Skip to main content

Questions tagged [public-key]

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.

331 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
15 votes
0 answers
1k views

Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
pg1989's user avatar
  • 4,646
8 votes
1 answer
737 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
Guillem's user avatar
  • 81
6 votes
0 answers
525 views

Is qTesla Secure?

qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
a196884's user avatar
  • 381
5 votes
0 answers
348 views

What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
fgrieu's user avatar
  • 142k
4 votes
0 answers
93 views

TPM - Ecc based encryption / decryption using the public key

Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
TrinityTonic's user avatar
4 votes
1 answer
349 views

Understanding RLWE Encryption

LWE Encryption Scheme by Regev is inefficient due to its public key sizes in $O(n^2)$. This led to the variant problem RLWE, defined in this paper : Let $n$ be a power of two, and q a prime ...
rerouille's user avatar
4 votes
0 answers
335 views

Cryptomania and NP $\cap$ co-NP

Cryptomania is usually presented as the Impagliazzo's world, which gives us public-key cryptography under the assumption that trapdoor OWFs exist. For purposes of constructing public-key cryptography ...
Ilk's user avatar
  • 233
4 votes
0 answers
79 views

Help with cryptanalysis of branching in schemes based on Multivariate Public Key Cryptography

I'm familiarized with the structure of branching found in Multivariate Cryptography, as it allows us to partition a $n$-tuple over $F_{q}$ into a $k$-tuple where the $i$-th element is in $F_{q^{\...
kub0x's user avatar
  • 898
4 votes
0 answers
78 views

Generalized Benaloh cryptosystem with $r=2$

Benaloh cryptosystem requires $\gcd(r, (q-1))=1$ which is impossible if $q>2$ (since it needs to be a large prime) and $r=2$. This confuses me, since Benaloh is referred to as an "extension" or "...
user4586535445838625's user avatar
4 votes
0 answers
295 views

Where do the PKs come from in Bluetooth device?

I am studying the Elliptic Curve Diffie-Hellman (ECDH) on Bluetooth 4.2. There are some questions about the PK.. Where do these public and private keys come from? Who defines them? and Will it be ...
Claire Liu's user avatar
4 votes
0 answers
776 views

Public key encryption from (1,2)-oblivious transfer

Prove that any two rounds of (1,2)-oblivious transfer, that is semi honestly secure, imply public key encryption. My ideas so far: Let's say Alice samples two $n$ random strings $(x_1, x_2)$, and ...
Napoleon's user avatar
  • 113
4 votes
0 answers
568 views

Why is this scheme not IND-CCA2 secure

I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead. However, it seems that (when used as a KEM) that any $\text{IND-...
Demi's user avatar
  • 4,793
3 votes
0 answers
57 views

Are high-dimensional versions of NTRU cryptosystem more secure?

The basis for this question is a 1-dimensional NTRU cryptosystem. After some literature inspection I have found out it can be also generalised into higher algebras: quaternions (QTRU) and octonions (...
max's user avatar
  • 219
3 votes
0 answers
145 views

Solving DDH from an ElGamal adversary

Suppose an adversary wins IND-CPA against ElGamal, They're given public key $h=g^x$, Give a pair of messages $m = [m0,m1]$, Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$, from which ...
bs-'s user avatar
  • 83
3 votes
0 answers
151 views

Is it possible to have a shared secret without any party knowing all the parts?

I believe with Shamir’s Secret Sharing Scheme, I can create an n-part secret and distribute each of those parts to n parties. ...
Shamoon's user avatar
  • 131
3 votes
0 answers
373 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
Bastian's user avatar
  • 31
3 votes
0 answers
40 views

Have time-release servers been implemented?

Conceivably, Alice could release a public encryption key and promise to release the private decryption key on a certain date. That way anyone could use that encryption key, combined with others from ...
Nic's user avatar
  • 498
3 votes
0 answers
168 views

Key strength comparison: symmetric key vs RSA/DH key

I came across different reputable sources quoting different equivalent symmetric key strengths for RSA/DH keys. This NIST paper (page 67) states the following offer corresponding security strenghts (...
user avatar
3 votes
0 answers
186 views

Solving LPN using algorithm for syndrome decoding

Given an algorithm $A_D$ which solves an instance of the decoding problem $e \in \mathbb{F}_2^n$ in time $T_D$ given a parity check matrix $H \in \mathbb{F}_2^{(n-k)\times n}$ and a syndrome $s \in \...
Pg1234's user avatar
  • 31
3 votes
0 answers
1k views

