Questions tagged [reference-request]

A reference request is a request to be provided with a source from documentation, official papers, and specs related to one or more specific algorithms or cryptographic procedures. Open ended literature recommendation requests are off topic! Also: Crypto.SE is not an optimal replacement for a search engine. The reference-request tag is not something that provides a base to replace research efforts.

Filter by
Sorted by
Tagged with
5
votes
1answer
249 views

How difficult is inverting a non-square matrix?

Partially inspired by ring learning with errors (RLWE), I am trying to construct a cryptosystem that requires the use of a non-invertible matrix. Of the methods I've thought of to generate a matrix ...
6
votes
3answers
648 views

Has any alternative to RSA and Discrete Logarithm been standardized for deployment?

Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse? So ...
7
votes
2answers
332 views

Standard parameters for Boneh–Lynn–Shacham signature?

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature (perhaps: asymptotically). Are there standard parameters for BLS ...
4
votes
1answer
408 views

Where is HChaCha20 formally defined?

I stumbled upon the Q&A “Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?” which mentions “HChaCha20” in the question. Trying to look it up via the usual research sources, I failed to find an ...
5
votes
1answer
7k views

Public-key format for ECDSA as in FIPS 186-4?

What is the public-key format for ECDSA as in FIPS 186-4, and where is it formally defined? In particular, are there variants beyond Cartesian coordinates? Is that a pair of bitstrings, or a ...
1
vote
2answers
961 views

What are good sources for properly learning cryptography for a mathematician? [closed]

I'm a pure mathematics student(currently in a Msc program) looking to get into cryptography. I imagine most "regular" introductory books on cryptography would avoid being too heavy on mathematical ...
7
votes
4answers
2k views

When is an RNG a CSPRNG, a CSRNG, or a TRNG?

In a recent answer to a question about CSPRNGs, it was stated that… Nondeterministic algorithms where there is no such requirement, and ideally could be replaced by a true random generator. ...
1
vote
1answer
238 views

AES ShiftRow Confusion

I'm implementing AES and I'm getting confused in the ShiftRows step. So far, my key expansion and SubBytes works and I get the ...
3
votes
1answer
264 views

Fortuna: Reseeding

It is recommended that a new seed file be generated approximately every ten minutes by seed file manager in FORTUNA,though it depends on the application and on the rate of the accumulation of entropy. ...
2
votes
2answers
182 views

Good Hash and making a bad hash

It is obvious that there are different hashes. I am looking for a reference on hash complexity as it relates to strength because I am considering making a "bad hash". I have read a few things on the ...
4
votes
2answers
221 views

Special-purpose witness encryption without multilinear maps

In Witness Encryption and its Applications Garg et al describe "witness encryption" which allows one to encrypt some specified data to a NP problem, such that another party can decrypt iff they ...
4
votes
1answer
508 views

Proof of $\sqrt{\pi/2}$ in birthday paradox?

I had found in the past a publication in a crypto conference (in 80s if i am not mistaken) which I believe was the first proof why for example a random function $f:X\rightarrow X$ with $\#X=2^n,$ is ...
4
votes
1answer
312 views

O(1) EC Linkable Ring Signature Without Group Manager

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-...
6
votes
1answer
772 views

Normalization of points on an Elliptic Curve

The Bouncy Castle source code (Java edition) has a ECPoint.normalize() function. It seems to calculate the modular inverse of a coordinate of a point on the curve. ...
0
votes
1answer
149 views

Who defined semantic security?

In my opinion the most important development in cryptography in the last 30 years is the precise definition of semantic security of a cipher. This definition captures the intuitive ideas of Martin ...
-1
votes
1answer
2k views

How I can attach a signed hash to a file?

I am signing files through a web service. As I want to reduce the bandwidth consumption I am signing only hash, but I don't know how can I attach the signed hash to the file. How can I do this?
9
votes
2answers
424 views

What is the official, generally accepted definition of “lightweight crypto”?

