Questions tagged [reference-request]
A reference request is a request to be provided with a source from documentation, official papers, and specs related to one or more specific algorithms or cryptographic procedures. Open ended literature recommendation requests are off topic! Also: Crypto.SE is not an optimal replacement for a search engine. The reference-request tag is not something that provides a base to replace research efforts.
86
questions
10
votes
3
answers
7k
views
Is knowing the private key of RSA equivalent to the factorization of $N$?
Given the RSA modulus $N$ the fastest method to factor it is of sub-exponent order. But, now if I know the private key $d$ of RSA, does that mean I can factor $N$ efficiently?. It intuitively seems ...
- 1,272
15
votes
2
answers
1k
views
How to do a literature search
How do I do a literature search of the research literature on cryptography? Assume there's some topic in cryptography I'd like to learn more about; how do I search the cryptographic research ...
- 36k
39
votes
1
answer
2k
views
Who first published the interest of more than two prime factors in RSA?
Multi-prime RSA is now a well known technique (described here): it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed ...
- 134k
17
votes
2
answers
6k
views
Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256
FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks:
it is possible to use an XOF as a hash ...
- 306
35
votes
4
answers
16k
views
Is there a string that's hash is equal to itself?
I was wondering if there's any string that has a hash equal to itself, so that – when using any (none specific) hash function – the hash would be equal to that string?
so that:
...
- 453
30
votes
2
answers
4k
views
When using Curve25519, why does the private key always have a fixed bit at 2^254?
When using Curve25519, the private key always seems to have a fixed bit set at position $2^{254}$.
Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private ...
- 684
13
votes
1
answer
7k
views
Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the ...
- 443
9
votes
3
answers
3k
views
Elliptic Curves of different forms
Looking at http://safecurves.cr.yp.to/ to find a safe curve, I find that most curves described here are of a different form from that generally used.
In Bouncy Castle, for example, ...
- 223
9
votes
4
answers
7k
views
Security proofs for CBC mode
I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?
- 2,817
9
votes
2
answers
810
views
Standard parameters for Boneh–Lynn–Shacham signature?
The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature (perhaps: asymptotically).
Are there standard parameters for BLS ...
- 134k
8
votes
1
answer
2k
views
How can uniformity of hash functions (e.g. SHA-256) be proved?
In reading about the Bitcoin protocol I noticed how much its proofs-of-work apparently depend on uniformity of the SHA-256 hash function. And so presumably do many other applications.
How do ...
- 243
24
votes
5
answers
12k
views
Developing algorithm for detecting plain text via frequency analysis
I'm currently attempting the Matasano Crypto Challenges as a basic intro to cryptography. For solving some of the earlier challenges I utilised n-grams to determine which is going to be the most ...
- 243
17
votes
2
answers
950
views
Status of Algebraic Eraser key exchange?
Algebraic Eraser™ is a relatively new asymmetric key agreement protocol (also designated the Colored Burau Key Agreement Protocol), based on a simultaneous conjugacy search problem in a braid ...
- 134k
11
votes
1
answer
3k
views
How much entropy is lost via hashing when you add known or low entropy data?
(I updated the title, as I think there was some confusion as to the question)
Here's the question:
For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
- 541
11
votes
1
answer
3k
views
Is every point on an elliptic curve of a prime order group a generator?
If the order of elliptic group is prime then every point is a generator of that group.
I tested the above statement on some elliptic curves and found it true.
Does that really work on all curves?
Is ...
- 121
8
votes
1
answer
4k
views
What is “Implicit Authentication”?
What is “Implicit Authentication” in the context of authentication methods?
I searched the Web but could not find any article that describes this.
If anyone can describe it, that would be a great ...
- 183
53
votes
4
answers
52k
views
Is secp256r1 more secure than secp256k1?
Curves secp256r1 and secp256k1 are both examples of two elliptic curves used in various asymmetric cryptography.
Googling for these shows most of the top results are Bitcoin related. I've heard the ...
