Questions tagged [public-key]

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.

Filter by
Sorted by
Tagged with
4
votes
1answer
673 views

How to protect against ephemeral key reuse in some signature schemes?

Given that some signature schemes (for instance Elgamal) use an ephemeral key that cannot be reused ever. How do people usually protect against this? I'll elaborate more: if you reuse the ephemeral ...
1
vote
0answers
8 views

Can a PKE scheme be turned into a signature scheme?

Recently, I have been wondering whether you can turn any PKE scheme into a signature scheme and, if so, how (is there a general construction, or is this scheme-specific?). I have found several posts ...
-4
votes
2answers
40 views

RSA impossible to be factorized?

So if the RSA numbers are odd, how can they be factorizes by two primes? Since a prime is only divisible by itself and 1?!
0
votes
1answer
28 views

Does CPA model the challenge plaintext are the same

For a CPA-secure encryption scheme, suppose that there is an adversary who can find that the two ciphertexts are encrypted from the same plaintext. Is this encryption scheme still CPA secure? Or, CPA ...
1
vote
1answer
85 views

How to find integer point of a ec curve in a given range?

I was looking inside the basics of ecc and found the examples from Internet either uses continuous domain curve or use a very small prime number p like 17 in a ...
1
vote
0answers
24 views

Private Key from Extended Private Key and Public Address [closed]

Is it possible to generate a private key from a public address and an extended private key? For context: I am using C# and NBitcoin. The public address is generated from the outside via an extended ...
0
votes
0answers
49 views

Can Pollard Rho be used break cryptographic hash functions such as RIPEMD-160? [closed]

Can a Pollard Rho algorithm be used break cryptographic hash functions such as RIPEMD-160, so that the output would be a public key? If so, what are the estimated number of calculations based on the ...
1
vote
2answers
967 views

What is a good and bulletproof private key for ECC curves?

I am quite new to cryptography low-level mathematic details, though had worked in the crypto area for 2.5 years before. So if I am wrong about any of below part, please correct me without a facepalm ...
0
votes
0answers
23 views

User key management scheme: BYOK vs. client only keys vs. a mix of both

We are designing a web app where users can share documents with each other. The ultimate goal is to achieve zero trust needed by the users, i.e. client-side encryption makes sure that the servers (or ...
27
votes
1answer
13k views

Multi-party encryption algorithm

To give some foreground information: I acknowledge that I am a cryptography newb and not by any means an expert (and probably never will be). In a recent CS class we had several assignments writing ...
5
votes
3answers
394 views

Can an arbitrary physical image be a key?

Assume an arbitrary secret physical image¹, such as a privately made chemical Polaroid™ similar to this Is there a feasible and secure way that this physical image could be used as cryptographic key, ...
0
votes
1answer
30 views

Can I use a certificate authority with Elgamal encryption?

Can I use a certificate authority with Elgamal encryption? Is this type of keys in CA?
0
votes
0answers
33 views

Use Diffie Hellman to share a secret

I was trying to use Diffie Hellman to first agree on a key and then use that key to symmetrically share a secret. The python3 code using cryptography library look like ...
5
votes
2answers
500 views

EdDSA Verification vs. Cofactorless Verification

In the EdDSA for more curve paper the authors defines: Keys An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = 2^n+\sum_{c≤i<n} ...
1
vote
2answers
134 views

RSA algorithm implementation

$$m^{ed} \equiv m \bmod n$$ $n =pq$, so by Chinese Remainder Theorem it is equivalent to $$m^{ed} \equiv m \bmod 𝑝, m^{ed} \equiv m \bmod q$$ where $n=p\cdot q$ So how did 2 come from 1 by the ...
0
votes
1answer
28 views

Congruence in the Schnorr identification scheme

I have been looking at the Cryptography: Theory and Practice book by Stinson and Paterson and when I came to the Schnorr identification scheme, I read the sentence that goes something like this: ...
0
votes
0answers
22 views

Authentication between two servers using PKA

I've run into an small issue regarding authentication between 2 services (One way communication) using public and private key authentication (Elliptic Curve, secp256k1). The services will communicate ...
0
votes
3answers
104 views

Asymmetric cryptosystems based on curves besides elliptic curves

Elliptic curve cryptography (ECC) has been gaining a lot of popularity recently because of its security. I tend to find the process of encoding plaintext using ECC particularly interesting so I was ...
2
votes
0answers
24 views

MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?

Background MuSig is an extension of/derivation from Schnorr signatures using cyclic groups on elliptic curves. In the original paper, the authors point out that naive multi-Schnorr is vulnerable to a ...
1
vote
1answer
19 views

Asymmetric Encryption Using Existing Secret Key

I'm using Python to build a system in which users (accounts on a blockchain: defined by a public key and a secret key) need to communicate with each other securely and I think asymmetric encryption is ...
8
votes
0answers
333 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard? [duplicate]

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
3
votes
1answer
322 views

Is Paillier secure from known plaintext attack for single character message?

Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3. Does that mean that c1=c2=c3 in cipher-text from ? If not, how many times can I encrypt a message m=1 and still ...
0
votes
1answer
41 views

Question on double-asymmetric encryption and split knowledge

Moin moin, Let‘s assume there are two keypairs (d1,e1) and (d2,e2), where d1 and ...
1
vote
1answer
67 views

How do I encrypt a bunch of messages by different authors, shared with that group of people?

I'm still getting my head around public/private key cryptography, and I can't quite work out how to ask the right question to get an answer for this problem, but here goes! Alice, Bob, Carol, and ...
7
votes
4answers
2k views

Can we pick which key is private or public in asymmetric encryption? Do the keys actually encrypt and decrypt a cipher text?

