Questions tagged [public-key]
An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.
295
questions with no upvoted or accepted answers
15
votes
0
answers
1k
views
Given a 'good' basis for a lattice, how can we solve the CVP?
I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
- 4,616
7
votes
1
answer
655
views
Zero knowledge proof for Paillier addition under multiple keys
Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower)
Under a Paillier cryptosystem, set
$e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$
...
- 71
6
votes
0
answers
302
views
Is qTesla Secure?
qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
- 381
5
votes
0
answers
328
views
What public-key encryption protocol can use the same key pair as ECDSA?
Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
- 134k
4
votes
0
answers
57
views
TPM - Ecc based encryption / decryption using the public key
Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
- 766
4
votes
1
answer
46
views
UF-naCMA not implies UF-CMA
I am trying to show that UF-naCMA doesn't imply UF-CMA. UF-naCMA is actually defined as UF-CMA but the adversary should send $q \in poly$ messages $m_i$ chosen non-adaptively (i.e. all at the same ...
- 61
4
votes
0
answers
299
views
Cryptomania and NP $\cap$ co-NP
Cryptomania is usually presented as the Impagliazzo's world, which gives us public-key cryptography under the assumption that trapdoor OWFs exist.
For purposes of constructing public-key cryptography ...
- 214
4
votes
0
answers
77
views
Help with cryptanalysis of branching in schemes based on Multivariate Public Key Cryptography
I'm familiarized with the structure of branching found in Multivariate Cryptography, as it allows us to partition a $n$-tuple over $F_{q}$ into a $k$-tuple where the $i$-th element is in $F_{q^{\...
- 898
4
votes
0
answers
66
views
Generalized Benaloh cryptosystem with $r=2$
Benaloh cryptosystem requires $\gcd(r, (q-1))=1$ which is impossible if $q>2$ (since it needs to be a large prime) and $r=2$. This confuses me, since Benaloh is referred to as an "extension" or "...
4
votes
2
answers
692
views
Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)
I have few sub-questions
Do secret keys get expired, or just the public key gets expired?
Do I have to back up the master sec key each time I renew it?
For an ...
- 141
4
votes
0
answers
284
views
Where do the PKs come from in Bluetooth device?
I am studying the Elliptic Curve Diffie-Hellman (ECDH) on Bluetooth 4.2.
There are some questions about the PK..
Where do these public and private keys come from?
Who defines them?
and Will it be ...
- 41
4
votes
0
answers
679
views
Public key encryption from (1,2)-oblivious transfer
Prove that any two rounds of (1,2)-oblivious transfer, that is semi honestly secure, imply public key encryption.
My ideas so far:
Let's say Alice samples two $n$ random strings $(x_1, x_2)$, and ...
- 113
4
votes
0
answers
536
views
Why is this scheme not IND-CCA2 secure
I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead.
However, it seems that (when used as a KEM) that any $\text{IND-...
- 4,763
3
votes
0
answers
68
views
Solving DDH from an ElGamal adversary
Suppose an adversary wins IND-CPA against ElGamal,
They're given public key $h=g^x$,
Give a pair of messages $m = [m0,m1]$,
Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$,
from which ...
- 83
3
votes
0
answers
125
views
Is it possible to have a shared secret without any party knowing all the parts?
I believe with Shamir’s Secret Sharing Scheme, I can create an n-part secret and distribute each of those parts to n parties. ...
- 131
3
votes
0
answers
36
views
Have time-release servers been implemented?
Conceivably, Alice could release a public encryption key and promise to release the private decryption key on a certain date. That way anyone could use that encryption key, combined with others from ...
- 488
3
votes
0
answers
128
views
Key strength comparison: symmetric key vs RSA/DH key
I came across different reputable sources quoting different equivalent symmetric key strengths for RSA/DH keys. This NIST paper (page 67) states the following offer corresponding security strenghts (...
- 481
3
votes
0
answers
171
views
Solving LPN using algorithm for syndrome decoding
Given an algorithm $A_D$ which solves an instance of the decoding problem $e \in \mathbb{F}_2^n$ in time $T_D$ given a parity check matrix $H \in \mathbb{F}_2^{(n-k)\times n}$ and a syndrome $s \in \...
