All Questions

0
votes
0answers
9 views

How does the squeeze function in the NaCL Poly1305 implementation work?

The NaCL ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()): ...
0
votes
1answer
9 views

Needham–Schroeder fix by adding opponent's identity to the first message

Recap: Needham–Schroeder is as follows: $A \rightarrow B : \{A, N_a\}_{pk_B}$ $B \rightarrow A : \{N_a, N_b\}_{pk_A}$ $A \rightarrow B : \{N_b\}_{pk_B}$ Then, there is a MITM attack by Lowe ...
1
vote
1answer
40 views

I don't want to store passwords, can I use them as an encryption key for another field?

I'm not a 'cryptographic' anything, so if this is a super-dumb question please let me know (politely). So here's the deal, say I don't want to store passwords because that opens me up to all sorts of ...
0
votes
0answers
16 views

How to do division using Beaver Multiplication Triples

It is very straight-forward and intuitively to achieve addition, subtraction and even generalized polynomial using Beaver's Multiplication Triples. However division seems difficult to achieve on two ...
0
votes
1answer
14 views

RIBE Scheme Implementation - How to encrypt message

This question is regarding "A Fully Secure Revocable ID-Based Encryption in the Standard Model" - Tung-Tso TSAI, Yuh-Min TSENG, Tsu-Yang WU The encryption method specifies part of the encryption ...
5
votes
2answers
682 views

What does this paraphrase of the birthday problem mean?

The following is an excerpt from A Generalized Birthday Problem - David Wagner: One of the best-known combinatorial tools in cryptology is the birthday problem: Problem 1. Given two lists $L_1, \...
-1
votes
0answers
33 views

Cryptography over non-elliptic curves [duplicate]

I'm just curious, what is the decisive factor to be restricted to elliptic curves? In theory, as long as we have a generator $g$ to have a suitable key pair $K, k: k\in F_q $ such that $K\equiv g^k \...
0
votes
0answers
42 views

What does XOR mean in regards to AES cryptography? [on hold]

This might be too basic to answer but I am learning about the different modes of operation and I am trying to grasp the material and having trouble deciphering the meaning. I was just wondering if ...
0
votes
0answers
12 views

Mixed HMAC / GMAC with fixed IV

I was just thinking about improving the performance of HMAC - what would be the issues in doing the following: Let $G_K(IV,M)$ be GMAC with a key $K$, for IV and message $M$. Let $H$ be a secure hash ...
19
votes
1answer
2k views

Why does AES have exactly 10 rounds for a 128-bit key, 12 for 192 bits and 14 for a 256-bit key size?

I was reading about the AES algorithm to be used in one of our projects and found that the exact number of rounds is fixed in AES for specific key sizes: $$ \begin{array}{|c|c|} \hline \begin{array}...
2
votes
0answers
31 views

Impossible to construct collision resistant hash function from one way function

[Simon 98] showed that it is impossible to construct collision resistant hash function from one way functions in a black-box way. I read the paper but barely understood it. Is there any source, where ...
1
vote
0answers
42 views

Quantum Resistant Algorithms and types: PKE vs PKEs vs KEM vs KEMs vs DSS

I am trying to wrap my head around the second round Quantum Resistant Algorithm candidates currently under the NIST PQC Effort. Can someone verify if the following is a correct summary of the 17-...
0
votes
2answers
63 views

Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search?

