All Questions

2
votes
1answer
37 views

Elliptic curves on finite fields

I've been reading: https://github.com/bellaj/Blockchain/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf On page 22 it shows an eliptic curve over F17. I have added the orange lines ...
2
votes
0answers
17 views

Asmuth-Bloom Secret Sharing $m_0$ public?

i am trying to figure out how Asmuth-Bloom secret sharing works and followed the example on wikipedia and replaced it with own numbers. Namely, i used: $S=3$ $k=3$ $n=4$ $m_0 = 13, m_1=45, m_2=46, ...
1
vote
1answer
46 views

SHA-1 collision for strings of two symbols

Is it possible to have strings of two (Unicode) symbols with equal SHA-1 hash? For example, smth like "ab", "ba".
1
vote
1answer
838 views

RSA: Is it possible to recover the plaintext given that we have the ciphertext and the public key?

The $N$ and ciphertext are huge number that is more than 600 digits long. I'm trying to find the prime factors of $N$ in order to get $p$ and $q$. Using $p$ and $q$ I can get $\phi(n)$. And using $...
2
votes
0answers
12 views

Is there an advantage to using a hash in combination with a key-derivation function?

Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap. It is currently recommended by OWASP to use an adaptive key-derivation ...
-4
votes
0answers
17 views

Given a cipher text, How to start the attack on it? How to identify what cipher has been used to encrypt it?

I have a cipher text which contains english alphabets only. How to figure out what method has been used to encrypt it. It doesn't seems a good idea to try all known encryption methods.
1
vote
0answers
31 views

Zero knowledge proofs for a Merkle Tree

Say I have a publicly available Merkle tree, and I want to prove the existence of a leaf (containing a number, maybe) in the tree. I could give the path along with the siblings, for a normal Merkle ...
1
vote
1answer
22 views

AES-256-CBC with random IV - storing same plaintext as same ciphertext

I am encrypting some information stored in a column of a MySQL database. The column can contain repeated values, let's say the table has 7 rows and the column to be encrypted has the following values:...
0
votes
1answer
22 views

One-way function with combination sets as output / image

One-way functions generally operate on bit strings, for the input and the output. Are there any examples of one-way functions that produce a combination set in output? Let's call this function $f$. ...
1
vote
0answers
49 views

Diffie hellman: fixed modulus a risk?

In DH, are algorithms with fixed modulus p (large safe prime) to be avoided? What if it was changed every x minutes?
2
votes
1answer
46 views

Can the Keccak sponge construction be used to create a random permutation of bit strings of length $n$, where $n$ can be any positive integer?

I need an efficient, invertible random permutation of $n$-bit strings, defined by a $128$-bit key. $n$ can be any positive integer from $6$ to $128$. I have no requirements on the security of the ...
3
votes
1answer
59 views

Is it possible to validate an email address without the user actually revealing the email address?

Say hypothetically I want a service where users express their opinions. But those opinions are heavily dependent upon where they work, and the best way to prove that they actually work at a specific ...
1
vote
0answers
23 views

berlekamp massey feedback polynomial

I have a couple of polynomials to find. Can anybody guide me with the steps to find the feedback polynomial using berlekamp massey's algorithm. Example: Key fragment: 10100100001001101001011 seed: ...
0
votes
0answers
38 views

Strong pseudo random permutation implies CCA-security

Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows: On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
-2
votes
1answer
78 views

What is the difference between $\bmod{p - 1}$ and $\bmod p$

I have a doubt in my research work, can anyone tell me; What is the difference between $\bmod {p-1}$ and $\bmod p$
1
vote
0answers
14 views

Temporal or spatial digital signatures

Digital signatures allow authentication of content based on a secret held by the signing entity. Are there any existing schemes, proposals or even services for letting "location" or "time" sign the ...
1
vote
0answers
34 views

SEAL - binary encoded ciphertext

In SEAL, am I able to convert a ciphertext that is encoded with polynomial to a ciphertext that is encoded as binary?
14
votes
2answers
1k views

Is there a contingency plan in the event of a catastrophic attack on AES?

NIST selected Rijndael in 2000 to be AES. In a paper from the Serpent authors, they mention that there was the possibility of choosing a second cipher as a backup in the case of any severe breaks: ...
-1
votes
1answer
70 views

AES based question

The minimum key length for the AES algorithm is 128 bit. Assume that a special-purpose hardware key-search machine can test one key in 10 ns on one processor. The processors can be parallelized. ...
0
votes
0answers
28 views

Store the public key and private key [on hold]

i want to implement digital signature scheme in my form sign up in my web, and i read all PKCS from PKI but it made me little confused. i have many questions, where i store my public and private key ? ...
1
vote
1answer
54 views

One-Time-Pad with multiple keys?

Would it be more secure if we used multiple keys in a One-Time-Pad encryption?
8
votes
2answers
626 views

Concrete evidence for the asymptotics of $\lambda_1(\Lambda^\perp(A))$?

A recent eprint paper claims to bound $\lambda_1(\Lambda^\perp(\mathbf{A}))$ for $\mathbf{A}\in\mathbb{Z}^{n\times m}$, a uniformly random matrix, by $O(1)$, specifically by $4$. This has applications ...
1
vote
0answers
35 views

Why (N+1)sec's mDP Implementation does not check whether all the XORED received $z$ values are 0

In the original mDP protocol once all $z$ values received from each participant the following calculation is being done: If either $XOR(z_1,z_2,...,z_n) = 0 $ or received invalid Signature then ...
0
votes
0answers
21 views

RSA-based encryption scheme and random oracle

I don't really get how this problem should be solved. My main issue is with the random oracle generally, a short explanation of ROs and how they are used in such proofs maybe with this example will ...
-1
votes
0answers
19 views

is a safe prime subgroup length important?

