Skip to main content

Questions tagged [algorithm-design]

Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its name.

Filter by
Sorted by
Tagged with
0 votes
0 answers
47 views

Multi-signature scheme with support for aggregating signatures of multiple data

If a piece of data belongs to more than one person, we can use a multisignature to sign the data and generate a signature. There are two pieces of data, $\mathrm{data}_1$ and $\mathrm{data}_2$, and ...
chrysanthemum's user avatar
0 votes
0 answers
47 views

What is a generalized algorithm to find five $z$-bit words for the inverse of $\theta$ function in the Keccak-$f$ permutation?

This implementation of the inverse of the Keccak-$f$ permutation contains five 64-bit words (called “inversePositions64” in the code) for the inverse of $\theta$ function: ...
lyrically wicked's user avatar
2 votes
1 answer
70 views

How to design a reversible shifted XOR with an S-box?

According to this post, S-boxes are invertible. Inverting S-boxes can be very easy: you simply create a lookup table that reverse all the possible substitutions of the S-box. E.g. if the S-box maps ...
nalzok's user avatar
  • 123
-1 votes
1 answer
71 views

Is security of Manuel Blum's Mental Hash function dependent on Security Through Obscurity for it's effectiveness?

I have been practicing using Manuel Blum's Mental Hash Function for personal use, described in the link below: Mental Cryptography and Good Passwords However, Rob Shearer has shown that the function ...
its.just.me's user avatar
0 votes
0 answers
42 views

Can I recover the seed used to generate the internal state of MT19937 using the state itself?

Is there any way to extract the seed that has been used to generate the state in python or any other language? I tried to find the implementation of the random.seed ...
Someone's user avatar
2 votes
1 answer
89 views

Is there any bijective obfuscation scheme which maintains a byte order (e.g. sorted) or does so after not too many trials? (for 128bit = 16 byte)

We have given 16 bytes and apply some order to them. For example sorting them by their absolute value. We want to obfuscate them as best as possible while maintaining their order. That means if we ...
J. Doe's user avatar
  • 453
0 votes
2 answers
70 views

New Service to Service Protocol Presented for Public Scrutiny (Time-based Token Signing), Is it Safe?

I came up with the following protocol to provide a life-time for JWT tokens while differentiating services to communicate securely with web services (service-to-service) using symmetric key signing ...
Adam Memisyazici's user avatar
0 votes
1 answer
69 views

wrting algorithm for torsion group elements

Yesterday,I took an exam. There are two questions I received very low points. I will write the first question in this post. The question says let $E:y^2:x^3+kx+1$ in GF(p) be an elliptic curve where p ...
user avatar
1 vote
0 answers
57 views

Choice of algorithm for ECDLP when you have information regarding private key

Okay, I have a ECDSA public key $P$. The curve is arbitrary and not necessarily secure. The finite field of curve, $q$, is a $315$ bit prime. I know the following information regarding key: The ...
madhurkant's user avatar
2 votes
0 answers
90 views

Fast algorithm for finding parity of an RNS number

Does anybody have a library of fastest parity finding algorithms in RNS representation? By parity I mean $x \bmod 2$ where $x$ is the number between $0$ and $N=\Pi m_i$ and all moduli are odd. I have ...
Benoit Avril's user avatar
2 votes
1 answer
186 views

How to identify if a legacy encryption algorithm used in my programming language is secure?

I used an open-source programming language called Lucee / Cfscript that is closely related to Adobe Coldfusion. The default function that developers use to encrypt and decrypt data (usually for ...
ialexander's user avatar
3 votes
1 answer
194 views

Testing whether the Euler Totient of a number equals to certain value

I have solved a problem in Project Euler. My solution was based on the finding the all numbers whose Euler Totient value equals to $13!$ However, while I was working on the problem, I thought that: &...
NB_1907's user avatar
  • 640
0 votes
0 answers
34 views

Implementing Secret Sharing Among Multiple Parties

I'm working on a scenario where a safe has a lock code '42', and this code needs to be shared securely among four individuals. The goal is to set up a system where at least two out of these four ...
Iman Mohammadi's user avatar
1 vote
0 answers
39 views

Grow-only set homomorphic hash function from semigroup?

I have been exploring Bellare and Micciancio's "randomize-then-combine" paradigm for deriving set homomorphic hashing functions. I am particularly interested in grow-only sets, such that ...
Carson Farmer's user avatar
0 votes
0 answers
68 views

Key-dependent cipher generation

Is there any cryptanalysis possible if the cipher itself is deterministically derived from key material? For example, suppose you have n building blocks (ARX primitives, AES ops, other primitives) and ...
user avatar
-2 votes
3 answers
169 views

Can a very efficient RSA factoring algorithm be worth money?

