast, months, days, hours, minutes? ...
steveK's user avatar
  • 1
2 votes
1 answer
60 views

Rationale for BLAKE2 message schedule?

BLAKE2 uses a message schedule I did not see before. It uses permutations of pieces of the message block. The BLAKE2 book did not state the rationale for such a choice and how it contrasts with the ...
LightTunnelEnd's user avatar
0 votes
1 answer
114 views

How do bad actors manipulate game results in real time within 'provably fair' gaming systems?

Ive been assigned research involving online gaming companies and their use of cryptographic algorithms to produce 'provably fair' results. The largest player in the industry uses a method involving a ...
Joey Jolly's user avatar
1 vote
1 answer
203 views

Truncating ciphertext as encryption and to decrease bandwidth in code-based PKEs

Since code-based PKEs work by correcting error introduced into the ciphertext, and since truncating ciphertext constitutes both saving in bandwidth and introducing "errors", my question ...
DannyNiu's user avatar
  • 9,080
1 vote
0 answers
80 views

Can the requirement to increase rounds with key size be bypassed?

When taking AES for example, the number of rounds increases as the key size increases. This is done in order to adequately diffuse key bits into the state of the cipher. Suppose you replace the AES ...
LightTunnelEnd's user avatar
1 vote
1 answer
100 views

Construction of Blake2 and Cha Cha

Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
Neev Penkar's user avatar
2 votes
1 answer
76 views

Oribatida masking question

Why Oribatida uses previous capacity $V_{a+m-1}$ instead of current capacity $V_{a+m}$ for rate masking?
LightBit's user avatar
  • 1,649
1 vote
1 answer
144 views

Double- and -add algorithm

I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
Stefan's user avatar
  • 11
3 votes
3 answers
1k views

Why is SHA-2 considered an ARX construction when it also uses non-ARX operations?

SHA-2 makes use of non-ARX non-linear operators such as the Choice and Majority functions: \begin{align} \mathsf{Ch}(E,F,G) &= (E \wedge F) \oplus (\neg E \wedge G)\\ \mathsf{Ma}(A, B, C) &= (...
LightTunnelEnd's user avatar
0 votes
1 answer
73 views

Is it possible for XTS to use two different key sizes?

As an example could be XTS with a 512-bit key that treats the key as one 128-bit key and one 348-bit key. As to why I'm asking it's because XTS runs on one large key that it treats like two keys. ...
I don't wanna make an account's user avatar
0 votes
0 answers
46 views

Open-Source Shamir Secret Sharing Hardware Implementations in GF

Is there any hardware implementation of Shamir's secret-sharing method available? I have only go the following two implementations in the existing literature. Paper 1 Paper 2 Anything more in the ...
Tan007's user avatar
  • 1
0 votes
0 answers
104 views

What is the AEGIS design rationale for one way rounds and slow diffusion?

The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation. As you can see the previous state is XORed with AES applied to itself ...
LightTunnelEnd's user avatar
1 vote
0 answers
131 views

Can a Full-State Keyed Sponge be used as AEAD by using XEX?

Full-State Keyed Sponge (aka Donkey Sponge) is when a message is absorbed into the full state of the sponge. Such an approach to MAC construction is considered secure. 1 However for an AEAD or a ...
LightTunnelEnd's user avatar
0 votes
1 answer
89 views

Does ISAAC really guarantee a cycle length of at least 2**40?

I just noticed that the FSE 1996 conference paper which defines ISAAC mentions a counter variable cc. This variable is said to be the reason why ISAAC has a ...
Guenther Brunthaler's user avatar
2 votes
0 answers
61 views

Is ISAAC+ actually an improvement over ISAAC?

I just tried to implement ISAAC from scratch, using the Jean-Philippe Aumasson paper from 2007 as a reference. This paper gives a definition of the original ISAAC algorithm as well as the improved ...
Guenther Brunthaler's user avatar
1 vote
1 answer
73 views

DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
Alessio Proietti's user avatar
0 votes
0 answers
9 views

Lower bound on additive error when releasing vector of values differentially privately

I have a vector of $n$ elements where each entry is a non-negative integer. Neighboring vectors differ in one element where the absolute value difference between the elements that differ is $1$. I ...
user167622's user avatar
1 vote
0 answers
36 views

How are elliptic curves designed for encryption purpose? [closed]

Why can't we use any random elliptic curve? What are the properties that need to be satisfied?
tend0pain's user avatar
2 votes
1 answer
63 views

Which reordering should I use for an 8-bit S-box?

