Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

A reference request is a request to be provided with a source from documentation, official papers, and specs related to one or more specific algorithms or cryptographic procedures. Open ended literature recommendation requests are off topic! Also: Crypto.SE is not an optimal replacement for a search ...

0
votes
0answers
37 views

What is the computational complexity of Coppersmith's bivariate algorithm?

Coppersmith's original paper Finding a Small Root of a Bivariate Integer Equation; Factoring with High Bits Known says the algorithm to find bivariate roots under certain conditions runs in ...
2
votes
2answers
340 views

Is there a symmetric cipher that is explicitly designed to be slow?

I am trying to find a symmetric cipher that is explicitly designed to be slow. I realize that this is generally not desirable, but I'd like many cycles and lots of electronic action. I could modify ...
2
votes
2answers
72 views

Is there a way to sign a message without being allowed to see it?

I want to sign a message while not being able to see the message. Logically, there should be a way, I just don't know how this translates into cryptography. Here is an illustration for what I mean: ...
0
votes
1answer
41 views

Time-release Protocol Implementation

“How to Build Time-Lock Encryption” by Jager “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan I looked through the references, googled, searched GitHub ...
0
votes
1answer
73 views

AES MixColumns Predefined Lookup 2D Tables and Rcon Predefined Lookup 2D Table

I need to have the a copy of predefined 2D table lookup for AES MixColumns when state is multiplied by 2 and 3, 9,11,13,14 and also the Rcon predefine table. I search it everywhere but I couldn't ...
1
vote
1answer
40 views

Counting the number of binary solutions of quadratic system

I have a quadratic system of equations related to a balanced RSA modulus $n=pq$ (i.e. $\log p\approx\log q$), and I want to give an upper bound on the number of solutions. Indeed, let $p_i,q_i$ be ...
3
votes
1answer
77 views

What is Standard Referencing of Cryptography Papers

I am writing a paper. One of my references is 1)Barreto, P. and Rijmen, V., “The Khazad Legacy-Level Block Cipher,” Submission to the NESSIE Project, vol. 97, 2004. My professor criticize ...
2
votes
2answers
58 views

How is formal analysis of the strength of a round achieved?

I've been trying to understand how the number of rounds are picked for ciphers. There seems to be a minimum number of rounds that is analyzed for "strength" and then some security margin is added. ...
0
votes
1answer
49 views

Reference for the Tortoise and Hare algorithm by Floyd?

Can someone please point me to a book or paper that describes the Tortoise and Hare algorithm by Floyd? I know there are ample websites out there, but for reference purposes, I need a book or paper ...
1
vote
1answer
48 views

Can NORX be used as a general purpose hash function?

In general terms, NORX works combining a cryptographic hash function and an stream cipher. At the end of an encryption operation you end with a ciphered message plus its authenticated hash. If you ...
0
votes
1answer
173 views

Any concrete examples of the use of NIST Special Publication 800-90B?

This question relates to NIST Special Publication 800-90B, Recommendation for the Entropy Sources used for Random Bit Generation. A copy is available here. Can anyone supply a pointer to any ...
5
votes
0answers
119 views

Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
1
vote
1answer
55 views

Can you point me to an MDS table reference for the Kalyna cipher?

I'm working with cipher Kalyna. Kalyna — like AES — has MDS tables in its MixColumns step. But Kalyna's documentation doesn't list these MDS tables. Could you give me a hint where to find proper ...
2
votes
1answer
49 views

Would it be possible to negotiate a key of 128 or 256 bits strength using Merkle puzzles?

One can be fascinated by the simplicity of the schemes created by Ralf Merkle; like the Merkle tree or his key negociation protocol over an insecure channel. Wikipedia has some material on "Merkle ...
3
votes
3answers
119 views

How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...
14
votes
1answer
2k views

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
5
votes
1answer
124 views

Is there a standard padding/format for RSA Blind Signatures?