I use some diceware pass phrases in some places but I have one question that I can't find the answer to. Let's say I roll the dice and get $N$ words with a total of $M$ letters and that I don't put ...
2
votes
0answers
31 views

ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
3
votes
1answer
48 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
0
votes
0answers
21 views

EKCDSA Implementation [migrated]

I have two implementations of sign() for EKCDSA, one in Java (on BitBucket) and one in C (on GitHub. Java: ...
0
votes
0answers
22 views

HSM nCipher: OCS protected key with quorum m/n [on hold]

I'm developing a server that implements a stamping server using a key protected by an OCS. The current configuration uses a quorum of 1/3. So when the server is starting, it asks the passphrase of the ...
0
votes
1answer
28 views

Elliptic Curves for Pairings

how can is possible to know if an elliptic curve is suitable for protocols that adopt pairing? For example, in Certificateless Cryptography with pairing, is it possible to know if all elliptic curves ...
0
votes
0answers
17 views

Comparison between Paillier Homomophic Encryption and Public key Encryption with equality test (searchable encryption)) [on hold]

I am writing a paper where i am replacing C Paillier Homomophic Encryption and Public key Encryption with equality test (searchable encryption)). So i need to compare
0
votes
1answer
31 views

Why is it better to add and double points on an elliptic curve using projective space?

I have been given a textbook which defines the addition of two points on an elliptic curve and the doubling of a point on an elliptic curve. This textbook explains elliptic curves in projective space ...
1
vote
2answers
43 views

With randomized encryption, ciphertexts must be slightly longer than plaintexts in order to allow for more than one possible ciphertext per plaintext

Can anyone give me a simple example of this? "For example, if there are $2^{64}$ possible cipher texts per plain text, cipher texts must be at least 64 bits longer than plain texts" This is ...
1
vote
0answers
28 views

Prove that Alice’s solution x is equal to Bob’s plaintext m

The answer to the second part of this question exists already. However, I need help understanding how the first part of the question is solved. I have a feeling that it must have something to do with ...
1
vote
0answers
22 views

Linear combination IOP for SNARK registers

The STARK paper says Our ZK-STARK uses a separate Reed-Solomon codeword for each register, leading to w many codewords, each of lower degree ...
2
votes
0answers
23 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
0
votes
0answers
15 views

SEAL-CKKS max multiplication depth

I am trying to understand how SEAL-CKKS scheme works and I wonder what multiplication level can we achieve using this scheme? Like 100 possible?
2
votes
2answers
95 views

Why should one model an entropy source in order to build a TRNG?

Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "...
4
votes
2answers
63 views

Hardness of LPN problem with small secret

The Learning Parity with Noise (LPN) assumption states that, for a fixed secret $s$ chosen uniformly from $\{0,1\}^n$, then the distribution that outputs $(a,a\cdot s+e)$, where $a$ is uniform in $\{0,...
4
votes
0answers
96 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
3
votes
0answers
60 views

Are commutative digital signature possible?

Say we have a message $m$. Signer $S^1$ will sign this message using his digital signature to produce: $$\operatorname{Sign}_{S^1}(m)$$ Now, say another signer $S^2$ wants to sign the output of the ...
-1
votes
0answers
25 views

Decode location of an RSA encryption message [on hold]

You have intercepted an RSA encrypted message with encoding exponent 7221 and base 5829679010047531. Decode the location: 815427339135043, 5556391338134431, 2892812128428033. I have to find the ...
2
votes
0answers
41 views

Is it possible to check if a number is the product of two primes without factorizing it?

I have a large number which I suspect may be a private RSA key (although its size, at 613 bits, seems a bit unorthodox). I have started to run a factorization algorithm on it, and after a few hours ...
1
vote
2answers
42 views

Zero Knowledge for Low Entropy Witness

For any PPT prover ($p$) and verifier ($v$), imagine I have a low entropy witness, say smaller than $2^8$. Now, let us say I have a dlog statement in the form of $y = g^w$. Theory says I could use a ...
0
votes
0answers
33 views

Cryptography and Security Self Learning [on hold]

I'm an IT developer but interested in Cryptography and Security. Not only I want to learn about cryptography but also want improve my skills for network security job roles. So I was looking for ...
0
votes
0answers
27 views

Prove that a given signature scheme is secure under random message attacks

This is a follow up to my previous question. Consider the following signature scheme: $KeyGen (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : G \times G \...
0
votes
0answers
23 views

