All Questions

18,453 questions
23 views

Proof that secret sharing based scheme is CPA secure as long as one of the scheme is CPA secure

I want to construct a CPA-secure schemes using two given schemes $\prod_1$ and $\prod_2$ if only one of them is CPA secure. Taking suggestions from this answer, I am able construct a scheme as ...
46 views

Unconditional security

In practice, we often use a shared (long-term) master-key $Z$ to encrypt a (one-time) session-key $K$, $T=\text{E}_Z(K)$, and use $K$ to encrypt plaintext $P$, $C=\text{E}_K(P)$, then send $(T, C)$ to ...
57 views

handling junk bytes in chi squared character freq analysis

I'm doing the Matasano crypto challenges. After implementing a naive character frequency scoring (that worked), i was looking for something mathematically more precise and found this thread: ...
60 views

Why is the security level defined by $\log _{2} \inf \{ t_{i}/\varepsilon_{i} \mid i \in I \}$

In public-key cryptography, the security level indicates the strength of an adversary in breaking a scheme or solving a problem, which can be seen as the time cost of breaking a scheme or solving a ...
33 views

Generate unique pair $g^k, E(k^{-1})$ for each group

Let say I have n computers, with some t-threshold encryption scheme. I want to have n public shares (known to every participant) such that any t of them generates a pair: $g^k, E(k^{-1})$ that is ...
58 views

Find encryption algorithm knowing input, output and secret

Today on my PC I found some old backups; they contain also some pictures I encrypted years ago with a smartphone running Windows Mobile but I don't remember the application I used to cipher them. I'm ...
24 views

How to calculate the number of Linearly active Sbox

I cant understand the concept of linearly active sbox. In the case of differential analysis it is more easy to understand the concept of 'active sbox' Also how the increase in number of (linearly) ...
52 views

Can we input $(0,0)$ in ECC addition?

If I have two points which are $(0,0)$ and $(6,9)$, then I apply addition $P + Q$ in ECC .Thus the answer give $(0,0)$ or $(6,9)$? Or is it not valid? Please explain, I'm confused.
70 views

Formal definition PRNG

I tried to look for a book that presents cryptographic concepts(specially PRNG) in a formal way but what I find is an intuitive approach. So my question is what is the formal definition of Psuedo-...
89 views

Encryption: am I doing it right?

I'm trying to get a per-user encryption key scheme off the ground and need some validation from wiser crypto pros. Consider the following procedure: User provides registration information to include ...
47 views

Concrete examples / tutorials of how blockchain/bitcoin works

I want to understand the crypto details behind the blockchain (at least in the form that bitcoin implements it). Can you point me to some page or documents that show the details with examples? I ...
93 views

65 views

Can block ciphers encrypt messages larger than the key length?

I am trying to learn some basic cryptography and I am reading some conflicting statements about block cipher. My current understanding is that we start with an XOR to obfuscate our data. We can then ...
30 views

Malleable version of Schnorr signature

Given an elliptic curve defined in $\mathbb{F}_{q}$ with a generator $G$ and a hash function $H_{q}(x)$ which maps $x$ to $\mathbb{F}_{q}$. A Schnorr signature variation for a data block $B$ such as: ...
75 views

What are the uses of arbitrary length output hashes (other than OAEP)?

Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications. I know that ...
112 views

Digital Signature Algorithm (DSA) with medium fields

I understand it when we have to solve Discrete Logarithm Problem $a^x\equiv b\pmod p$, where $a$ and $b$ are given integers and we have to find secret integer $x$ that makes the equation true for some ...
69 views

What are the chances of an RSA signature collision?

My understanding is: fundamentally it should be hard to produce a different message with the same signature. Therefore chance of collision should be low. But what exactly is the probability of a ...
112 views

CAESAR finalists: Lightweight case (ASCON vs ACORN)

ASCON cipher has been selected as the first choice in lightweight case and ACORN as the second. However according to Face-off between the CAESAR Lightweight Finalists: ACORN vs. Ascon paper, the ...
27 views

Cryptographically secure PRNG from a hash function [duplicate]

Is it possible to get a secure random number generator from a secure hash function this way First choose a natural number $n$ as seed, then if we are looking to generate random numbers from $0$ to $F$...
48 views

How were the constants chosen in round 2 and 3 in MD4?

