Questions tagged [public-key]

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.

Filter by
Sorted by
Tagged with
15
votes
1answer
2k views

What is a (smooth) projective hash function?

I recently came across the term "smooth projective hash function", and I see that there are many constructions nowadays that rely on them, especially some PAKE constructions. But, I didn't exactly ...
0
votes
1answer
81 views

How to multiply two Public Keys in Elliptic Curve in Go

I am working on a messaging client similar to Signal. I am stuck on implementing Tripartite Diffie-Hellman handshake in which three DH exchanges are combined to authenticate both parties and produce ...
4
votes
1answer
309 views

Are the first 4 bytes of a Ed25519 public key random?

We are using the Ed25519 signature scheme (which uses Curve25519). A key pair is generated by generating the secret key from random data and then computing the 32-byte (256-bit) public key from said ...
2
votes
0answers
149 views

Quantum Resistant Algorithms and types: PKE vs PKEs vs KEM vs KEMs vs DSS

I am trying to wrap my head around the second round Quantum Resistant Algorithm candidates currently under the NIST PQC Effort. Can someone verify if the following is a correct summary of the 17-...
2
votes
1answer
620 views

Is it possible to implement the Signal Protocol without a server?

My question is regarding the Signal Protocol[1]. Is it possible to implement the protocol securely, without a server? (I have no particular motivation for the question other than to understand better ...
1
vote
2answers
65 views

Zero Knowledge for Low Entropy Witness

For any PPT prover ($p$) and verifier ($v$), imagine I have a low entropy witness, say smaller than $2^8$. Now, let us say I have a dlog statement in the form of $y = g^w$. Theory says I could use a ...
0
votes
1answer
314 views

RSA-OAEP Padding scheme

Honestly I'm really confused about padding in RSA scheme. I don't study computer science, and I'm a beginner learning cryptography (self-taught). Can anyone give me suggestions?
2
votes
2answers
38 views

Mathematical explaination of file encryption for multiple persons with multiple keys

Let's say I want to encrypt a document which only can be read by John, Mike, and Dave. This can easily done with PGP/GPG: Import John‘s, Mike‘s, and Dave's public key Encrypt the document using those ...
3
votes
1answer
102 views

What is this called: encrypt $X$ with key $E$, decrypt $X$ with key $D$?

I am a software developer interested in developing an application with cryptography. I can explain what I want to accomplish, but I do not know the technical terms for the cryptographic functions I am ...
2
votes
1answer
2k views

How are the primes used to generate RSA keys?

I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
3
votes
1answer
365 views

Is there a symmetric-key algorithm which we can use for creating a signature?

I know that in the asymmetric-key algorithm the RSA signature exists but what about the symmetrical ones?
1
vote
0answers
128 views

Using NewHope key exchange between browser and BouncyCastle implementation

I have been looking around with some new Post-Quantum secure key exchange methods, such as McEliece, NTRU and SIDH, but none of these seem to be working nicely between the browser and the BouncyCastle ...
4
votes
1answer
116 views

Curve25519's Y coordinate of Basepoint origin

The paper High-speed high-security signatures by Bernstein et al. introduces the Edwards curve Ed25519. Concerning the base point $B$, it says that $B$ is the unique point $(x,4/5)∈E$ for which $x$...
3
votes
3answers
755 views

What is the benefit of zero knowledge identification (Fiat Shamir) over a standard digital signature?

Let's say there is a public key $v$. Peggy has to prove to Victor that she has the corresponding private key $a$. Of course she doesn't want to disclose $a$ to Victor, but just to prove that she has ...
0
votes
0answers
55 views

Isogeny of elliptic curve

If we have two elliptic curves $E$ and $E'$ and the points of both elliptic curves are same. Then all the points of $E$ map to all the points of another elliptic curve $E'$. For example $E$ has ...
2
votes
1answer
268 views

What is the relationship between attribute based encryption (ABE) and access control?

So if possible could someone tell me or at least recommend a book.
0
votes
1answer
187 views

Is there a feasible way to generate an RSA key manually the same way as it is for an ECC one?

In elliptic curves, a private key is just a random number, and one relatively small compared to other crypto systems (256 bits for ECC vs 4096 bits for RSA for example). Suppose I don't trust ...
0
votes
0answers
36 views

Audio Files and Digital Bearer Instruments

Is it possible to combine Audio Files and Public Key Cryptography creating a Digital Bearer Audio File that is in complete control of the owner who would then have the ability to grant access to ...
9
votes
1answer
9k views

How does encryption work in elliptic curve cryptography?

So I think I understand a good amount of the theory behind elliptic curve cryptography, however I am slightly unclear on how exactly a message in encrypted and then how is it decrypted. So my ...
0
votes
1answer
60 views

Difference between Identity-based encryption and multiple key-pairs of public key encryption?

What is the difference between Identity-based encryption and multiple key-pairs of public key encryption scheme?? Suppose trusted key generator generates a bunch of public and private key pairs $(k_{\...
1
vote
1answer
56 views

Diffie-Hellman: Recommendation of the base size?

Based upon choosing a prime $p$ of recommended length and $N=2p+1$, where $N$ is also prime, and $a^2$ is not congruent to $1 \pmod N$, and $a^p ≡ 1 \pmod N$, I believe you can rely upon $a$ as having ...
2
votes
3answers
2k views

Why do we need a digital signature?

