All Questions

1
vote
0answers
23 views

Proof that secret sharing based scheme is CPA secure as long as one of the scheme is CPA secure

I want to construct a CPA-secure schemes using two given schemes $\prod_1$ and $\prod_2$ if only one of them is CPA secure. Taking suggestions from this answer, I am able construct a scheme as ...
-1
votes
0answers
46 views

Unconditional security

In practice, we often use a shared (long-term) master-key $Z$ to encrypt a (one-time) session-key $K$, $T=\text{E}_Z(K)$, and use $K$ to encrypt plaintext $P$, $C=\text{E}_K(P)$, then send $(T, C)$ to ...
2
votes
1answer
57 views

handling junk bytes in chi squared character freq analysis

I'm doing the Matasano crypto challenges. After implementing a naive character frequency scoring (that worked), i was looking for something mathematically more precise and found this thread: ...
1
vote
1answer
60 views

Why is the security level defined by $\log _{2} \inf \{ t_{i}/\varepsilon_{i} \mid i \in I \}$

In public-key cryptography, the security level indicates the strength of an adversary in breaking a scheme or solving a problem, which can be seen as the time cost of breaking a scheme or solving a ...
2
votes
0answers
33 views

Generate unique pair $g^k, E(k^{-1})$ for each group

Let say I have n computers, with some t-threshold encryption scheme. I want to have n public shares (known to every participant) such that any t of them generates a pair: $g^k, E(k^{-1})$ that is ...
1
vote
1answer
58 views

Find encryption algorithm knowing input, output and secret

Today on my PC I found some old backups; they contain also some pictures I encrypted years ago with a smartphone running Windows Mobile but I don't remember the application I used to cipher them. I'm ...
1
vote
1answer
24 views

How to calculate the number of Linearly active Sbox

I cant understand the concept of linearly active sbox. In the case of differential analysis it is more easy to understand the concept of 'active sbox' Also how the increase in number of (linearly) ...
-1
votes
0answers
52 views

Can we input $(0,0)$ in ECC addition?

If I have two points which are $(0,0)$ and $(6,9)$, then I apply addition $P + Q$ in ECC .Thus the answer give $(0,0)$ or $(6,9)$? Or is it not valid? Please explain, I'm confused.
2
votes
1answer
70 views

Formal definition PRNG

I tried to look for a book that presents cryptographic concepts(specially PRNG) in a formal way but what I find is an intuitive approach. So my question is what is the formal definition of Psuedo-...
0
votes
1answer
89 views

Encryption: am I doing it right?

I'm trying to get a per-user encryption key scheme off the ground and need some validation from wiser crypto pros. Consider the following procedure: User provides registration information to include ...
0
votes
0answers
47 views

Concrete examples / tutorials of how blockchain/bitcoin works

I want to understand the crypto details behind the blockchain (at least in the form that bitcoin implements it). Can you point me to some page or documents that show the details with examples? I ...
-1
votes
2answers
93 views

Learning about Feistel Cipher

I'm learning about Feistel Ciphers at the moment, but having issues with the formulae, so I can't move on from it. Encryption: $𝐿𝐸_{𝑖+1} = 𝑅𝐸_𝑖$ $𝑅𝐸_{𝑖+1} = 𝐿𝐸_𝑖 \oplus 𝐹( 𝑅𝐸_𝑖 , 𝐾...
1
vote
1answer
32 views

Can 2 bit commitment protocols be secure when sent together with the same bit

Suppose I have 2 bit commitment schemes, C1 and C2 which are computationally hiding.Suppose I commit the same bit using both and send them to an adversary who knows that the same bit was committed. Is ...
0
votes
2answers
52 views

secret and unique random number generator within a range

I am trying to think of a way to generate secret and unique random numbers within a range. Say we have a public range [1-n], how could we have a maximum of n users choose a random number within this ...
-2
votes
0answers
16 views

Calculating s in ECDSA over GF(2m) [migrated]

I tried to calculate s over GF(m) , as integer but it is not working since the integer in vhdl has limit size specially that your working with 2^163 any help ??? thanks
0
votes
0answers
14 views