I'm working on a RSA blinded signature scheme. RSA Blind signatures are discussed in Chaum's original paper and other places like wikipedia. The descriptions of RSA blind signatures are straight ...
2
votes
0answers
59 views

*feasible* pre-image attacks against reduced SHA-1

(tldr: see last paragraph) Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is ...
6
votes
1answer
93 views

Is the context of “constant time” algorithms inclusive when you have a clock control?

There is generally a push to make algorithms and components constant time to be resistance to side channel attacks. For instance, AES-NI instructions take as many cycles as rounds; however, I can ...
1
vote
0answers
47 views

Are there any references on using neural networks to distinguish CSPRNGs?

No feasible algorithm should be able to distinguish the outputs of two CSPRNGs. Are there any research papers that present results of actually testing this? In particular, I'm interested in ...
2
votes
1answer
81 views

Are there encryption systems that are both homomorphic and commutative?

If so, which ones are? If not, is it known whether or not these are mutually exclusive? Is there a page that exhaustively lists encryption systems and properties such as these? I could not find a ...
6
votes
1answer
168 views

How difficult is inverting a non-square matrix?

Partially inspired by ring learning with errors (RLWE), I am trying to construct a cryptosystem that requires the use of a non-invertible matrix. Of the methods I've thought of to generate a matrix ...
6
votes
3answers
402 views

Has any alternative to RSA and Discrete Logarithm been standardized for deployment?

Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse? So ...
5
votes
1answer
120 views

Standard parameters for Boneh–Lynn–Shacham signature?

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature. Are there standard parameters for BLS signature, (being?) defined ...
4
votes
1answer
232 views

Where is HChaCha20 formally defined?

I stumbled upon the Q&A “Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?” which mentions “HChaCha20” in the question. Trying to look it up via the usual research sources, I failed to find an ...
5
votes
1answer
3k views

Public-key format for ECDSA as in FIPS 186-4?

What is the public-key format for ECDSA as in FIPS 186-4, and where is it formally defined? In particular, are there variants beyond Cartesian coordinates? Is that a pair of bitstrings, or a ...
1
vote
2answers
687 views

What are good sources for properly learning cryptography for a mathematician? [closed]

I'm a pure mathematics student(currently in a Msc program) looking to get into cryptography. I imagine most "regular" introductory books on cryptography would avoid being too heavy on mathematical ...
7
votes
4answers
830 views

When is an RNG a CSPRNG, a CSRNG, or a TRNG?

In a recent answer to a question about CSPRNGs, it was stated that… Nondeterministic algorithms where there is no such requirement, and ideally could be replaced by a true random generator. ...
1
vote
1answer
107 views

AES ShiftRow Confusion

I'm implementing AES and I'm getting confused in the ShiftRows step. So far, my key expansion and SubBytes works and I get the ...
3
votes
1answer
209 views

Fortuna: Reseeding

It is recommended that a new seed file be generated approximately every ten minutes by seed file manager in FORTUNA,though it depends on the application and on the rate of the accumulation of entropy. ...
3
votes
2answers
154 views

Good Hash and making a bad hash

It is obvious that there are different hashes. I am looking for a reference on hash complexity as it relates to strength because I am considering making a "bad hash". I have read a few things on the ...
4
votes
2answers
171 views

Special-purpose witness encryption without multilinear maps

In Witness Encryption and its Applications Garg et al describe "witness encryption" which allows one to encrypt some specified data to a NP problem, such that another party can decrypt iff they ...
3
votes
1answer
369 views

Proof of $\sqrt{\pi/2}$ in birthday paradox?

I had found in the past a publication in a crypto conference (in 80s if i am not mistaken) which I believe was the first proof why for example a random function $f:X\rightarrow X$ with $\#X=2^n,$ is ...
0
votes
0answers
102 views

How to prove that Asymmetric cryptography is more resource-hungry than Symmetric cryptography?

