Questions tagged [reference-request]

A reference request is a request to be provided with a source from documentation, official papers, and specs related to one or more specific algorithms or cryptographic procedures. Open ended literature recommendation requests are off topic! Also: Crypto.SE is not an optimal replacement for a search engine. The reference-request tag is not something that provides a base to replace research efforts.

Filter by
Sorted by
Tagged with
2
votes
1answer
534 views

What is the difference between CPA and IND-CPA?

I am writing a paper and I got comments from the reviewer that I don’t really understand. Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
2
votes
2answers
2k views

PKCS#7 message content

I am using a vendor library that signs a text producing a PKCS#7 message. I'm not sure of the content of this message. Does a pkcs#7 message have to contain the signed message, the certificate, the ...
4
votes
1answer
358 views

ElGamal Signatures

I know various applications of RSA signatures. I wonder, is there any real-world applications of ElGamal signatures and encryption?
3
votes
1answer
192 views

converting finite field elements to octet strings

I need to convert elements of the finite field $GF(p^k)$, where $p$ is an odd prime, to octet strings. To be more precise, I want to include elliptic curve points over $GF(p^2)$ in a Subject Public ...
1
vote
1answer
138 views

Are there any existing ASN.1 structures for transferring symmetric keys?

Is there any reasonable ASN.1 standard to encode symmetric keys? I found PSKC, but it seems extremely heavy, and I can't quite find any library (e.g. bouncycastle) that would simplify using it. If ...
2
votes
1answer
249 views

Is succinct verification of an arbitrary data transformation theoretically possible? Is it feasible? How?

Given input string S, and transformation (i.e. computer program) T, is it possible to provide a succinct proof that another binary string S' is identical to the output T(S)? By "succinct", I ...
2
votes
1answer
86 views

TLS: How is the shared secret (via Diffie-Hellman) used in the symmetric crypto function?

So let's say we use a cipher suite with DH key exchange and AES symmetric encryption. Alice and Bob both end up with the same shared secret key $k$. How is this value ...
8
votes
3answers
1k views

What was the first MD5 collision ever constructed?

We all know that MD5's collision resistance is severly broken. But when thinking of "random" strings with great cryptographic importance I've come up with NIST's curve seeds and MD5 collisions. But ...
3
votes
1answer
714 views

Is this a proper PBKDF2 key derivation function algorithm?

I've started implementing PBKDF2 algorithm recently and since I'm new in crypto, I would like to ask if my implementation is good. I looked up some documentations and I tried to follow many of them ...
1
vote
2answers
1k views

Determining if a ciphertext can be decrypted

I want to know what the state of the art in the following cryptographic problem is. Assume a public channel on which encrypted messages are exchanged, using symmetric key encryption. I hold a couple ...
5
votes
0answers
249 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
10
votes
3answers
2k views

Is there an encryption format that preserves length and only outputs alphanumerics?

I'm trying to design a promo code system for a server app I'm designing. Basically, I generate a promo code for a certain item and give the code out to someone, who then types it into the server. ...
2
votes
1answer
558 views

Is Shoup's Practical Threshold Signatures considered secure?

I am planning to use threshold cryptography in a Java application. So far, I have only found ThresSig and a ECDSA implementation used in TwoFactorBtcWallet. However, ThresSig is based on a 15-years ...
7
votes
1answer
832 views

Where is CFB-MAC defined?

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds. Is there a standard for CFB-MAC? Where can I ...
9
votes
1answer
221 views

What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did?

I know that these functions are there to actually make the program work. What I want to know is why they made the functions one way but not another. For example, why did they pick F1(B, C, D) = (B &...
1
vote
1answer
847 views

Inverse public-key encryption

I'm in the need of an inverse public-key encryption method where you encrypt with the private key and decrypt with the public key. In other words an asymetric encryption where you can't generate the ...
0
votes
2answers
842 views

DES hardware implementation of substitution lookup table [ ReWorked ]

I'm a crypto enthusiastic and student of cryptography. I'm developing a project with other students titled "A hardware implementation of a DES cryptography for educational purposes", our idea was to ...
1
vote
0answers
178 views

Example describing Baek and Zheng’s threshold identity-based decryption scheme

I am trying to work through an example of Baek and Zheng’s “threshold identity-based decryption scheme” and I tried a lot to solve this, but somewhere I’m doing something wrong. I hope someone can ...
3
votes
1answer
1k views

How does the HOTP dynamic truncation function generalize to longer hashes?