Order preserving hashes [duplicate]

Are there hash functions that dynamically take integers a and b, and output h(a) and h(b) such that if a>b we have h(a) > h(b)?
2
votes
1answer
95 views

What are implementations of PRNGs based on ChaCha20? [closed]

I thought I'd find an implementation in NaCl, but /dev/urandom is what I find. Search engines samples revealed most implementations are broken. What libraries are ...
1
vote
1answer
58 views

Can i generate a SHA512 hash if i know the SHA256 hash of some unknown data?

if the SHA256 Hash of some unknown data is known ! Can i find the SHA512 of that unknown data ?
8
votes
1answer
126 views

Obfuscating functions that are mostly zero

Let $f_k(x)$ be a boolean function of two arguments with two properties: The function $f$ can be efficiently computed. The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
0
votes
1answer
65 views

Can block ciphers encrypt messages larger than the key length?

I am trying to learn some basic cryptography and I am reading some conflicting statements about block cipher. My current understanding is that we start with an XOR to obfuscate our data. We can then ...
0
votes
1answer
30 views

Malleable version of Schnorr signature

Given an elliptic curve defined in $\mathbb{F}_{q}$ with a generator $G$ and a hash function $H_{q}(x)$ which maps $x$ to $\mathbb{F}_{q}$. A Schnorr signature variation for a data block $B$ such as: ...
4
votes
1answer
75 views

What are the uses of arbitrary length output hashes (other than OAEP)?

Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications. I know that ...
4
votes
1answer
112 views

Digital Signature Algorithm (DSA) with medium fields

I understand it when we have to solve Discrete Logarithm Problem $a^x\equiv b\pmod p$, where $a$ and $b$ are given integers and we have to find secret integer $x$ that makes the equation true for some ...
3
votes
1answer
69 views

What are the chances of an RSA signature collision?

My understanding is: fundamentally it should be hard to produce a different message with the same signature. Therefore chance of collision should be low. But what exactly is the probability of a ...
7
votes
1answer
112 views

CAESAR finalists: Lightweight case (ASCON vs ACORN)

ASCON cipher has been selected as the first choice in lightweight case and ACORN as the second. However according to Face-off between the CAESAR Lightweight Finalists: ACORN vs. Ascon paper, the ...
0
votes
0answers
27 views

Cryptographically secure PRNG from a hash function [duplicate]

Is it possible to get a secure random number generator from a secure hash function this way First choose a natural number $n$ as seed, then if we are looking to generate random numbers from $0$ to $F$...
5
votes
1answer
48 views

How were the constants chosen in round 2 and 3 in MD4?

Just reading Ron Rivest's explanation of MD4 the hash uses two round constants one $ \text{5A827999}$ on round $2$ and the other $\text{6ED9EBA1}$ on round $3$. I think they are supposed to be hex ...
0
votes
0answers
23 views

Verify Sha256Rsa message [migrated]

I have a plaintext, rsaSignature (in hex) and a cert (.cer) How can i verify the rsasignature with the plaintext and cert given. I know that i am required to extract the public key from the cert. I ...
-2
votes
0answers
55 views

Encrypting/Decrypting with a Proof of Knowledge protocol in place

Let's say I would like to encrypt a document in where I would need to securely send it to a friend where a computational problem in which he/she provides me would have to be solved in order to decrypt ...
1
vote
1answer
38 views

Diffie-Hellman: Recommendation of the base size?

Based upon choosing a prime $p$ of recommended length and $N=2p+1$, where $N$ is also prime, and $a^2$ is not congruent to $1 \pmod N$, and $a^p ≡ 1 \pmod N$, I believe you can rely upon $a$ as having ...
2
votes
1answer
60 views

Relationship between Fibonacci LFSR and Galois LFSR

I'm studying about LFSR and have some troubles understanding LFSRs. For Galois LFSR, it is clear that LFSR just multiplies $x$, the primitive element of $GF(2^n)$, so that it makes all the elements ...
3
votes
2answers
164 views

Performance metrices of cryptographic algorithms

I'm a beginner and working on cryptography performance metrics. My question is that what are the important metrics to check the performance of Cryptography Algorithms.
1
vote
0answers
39 views

Pseudorandom zero-sharing: how does it work?