I'm designing a cipher which has key-dependent S-boxes. The procedure is like this: Transform the key (a string of bytes) into 96 16-bit words (the high bits are ignored, but make a difference when ...
Pierre Abbat's user avatar
1 vote
2 answers
83 views

Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?

There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
aiootp's user avatar
  • 785
0 votes
0 answers
45 views

Is combining Elgamal algorithm and RSA algorithm for key generation and AES+RSA algorithm for encryption and decryption a novel approach?

Key generation: Key Generation Firstly, the RSA algorithm will be used to generate a public and a private key. Generate two random prime numbers p, q. Select RSA public key, P k such that gcd(P k, Φ)=...
Srity Ahmed's user avatar
0 votes
0 answers
46 views

Does randomization make a big difference in the output of the BKZ algorithm?

We all know that block Korkine-Zolotarev (BKZ) algorithm is essentially a deterministic lattice reduction algorithm. However, in the actual implementation, the BKZ algorithm contains some ...
constantine's user avatar
2 votes
1 answer
199 views

Is Python secrets module using a unsafe RNG on Windows?

The Python secrets module claims to produce cryptographically secure random numbers. I did some research on which random number generator is used when you call the secrets module on Windows. I found ...
Riemann's user avatar
  • 221
0 votes
0 answers
78 views

Why is decryption algorithm usyally deterministic?

For security against Chosen Plaintext Attack (CPA), we need randomized algorithms for encryption. But in some schemes (maybe almost all of them) take decryption algorithm deterministic. This procedure ...
user1035648's user avatar
1 vote
2 answers
201 views

State recovery algorithm for Xorshift128 given modular outputs

I am researching the Xorshift128 PRNG. I am particularly interested in recovering the state given a set of outputs that have the remainder taken with different values. A common way to take a unsigned ...
joemelsha's user avatar
1 vote
1 answer
107 views

Enigma Questions: Eliminating the can't encode to itself flaw? Maybe not a flaw

I am currently writing a paper in my old age for the fun of it. I feel that the enigma machine had gotten a bad wrap for some of its flaws. I decided to write a machine simulation to see if I can ...
DJ in Colorado's user avatar
1 vote
0 answers
39 views

Is there a type of method where multiple keys are involved, and final key produces invalid results unless all prior keys are used?

I'm looking for a mechanism for a type of cert/key signing, where multiple keys need to sign/encrypt something, and a final key/method does not product a valid confirmation unless all those keys did ...
New Alexandria's user avatar
1 vote
0 answers
72 views

Is there a good website to circulate RFCs [closed]

I'm drafing an RFC for a low computation crypto algorithm, intended for low power bluetooth communication. Likely without a connection using advertisements only. It's going to include raw C code ...
firesilver's user avatar
1 vote
1 answer
81 views

What is the name of this kind of cipher? (algorithm and description provided)

I have a cipher algorithm that doesn't seem to be one of the "well known" ones I could find. I expect someone has already come up with this and I just don't know the name. Hoping one of you ...
Iain Ballard's user avatar
1 vote
3 answers
154 views

Given the existence of provably-hard-to-solve problems, why do we routinely rely on conjectured-to-be-hard problems for encryption?

Let $(X, Y, Z)$ be a set of binary strings of length $n$. Let random $X$ be the private key for encoding (or decoding) message random $Y$ as $Z$. Let the encryption algorithm $m$ be a matching ...
virtuolie's user avatar
  • 139
13 votes
2 answers
2k views

What can make an implementation of a large integer library unsafe for cryptography

Unfortunately, I don't have any references, but I remember people mentioning that some large integer libraries can be unsafe to use for writing cryptographic algorithms such as the RSA. That made me ...
Keen's user avatar
  • 233
3 votes
1 answer
157 views

Why in authenticated encryptions do we need separate keys for cipher and MAC?

