All Questions

10
votes
4answers
3k views

If Kerckhoff's Principle holds, why do we need a cipher at all?

I understand Kerckhoff's principle, in a very practical sense, that the best attack that can be performed on a given cryptographic algorithm should be only as practical, if not less practical, than an ...
5
votes
2answers
212 views

Argon2 for both password storage and key derivation

Is using Argon2 for both password storage and key derivation secure? I'm planning on using different salt values, of course. The basic concept is something like this: Alice has some secret data ($...
3
votes
2answers
129 views

How close is AES to random oracle model?

I'm wondering if there are any guarantees about AES's randomness in comparison to Random Oracle, but I couldn't find any papers nor publications about it. Let's say I have a blackbox B which for any ...
0
votes
0answers
22 views

NIZKP that El-Gamal ciphertext is encryption of a prime number among a predefined set of prime numbers

I am working on designing an open source blockchain-based voting platform. Users receive a common public key $K_{pub}$. They cast their ballot, encrypt it with $K_{pub}$ and an ephemeral key $k$ (El-...
9
votes
3answers
1k views

Homomorphic encryption - Why does addition not imply multiplication?

As far as I know: There are some partially homomorphic encryption (PHE) systems that support either addition or multiplication. A fully homomorphic encryption (FHE) system can do addition as well as ...
-1
votes
0answers
33 views

Is there a common unit of measurement for comparison of computing power used to solve mathematical puzzles?

I just wanted to make sure if I'm reasoning correctly. So, if two computers are solving the same mathematical puzzle i.e. SHA-256 function of Bitcoin (finding nonce that satisfies difficulty target), ...
1
vote
1answer
55 views

Digital signature

I learned that a digital signature is encrypted using private key and is decrypted using public key. How does the verifier gets the public for verifying the signature? If a person has to request ...
0
votes
1answer
43 views

How to make my hash more robust to the brute force?

I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret. I want to increase the cost of brute forcing the passphrase I use to generate the secret. I'm thinking of using scrypt after ...
2
votes
1answer
58 views

Why SM2 ECC parameters does not specify cofactor h?

Recently I've been studying the ECC with the Chinese SM2 standard. One question is on standard part 5, parameters definition, it only defines $p, a, b, n, XG,$ and $YG$, but not cofactor $h$. I found ...
4
votes
1answer
134 views

Do AEADs also authenticate the nonce?

I'd like to include an authenticated timestamp in my messages. I'm wondering if I can save a little space by putting the timestamp in the nonce. Concrete example: Let's say I'm using XChaCha20-...
0
votes
1answer
42 views

Two-way secret sharing for authentication?

Secret sharing, using methods such as Shamir's Secret Sharing allows for t out of n shares to recreate a secret. For authentication, the secret can be a user ID. A client with a logged-in user can ...
1
vote
1answer
109 views

Encryption using matrix transformations

I have been thinking lately about a block cipher which takes a block of bits and arranges them in a square matrix. Then defining transforms on submatrices of the square matrix to scramble the bits. ...
0
votes
0answers
28 views

What is connection between curve used for ec_keypair generation and ClientHello extension?

Im currently experimenting setting up my first SSL server and don't understand the following scenario: My server has a generated ECC keypair with group identifier $A$ (e.g Brainpool256r1). During TLS ...
0
votes
0answers
22 views

Implememtning GKE+P Group Key agreement protocol on nodejs [migrated]

I try to implement the GKE+P protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David Pointcheval ...
-1
votes
0answers
33 views

What are some shuffling algorithms I can implement?

I am building a mixnet and right now I am looking for an algorithm that can give me a random, secret permutation when applied to the corresponding inputs. The correspondence of the inputs and outputs ...
2
votes
2answers
91 views

Safely erasing encrypted data

My secret message is encrypted in a byte buffer with AES-128 in CBC mode. The first 16 bytes are the IV and the message follows contiguously. If I want to securely delete this message is it enough ...
1
vote
0answers
38 views

Random Primes Conjecture [closed]

I know it is believed that primes appear to be randomly distributed among the integers. Is there a formal conjecture or theorem that expressly states that the occurrence of the prime numbers is ...
4
votes
1answer
67 views

What is an accurate definition for a 'Monoalphabetic substitution cipher' and why does it provide a poor level of security

From my research online, I am confused about the difference between a 'monoalphabetic cipher' and 'monoalphabetic substitution cipher'. However, I have got my answer from the websites Kifanga and ...
3
votes
1answer
109 views

Why is Diffie-Hellman Insecure If Order of the Generator Has Only Small Prime Factors?