For most cryptographers, my question may appear silly. Context: Diffie Hellman. Object: finding good primes. Code: given that NodeJS program: ...
-1
votes
0answers
30 views

Secure comparison protocol

I want to implement the existing comparison protocol using SEAL. For private comparison checking the existence of a 0 is possible with DGK scheme. Is there any other way to do it without DGK scheme? ...
2
votes
1answer
32 views

ElGamal variant

I came across this problem, while currently reading "Introduction to Modern Cryptography" by Katz and Lindell. I am new to crypto and just trying to go through the book and solve the exercises, ...
-1
votes
0answers
21 views

How to select best safe primes for DH <-> subgroups?

I run a test on some safe primes. Here is the code: ...
1
vote
1answer
56 views

Can POS devices really generate random numbers?

I am doing an implementation of a system designed by a payment company and I am a little skeptical about the way they have designed the end to end cryptography. The system is as follows: There are ...
0
votes
0answers
17 views

Which Auxiliary Hash Function to use for Pointcheval's mDP protocol

I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David ...
0
votes
0answers
13 views

Is my method of identifying remote ZMQ clients secure?

ZMQ provides a CURVE based authorization / encryption system based on certs/keys. After endpoints are authenticated to the server, they can send an "identity" with each request. Unfortunately they ...
1
vote
1answer
31 views

Plaintext Size Limit for ECIES with AES-128 CBC mode

Using the ECIES (Elliptic Curve Integrated Encryption Scheme), is there a limit size of plaintext? (what is the maximum allowed number of bytes to be encrypted with ECIES).
-1
votes
1answer
34 views

Verification of the NI-ZK Proof

I'm currently learning about ZKP and Non-interactive zero knowledge (NI-ZK) but I'm confused in the process of NI-ZK verification. I have taken the following example to learn about NI-ZK from this ...
8
votes
5answers
769 views

Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
0
votes
2answers
50 views

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting ...
2
votes
2answers
43 views

Why does libSTARK use binary fields as opposed to prime fields for zk-SNARKs?

zk-STARKs make use of FRI for low degree testing of polynomials. The zk-STARKs paper states on page 11: we stress that ZK-STARK could also operate over prime fields but we have not realized this ...
0
votes
0answers
45 views

Sharing secret content with multiple recipients

I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email. I am no expert in crypto ...
0
votes
0answers
42 views

Combination of Homomorphic Encryption and Homomorphic Signature

Is there any scheme that can combine homomorphic encryption and homomorphic signatures? If not, is there any paper, which shows why they can't be combined together? And is Homomorphic Signature ...
-1
votes
0answers
41 views

AES decryption algorithm [on hold]

I'm quite new to Cryptography. How does the decryption work for AES? We know that it implements encryption using confusion and diffusion technique, how does it work for decryption?
1
vote
0answers
59 views

CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
0
votes
0answers
42 views

Simple but secure method to share secret (128 bit AES key) though an untrusted relay

I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
0
votes
0answers
20 views

Is my reasoning sound in the included scenario?

There is a package that contains a device, the device is activated/deactivated over a short range radio signal - it's function is to detect any unauthorised tampering of the package during the time it ...
0
votes
0answers
25 views

Identify encrypton method [on hold]

I'm trying to emulate the ID parameter in my system but can't able to as I don't know the encryption method. Can anyone please help me - Here is the thing I'm trying to do. I successfully generate ...
0
votes
0answers
3 views

Watch-only addresses inside segwit transactions [migrated]

I'm using bitcoin core (via rpc api). I've generated one 2of2 multisig address on electrum wallet, and after that, I've imported that address into bitcoin core by using importaddress rpc method. When ...
5
votes
1answer
96 views

Why threshold number number of shares is required to construct secret?

In this paper of Asmuth–Bloom threshold SSS, the algorithm is as follows: Shares Distribution To distribute n shares of a secret $K$ among the set of participants $P = \{ p_i : 1 ≤ i ≤ n\}$, the ...
0
votes
1answer
25 views

Refreshing Procedure in FHEW: membership test

I am facing an issue regarding the paper FHEW: Bootstrapping Homomorphic Encryption in less than a second. It concerns the MSBextract algorithm during the refresh procedure. Especially, they ...
0
votes
0answers
12 views

how to decrypt columnar transposition cipher with a permutation as a key [on hold]

I'm trying to decipher a columnar transposition cipher. Using a key that has a permutation. Currently, I'm not sure how to go about permuting the rows according to the key, in other words basically ...
0
votes
1answer
58 views

If I know an element and it's inverse, whether the modulo will be known?

If I know an element $x$ in a group, and it's inverse $x^{-1}$, can I guess the modulo, or with a probability?
4
votes
0answers
46 views

Which organization is responsible for certifying a TSA?

I see there a number of free TSA services according to this page (not all are still in service). In other sources I see references to the requirement of audits for the TSA to be 'rfc3161 compliant'. ...
1
vote
1answer
75 views

What is the difference between subtracting the modulus from a scalar field element and reducing it?

When implementing a Field element, we define the necessary operations on the data structure. One function that I see is a "scalar reduce" function, which effectively reduces a random scalar so that ...

15 30 50 per page