HOTP, the HMAC-based One-Time Password algorithm from RFC 4226, uses a "dynamic truncation" function to turn the 20 byte HMAC-SHA-1 value into a 31 bit string. The dynamic truncation (from Section 5.3)...
4
votes
2answers
264 views

Are there simpler FHE methods than Craig Gentry's original paper?

Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE. I was wondering though, are there any simpler methods that have been discovered since ...
6
votes
1answer
223 views

Where can I find NTRU test vectors?

In some research work in 2001, it is stated that test vectors were not publicly available at the time. Then in this ESSS1v2 standard under IEEE1363 here , the appendix B mentions that the test vectors ...
0
votes
0answers
595 views

How can I calculate the probability of collisions of a hashing algorithm? [duplicate]

I'm pulling a “Dave” and I'm designing my own hashing algorithm. Not that I intend to use it, I'm not certifiable or anything, I just want the challenge of creating something. I'm not going to get ...
1
vote
0answers
1k views

How to calculate the avalanche effect in aes-256?

I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key. I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using ...
9
votes
1answer
1k views

What is the original SKID3 protocol?

While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it. The basic structure is the following: (1) $A \rightarrow B: r_A$ (...
3
votes
1answer
328 views

CP-ABE for threshold cryptography

I would like to know if there is any research work using CP-ABE for threshold cryptography? I want to know also if applying CP-ABE for threshold cryptography would overcome other techniques.
3
votes
1answer
511 views

Is modular Barrett reduction usable for Ed25519?

I currently try to implement Ed25519 following this draft. I have implemented every field operation except the reduction by the group order $q$ (in chapter 5). I looked for a reduction algorithm and ...
1
vote
1answer
104 views

Encryption algorithms larger than 256 Bit for “big data” encryption?

I'm somewhat new to encryption. When looking at encryption programs for big data, I frequently see a maximum of 256 bits. Why do we generally restrict our (symmetric) keys to 256 bits? Can more ...
1
vote
0answers
99 views

Prove that certain amount of data was stored

I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ...
3
votes
0answers
77 views

Words having weight near to minimum distance

I am studying the NP-Problem of the codes Syndrome Decoding. The formulation is show below. Input: a binary matrix $H$ of dimension $r \times n$ and a bit string $S$ of length $r$. Property: there ...
5
votes
2answers
5k views

How to prove that a function is not pseudorandom?

I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell. I'm struggling with the exercies which ask for proofs, like the following one: Let G(k) be a PRG with |k| ...
4
votes
4answers
3k views

Are specially designed fonts sometimes used in cryptography?

As a font designer, I was thinking that it would be very easy to design a special font that could either jumble characters of a language (or of a code) or simply (with the features offered by the OTF ...
6
votes
1answer
1k views

What is degree of randomness in individual bits of MD5 hash?

I am researching on Hashing Algorithms and would like to know if we take individual bits of MD5, say we take first 8 bits or any random 8 bits of MD5 then what is the randomness probability of having ...
1
vote
0answers
108 views

Where can I find names for cryptographic notation I don't recognize?

I'm new to this space and find myself stumbling over come cryptographic/mathematical notation. Search engines are not very helpful when copying and pasting Greek letters. Is there any reference that ...
1
vote
1answer
215 views

Does SHA-1 meet the strict avalanche criterion?