If someone had a very efficient RSA factoring algorithm, would a company or government entity be willing to purchase it? What factoring time would be considered fast, months, days, hours, minutes? ...
steveK's user avatar
  • 11
2 votes
1 answer
68 views

Rationale for BLAKE2 message schedule?

BLAKE2 uses a message schedule I did not see before. It uses permutations of pieces of the message block. The BLAKE2 book did not state the rationale for such a choice and how it contrasts with the ...
LightTunnelEnd's user avatar
0 votes
1 answer
529 views

How do bad actors manipulate game results in real time within 'provably fair' gaming systems?

Ive been assigned research involving online gaming companies and their use of cryptographic algorithms to produce 'provably fair' results. The largest player in the industry uses a method involving a ...
Joey Jolly's user avatar
1 vote
1 answer
207 views

Truncating ciphertext as encryption and to decrease bandwidth in code-based PKEs

Since code-based PKEs work by correcting error introduced into the ciphertext, and since truncating ciphertext constitutes both saving in bandwidth and introducing "errors", my question ...
DannyNiu's user avatar
  • 9,421
1 vote
0 answers
82 views

Can the requirement to increase rounds with key size be bypassed?

When taking AES for example, the number of rounds increases as the key size increases. This is done in order to adequately diffuse key bits into the state of the cipher. Suppose you replace the AES ...
LightTunnelEnd's user avatar
1 vote
1 answer
112 views

Construction of Blake2 and Cha Cha

Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
Neev Penkar's user avatar
2 votes
1 answer
95 views

Oribatida masking question

Why Oribatida uses previous capacity $V_{a+m-1}$ instead of current capacity $V_{a+m}$ for rate masking? EDIT: I have asked this one of the authors (Arghya Bhattacharjee) and he replied: Let's say ...
LightBit's user avatar
  • 1,649
1 vote
1 answer
168 views

Double- and -add algorithm

I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
Stefan's user avatar
  • 11
3 votes
3 answers
1k views

Why is SHA-2 considered an ARX construction when it also uses non-ARX operations?

SHA-2 makes use of non-ARX non-linear operators such as the Choice and Majority functions: \begin{align} \mathsf{Ch}(E,F,G) &= (E \wedge F) \oplus (\neg E \wedge G)\\ \mathsf{Ma}(A, B, C) &= (...
LightTunnelEnd's user avatar
0 votes
1 answer
79 views

Is it possible for XTS to use two different key sizes?

As an example could be XTS with a 512-bit key that treats the key as one 128-bit key and one 348-bit key. As to why I'm asking it's because XTS runs on one large key that it treats like two keys. ...
I don't wanna make an account's user avatar
0 votes
0 answers
68 views

Open-Source Shamir Secret Sharing Hardware Implementations in GF

Is there any hardware implementation of Shamir's secret-sharing method available? I have only go the following two implementations in the existing literature. Paper 1 Paper 2 Anything more in the ...
Tan007's user avatar
  • 1
0 votes
0 answers
110 views

What is the AEGIS design rationale for one way rounds and slow diffusion?

The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation. As you can see the previous state is XORed with AES applied to itself ...
LightTunnelEnd's user avatar
1 vote
0 answers
139 views

Can a Full-State Keyed Sponge be used as AEAD by using XEX?

Full-State Keyed Sponge (aka Donkey Sponge) is when a message is absorbed into the full state of the sponge. Such an approach to MAC construction is considered secure. 1 However for an AEAD or a ...
LightTunnelEnd's user avatar
0 votes
1 answer
93 views

Does ISAAC really guarantee a cycle length of at least 2**40?

I just noticed that the FSE 1996 conference paper which defines ISAAC mentions a counter variable cc. This variable is said to be the reason why ISAAC has a ...
Guenther Brunthaler's user avatar
2 votes
0 answers
69 views

Is ISAAC+ actually an improvement over ISAAC?

I just tried to implement ISAAC from scratch, using the Jean-Philippe Aumasson paper from 2007 as a reference. This paper gives a definition of the original ISAAC algorithm as well as the improved ...
Guenther Brunthaler's user avatar
1 vote
1 answer
88 views

DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
Alessio Proietti's user avatar
0 votes
0 answers
9 views

Lower bound on additive error when releasing vector of values differentially privately

I have a vector of $n$ elements where each entry is a non-negative integer. Neighboring vectors differ in one element where the absolute value difference between the elements that differ is $1$. I ...
user167622's user avatar
1 vote
0 answers
36 views

How are elliptic curves designed for encryption purpose? [closed]

Why can't we use any random elliptic curve? What are the properties that need to be satisfied?
tend0pain's user avatar
2 votes
1 answer
76 views

Which reordering should I use for an 8-bit S-box?