Fixed point in RSA encryption

Some papers count the number of the fixed points in the RSA encryption algorithm. They're a minimum of 9 and the real number depends on the smoothness of primes $p$ and $q$. It very unlikely that a ...
ddddavidee's user avatar
  • 3,344
3 votes
0 answers
126 views

Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
Kri Noe's user avatar
  • 53
3 votes
0 answers
61 views

Encryption scheme that requires fewer keys for decryption than for encryption

I want to attempt creating a decentralized dead man's switch, so I'm looking for an asymmetric encryption scheme, with the following properties (ideally), or something close to them: There is a group ...
koorkevani's user avatar
3 votes
0 answers
103 views

Is it possible to verify attributes of encrypted content?

Let's say that Alice has this information about her, { "name": "Alice", "age": 25, "eyes": "brown" } which she encrypts with a key pair so that no one access ...
Maxim Gaina's user avatar
3 votes
0 answers
760 views

Where shoul I store private/public keys and how should I share it?

I'm new in terms of encryption and I have to encrypt the data between two Java Spring applications, one have serves as MVC framework and other as Web Service, I'm implementing an asymmetric encryption ...
Carlos Robles's user avatar
3 votes
0 answers
245 views

Montgomery modular multiplication – confusion with subtraction of modulus

I'm reading the paper “COMPARISON OF SCALABLE MONTGOMERY MODULAR MULTIPLICATION IMPLEMENTATIONS EMBEDDED IN RECONFIGURABLE HARDWARE” (PDF) on hardware algorithms for montgomery multiplication for ...
asmvolatile's user avatar
3 votes
0 answers
63 views

show how LWE errors can have a greater impact on result

Hi weve been given the following question in one of our classes but have not been taught anything about it and is worded strangely. It is to show how the LWE problem works by showing how small errors ...
dmnte's user avatar
  • 51
3 votes
0 answers
544 views

RSA - factorizing $N$ to get $p$ and $q$

I need to decrypt a message encrypted using RSA. I only know the public keys $n$ and $e$. I need to get the private key $p$ and $q$ in order to get the decryption exponent $d$. Now to do so, I know ...
William Lariviere's user avatar
3 votes
0 answers
259 views

In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$

In the NTRU cryptosystem, it is suggested to take $N$ prime. I want to understand why. In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
Leafar's user avatar
  • 325
3 votes
0 answers
172 views

David Chaum's anonymous credential

I am a newbie in cryptography (I know the basic RSA, AES stuffs) and am interested in anonymous authentication systems. Looks like David Chaum is the godly figure in the field. I see lots of people ...
nepee's user avatar
  • 131
3 votes
0 answers
2k views

Determining the algorithm used to generate a digital signature

I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature. From the signed string, is it possible to find out what ...
user93353's user avatar
  • 2,245
3 votes
1 answer
296 views

Why gcd(r,(p-1)/r) needs to be 1 in benaloh cryptosystem

I recently discovered the benaloh cryptosystem. I am working with the system as it is discribed in the following link: https://en.wikipedia.org/wiki/Benaloh_cryptosystem However I need some help in ...
user28082's user avatar
  • 173
3 votes
1 answer
84 views

Proof-of-Randomness with an EC Public Key

I will be using a tRNG to generate EC keypairs on a Secure Integrated Controller. I need to demonstrate I, the issuer, can not know the private key without colluding with the user to obtain it, even ...
WindowCleaner's user avatar
2 votes
0 answers
79 views

Can you sign messages using Wireguard's keys?

I was wondering if I could use Wireguard's keys to sign messages, and prove authenticity of a node that runs Wireguard with its known public key from other nodes, so that I can use it in a system to ...
Alex's user avatar
  • 121
2 votes
1 answer
63 views

Which one is more general, attribute based encryption or inner product predicate encryption?

If we have a scheme for inner product predicate encryption (IPPE), then can we claim that we already have designed an attribute based encryption (ABE) scheme; So we do not need to design an ABE again. ...
user1035648's user avatar
2 votes
2 answers
155 views

Regev's learning with error

If we talk about the security of public key encryption in Regev's lwe system, if attacker would have knowledge of $(u,u'):[\mathbf u=A\mathbf r, \mathbf u'=\mathbf b^t\mathbf r + \mu q/2, \mathbf r\in\...
user479610's user avatar
2 votes
0 answers
55 views

Claims about universally composable oblivious transfer, which ones are correct?