First of all, I want to say that I'm totally new to cryptography. I searched on crypto stackexchange but couldn't find the answer to the following question.(probably because it's easy, but I still don'...
0
votes
2answers
143 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S` = ((Z` + (X * R`)) / K`) mod n G - Base point, of order n; ...
17
votes
2answers
1k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
3
votes
1answer
162 views

Cloneability of AES-128

I would like to implement an anti-counterfeiting scheme for tools my company manufactures. This would ideally be done via RFID/NFC tags. However, the environment in which these tags operate would ...
0
votes
2answers
1k views

Understanding Public key and Private key

I try to understand the private and the public key concept, and need some validation about my statements: If I encrypt a message with public key, I can only decrypt with private key. If I encrypt a ...
3
votes
2answers
2k views

Are ECDSA keys and RSA keys interchangeable?

Is it possible to use an ES512 key pair for RS512 signatures? Is it possible to use an RS512 key pair for ES512 signatures? I've also posted an issue in the NodeJS jwa package. I created a key pair ...
3
votes
1answer
591 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
4
votes
1answer
4k views

How can one validate with a public key a JWT signature generated with a private key?

As I understand it, a JSON Web Token (JWT) consists of 3 parts: the header, specifying the hashing algorithm to use for the signature; the payload itself; and the signature, which is a hash of the ...
2
votes
1answer
126 views

Secure multi-party computation for digital signature

Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
1
vote
0answers
70 views

Purpose of the ZKPoPK in the original SPDZ protocol

What is the purpose of ZKPoPK in the SPDZ paper? And will the following can detect the active adversaries in 2 party spdz excluding ZKPoPK step? Each party sends a commitment on his MAC key ∆_i ...
2
votes
1answer
121 views

Looking to verify my understanding of RSA math

I want to explain RSA to a programming audience with no cryptography background and I want to be sure my explanation is correct. The goal is to help them understand how RSA works under the hood. You ...
6
votes
2answers
721 views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is ...
3
votes
1answer
218 views

Why does gnupg create 4 separate keys and what does sub and ssb mean?

When using gpg to create a single key, I get: ...
1
vote
0answers
52 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
3
votes
1answer
282 views

Diffie-Hellman private key recover with non-prime modulus

Say we have a classic Diffie-Hellman key exchange. We have the following parameters of a public key: p,g,y Where $p$ is the modulus, $g$ is the base, $y$ is the ...
0
votes
0answers
59 views

Can we build a zero knowledge mapping using public-key encryption?

I'm trying to understand if this design is possible. I want to build a mapping that is zero-knowledge, between a (pubkey, proposalId) => bytes form, without ...
3
votes
1answer
100 views

In NIST modulus and key size recommendations is `group` equivalent to modulus and `key` equivalent to exponent?

Looking at the following NIST recommendations for a discrete logarithm, for 2016-2030 and beyond they list 3072-bit number for the group and 256-bit for the ...
2
votes
1answer
237 views

Find hash and signature algorithms used in an X.509 certificate signed with RSASSA-PSS

I'm trying to understand the new PSS scheme, but having trouble figuring out how to parse it properly. When receiving a certificate with OID of RSASSA-PSS, how can I know which hash and signing ...
0
votes
0answers
15 views

Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security? [duplicate]

In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...
0
votes
0answers
33 views

Mitigating leakage of asymmetric encryption scheme leaking the length of plaintext

Asymmetric encryption schemes do leak something about the encrypted plaintext: the length of the plaintext. How can this be mitigated? My solution: Padding the plaintext with some string of the ...
0
votes
2answers
182 views

zero knowledge proof of encryption

I am trying to see if there is a way to prove that a ciphertext c was encrypted under a given Public Key, Pk, without revealing the plain text message m.
1
vote
1answer
359 views

How can you derive a P-256 public key from the X and Y points

Deriving a secp256k1 public key is also possible. For whatever reason, I'm only being provided X and Y, not the public portion. I just need to get the binary representation of the public key given ...
0
votes
0answers
65 views

Could any one suggest alternative Zero knowledge proof protocol to Schnorr protocol ZKP?

I read that Schnorr protocol cannot be proved zero knowledge on that link: Perfect zero knowledge for the Schnorr protocol? Could any one suggest alternative Zero knowledge proof protocol so a prover ...
0
votes
1answer
79 views

Finding a secret key corresponding to a public key

As far as I know, a secret key corresponding to a given public key is not unique. So, for example, there are actually multiple secret keys that can produce the same digital signature under RSA ...
10
votes
3answers
2k views

Asymmetry between public key and private key: digital signatures use the private key for “encryption”?

I have a misunderstanding concerning public key cryptography...would be very helpful if you answer the questions... Digital signatures: You use your private key for "encryption" and they use your ...
0
votes
0answers
27 views

If finding a private key from a public key is [co-]NP-complete, does NP=co-NP?

In a given public key cryptosystem, if the problem of determining the private key from the public key is NP-complete or co-NP-complete, does that imply that NP = co-NP? Complexity theory is ...
1
vote
0answers
23 views

Private key which becomes invalid after specific timestamp

Sorry for my dumb question, as I'm not crypto guy. Is there any algorithm, which allows to encrypt some message with the public key, but the associated private key is only valid for specific period ...
2
votes
2answers
126 views

Does libsodium sealed box leak key ids?

I am using python and libnacl, which is a libsodium wrapper, to develop an application where users can deposit encrypted data. Alice uses ...
0
votes
0answers
31 views

Does public key encryption support a large message size? [duplicate]

I'm somewhat new to encryption. I see that the actual RSA sizes are 1024 and 2048? Can those key sizes support data blocks of 128 MB?