As asked, I suppose this must have been answered before, even if not in the form asked here. The most notable AEAD schemes GCM-AES and ChaCha20-Poly1305 do this. Also, even outside AEAD, ad-hoc ...
DannyNiu's user avatar
  • 9,080
1 vote
1 answer
83 views

Constant-time decompression on an elliptic curve

Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
Dimitri Koshelev's user avatar
5 votes
1 answer
176 views

Cryptographically obfuscating IP addresses while preserving locality

In an online community, you sometimes have to ban certain IP addresses or even entire IP ranges due to abuse. You may hire moderators to help you with this, but you might not trust them enough to show ...
Isopod's user avatar
  • 53
1 vote
0 answers
50 views

Can new decryption keys be issued without modifying the encrypted contents? [closed]

I'm curious if there's an encryption scheme where content may be encrypted to a public key where the associated private key can generate new decryption keys for the same content. The goal is to ...
Kai's user avatar
  • 11
2 votes
1 answer
70 views

Conceal time-based GUIDs with an affine-cipher?

I'd like to create a custom type of sortable GUID by concatenating an 8-byte nanosecond timestamp, 6 random bytes, a 1-byte node number, and a 1-byte counter. But, such a precise timestamp can be used ...
aiootp's user avatar
  • 785
2 votes
4 answers
201 views

Is finding an encryption (or hash) algorithm science, or is it art? [closed]

I'm not into cryptography, but I read a bit about it. I wonder: AFAIK all encryption (decryption) and hashing routines are built using some very primitive functions (let's name them "atoms" ...
U. Windl's user avatar
  • 167
1 vote
1 answer
88 views

Which encryption algorithm should I use for encrypting a string [closed]

I have a very important string it's of around 20-40 words. I want to encrypt this string and store it online . Which encryption algorithm will be useful for me.
TECH HINDER's user avatar
1 vote
2 answers
98 views

Can we find pairs $(c,m)$ with $f(c)=f(m)=true$ in $c = AES(m,K)$ with a fixed known Key $K$ significantly faster than brute force?

Different to the usual adversary use case we do not want to find the hidden key but instead pairs of $(m,c)$ which each fulfill a certain property $f(x)=true$ An example property could be e.g. 42 ...
J. Doe's user avatar
  • 573
1 vote
1 answer
127 views

What exactly is a "pass" when talking about hashing, ciphers and MAC algorithms?

I was very surprised when I said that hashing the same data twice was "double pass" and a comment came in that this wasn't the case if the hashing could be performed in parallel. This would ...
Maarten Bodewes's user avatar
  • 92.3k
2 votes
1 answer
141 views

blake3 keyed hash compression output xor'ed with key secure?

I'm currently trying to write the blake3 algorithm in JS using the official whitepaper or what it's called. If I understand correctly then... after the 7 round keyed permutation (at the end of the ...
slee69's user avatar
  • 25
2 votes
2 answers
410 views

What does it mean that DES algorithm was meant to run on hardware?

According to sources that I've read, it says that DES is not suited to a software implementation and that it is better suited to hardware, what does this mean?
Taimoor's user avatar
  • 21
1 vote
2 answers
94 views

How fast does revealing parity bits leak information?

I've got a scheme where I XOR a secret key value with a public (but random) value, XOR together all the bits of the result, and publish that bit (0 or 1), which is the parity of the result of the XOR. ...
interfect's user avatar
  • 111
1 vote
2 answers
229 views

Keyspace in Encryption using Chaotic Maps

I wish to encrypt an image using Logistic map. A Logistic map can be specified with the Equation: $$x_{n+1} = r\,x_n (1-x_n).$$ Now, according to the Kerckhoff principle, the entire system's security ...
nivedita's user avatar
1 vote
1 answer
80 views

Identifying an encryption algorithm and/or writing an encryption function

I am currently trying to reverse engineer a piece of software that uses a seemingly-custom encryption algorithm. After disassembling the decryption part of the code, I've come up with the following ...
akasaka's user avatar
  • 131

1
2 3 4 5
18