- 31
3
votes
0
answers
114
views
Verifying the ownership of curve25519 public keys
Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
- 53
3
votes
0
answers
59
views
Encryption scheme that requires fewer keys for decryption than for encryption
I want to attempt creating a decentralized dead man's switch, so I'm looking for an asymmetric encryption scheme, with the following properties (ideally), or something close to them:
There is a group ...
- 31
3
votes
0
answers
102
views
Is it possible to verify attributes of encrypted content?
Let's say that Alice has this information about her,
{ "name": "Alice", "age": 25, "eyes": "brown" }
which she encrypts with a key pair so that no one access ...
- 31
3
votes
0
answers
653
views
Where shoul I store private/public keys and how should I share it?
I'm new in terms of encryption and I have to encrypt the data between two Java Spring applications, one have serves as MVC framework and other as Web Service, I'm implementing an asymmetric encryption ...
3
votes
2
answers
279
views
How to define a FHE scheme whose plaintext space is infinite using boolean circuits?
There are many kinds of fully homomorphic encryption scheme by using boolean circuits. And the plaintext space $\mathcal{P} = \{ 0,1 \}$.
If there is a -bit FHE scheme, we can construct a FHE scheme ...
- 1,572
3
votes
0
answers
235
views
Montgomery modular multiplication – confusion with subtraction of modulus
I'm reading the paper “COMPARISON OF SCALABLE MONTGOMERY MODULAR MULTIPLICATION IMPLEMENTATIONS EMBEDDED IN RECONFIGURABLE HARDWARE” (PDF) on hardware algorithms for montgomery multiplication for ...
- 161
3
votes
0
answers
62
views
show how LWE errors can have a greater impact on result
Hi weve been given the following question in one of our classes but have not been taught anything about it and is worded strangely. It is to show how the LWE problem works by showing how small errors ...
- 51
3
votes
0
answers
496
views
RSA - factorizing $N$ to get $p$ and $q$
I need to decrypt a message encrypted using RSA. I only know the public keys $n$ and $e$.
I need to get the private key $p$ and $q$ in order to get the decryption exponent $d$. Now to do so, I know ...
3
votes
0
answers
229
views
In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$
In the NTRU cryptosystem, it is suggested to take $N$ prime.
I want to understand why.
In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
- 325
3
votes
0
answers
168
views
David Chaum's anonymous credential
I am a newbie in cryptography (I know the basic RSA, AES stuffs) and am interested in anonymous authentication systems. Looks like David Chaum is the godly figure in the field. I see lots of people ...
- 131
3
votes
0
answers
2k
views
Determining the algorithm used to generate a digital signature
I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature.
From the signed string, is it possible to find out what ...
- 2,290
3
votes
1
answer
282
views
Why gcd(r,(p-1)/r) needs to be 1 in benaloh cryptosystem
I recently discovered the benaloh cryptosystem.
I am working with the system as it is discribed in the following link:
https://en.wikipedia.org/wiki/Benaloh_cryptosystem
However I need some help in ...
- 173
3
votes
1
answer
63
views
Proof-of-Randomness with an EC Public Key
I will be using a tRNG to generate EC keypairs on a Secure Integrated Controller.
I need to demonstrate I, the issuer, can not know the private key without colluding with the user to obtain it, even ...
2
votes
0
answers
22
views
Claims about universally composable oblivious transfer, which ones are correct?
There are two papers that propose oblivious transfer protocols, both claiming to be universally composable (UC). The first protocol is more complex, and I am convinced that it is indeed UC. The second ...
- 248
2
votes
0
answers
14
views
Which channel protocol should I use to broadcast the message between parties?
I am building the Threshold Signature Scheme (TSS) based wallet. I would like to run the each party's node separately with different host. And these nodes should be able to send the messages through ...
2
votes
0
answers
54
views
How can I extend the RSA LSB Oracle attack, to n-LSBs?
Suppose we have an RSA-Oracle that can encrypt and decrypt our input. The the decryption output is equal to: $ (C^d \mod N) \mod 2^n $.
How can I extend the LSB oracle attack, using the using ...