I'm designing a cipher which has key-dependent S-boxes. The procedure is like this: Transform the key (a string of bytes) into 96 16-bit words (the high bits are ignored, but make a difference when ...
Pierre Abbat's user avatar
1 vote
2 answers
85 views

Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?

There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
aiootp's user avatar
  • 814
0 votes
0 answers
50 views

Is combining Elgamal algorithm and RSA algorithm for key generation and AES+RSA algorithm for encryption and decryption a novel approach?

Key generation: Key Generation Firstly, the RSA algorithm will be used to generate a public and a private key. Generate two random prime numbers p, q. Select RSA public key, P k such that gcd(P k, Φ)=...
Srity Ahmed's user avatar
0 votes
0 answers
49 views

Does randomization make a big difference in the output of the BKZ algorithm?

We all know that block Korkine-Zolotarev (BKZ) algorithm is essentially a deterministic lattice reduction algorithm. However, in the actual implementation, the BKZ algorithm contains some ...
constantine's user avatar
2 votes
1 answer
279 views

Is Python secrets module using a unsafe RNG on Windows?

The Python secrets module claims to produce cryptographically secure random numbers. I did some research on which random number generator is used when you call the secrets module on Windows. I found ...
Riemann's user avatar
  • 221
0 votes
0 answers
87 views

Why is decryption algorithm usyally deterministic?

For security against Chosen Plaintext Attack (CPA), we need randomized algorithms for encryption. But in some schemes (maybe almost all of them) take decryption algorithm deterministic. This procedure ...
user1035648's user avatar
1 vote
2 answers
304 views

State recovery algorithm for Xorshift128 given modular outputs

I am researching the Xorshift128 PRNG. I am particularly interested in recovering the state given a set of outputs that have the remainder taken with different values. A common way to take a unsigned ...
joemelsha's user avatar
1 vote
1 answer
133 views

Enigma Questions: Eliminating the can't encode to itself flaw? Maybe not a flaw

I am currently writing a paper in my old age for the fun of it. I feel that the enigma machine had gotten a bad wrap for some of its flaws. I decided to write a machine simulation to see if I can ...
DJ in Colorado's user avatar
1 vote
0 answers
40 views

Is there a type of method where multiple keys are involved, and final key produces invalid results unless all prior keys are used?

I'm looking for a mechanism for a type of cert/key signing, where multiple keys need to sign/encrypt something, and a final key/method does not product a valid confirmation unless all those keys did ...
New Alexandria's user avatar
1 vote
0 answers
72 views

Is there a good website to circulate RFCs [closed]

I'm drafing an RFC for a low computation crypto algorithm, intended for low power bluetooth communication. Likely without a connection using advertisements only. It's going to include raw C code ...
firesilver's user avatar
1 vote
1 answer
89 views

What is the name of this kind of cipher? (algorithm and description provided)

I have a cipher algorithm that doesn't seem to be one of the "well known" ones I could find. I expect someone has already come up with this and I just don't know the name. Hoping one of you ...
Iain Ballard's user avatar
1 vote
3 answers
160 views

Given the existence of provably-hard-to-solve problems, why do we routinely rely on conjectured-to-be-hard problems for encryption?

Let $(X, Y, Z)$ be a set of binary strings of length $n$. Let random $X$ be the private key for encoding (or decoding) message random $Y$ as $Z$. Let the encryption algorithm $m$ be a matching ...
virtuolie's user avatar
  • 139
13 votes
2 answers
2k views

What can make an implementation of a large integer library unsafe for cryptography

Unfortunately, I don't have any references, but I remember people mentioning that some large integer libraries can be unsafe to use for writing cryptographic algorithms such as the RSA. That made me ...
Keen's user avatar
  • 233
3 votes
1 answer
205 views

Why in authenticated encryptions do we need separate keys for cipher and MAC?

As asked, I suppose this must have been answered before, even if not in the form asked here. The most notable AEAD schemes GCM-AES and ChaCha20-Poly1305 do this. Also, even outside AEAD, ad-hoc ...
DannyNiu's user avatar
  • 9,421
1 vote
1 answer
92 views

Constant-time decompression on an elliptic curve

Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
Dimitri Koshelev's user avatar
5 votes
1 answer
187 views

Cryptographically obfuscating IP addresses while preserving locality

In an online community, you sometimes have to ban certain IP addresses or even entire IP ranges due to abuse. You may hire moderators to help you with this, but you might not trust them enough to show ...
Isopod's user avatar
  • 53
1 vote
0 answers
50 views

Can new decryption keys be issued without modifying the encrypted contents? [closed]

I'm curious if there's an encryption scheme where content may be encrypted to a public key where the associated private key can generate new decryption keys for the same content. The goal is to ...
Kai's user avatar
  • 11

1
2 3 4 5
18