There are two papers that propose oblivious transfer protocols, both claiming to be universally composable (UC). The first protocol is more complex, and I am convinced that it is indeed UC. The second ...
user2249675's user avatar
2 votes
0 answers
23 views

Which channel protocol should I use to broadcast the message between parties?

I am building the Threshold Signature Scheme (TSS) based wallet. I would like to run the each party's node separately with different host. And these nodes should be able to send the messages through ...
thant zin tun's user avatar
2 votes
0 answers
176 views

How can I extend the RSA LSB Oracle attack, to n-LSBs?

Suppose we have an RSA-Oracle that can encrypt and decrypt our input. The the decryption output is equal to: $ (C^d \mod N) \mod 2^n $. How can I extend the LSB oracle attack, using the using ...
Jamal's user avatar
  • 21
2 votes
0 answers
46 views

A tensor-based Diffie-Hellman exchange

Below is a description of a "cube" Diffie-Hellman, based on commuting matrix actions on tensor products. Some questions: References for something similar? Obvious flaws, is this a terrible ...
yoyo's user avatar
  • 420
2 votes
0 answers
57 views

Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them

Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
Dimitri Koshelev's user avatar
2 votes
0 answers
45 views

Can you derive the public key from a PGP encrypted message without knowing the message content?

I am working on a system to transfer short messages while obfuscating the intended recipient. In essence, it combines many messages encrypted using PGP, and periodically publishes a file containing ...
Electron-Capture's user avatar
2 votes
0 answers
55 views

Is it possible to use PGP subkeys in multiple emails without correlating them?

I would like to know if sub-public keys of PGP keys can be published separately, if I create a pair of master keys and multiple sub keys to be used in multiple emails, and normally use only the sub ...
AvalonWeaver's user avatar
2 votes
0 answers
48 views

How to convert plaintext to element of cyclic group in Cramer-Shoup cryptosystem

I am trying to implement a cramer-shoup cryptosystem but I don't understand how to work with the plaintext I want to encrypt. From what I understand, the plaintext needs to be converted to an element ...
KoiNip's user avatar
  • 21
2 votes
1 answer
123 views

KP-ABE Key Generation

In Key Policy Attribute-based encryption if we need a targeted broadcast where the set of attributes are the same for a group of users. It means they all share the same secret key right? Or is it that ...
Crypto_researcher's user avatar
2 votes
0 answers
99 views

Why is asked that gcd(pq,(p-1)(q-1))=1 in the Paillier encryption scheme?

I don't see this property $\gcd(p\,q,(p-1)(q-1))=1$ used in the scheme. And in Paillier's original paper, I don't find this requirement. Is it required just for the difficulty of factoring $n$? Or is ...
mactep Cheng's user avatar
2 votes
0 answers
62 views

What grade of protection does a private key's passphrase provide at best?

Does a passphrase with high entropy provide the same level of security as the private key itself? General scenario: An attacker has access to a private key file that is protected with a passphrase ...
schnatterer's user avatar
2 votes
0 answers
88 views

DES decryption of the homomorphic encryption ciphertext

I implemented an application using partial homomorphic encryption for outsourced computations. To get an efficient bandwidth, I am thinking to apply (DES) symmetric algorithm to encrypt the message ...
Maka's user avatar
  • 21
2 votes
0 answers
125 views

Is the first Nonce exchange between Alice and Bob in Needham-Schroder key exchange protocol redundant?

For the Needham-Schroder protocol, assuming Alice and Bob are both able to guarantee each other's public keys (e.g. through a Certificate authority), the protocol is 1) A sends to B: $E_{publicB} [...
ackbar03's user avatar
2 votes
0 answers
39 views

What are some examples of out of bound channels that work over the Internet in practice?

If I want to verify a public key (be it RSA, PGP, etc.) with another client over the Internet only, what are some viable out-of-bound channels for verification? Which channels have been used in ...
09182736471890's user avatar
2 votes
0 answers
181 views

Recursive RSA encryption

I have a ciphertext $C$ encrypted with public key $pub_C$, which contains ciphertext $B$ and $pub_B$, $$C= E_{pub_C}(B\mathbin\|pub_B)$$ Ciphertext $B$ is encrypted with $pub_B$ and contains $pub_A$ ...
user avatar

1
2 3 4 5
7