I frequently stumble upon the term "lightweight crypto". It tends to be used is a for special algorithms that use less resources, for constrained systems. Yet, it's somewhat unclear to me where to ...
9
votes
1answer
446 views

Are there any security issues when replacing the SHA-256 initialisation values?

As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words. These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
10
votes
0answers
163 views

How exactly does ASKE (Alpha Secure Key Establishment) in Zigbee work?

I am working on Zigbee security. For key establishment, some approaches are given in Zigbee. Some of them are: ASKE (Alpha Secure Key Establishment), ASAC (Alpha Secure Access Control), and SKKE (...
1
vote
0answers
83 views

Multilinear maps for self-study [closed]

I am a final-year student in the Department of Computer Science. I do my bachelor thesis in cryptography and the subject is multilinear maps. There exists a good book describing the concepts? Or maybe ...
5
votes
1answer
100 views

Is there a standard method to compare hardware-implemented ciphers?

I have been reviewing literature and I am trying to determine the best method to compare ciphers in hardware. The two methods that seem to be somewhat de facto standard the literature are looking at ...
11
votes
3answers
2k views

Does AES-NI offer better side-channel protection compared to AES in software?

Does AES-NI offer better side-channel protection compared to AES in software? Also, it would be great of you could provide according references in your answer.
4
votes
1answer
895 views

Security difference(s) between Shamir's Secret Sharing Scheme and Blakley's Secret Sharing Scheme?

We know that Blakley's scheme is less space-efficient than Shamir's and that they both work based on pretty different aspects (Shamir = polynomial-based; Blakley = hyperplane-based). Looking at how ...
3
votes
1answer
102 views

Select a single message without showing which one has been selected

Can anyone suggest a cryptosystem for the following problem? We are working on a university research project. Problem Alice has multiple messages $M_i$, $i = 1,\ldots ,n$. Bob should obtain any, but ...
2
votes
1answer
285 views

What are methods of hash classification by finding patterns?

I have a long set of hashes (long hashes, long set) generated with the same algorithm. And for each hash I know that it belongs to one of two groups. Are there any methods of hash analysis, that ...
1
vote
0answers
126 views

Is there any concrete working example for Function Field Sieve method?

I'm new to Function Field Sieve(FFS) (Number Field Sieve(NFS) as well) method and I'm finding it is quite difficult to understand it (especially concepts of valuation at infinity, Ca,b curves etc.) ...
4
votes
3answers
210 views

Three-party protocol for multiplication with output privacy

Suppose this simple protocol with three parties: $X$ (with secret input $x$), $Y$ (with secret input $y$), and $Z$ (no input). Suppose that we are operating with elements from a finite field. The ...
1
vote
2answers
280 views

Why don't we have 256-bit security level digital signature schemes (in common use)?

Recently (2016) I've been researching on post-quantum digital signature schemes, and read about BLISS, BLZZRD, REBLISS schemes. What I've noticed about them is that they lack a parameter set for 256-...
1
vote
1answer
597 views

Key Generation for TOTP in TLS

So lately I've been studying the TLS Protocol. In particular, going through RFC 2246, section 7.4.7.1, i.e, RSA Encrypted Premaster Secret Message, I encountered: If RSA is being used for key ...
7
votes
2answers
579 views

Is there an upper limit to plaintext size in XSalsa20Poly1305?

While fiddling with the NaCl implementation in Go, specifically SecretBox, a general crypto question came up after reading the documentation. Quote: Package secretbox encrypts and authenticates ...
1
vote
1answer
190 views

What are the typical input lengths for KDFs?

I am looking for typical input lengths for key derivation functions like the HKDF. I know the parameters of HKDF, but can not find any information about typical input sizes to HKDF or any of the other ...
4
votes
1answer
467 views

How does mutlivariate crypto schemes work?