TL;DR How can the shares of the PRZS protocol proposed in [CDI05] reconstruct the "secret" $0$? Is the number of shares required to reconstruct $0$ equal to $2t + 1$? Long question The paper "...
2
votes
1answer
50 views

HMAC computation using AES key

I want to compute an HMAC value of a data set using CKM_SHA256_HMAC mechanism with AES key. I have the error code CKR_KEY_TYPE_INCONSISTENT because it seems that I need to use a key of key_type ...
1
vote
0answers
44 views

Private Set Intersection using a subset of the larger set

Alice has a set $S_A$ with a low cardinality (say ~30k). Bob on the other hand has a set $S_B$ with a much higher cardinality than of Alice's (say ~100M). We're trying to create a reduced ...
0
votes
1answer
61 views

What if AES-128 key / text length is more or less than 16 characters

In this example ( https://kavaliro.com/wp-content/uploads/2014/03/AES.pdf ), the AES-128 key and text are 16 characters each, but how would this example be explained if the key or text was more/less ...
1
vote
1answer
54 views

OAEP security with variable length hash function

I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable ...
2
votes
1answer
56 views

Secure multi-party random number generation

This question is actually continuation of my previous one. Secure multi-party computation for digital signature to implement solution there, I have to generate random data for padding (I will use ...
0
votes
0answers
42 views

Simple proof of knowledge

It seems to me that signing the hash of the public key with ECDSA should be a sufficient non-interactive proof of knowledge. In my use case, I only need the guarantee that "someone even had ...
-1
votes
1answer
94 views

Can Shamir’s Trick crack the cryptographic strength of ECDSA?

Recently stumbled upon a discussion in the forum "MyMathForum" What is Shamir’s Trick used for? Are there any such examples?
2
votes
1answer
56 views

Can any hash function based on the sponge construction work as extendable output function?

Keccak provides a sort of very useful XOFs. Can other sponge construction hash function like Spongent work as XOF? Is there any lightweight XOF for hardware or software implementation?
3
votes
2answers
116 views

Determine if $f(x)+x_0+x_n$ is balanced

If $f(x)=x_0x_1\oplus x_1x_2\oplus\cdots\oplus x_{n-2}x_{n-1}\oplus x_{n-1}x_n\oplus L(x)$ is a balanced boolean function (which is a boolean function whose output yields as many 0s as 1s over its ...
0
votes
0answers
27 views

GCM optimisation using $M_0$ and $R$ tables - Calculation of $R$

I'm implementing GCM in C as a way to learn about it. In the paper titled as The Galois/Counter Mode of Operation (GCM) by McGrew and Viega on chapter 4.1, page 11, 12, they talk about the ...
4
votes
1answer
370 views

Salsa20 Implementation: Sum of 2 Words with Carries Suppressed

I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ...
3
votes
2answers
125 views

Efficient pen-and-paper calculation of the Galois Field multiplication?

I have been reading on multiplication over GF for the Inverse Matrix Step in AES, and I feel like converting the hex numbers to binary, multiplying them and then doing the modifications required for ...
0
votes
0answers
36 views

Errors in LLL cracking knapsack crypto

I am attempting to try some sample knapsack encryption problems and the attack on them using the LLL algorithm. I am using here and here as the guides. They both provide examples to walk through, ...
0
votes
2answers
40 views

Elliptic curves - operations in larger groups - performance

According to my measurements and to this work, it seems that operations, for example scalar multiplication, are more expensive in larger groups. If I have, for example, an 80-bit elliptic curve and an ...
0
votes
2answers
73 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S` = ((Z` + (X * R`)) / K`) mod n G - Base point, of order n; ...
-1
votes
1answer
100 views

Why would it be risky to let Huawei build 5G networks? [closed]

I'm wondering why there is so much debate about letting Huawei build 5G networks in Europe and other countries. Shouldn't encryption which is used more and more on the web today make all communication ...
3
votes
2answers
91 views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...

15 30 50 per page