Could you help me better understand how the key-pair works in Asymmetric encryption? I'm studying cryptography at the surface level first. While reading multiple texts and talking with colleagues I'm ...
0
votes
1answer
27 views

(Non)security of algebraically derived EC keys

I recently had a situation where I needed to derive a secondary Curve25519 private key from an existing one programmatically. The obvious solution was to use a KDF, but I wondered at the time about ...
6
votes
1answer
481 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
2
votes
1answer
167 views

How can a public-key encryption scheme be used to construct a commitment scheme in the CRS model?

For a PKE scheme $(Gen, Enc, Dec)$, the most 'obvious' idea is to commit to an encryption of a bit and in the reveal phase maybe send $r_g$, $r_e$ where $r_g$ is the randomness of $Gen$ and $r_e$ is ...
0
votes
2answers
167 views

BIKE: Bit Flipping Key Encapsulation - Inverse encryption / decryption

I'm trying to understand white paper about BIKE Asymmetric crypt. And actually read about the inverse matrix that needs to be produced for decryption. My concern is: Can I actually encrypt data with ...
3
votes
1answer
99 views

Asymmetric encryption scheme with the shortest output for encrypting 1 byte of information

Imagine that one needs to periodically encrypt very short messages (i.e., a boolean Yes/No, a single byte, or 3-4 bytes in the worst case). We assume that there is no session, and we just need to ...
1
vote
1answer
74 views

Proof that someone has access to a private key whose public key is part of a known group

I'm a crypto newbie and hoping to get pointed in the right direction. I've seen some related questions like this but none that satisfy my requirements. Let's say Jane's Forum is a large community, and ...
0
votes
0answers
46 views

Saving highly sensitive data in US cloud - what encryption would you use?

We have a cloud-based application running on AWS servers and are looking for a way to store highly sensitive user data there without giving AWS the possibility of exposing our data to the US ...
7
votes
1answer
2k views

Why are NIST curves still used?

I'm relatively new to the world of crypto (But as far as the math goes, I am familiar with the inner workings. I used to rarely use it for privacy, but now I use it for many things). Anyway, I was ...
16
votes
3answers
3k views

Information about RSA key pair generation with backdoor?

Someone posted an article on Reddit a few days ago, and I haven't found much about it except for links back to the same page. And for a brief summary, essentially, it's possible to introduce a ...
0
votes
0answers
45 views

How many keys are used in symmetric, asymmetric, and hybrid encryption?

There are 8 people in total working on a project. Each one of them will send information to the rest of the team individually 2 times a day. They use 6 days in total for this project. Cryptosystem 1: ...
3
votes
1answer
65 views

Why is an ephemeral key required to prove possession of a static private key in Key-Establishment Schemes

In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 5.6.2.2.3.2 "Recipient Obtains Assurance [of the ...
0
votes
1answer
27 views

Related Key Attack on Schnorr Signature - Why does the challenge include $\psi = g^x$, not $y$?

The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent ...
0
votes
1answer
32 views

How to do the WOTS checksum

As far as I understand, the Winternitz one-time signature is made by: Making an array of private keys. Making an array of public keys by hashing each private key X times, X being the number of ...
1
vote
1answer
72 views

How to determine whether a point is greater than n/2?

How can we determine if a private key associated with a point, on an EC, is less than or greater than 1/2 $n$, where $n$ is the order?
2
votes
0answers
54 views

Asymmetric encryption, multiple recipients, traitor must share private key

Is there an asymmetric encryption scheme, or public-key encryption, where multiple recipients can access the data, but in order for one of the recipients to leak the key to the data, they would need ...
18
votes
3answers
1k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
0
votes
2answers
396 views

Counterfeit EU Green Passes

In the EU, a person will soon be able to perform certain activities (going to concerts, to sports events, etc.) only if they can present a valid Green Pass that certifies that the bearer has been ...
0
votes
1answer
34 views

What information is needed to be stored for RSA private key for decryption

I am using rsa module in Python. I use the following line to generate public and private key: ...
3
votes
1answer
87 views

Proof that a message is signed by a member of a group

I'm a newbie at cryptography. Here is my question: Alice makes a list of people: Bob, Carol and Dan; Alice gives a unique secret key to every member on the list, so they can uniquely sign messages; ...
1
vote
1answer
100 views

Combined scheme security proof

Let CS be a combined scheme of $n$ public key subschemes. CS is composed of two algorithms Setup and KeyGen, that all the subschemes share, plus all the other algorithms of each subscheme. Suppose ...
0
votes
0answers
23 views

Generating public/private key pair without a trusted dealer

I want to make an Ethereum wallet where I can prove no one has the private keys in one place. Basically, I was wondering whether the ECDSA signatures could be generated by multiparty computation like ...
6
votes
1answer
677 views

How to determine if a point is just a point or a valid public key?

In ECC, specifically over finite fields, in my mind there must be other points that exist that still yield $y^2 \bmod p=x^3 + ax + b \bmod p$ to be true but are never used because the Generator Point (...
2
votes
1answer
83 views

What's the use of storing R^2 with a public key?

I think I have successfully reverse engineered a Samsung RSA public key here. However, the public key mainly seems to consist of the modulus, but it also contains a 32 bit integer ...
6
votes
1answer
3k views

Why does gnupg create 4 separate keys and what does sub and ssb mean?

When using gpg to create a single key, I get: ...
1
vote
2answers
253 views

How can we encrypt a file to be just readable (and not writable) after decryption?

Is it possible to encrypt a file (e.g., a text document) such that when a user decrypts it, he/she be able to just read the file and not be able to change the content of the file? I mean, the result ...

1
2 3 4 5
39