I have been studying multivariate cryptography for post-quantum cryptography lately, but I have a hard time in understanding how these signature schemes work. As long as I see there there is UOV ...
2
votes
1answer
131 views

Correlation among Psuedo Random Sequences generated from seeds which are correlated

I want to see and mathematically verify how PN sequence generated by LFSR or maximum length codes would correlate (auto-correlation and cross correlation) for seeds of varying correlation. Say I want ...
1
vote
1answer
101 views

Permutations coming from RSA

The RSA algorithm can be used to generate a permutation. Given two prime numbers $p$ and $q$, the key length is $n=pq$. If $a$ is the private key, then $b$ is the public key, where $ab \equiv 1 \...
3
votes
0answers
264 views

Shared-secret authentication with implicit session keys?

Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which ...
4
votes
1answer
1k views

What is the cryptography job market like these days? [closed]

The security field seems to have jobs aplenty, but what about cryptography specifically? Is the field ridiculously difficult to break into, even with a relevant degree, or are industry/government/...
1
vote
1answer
385 views

What are the major differences between theoretical cryptography and applied (practical) cryptography? [closed]

There are a lot of theoreticians who don´t have a clue of the applied aspects involving cryptography. Are the two disciplines mutually exclusive? Can you learn one without the other?
1
vote
1answer
121 views

Do the Syllae algorithm and Malaysian cipher from Rubicon exist?

In the first episode of a tv series Rubicon (exactly in 482 and 491 lines of an English subtitles) there is mentioned “Syllae algorithm” and “Malaysian cipher”. I could not find any details about ...
4
votes
0answers
82 views

Is there a sufficiently memory-hard asymmetric encryption available? [closed]

The Password Hashing Competition offers several memory-hard hashing algorithms that are aware of time memory trade-off and essentially try to make it hard for ASICs and FPGAs to brute-force hashes. ...
1
vote
0answers
61 views

Freely available softwares for simulating/implementing MPC protocols [closed]

I have been designing multiparty computation (MPC) protocols for functions that interest me. Although theoretically I am able to deduce the asymptotic complexity of the protocol, I wish to know as to ...
3
votes
2answers
80 views

Are there some well-known crypto APIs that leak information?

Are there any well-known crypto APIs or libraries that leak or used to leak information (it can be the key or anything else)?
6
votes
2answers
280 views

Efficiency of oblivious algorithms vs non-oblivious algorithms?

Recently, plenty of researchers are looking at designing efficient data-oblivious algorithms. Roughly speaking, an algorithm is said to be data-oblivious if its data access patterns are independednt ...
4
votes
1answer
678 views

Binary format of encrypted PGP private key?

Short Version of the Question: I would like to remove any predictable information from an encrypted private keys binary representation. Does anyone have a hint where the binary format for encrypted ...
1
vote
0answers
152 views

Encrypted comms between devices on LAN

I'm trying to encrypt a protocol that shares data between devices on a local area network (i.e.no connection to the internet). I don't want to use predefined keys because they're too easy to read from ...
3
votes
1answer
477 views

Where in FIPS documents stated that SHA-1 is not secure?

SHA-1 is not secured for a very long time, but I still can see it here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf Where in FIPS documents stated that SHA-1 is not secure?
3
votes
0answers
83 views

On a proposition in NTRU original paper: $\gamma_1 |f|_2 |g|_2 \leq |f \circledast g|_\infty \leq \gamma_2 |f|_2 |g|_2$

In the original paper of NTRU cryptosystem, we have the following proposition (that is said to be suggested by Don Coppersmith): For any $\epsilon > 0$, there are constants $\gamma_1,\gamma_2 &...
4
votes
0answers
66 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
0
votes
1answer
395 views

Documents about ZUC

ZUC is a function that converts a string to another string. However, unlike a Hash function, ZUC converts a certain-length string to a any-length string. Can someone point me to its documentation or ...
1
vote
0answers
188 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
9
votes
1answer
319 views

State recovery of Micalli-Schnorr random number generator modulo a prime

Let $p$ be a public prime of $n$ bits. Define the sequence $x_i=z_{i-1}^e \bmod p$, where $z_i$ is the $k$ high-order bits of $x_i$, and $r_i$ the remaining $n-k$ bits of $x_i$ (thus $z_i=\Big\lfloor\...

1
2
3 4 5
7