In this post from security SE, Tom Leek mentioned that, for Diffie-Hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter. ...
2
votes
0answers
19 views

How does libgcrypt increment the counter for CTR mode? [migrated]

I have a file encrypted with AES-256 using libgcrypt's CTR mode implementation. I want to be able to decrypt the file in parts (e.g. decrypting blocks 5-10 out of 20 blocks without decrypting the ...
1
vote
1answer
73 views

How can I generate large primes for Pedersen commitment?

I want to make a commitment on Shamir's Secret Sharing, based on the work of Pedersen, "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing". To implement the commitment ...
3
votes
1answer
65 views

Security of Fast Two-Party ECDSA Signing

The paper "Fast Secure Two-Party ECDSA Signing" by Yehuda Lindell describes a system in which two parties, $P_1$ (with 1/2 of a share of a long-term ECDSA signing key $x_1$) and $P_2$ (with the other ...
2
votes
0answers
34 views

What is difference between Unipartite Secret Construction, Bipartite Secret Construction and Multipartite Secret Construction

In this paper authors extend Asmuth–Bloom and Kaya schemes to bipartite access structures and further investigate how SSSs realizing multipartite access structures can be conducted with the CRT. The ...
6
votes
1answer
189 views

Point halving on elliptic curves of even order

I am trying to understand how point halving on elliptic curves of even order works. Specifically: suppose $g$ is an elliptic curve, and $G$ is a generator point on this curve. The order of group ...
0
votes
1answer
45 views

Public key on Server Key Exchange Generation vs Public key on Server's Certificate

To understand the distinction between TLS 1.2 and TLS 1.3. I am stuck in the past understanding for TLS and the current reference I am studying: As I know certificate goes with owner's public key, ...
3
votes
1answer
236 views

Decrypting Ciphertext with partial Key Fragment using LFSR and Berlekamp-Massey

Edit Does the state register (the LFSR) always have to remain with 16 bits (I'm assuming yes). If so, are we shifting the register right by one (lfsr>>1) ...
5
votes
1answer
86 views
+50

Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ...
2
votes
0answers
62 views

Proving that a point on elliptic curve is smaller than half of group's order

Let's say I have an elliptic curve where generator $G_1$ has prime order $q$. Let's also say I have committed to a point $A_1 = a \cdot G_1$. Could I use the scheme below to prove that $a < \frac{q}...
2
votes
2answers
99 views

Why is Min-entropy significant in cryptography?

Let $H_{min}$ = Min-entropy and $H$ = Shannon entropy. Unless you're gaming the system or deliberately trying to be obtuse, very rarely is $ \frac{H} {H_{min}} > 10$ from any conceivable ...
0
votes
1answer
65 views

How to break RSA signature on XOR of hashed blocks

I'm trying to figure out if there's a way of breaking or weakening the following method of signing long messages Given $M=m_{1}m_{2}...m_{n},\,\,|m_i|=64b, \,\,h=h(m_{1})\oplus h(m_{2})\oplus\cdots\...
1
vote
0answers
44 views

Is it necessary to transmit two or three points of an elliptic curve?

Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
5
votes
2answers
116 views

Early propagation of carries in the BLAKE hash function

The BLAKE paper uses round constants derived from $\pi$ to improve diffusion, even if the additions modulo $2^{32}$ are replaced with bitwise XOR when processing a null message and null initial state: ...
2
votes
1answer
48 views

For two LUKS volumes made with the same password, can stealing the encryption key from one volume allow access to the other?