I had asked this question: Why are asymmetric cryptography keys more vulnerable to brute force attack than symmetric ones? some time back. One of the answers said that asymmetric cryptography is ...
4
votes
1answer
223 views

O(1) EC Linkable Ring Signature Without Group Manager

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-...
7
votes
1answer
444 views

Normalization of points on an Elliptic Curve

The Bouncy Castle source code (Java edition) has a ECPoint.normalize() function. It seems to calculate the modular inverse of a coordinate of a point on the curve. ...
0
votes
1answer
118 views

Who defined semantic security?

In my opinion the most important development in cryptography in the last 30 years is the precise definition of semantic security of a cipher. This definition captures the intuitive ideas of Martin ...
-2
votes
1answer
876 views

How I can attach a signed hash to a file?

I am signing files through a web service. As I want to reduce the bandwidth consumption I am signing only hash, but I don't know how can I attach the signed hash to the file. How can I do this?
8
votes
2answers
303 views

What is the official, generally accepted definition of “lightweight crypto”?

I frequently stumble upon the term "lightweight crypto". It tends to be used is a for special algorithms that use less resources, for constrained systems. Yet, it's somewhat unclear to me where to ...
9
votes
1answer
357 views

Are there any security issues when replacing the SHA-256 initialisation values?

As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words. These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
9
votes
0answers
110 views

How exactly does ASKE (Alpha Secure Key Establishment) in Zigbee work?

I am working on Zigbee security. For key establishment, some approaches are given in Zigbee. Some of them are: ASKE (Alpha Secure Key Establishment), ASAC (Alpha Secure Access Control), and SKKE (...
1
vote
0answers
76 views

Multilinear maps for self-study [closed]

I am a final-year student in the Department of Computer Science. I do my bachelor thesis in cryptography and the subject is multilinear maps. There exists a good book describing the concepts? Or maybe ...
5
votes
1answer
95 views

Is there a standard method to compare hardware-implemented ciphers?

I have been reviewing literature and I am trying to determine the best method to compare ciphers in hardware. The two methods that seem to be somewhat de facto standard the literature are looking at ...
10
votes
3answers
1k views

Does AES-NI offer better side-channel protection compared to AES in software?

Does AES-NI offer better side-channel protection compared to AES in software? Also, it would be great of you could provide according references in your answer.
5
votes
1answer
654 views

Security difference(s) between Shamir's Secret Sharing Scheme and Blakley's Secret Sharing Scheme?

We know that Blakley's scheme is less space-efficient than Shamir's and that they both work based on pretty different aspects (Shamir = polynomial-based; Blakley = hyperplane-based). Looking at how ...
3
votes
1answer
96 views

Select a single message without showing which one has been selected

Can anyone suggest a cryptosystem for the following problem? We are working on a university research project. Problem Alice has multiple messages $M_i$, $i = 1,\ldots ,n$. Bob should obtain any, but ...
3
votes
1answer
90 views

What are methods of hash classification by finding patterns?

I have a long set of hashes (long hashes, long set) generated with the same algorithm. And for each hash I know that it belongs to one of two groups. Are there any methods of hash analysis, that ...
1
vote
0answers
88 views

Is there any concrete working example for Function Field Sieve method?

I'm new to Function Field Sieve(FFS) (Number Field Sieve(NFS) as well) method and I'm finding it is quite difficult to understand it (especially concepts of valuation at infinity, Ca,b curves etc.) ...
5
votes
3answers
151 views

Three-party protocol for multiplication with output privacy

Suppose this simple protocol with three parties: $X$ (with secret input $x$), $Y$ (with secret input $y$), and $Z$ (no input). Suppose that we are operating with elements from a finite field. The ...
1
vote
2answers
205 views

Why don't we have 256-bit security level digital signature schemes (in common use)?

Recently (2016) I've been researching on post-quantum digital signature schemes, and read about BLISS, BLZZRD, REBLISS schemes. What I've noticed about them is that they lack a parameter set for 256-...