# Questions tagged [public-key]

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.

331 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1k views

### Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
• 4,646
737 views

### Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
• 81
525 views

### Is qTesla Secure?

qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
• 381
348 views

### What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
• 142k
93 views

### TPM - Ecc based encryption / decryption using the public key

Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
• 786
349 views

### Understanding RLWE Encryption

LWE Encryption Scheme by Regev is inefficient due to its public key sizes in $O(n^2)$. This led to the variant problem RLWE, defined in this paper : Let $n$ be a power of two, and q a prime ...
335 views

### Cryptomania and NP $\cap$ co-NP

Cryptomania is usually presented as the Impagliazzo's world, which gives us public-key cryptography under the assumption that trapdoor OWFs exist. For purposes of constructing public-key cryptography ...
• 233
79 views

• 4,793
57 views

### Are high-dimensional versions of NTRU cryptosystem more secure?

The basis for this question is a 1-dimensional NTRU cryptosystem. After some literature inspection I have found out it can be also generalised into higher algebras: quaternions (QTRU) and octonions (...
• 219
145 views

### Solving DDH from an ElGamal adversary

Suppose an adversary wins IND-CPA against ElGamal, They're given public key $h=g^x$, Give a pair of messages $m = [m0,m1]$, Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$, from which ...
• 83
151 views

### Is it possible to have a shared secret without any party knowing all the parts?

I believe with Shamir’s Secret Sharing Scheme, I can create an n-part secret and distribute each of those parts to n parties. ...
• 131
373 views

### TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
• 31
40 views

### Have time-release servers been implemented?

Conceivably, Alice could release a public encryption key and promise to release the private decryption key on a certain date. That way anyone could use that encryption key, combined with others from ...
• 498
168 views

### Key strength comparison: symmetric key vs RSA/DH key

I came across different reputable sources quoting different equivalent symmetric key strengths for RSA/DH keys. This NIST paper (page 67) states the following offer corresponding security strenghts (...
186 views

55 views

### Claims about universally composable oblivious transfer, which ones are correct?

There are two papers that propose oblivious transfer protocols, both claiming to be universally composable (UC). The first protocol is more complex, and I am convinced that it is indeed UC. The second ...
• 268
23 views

### Which channel protocol should I use to broadcast the message between parties?

I am building the Threshold Signature Scheme (TSS) based wallet. I would like to run the each party's node separately with different host. And these nodes should be able to send the messages through ...
176 views

### How can I extend the RSA LSB Oracle attack, to n-LSBs?

Suppose we have an RSA-Oracle that can encrypt and decrypt our input. The the decryption output is equal to: $(C^d \mod N) \mod 2^n$. How can I extend the LSB oracle attack, using the using ...
• 21
46 views

### A tensor-based Diffie-Hellman exchange

Below is a description of a "cube" Diffie-Hellman, based on commuting matrix actions on tensor products. Some questions: References for something similar? Obvious flaws, is this a terrible ...
• 420
57 views

Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\... 2 votes 0 answers 45 views ### Can you derive the public key from a PGP encrypted message without knowing the message content? I am working on a system to transfer short messages while obfuscating the intended recipient. In essence, it combines many messages encrypted using PGP, and periodically publishes a file containing ... 2 votes 0 answers 55 views ### Is it possible to use PGP subkeys in multiple emails without correlating them? I would like to know if sub-public keys of PGP keys can be published separately, if I create a pair of master keys and multiple sub keys to be used in multiple emails, and normally use only the sub ... 2 votes 0 answers 48 views ### How to convert plaintext to element of cyclic group in Cramer-Shoup cryptosystem I am trying to implement a cramer-shoup cryptosystem but I don't understand how to work with the plaintext I want to encrypt. From what I understand, the plaintext needs to be converted to an element ... • 21 2 votes 1 answer 123 views ### KP-ABE Key Generation In Key Policy Attribute-based encryption if we need a targeted broadcast where the set of attributes are the same for a group of users. It means they all share the same secret key right? Or is it that ... 2 votes 0 answers 99 views ### Why is asked that gcd(pq,(p-1)(q-1))=1 in the Paillier encryption scheme? I don't see this property$\gcd(p\,q,(p-1)(q-1))=1$used in the scheme. And in Paillier's original paper, I don't find this requirement. Is it required just for the difficulty of factoring$n$? Or is ... • 113 2 votes 0 answers 62 views ### What grade of protection does a private key's passphrase provide at best? Does a passphrase with high entropy provide the same level of security as the private key itself? General scenario: An attacker has access to a private key file that is protected with a passphrase ... • 121 2 votes 0 answers 88 views ### DES decryption of the homomorphic encryption ciphertext I implemented an application using partial homomorphic encryption for outsourced computations. To get an efficient bandwidth, I am thinking to apply (DES) symmetric algorithm to encrypt the message ... • 21 2 votes 0 answers 125 views ### Is the first Nonce exchange between Alice and Bob in Needham-Schroder key exchange protocol redundant? For the Needham-Schroder protocol, assuming Alice and Bob are both able to guarantee each other's public keys (e.g. through a Certificate authority), the protocol is 1) A sends to B:$E_{publicB} [...
• 97
I have a ciphertext $C$ encrypted with public key $pub_C$, which contains ciphertext $B$ and $pub_B$, $$C= E_{pub_C}(B\mathbin\|pub_B)$$ Ciphertext $B$ is encrypted with $pub_B$ and contains $pub_A$ ...