A running computer has two LUKS volumes that were made with the same password. One volume is open (key is in RAM), the other is closed. If the running computer is stolen, is the closed volume safe? ...
4
votes
2answers
203 views

How to efficiently generate a random safe prime of given length?

A prime $p$ is said to be safe prime if $(p-1)/2$ is also a prime. How to efficiently generate a safe prime? I have written the following code in sagemath which generates a random safe prime of 1536 ...
5
votes
1answer
147 views

Bit Flipping Attack on CBC Mode

To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
1
vote
2answers
59 views

Implementations of GCM with 64-bit cipher

The paper The Galois/Counter Mode of Operation (GCM) describes mainly the 128-bit case, for use with 128-bit block ciphers such as AES. AES-GCM test vectors are available from NIST. The paper also ...
14
votes
2answers
821 views

How did || come to be used in crypto texts to represent concatenation?

In RFC5647, NIST SP 800-38D, etc., || is used to denote concatenation. How did that come to be? In most programming languages ||...
1
vote
2answers
77 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
3
votes
0answers
92 views

Old French Cipher w/ Text Hidden In Drawing

I'm trying to find a cipher challenge I saw a few years back, it was an old drawing (I think 1800's or earlier) with clouds and stars on it and French text was hidden in the image. Does anyone happen ...
1
vote
0answers
47 views

ECDSA Message Recovery from Two Encrypted Messages with Signatures and Public Key

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am ...
2
votes
1answer
89 views

Proving that two points on elliptic curve are within range

Is it possible to prove that a point on an elliptic curve falls within a given range of another point, without revealing the distance between them. For example: Let's say $X$ and $Y$ are two points ...
0
votes
0answers
8 views

Trying to verify a download signature with PGP, but getting “no signed data” when passing in the .asc file? [migrated]

I tried the following steps from Verifying Signatures on the Tor Project: gpg.exe --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290 imported: 1 ...
2
votes
1answer
84 views

libSTARK TinyRAM private inputs (Zero-knowledge proofs)

I am looking into libSTARK and specifically TinyRAM and I cannot find out how to provide private inputs in a TinyRAM program. As private input I mean a variable that only the prover knows; i.e. the ...
0
votes
0answers
11 views

Production Ready Message Format Standart for Key agreements on top of XMPP

Greedings, I try to run group key agreements on top of XMPP thus I want somehow a production used message format for key agreement. As far I found theese: XEP-0384: OMEMO Encryption XEP-0102 But all ...
3
votes
2answers
148 views

Any point using CMAC with AES-256?

As we know, AES-256 is a block cipher with 256-bit key and 128-bit block size. The CMAC message authentication code outputs tag length equal to block cipher block size - thus 128 bits with AES. And ...
0
votes
0answers
37 views

Find RSA modulus, given plaintext and ciphertext [duplicate]

I have a way to get a ciphertext corresponding to any plaintext for an RSA system. However, I don't have the public key and so, I don't have the values of the modulus $n$ and the public exponent $e$. ...
3
votes
5answers
192 views

Is there a definition of the pseudo-random sequences like PRG or PRF in cryptography?

I have learned the definition of PRGs and PRFs. As I know the meaning of pseudoreandomness. I think that the pseudo-random sequence and the truly random sequence are indistinguishable. I did not find ...
0
votes
1answer
86 views

Is there distinguisher?

Are these distributions computationally indistinguishable ? $f:\{0,1\}^n \to \{0,1\}^n $ $\{X_n\}_{n\in N}$ : uniform distribution for function which $f(0^n)=0^n$ and for other function probability ...
1
vote
1answer
111 views

Given partial key exposure and encryption oracle, can we recover full AES key?

Suppose I have an encryption oracle for AES with some key $k$ (16 bytes) and that I know $n$ bytes of it. Is it possible to recover the rest ($16 - n$) in complexity less than $256^{16-n}$?
2
votes
0answers
84 views

Non-exact substitution cyphers

Picture a simple substitution cypher of text with length $N$(spaces optional): Plain : ATTACK AT DAWN Encrypted: ELLETI EL HEPG Another way to represent the encrypted text is with an $N \times N$ ...

15 30 50 per page