Questions tagged [public-key]

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.

Filter by
Sorted by
Tagged with
1
vote
1answer
23 views

Public key derivation for Ed448

Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic. In RFC 8032 one can find a number of test vectors for Ed488 - for example: <...
0
votes
0answers
20 views

Prove Paillier cryptosystem decryption $M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$

How can we prove mathematically that in Paillier cryptosystem decryption, our message is equal to the right side of $$M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$$
0
votes
0answers
33 views

Convert sr25519 key pair to Curve25519 key pair

I'm trying to implement public key encryption that support key pairs generated by different libraries: Curve25519 - libsodium cryptoBoxKeypair() Ed25519 - Google ...
0
votes
2answers
62 views

How can a recipient recognize which encrypted messages are intended for them?

Let's say there's a decentralized email service where parties' public keys are known. A sender sends a message to a recipient by encrypting via RSA with the recipient's public key and posting the ...
0
votes
0answers
17 views

How useful is proxy if we use a symmetric key?

I am trying to understand the proxy re-encryption scheme. In proxy re-encryption: (1)Alice use AES key to produce the symmetric ciphertext of her message. (2)The proxy encrypt symmetric ciphertext ...
1
vote
1answer
75 views

Faster alternatives to RSA trapdoor permutation

We're working on web3.0 decentralized internet, a big part of which is a decentralized file storage system where clients upload files to storage providers and pay them for the services. Storage ...
1
vote
0answers
50 views

Verification in a random cryptosystem

A client wants to train an algorithm. A data provider encrypts its data and sends it to the client. The client operates on it and sends the result back to the data provider for decryption. Once ...
0
votes
0answers
10 views

AKE using Noise_NNpsk2 vs Noise_NKpsk2

I am working on an implementation based on the Disco library, which itself is based on Noise and strobe framework. The goal is to do bilaterally entity-authenticated key agreement with perfect forward ...
0
votes
2answers
94 views

Given ciphertexts C1, C2 of different messages P1 and P2; how can we prove that both C1 and C2 were encrypted using public keys of the same pair?

I vaguely recall reading about a scheme that accomplished this but am not able to figure out which one it was. For the sake of brevity I'm gonna omit any nonces. Let's say we have an asymmetric ...
0
votes
2answers
45 views

Understanding public key cryptography example

Frankly, I wasn't sure whether this belongs in crypto.stackexchange.com or here, so forgive me. I've been going through a book where in one of the chapters the author tries to illustrate public key ...
1
vote
1answer
75 views

Why aren't public-private keys sufficient to build a block chain? Why do we need proof of work/stake?

Taking the simple case of Bitcoin here: If all nodes can validate published transactions by checking the signature (created using the private key of the sender) of the transaction against the public ...
3
votes
0answers
142 views

Cryptomania and NP $\cap$ co-NP

Cryptomania is usually presented as the Impagliazzo's world, which gives us public-key cryptography under the assumption that trapdoor OWFs exist. For purposes of constructing public-key cryptography ...
0
votes
0answers
9 views

Cross Platform ECDH encryption and Decryption Java and c# [migrated]

I am not expert in encryption. We have requirement to encrypt the data in c# and decrypt the same in java. We were able to encrypt and decrypt the data for same key in c# and java. When we try to ...
-1
votes
1answer
125 views

Can Big Data together with deep neural networks attack RSA by affording the vast calculation of prime multiplications in advance?

This is a spin-off from Can Big Data attack RSA by just calculating many prime multiplications in advance? [duplicate]. Intro I am somewhat new to cryptography. Repeating the basics of RSA from How ...
0
votes
0answers
64 views

Attack a RSA padding scheme that appends zeros

Imagine we implement RSA padding such that a number of byte zeros are appended to the message until its length is equal to 100 (i.e. 800 bits). Also, let's assume that the public exponent $e$ is equal ...
0
votes
0answers
77 views

Can Big Data attack RSA by just calculating many prime multiplications in advance? [duplicate]

Intro I am somewhat new to cryptography. Repeating the basics of RSA from How are the primes used to generate RSA keys?: Textbooks say the one-way function is merely two primes (with some critical ...
0
votes
1answer
37 views

How do I encrypt a bunch of messages by different authors, shared with that group of people?