Convert affine to projective coordinates and vice versa in ECC? [on hold]

I am working on a small project. A point $Q=(1,38)$, using point doubling $\{ a=-3,p=43\}$, i got $2Q=(41,5)$. Now in projective coordinate $Q=(1,38,1)$ taking $z=1$. Calculating $2Q$, I get $2Q=(22,...
-2
votes
0answers
23 views

Part of a challenge, from a group of adults, who break ciphers [on hold]

I am part of a group of adults, a cipher club who like to decode random ciphers, from texts to symbols and other things. We were presented with a set of 5 ciphered text, and we have managed to crack 3 ...
2
votes
1answer
28 views

Attack on a Feistel Cipher given the key and half of the ciphertext

Consider a classical Feistel Cipher, with the round functions given and the keys used in the ciphering process. Is it possible to reconstruct the original data if half of the ciphered text is given? ...
0
votes
2answers
37 views

human readable unpredictable & no collision uid based on time

I need to create an unpredictable uid based on time. I plan to allow it to work during a time frame of 100,000,000 seconds. So the seconds will go from 00000000 to 99999999. I need an algorithm that ...
0
votes
0answers
18 views

Prove that a signature scheme is $RUF-NMA$ and not $EUF-CMA$

I am working on the following exercise: Now, assume the following signature scheme: $KeyGen (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : G \times ...
2
votes
2answers
25 views

Mathematical explaination of file encryption for multiple persons with multiple keys

Let's say I want to encrypt a document which only can be read by John, Mike, and Dave. This can easily done with PGP/GPG: Import John‘s, Mike‘s, and Dave's public key Encrypt the document using those ...
0
votes
0answers
12 views

I2P Tunnel Creation Build on Request Record Question en(de)cryption method

Not sure if anyone here can help, but if so, sure would appreciate the help. If we read the https://geti2p.net/spec/tunnel-creation documentation page on how I2P creates a tunnel, we can read on the ...
1
vote
1answer
64 views

Comparing Shanks' Algorithm to Brute Force

I'm trying to understand how/why Shanks' algorithm solves the discrete log problem $y=g^x \bmod p$ faster than a brute force search does. Any explanation would be great.
0
votes
2answers
67 views

Meet-in-the-middle probability of success

In page 358 of Bruce Schneier's Apllied Crypto, when explaining the meet-in-the-middle attack, he states that the success probability is «1 in $2^{2m - 2n}$» with two plaintext/ciphertext pairs, and «...
0
votes
0answers
22 views

How to use Windows User Certificate (S/MIME) to sign data [migrated]

I am working on an internal ERP for my company. The portal is written in PHP and the current purchasing process is the following: Create a new order on the ERP portal Print the order (PDF) Ask for ...
3
votes
1answer
101 views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
0
votes
1answer
62 views

RSA-OAEP Padding scheme

Honestly I'm really confused about padding in RSA scheme. I don't study computer science, and I'm a beginner learning cryptography (self-taught). Can anyone give me suggestions?
2
votes
2answers
48 views

Self-synchronizing cipher recovery from dropped bits

This cryptography book says: There are also asynchronous or self-synchronizing stream ciphers, where the previously produced ciphertext bits are used to produce the current keystream bit. This ...
0
votes
1answer
51 views

Does encrypting a result of AES block cipher provide more security?

I would like to know if encrypting a result of AES256 block cipher provides more security. Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. ...
2
votes
1answer
81 views

What is this called: encrypt $X$ with key $E$, decrypt $X$ with key $D$?

I am a software developer interested in developing an application with cryptography. I can explain what I want to accomplish, but I do not know the technical terms for the cryptographic functions I am ...
0
votes
2answers
119 views

Is there an outdated or insecure hash algorithm thats output can be easily reversed back into the input?

I'm looking for a hash algorithm thats output can be reversed back into the input in a reasonable amount of time (a day or less) using a decent consumer computer. If anyone has any information on this,...

15 30 50 per page