- 1,007
20
votes
2
answers
32k
views
Does SHA-1024 hash exist?
Does SHA-1024 cryptographic hash function exist similarly to SHA-512? If not, what's the reason for that?
Links:
SHA-2 at Wikipedia
SHA-3 at Wikipedia
- 637
16
votes
6
answers
3k
views
How exactly is "true randomness" defined in the realms of cryptography?
Especially in relation to stream ciphers, I frequently read about (sometimes theoretical, sometimes practical) attacks that are able to "distinguish a ciphertext from a truly random stream".
What's ...
- 17.7k
9
votes
1
answer
1k
views
Adi Shamir's secret database of all primes
I was going through these presentation slides (PDF) on Crypto 2013.
It summarizes the paper, Factoring RSA keys from certified smart cards: Coppersmith in the wild.
In the last slide, it was ...
- 469
9
votes
1
answer
566
views
Are there any long term RC4 bias based exploits?
The RC4 cipher possibly exhibits low level bias in it's long run PRNG keystream. I'm specifically excluding short term bias attacks which I'm defining as outputs < 1024 bytes. Are there any real ...
- 14.6k
8
votes
3
answers
2k
views
What was the first MD5 collision ever constructed?
We all know that MD5's collision resistance is severly broken.
But when thinking of "random" strings with great cryptographic importance I've come up with NIST's curve seeds and MD5 collisions. But ...
- 45.5k
5
votes
3
answers
1k
views
Update to "Cryptographic Right Answers"
I'm a big fan of Colin Percival's "Cryptographic Right Answers" post.
This was written in 2009, which is a long time ago in Internet years.
Is the advice still valid or, if not, can someone point me ...
- 153
28
votes
1
answer
5k
views
Examples of modern, widely used ciphers that suddenly fell?
RC4 and GOST are two major ciphers (defined as being widely used to encrypt large amounts of data) that fell to cryptanalysis (relatively) suddenly. The first becoming totally broken and the second ...
- 4,763
24
votes
3
answers
2k
views
Selective format-compliant JPEG encryption?
I am working towards building a format-compliant encryption system for pictures. The aim of it is to be able to obscure specific areas of a picture (i.e. faces, car license numbers...) while keeping ...
- 349
16
votes
1
answer
3k
views
Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?
I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part.
What is the difference between ”ECDH with a co-...
- 191
10
votes
2
answers
14k
views
Digital Signature using symmetric key cryptography
Generally digital signature is a public key cryptography concept.But it needs high overhead.
So is there any publication or link available where 'digital signature using symmetric key' has been ...
- 201
9
votes
1
answer
637
views
Are there any security issues when replacing the SHA-256 initialisation values?
As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words.
These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
- 17.7k
9
votes
2
answers
519
views
What is the official, generally accepted definition of "lightweight crypto"?
I frequently stumble upon the term "lightweight crypto". It tends to be used is a for special algorithms that use less resources, for constrained systems. Yet, it's somewhat unclear to me ...
- 17.7k
9
votes
1
answer
1k
views
Families of public/private keys in elliptic curve cryptography
I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
- 4,709
8
votes
1
answer
2k
views
Keccak padding implementation, and bit ordering
I am trying to implement Keccak in Java for my school work. And I am getting stuck in two places:
On the summary page the padding is shown as
P = M || 0x01 || 0x00 || … || 0x00
P = P xor (0x00 |...
- 155
7
votes
1
answer
519
views
Is there a standard padding/format for RSA Blind Signatures?
I'm working on a RSA blinded signature scheme. RSA Blind signatures are discussed in Chaum's original paper and other places like wikipedia.
The descriptions of RSA blind signatures are straight ...
user10496
7
votes
2
answers
407
views
Why does NIST say that 2nd preimage resistance depends on the message length
In NIST FIPS 202 on the table, It is written as
Function
Output Size
Collision
PreImage
2nd Preimage
SHA-1
160
< 80
160
160–L(M)
SHA-224
224
112
224
min(224, 256–L(M))
SHA-512/224
224
112
224
...