I'm still getting my head around public/private key cryptography, and I can't quite work out how to ask the right question to get an answer for this problem, but here goes! Alice, Bob, Carol, and ...
0
votes
1answer
54 views

Has Burdges and De Feo's concept of Delayed Encryption ever been implemented?

In mid 2020 Jeffrey Burdges and Luca De Feo published a paper proposing a trapdoor-less time-lock puzzle called Delay Encryption. Has a prototype of this ever been made?
30
votes
9answers
7k views

Is it possible to create a “digital seal” to tell if a document has been opened?

So, in real life we have a handful of ways to leave a physical mark on a packet to know if it has been opened without authorization (eg. you can use 'opened' security tapes, or you can put a signature ...
1
vote
1answer
58 views

Known ciphertext, unknown public key

Let's say I have ciphertext c = Enc(pk,m), produced by a public-key encryption scheme but I don't know the public key of the sender. Can the sender easily produce ...
0
votes
1answer
73 views

In Microsoft Password Monitor implementation using HME how do they perform ComputeMatch Function?

https://www.microsoft.com/en-us/research/blog/password-monitor-safeguarding-passwords-in-microsoft-edge/ In this they mention The server then evaluates a matching function on the encrypted credential,...
0
votes
1answer
76 views

Example of breaking RSA with CRT [duplicate]

I understand that if the same message is sent to 3 people with $e=3$ that even with different public keys, the message can be decoded using the Chinese Remainder Theorem. I have tried to figure out ...
0
votes
0answers
21 views

Using same key pairs in several different encryption tools and version

can we use the same key pairs created by an encryption tool, for encryption decryption, in another encryption tool ? for ex, created by hypercrypt, but being used in cryptermite, or maybe within the ...
0
votes
0answers
45 views

Why if i change some characters of a Public key on authorizedKeys the login still works

This question is similar to: [1] Why does my SSH private key still work after changing some bytes in the file? But in this case (on Windows) after editing the authorized_keys file and changing some ...
0
votes
0answers
34 views

Is the NTRU Challenge still ongoing?

In 2016, security innovation released the NTRU challenge. I understand that NTRU is now patent free and it seems like most of the documents related to the NTRU challenge on security innovation's ...
1
vote
1answer
46 views

What is the NTRU parameter equivalent to security level 112, 128 and 192?

I came across this paper which mentions this table, which states that NTRU 347 is equivalent to 112 bit security level However, in this paper, Choosing parameters for NTRU mentions that NTRU-401 is ...
2
votes
3answers
145 views

Factoring Anderson's RSA backdoor

In 1993, Anderson [1] proposed a backdoor to the RSA key generation algorithm. This backdoor requires that a backdoor key (prime) $A$ be implanted within the key generation portion of the RSA ...
1
vote
1answer
88 views

Combined scheme security proof

Let CS be a combined scheme of $n$ public key subschemes. CS is composed of two algorithms Setup and KeyGen, that all the subschemes share, plus all the other algorithms of each subscheme. Suppose ...
1
vote
1answer
32 views

How to prove correct decryption in Goldwasser-Micali cryptosystem

In How to prove correct decryption in Paillier cryptosystem, it was asked whether Alice (in sole possession of the secret key) can convince Bob that a given plaintext is the decryption of a ciphertext ...
1
vote
1answer
45 views

Attestation of private key deletion

I recently came across an article outlining a framework for a hypothetical cryptocurrency, the article is here if you care to read the whole thing. The relevant section is the "Digital Cash" ...
1
vote
1answer
85 views

Is there a way to use a one-way hash function for both sides to “ratchet” an asymmetric keypair?

Is there any way to derive a series of asymmetric keys, such as using a one-way hashing function, where both sides can predict the next in the sequence? Detailed Scenario: Imagine a chat application ...
5
votes
1answer
129 views

Can one tell private key entropy from a public key?

Given a weak entropy private key and its associated public key. Can we predict low entropy from the private key by examining the public key? In other words, is the low entropy from the private key in ...
1
vote
1answer
133 views

Can an altered RSA private key still work as the original?

I am interested in understanding public-key encryption using RSA. On the Khan Academy website, I noticed an anomaly when testing out the tutorial. I created the following public/private keys: ...
0
votes
1answer
51 views

IV in RSA Encrypted Private Key

I have been provided an RSA encrypted private key which was generated in NodeJS (crypto) using the following: ...
0
votes
2answers
72 views

Wrong key length for EC public key

I have a problem with EC public key reading from smartcard using pkcs11 library. With the secp256r1 EC algorithm, I always get 65 or 67-byte length public key with different smartcards. But with the ...
0
votes
0answers
28 views

Is there a way of having a “temporary” decoding key?