Just reading Ron Rivest's explanation of MD4 the hash uses two round constants one $\text{5A827999}$ on round $2$ and the other $\text{6ED9EBA1}$ on round $3$. I think they are supposed to be hex ...
23 views

Verify Sha256Rsa message [migrated]

I have a plaintext, rsaSignature (in hex) and a cert (.cer) How can i verify the rsasignature with the plaintext and cert given. I know that i am required to extract the public key from the cert. I ...
55 views

Encrypting/Decrypting with a Proof of Knowledge protocol in place

Let's say I would like to encrypt a document in where I would need to securely send it to a friend where a computational problem in which he/she provides me would have to be solved in order to decrypt ...
38 views

Diffie-Hellman: Recommendation of the base size?

Based upon choosing a prime $p$ of recommended length and $N=2p+1$, where $N$ is also prime, and $a^2$ is not congruent to $1 \pmod N$, and $a^p ≡ 1 \pmod N$, I believe you can rely upon $a$ as having ...
60 views

Relationship between Fibonacci LFSR and Galois LFSR

I'm studying about LFSR and have some troubles understanding LFSRs. For Galois LFSR, it is clear that LFSR just multiplies $x$, the primitive element of $GF(2^n)$, so that it makes all the elements ...
164 views

Performance metrices of cryptographic algorithms

I'm a beginner and working on cryptography performance metrics. My question is that what are the important metrics to check the performance of Cryptography Algorithms.
39 views

Pseudorandom zero-sharing: how does it work?

TL;DR How can the shares of the PRZS protocol proposed in [CDI05] reconstruct the "secret" $0$? Is the number of shares required to reconstruct $0$ equal to $2t + 1$? Long question The paper "...
50 views

HMAC computation using AES key

I want to compute an HMAC value of a data set using CKM_SHA256_HMAC mechanism with AES key. I have the error code CKR_KEY_TYPE_INCONSISTENT because it seems that I need to use a key of key_type ...
44 views

Private Set Intersection using a subset of the larger set

Alice has a set $S_A$ with a low cardinality (say ~30k). Bob on the other hand has a set $S_B$ with a much higher cardinality than of Alice's (say ~100M). We're trying to create a reduced ...
61 views

What if AES-128 key / text length is more or less than 16 characters

In this example ( https://kavaliro.com/wp-content/uploads/2014/03/AES.pdf ), the AES-128 key and text are 16 characters each, but how would this example be explained if the key or text was more/less ...
54 views

OAEP security with variable length hash function

I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable ...
56 views

Secure multi-party random number generation

This question is actually continuation of my previous one. Secure multi-party computation for digital signature to implement solution there, I have to generate random data for padding (I will use ...
42 views

Simple proof of knowledge

It seems to me that signing the hash of the public key with ECDSA should be a sufficient non-interactive proof of knowledge. In my use case, I only need the guarantee that "someone even had ...
94 views

Can Shamir’s Trick crack the cryptographic strength of ECDSA?

Recently stumbled upon a discussion in the forum "MyMathForum" What is Shamir’s Trick used for? Are there any such examples?
56 views

Can any hash function based on the sponge construction work as extendable output function?

Keccak provides a sort of very useful XOFs. Can other sponge construction hash function like Spongent work as XOF? Is there any lightweight XOF for hardware or software implementation?
116 views

Determine if $f(x)+x_0+x_n$ is balanced

If $f(x)=x_0x_1\oplus x_1x_2\oplus\cdots\oplus x_{n-2}x_{n-1}\oplus x_{n-1}x_n\oplus L(x)$ is a balanced boolean function (which is a boolean function whose output yields as many 0s as 1s over its ...
27 views

GCM optimisation using $M_0$ and $R$ tables - Calculation of $R$

I'm implementing GCM in C as a way to learn about it. In the paper titled as The Galois/Counter Mode of Operation (GCM) by McGrew and Viega on chapter 4.1, page 11, 12, they talk about the ...
370 views

Salsa20 Implementation: Sum of 2 Words with Carries Suppressed

I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ...
125 views

Efficient pen-and-paper calculation of the Galois Field multiplication?

I have been reading on multiplication over GF for the Inverse Matrix Step in AES, and I feel like converting the hex numbers to binary, multiplying them and then doing the modifications required for ...
36 views

Errors in LLL cracking knapsack crypto

I am attempting to try some sample knapsack encryption problems and the attack on them using the LLL algorithm. I am using here and here as the guides. They both provide examples to walk through, ...
40 views

Elliptic curves - operations in larger groups - performance

According to my measurements and to this work, it seems that operations, for example scalar multiplication, are more expensive in larger groups. If I have, for example, an 80-bit elliptic curve and an ...
73 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S = ((Z + (X * R)) / K) mod n G - Base point, of order n; ...