- 46k
5
votes
4
answers
2k
views
Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?
For RSA cryptography, we know that the modulo $n$ is a product of two big prime numbers(say $p$ and $q$). However, in some documents I see an extension of $p=2p'+1$ and $q=2q'+1$ with $q'$ and $p'$ ...
- 205
5
votes
1
answer
2k
views
Which public key encryption scheme is re-randomizable? How can I re-randomize an encryption scheme?
Which public key encryption scheme is re-randomizable?
Is there any library for re-randomizable encryption scheme?
If not, how can I re-randomize a given public key encryption scheme?
I cannot find ...
- 905
3
votes
1
answer
518
views
Attacks on schemes based on elliptic curves when the transmitted points are not on the curve
Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does ...
- 2,015
2
votes
2
answers
274
views
Why should one model an entropy source in order to build a TRNG?
Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:-
What is a "...
- 14.6k
2
votes
1
answer
1k
views
Inverse public-key encryption
I'm in the need of an inverse public-key encryption method where you encrypt with the private key and decrypt with the public key. In other words an asymetric encryption where you can't generate the ...
- 21
1
vote
1
answer
722
views
Choosing primes in the Paillier cryptosystem
In the first step of key generation phase in Paillier cryptosystem given here.
It's given that
$$\operatorname{length}(p) = \operatorname{length}(q) ) \implies \operatorname{gcd}(pq,(p-1)(q-1))=1$$
...
- 499
19
votes
2
answers
4k
views
What is "witness encryption"?
I recently skimmed over tho papers on time-lock encryption:
“Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan
“How to Build Time-Lock Encryption” by Jager
...
- 45.5k
18
votes
3
answers
3k
views
Digital signature that is only verifiable by one specific person
I would like to digitally sign a message in such a way that the signature can only be verified by one specific person. Simply encrypting the signature will not work, because that person could then ...
- 281
18
votes
3
answers
5k
views
Webcam random number generator
I have a question about random number generators.
I have read from a real random number generator, based on a webcam ("randcam"). My problem is, that I do not really understand how the generation of ...
- 337
14
votes
0
answers
216
views
Space complexity of quantum collision search?
Is there a known way to reduce the space complexity of quantum collision search (PDF) beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below ...
user991
14
votes
1
answer
2k
views
What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?
When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
- 17.7k
13
votes
2
answers
3k
views
Has threefish successfully been attacked (practically or theoretically)?
Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating:
Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a 256-...
- 684
12
votes
6
answers
8k
views
Which cryptography technique does not increase the size of the plain data?
I want to encrypt some data(text/voice/video) but it is essential that the size of the cipher data remains the same as the plain data.
Which techniques can I use, and how secure are these techniques ...
- 359
12
votes
3
answers
2k
views
Does AES-NI offer better side-channel protection compared to AES in software?
Does AES-NI offer better side-channel protection compared to AES in software? Also, it would be great of you could provide according references in your answer.
- 167
10
votes
2
answers
2k
views
Why cannot I assume that cryptography published in venues/journals handled by the same publishers as prestigious journals is serious?
I do not know if it is allowed to ask this question.
I have been told that "most of the papers on chaos-based cryptography are appearing in fee/generalist journals, whose focus is not security&...
- 407
10
votes
1
answer
567
views
Who is the inventor of the OFB block cipher mode of operation?
Handbook of Applied Cryptography gives two resources for the OFB mode
1980 FIPS 81. This doesn't give any references, unlike NIST.
1983 ANSI X3.106, unfortunately pay-walled.
Who is the inventor of ...
- 46k
9
votes
1
answer
297
views
Is there any general description language for block ciphers?
In page 9 (16 in the PDF) of Final report of European project IST-1999-12324 (NESSIE), it is mentioned that:
The NESSIE project is also developing a new generic tool to analyze block
ciphers with ...
- 3,972