I am pretty sure that what I am asking for is impossible, but on the off chance it might be possible, here is my question/problem statement : Is there any known algorithm/protocol or does it even ...
2
votes
1answer
101 views

How do I multiply two points on an elliptic curve?

Tell me if there is a way to multiply two points on an elliptic curve? For example, as in secp256k1 ...
-1
votes
1answer
74 views

How to find “k” in system of equations?

This is a $y^2=x^3+7$ elliptic curve points - $Q,G_1,G_2,G_3. k_1,k_2,k$? - secret exponents: $k_1*G_1( x_1,y_1) = Q(X,Y)$ $k_2*G_2( x_2,y_2) = Q(X,Y)$ $k*G_3( x_3,y_3) = Q(X,Y)$ How to find a $k$?...
1
vote
0answers
24 views

what is the probability for an adversary to find the new key after adding new entropy in a group where computational diffie hellman is hard?

Let's say I have an Elliptic curve group $E(\mathbb{F}_q)$ with base Point $G$ and large prime order $n$. Computational Diffie-Hellman is assumed to be hard in that group. $H: \{0,1\}^*\rightarrow \{...
0
votes
1answer
36 views

Generating and distributing a secret without trusting the source

I have multiple entities (servers) that all share a private secret already. Those servers need a rotating secret (TTL a few hours). All servers must have the same set of secrets at all times. I have ...
1
vote
0answers
27 views

Signature algorithm for constrained environment, curve25512 already present for ECDH

I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no ...
1
vote
1answer
28 views

Encrypting a broadcast message decryptable by a subset of receivers

I wasn't certain how to title this request/problem, but here goes: I'm A, and I want to send a message that is received by B, C, D. Each receiving entity here is part of some set of domains D1, D2, D3:...
1
vote
1answer
37 views

Static vs ephemeral diffie-hellman

I feverishly searched the web and couldn't find a clear explanation about what exactly is "Ephemeral diffie-hellman". Let's briefly recall how diffie-hellman basically works: Bob and Alice ...
0
votes
0answers
35 views

Is blinded mixing possible?

Alice creates ordered set of $N$ public messages $(m_1,...,m_N)$ and sequentially sends them to Bob. Bob evaluates $N$ functions $E_i(m_1,...,m_N)$ (possibly using a secret random value $r$ and/or his ...
0
votes
1answer
47 views

One way shared key encryption with NaCl - is it safe to generate a throwaway keypair for the encrypting party

Libsodium seems to be a famous library so I'm not sure I need to introduce it but just incase: https://nacl.cr.yp.to/ (Edit: NaCl not Libsodium, oops!) So, I need users to be able to pass me ...
1
vote
1answer
59 views

Algebraic Variants of NTRU

There are a large number of algebraic NTRU variants: for example, in some (such as ETRU), the underlying ring has been changed to the ring of integers of a certain number field; there is GR-NTRU, ...
0
votes
0answers
34 views

Diffie Hellman with Smartwatch

I am trying to reverse engineer the Handshake wit a Smartwatch by sniffing the BLE traffic. There is what I figured out and were able to reproduce: The manufacturer-app requests a random number from ...
6
votes
1answer
1k views

How is the session key more secure than the public key?

From the website of GNU Privacy Guard (GnuPG): If an attacker could decrypt a session key it would only be useful for reading the one message encrypted with that session key. The attacker would have ...
1
vote
0answers
40 views

Why is a hash function required for building Public Key Encryption from a Trap Door Function

This is from Dan Boneh's Coursera Lectures - Week 6 - Constructions. https://www.coursera.org/learn/crypto/lecture/nTRhL/constructions Here he picks a random x from X. And then Hashes X to get the ...
0
votes
0answers
28 views

Recommended length for a nonce in hashed-based authentication

Considering the following variation of the SKID3 protocol (1) $A \rightarrow B: r_A$ (2) $B \rightarrow A: r_B || \operatorname{MAC}(r_B||r_A||A)$ (3) $A \rightarrow B: \operatorname{MAC}(r_B||r_A||B)$...

1
2 3 4 5
37