- 21
2
votes
0
answers
33
views
A tensor-based Diffie-Hellman exchange
Below is a description of a "cube" Diffie-Hellman, based on commuting matrix actions on tensor products. Some questions:
References for something similar?
Obvious flaws, is this a terrible ...
- 265
2
votes
0
answers
52
views
Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them
Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
- 355
2
votes
0
answers
35
views
Can you derive the public key from a PGP encrypted message without knowing the message content?
I am working on a system to transfer short messages while obfuscating the intended recipient.
In essence, it combines many messages encrypted using PGP, and periodically publishes a file containing ...
2
votes
0
answers
49
views
Is it possible to use PGP subkeys in multiple emails without correlating them?
I would like to know if sub-public keys of PGP keys can be published separately, if I create a pair of master keys and multiple sub keys to be used in multiple emails, and normally use only the sub ...
- 21
2
votes
2
answers
121
views
Which solution is the more protected?
I am wondering which of these two solutions is better for security on the long run. The problem is:
Alice and Bob exchange a secret key/private key. Then they go far away from each other and never ...
- 119
2
votes
0
answers
48
views
How to convert plaintext to element of cyclic group in Cramer-Shoup cryptosystem
I am trying to implement a cramer-shoup cryptosystem but I don't understand how to work with the plaintext I want to encrypt.
From what I understand, the plaintext needs to be converted to an element ...
- 21
2
votes
0
answers
66
views
Why is asked that gcd(pq,(p-1)(q-1))=1 in the Paillier encryption scheme?
I don't see this property $\gcd(p\,q,(p-1)(q-1))=1$ used in the scheme. And in Paillier's original paper, I don't find this requirement.
Is it required just for the difficulty of factoring $n$?
Or is ...
- 143
2
votes
0
answers
238
views
TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message
I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
- 21
2
votes
1
answer
133
views
How do I encrypt a bunch of messages by different authors, shared with that group of people?
I'm still getting my head around public/private key cryptography, and I can't quite work out how to ask the right question to get an answer for this problem, but here goes!
Alice, Bob, Carol, and ...
lowercasename
2
votes
0
answers
56
views
What grade of protection does a private key's passphrase provide at best?
Does a passphrase with high entropy provide the same level of security as the private key itself?
General scenario: An attacker has access to a private key file that is protected with a passphrase ...
- 121
2
votes
0
answers
84
views
DES decryption of the homomorphic encryption ciphertext
I implemented an application using partial homomorphic encryption for outsourced computations. To get an efficient bandwidth, I am thinking to apply (DES) symmetric algorithm to encrypt the message ...
- 21
2
votes
0
answers
1k
views
Fixed point in RSA encryption
Some papers count the number of the fixed points in the RSA encryption algorithm. They're a minimum of 9 and the real number depends on the smoothness of primes $p$ and $q$.
It very unlikely that a ...
- 3,264
2
votes
0
answers
106
views
Is the first Nonce exchange between Alice and Bob in Needham-Schroder key exchange protocol redundant?
For the Needham-Schroder protocol, assuming Alice and Bob are both able to guarantee each other's public keys (e.g. through a Certificate authority), the protocol is
1) A sends to B:
$E_{publicB} [...
- 87
2
votes
0
answers
37
views
What are some examples of out of bound channels that work over the Internet in practice?
If I want to verify a public key (be it RSA, PGP, etc.) with another client over the Internet only, what are some viable out-of-bound channels for verification? Which channels have been used in ...
- 516
2
votes
0
answers
161
views
Recursive RSA encryption
I have a ciphertext $C$ encrypted with public key $pub_C$, which contains ciphertext $B$ and $pub_B$, $$C= E_{pub_C}(B\mathbin\|pub_B)$$
Ciphertext $B$ is encrypted with $pub_B$ and contains $pub_A$ ...
user33580
2
votes
0
answers
108
views
Verify commitment C commits to the same value that E encrypts
Given the following (using additive notation):
$G$ - generator of an elliptic curve group of order $q$
$s$ - secret drawn uniformly from the distribution $1..q$
$k$ and $K$ - a private public keypair
...
- 21