Does SHA-1 meet the strict avalanche criterion? I've been looking for a paper to cite on this, but haven't found one. It's something that seems to be easy to check (in "On the Design of S-Boxes", ...
2
votes
2answers
267 views

Question about keyed hash functions

Maybe the answer to my question is obvious, but I have doubt... I have noticed that hash functions are studied in two forms, keyed hash functions or unkeyed. In general, lecture notes present hash ...
3
votes
2answers
376 views

Inner product with homomorphic encryption

I want to do a very simple thing: Given two vectors, I want to encrypt them and do some calculation, then decrypt the result and get the inner product between both vectors. I want to do this as fast ...
3
votes
1answer
230 views

Where is SRP-Z from?

The Stanford license for SRP says: Broader use of the SRP authentication technology, such as variants incorporating the use of an explicit server secret (SRP-Z), may require a license; Yet I ...
3
votes
0answers
51 views

El-Gamal and Lines on Planes

I've been thinking about a geometric picture for El-Gamal. The idea is to understand the set $\{(my^{x},g^x) \mid x \in Z_p\}$ (the set of encryption of $m$ for fixed $g$ and $y$) by taking the $\...
14
votes
1answer
2k views

What is “witness encryption”?

I recently skimmed over tho papers on time-lock encryption: “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan “How to Build Time-Lock Encryption” by Jager ...
9
votes
2answers
341 views

Why develop Edward curve formulas that deviate from unification?

Edward curves were considered initially because they provide a unified formula for both doubling and addition, thus having inherent side-channel resistance. But a lot of work has been done recently ...
1
vote
1answer
1k views

computational complexity class of decryption of AES [closed]

I haven't really seen what computational complexity class of decryption of AES is. Can anyone provide reference papers or answers here?
0
votes
1answer
83 views

Interesting malleability property of Goldwasser-Micali PKC

GM is a cryptosystem with a modulus $N = pq$ ($p$, $q$ prime) and quadratic nonresidue $r \in (\Bbb Z / N\Bbb Z)^*$ as the public key. You can see the details on Wikipedia. Anyway, let's say that $N &...
1
vote
0answers
66 views

Commitment scheme to share money

I have such problem: party $X$ has an amount of money $M$, which it needs to share with $n$ other parties. Every week the amount of money is different. Let say not, that I am a party A, which is one ...
0
votes
0answers
62 views

Does “identity-based dynamic threshold signature” exist and could such scheme contain a “Signature Combination” algorithm?

I came across [1] and I'm very puzzled by this paper. They use a building block which they call "identity-based dynamic threshold (IBDT) signature", citing paper [2]. First of all [2] does use this ...
1
vote
1answer
402 views

What is the “Walsh Function” about?

I'm currently dealing on the so called “Walsh Function” (WF) that is written like: $$f^W(a)=\sum_{x\in{F^n_2}}(-1)^{f(x)+(a,x)}$$ What I know is that this function is used to approximate an arbitrary ...
2
votes
1answer
63 views

Use of Lamport's Signature as a primitive

Is Lamport's One Time Signature used as a primitive to construct any other cryptographic protocols?
1
vote
3answers
277 views

Is the Salsa20-GCM composition secure?

AES-GCM seems to be used by everyone, but I have never seen even one post about Salsa20-GCM. Is it secure? Wikipedia mentions ...
1
vote
0answers
97 views

Existence of encryption schemes where $F_{k}^{-1} \big( F_{k}(A) + R \big) = A + O(R)$

Is there a encryption scheme in literature, where I can do something like $$F_{k_1}^{-1} \big( F_{k_2}(A) + R \big) = A + O(R)$$ where, $A$ is a $m \times n$ real matrix, $R$ is a $m \times n$ real ...
3
votes
2answers
362 views

Differential Privacy and appropriate noise distribution

In differential privacy solutions and more specifically for queries that they do entail counting the proposed solutions define the Laplace distribution that is best calibrated for low error. Other ...
4
votes
0answers
421 views

What is the fixed point attribute of DES (when used with weak-keys) [duplicate]

I've heard in some lecture that the weak keys in DES implies the existence of $2^{32}$ fixed points in the algorithm, i.e. that $DES_k(x)=x$ for $2^{32}$ such $x$'s. I couldn't find anything about ...

1 2 3
4
5
7