All Questions

0
votes
0answers
6 views

Why should one model an entropy source in order to build a TRNG?

Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "...
1
vote
1answer
55 views

Signal/TextSecure multiparty Chat. Does the protocol transmits a symmetric key?

As I look over the TexSecures specifications for multi-party chat I have noticed this. Also as far as I understood in TextSecure (now known as Signal) the minimal steps required to do a secure ...
3
votes
1answer
102 views

How does future secrecy fail for Signal group messaging?

In the paper More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema, the abstract claims that We additionally show that strong security properties, such as ...
0
votes
1answer
47 views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
2
votes
1answer
407 views

Is it possible to implement the Signal Protocol without a server?

My question is regarding the Signal Protocol[1]. Is it possible to implement the protocol securely, without a server? (I have no particular motivation for the question other than to understand better ...
1
vote
1answer
222 views

Signal Protocol: What extra features does double ratchet algorithm add to Diffie-Hellman ratchet?

I have been reading the documentation of Signal protocol and could not find out why they came up with double ratchet instead of using Diffie-Hellman ratchet which was available at first place in OTR?
3
votes
1answer
265 views

Signal Double Ratchet - How can Alice send 2+ messages in the beginning of the Signal Protocol?

I'm studying about Signal Protocol and I had a doubt in Double Ratchet Algorithm. This section describes how to derive the receiving and sending key messages. Alice is initialized by Bob public ...
9
votes
1answer
2k views

What is the difference between OTR and Signal protocols?

The Signal Protocol is a relatively new secure messaging protocol that was recently implemented in Signal, WhatsApp, and several other messenging apps. According to Wikipedia, the Signal protocol is ...
0
votes
0answers
13 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
0
votes
2answers
30 views

human readable unpredictable & no collision uid based on time

I need to create an unpredictable uid based on time. I plan to allow it to work during a time frame of 100,000,000 seconds. So the seconds will go from 00000000 to 99999999. I need an algorithm that ...
1
vote
0answers
8 views

Hardness of LPN problem with small secret

The Learning Parity with Noise (LPN) assumption states that, for a fixed secret $s$ chosen uniformly from $\{0,1\}^n$, then the distribution that outputs $(a,a.s+e)$, where $a$ is uniform in $\{0,1\}^...
3
votes
5answers
1k views

How to roll my own hardware RNG?

I am considering building a hardware RNG myself using cheap parts. Is this a good idea and safe enough? Random sources: amplified Zener noise from one randomly chosen ...
2
votes
0answers
28 views

are commutative digital signature possible

Say we have a message $m$. Signer 1 will sign this message using his digital signature to produce $\operatorname{Sign}_1(m)$. Now, say another signer 2 wants to sign the output of the previous ...
1
vote
1answer
49 views

Comparing Shank's Algorithm to Brute Force

I'm trying to understand how/why Shank's algorithm solves the discrete log problem $y=g^x \bmod p$ faster than a brute force search does. Any explanation would be great.
1
vote
2answers
20 views

Zero Knowledge for Low Entropy Witness

For any PPT prover ($p$) and verifier ($v$), imagine I have a low entropy witness, say smaller than $2^8$. Now, let us say I have a dlog statement in the form of $y = g^w$. Theory says I could use a ...
-1
votes
0answers
14 views

Decode location of an RSA encryption message [on hold]

You have intercepted an RSA encrypted message with encoding exponent 7221 and base 5829679010047531. Decode the location: 815427339135043, 5556391338134431, 2892812128428033. I have to find the ...
2
votes
0answers
26 views

Is it possible to check if a number is the product of two primes without factorizing it?

I have a large number which I suspect may be a private RSA key (although its size, at 613 bits, seems a bit unorthodox). I have started to run a factorization algorithm on it, and after a few hours ...
1
vote
1answer
22 views

Attack on a Feistel Cipher given the key and half of the ciphertext

Consider a classical Feistel Cipher, with the round functions given and the keys used in the ciphering process. Is it possible to reconstruct the original data if half of the ciphered text is given? ...
1
vote
2answers
37 views

self-synchronizing cipher recovery from dropped bits

This cryptography book says: There are also asynchronous or self-synchronizing stream ciphers, where the previously produced ciphertext bits are used to produce the current keystream bit. This ...
0
votes
1answer
52 views

RSA-OAEP Padding scheme

Honestly I'm really confused about padding in RSA scheme. I don't study computer science, and I'm a beginner learning cryptography (self-taught). Can anyone give me suggestions?
-2
votes
0answers
17 views

Part of a challenge, from a group of adults, who break ciphers [on hold]

I am part of a group of adults, a cipher club who like to decode random ciphers, from texts to symbols and other things. We were presented with a set of 5 ciphered text, and we have managed to crack 3 ...
3
votes
3answers
79 views

How to generate a good symmetric secret key

I would like to generate a good secret key, that later will be used to encrypt data symmetrically. I am not sure how to generate a good secret key. I use Linux, I am not sure which sources of ...
0
votes
0answers
28 views

Cryptography and Security Self Learning [on hold]

I'm an IT developer but interested in Cryptography and Security. Not only I want to learn about cryptography but also want improve my skills for network security job roles. So I was looking for ...
0
votes
0answers
21 views

Prove that a given signature scheme is secure under random message attacks

This is a follow up to my previous question. Consider the following signature scheme: $KeyGen (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : G \times G \...
0
votes
0answers
13 views

Convert affine to projective coordinates and vice versa in ECC?

I am working on a small project. A point $Q=(1,38)$, using point doubling $\{ a=-3,p=43\}$, i got $2Q=(41,5)$. Now in projective coordinate $Q=(1,38,1)$ taking $z=1$. Calculating $2Q$, I get $2Q=(22,...
0
votes
0answers
17 views

Prove that a signature scheme is $RUF-NMA$ and not $EUF-CMA$

I am working on the following exercise: Now, assume the following signature scheme: $KeyGen (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : G \times ...
2
votes
2answers
23 views

Mathematical explaination of file encryption for multiple persons with multiple keys

Let's say I want to encrypt a document which only can be read by John, Mike, and Dave. This can easily done with PGP/GPG: Import John‘s, Mike‘s, and Dave's public key Encrypt the document using those ...
0
votes
2answers
62 views

Meet-in-the-middle probability of success

In page 358 of Bruce Schneier's Apllied Crypto, when explaining the meet-in-the-middle attack, he states that the success probability is «1 in $2^{2m - 2n}$» with two plaintext/ciphertext pairs, and «...
5
votes
2answers
86 views

What do NM-CPA, and NM-CCA mean?

When I've been researching authenticated encryption, the following terms keep showing up: NM-CPA NM-CCA ....without any definition as to what they mean. I've tried searching the web for their ...
1
vote
2answers
160 views

Can we use Shamir secret sharing conversely?

In Shamir secret sharing scheme, we have a secret and then the shares are generated based on the secret. The question is can we generate the shares before knowing the 'secret' (which is uniformly ...
0
votes
2answers
101 views

Is there an outdated or insecure hash algorithm thats output can be easily reversed back into the input?

I'm looking for a hash algorithm thats output can be reversed back into the input in a reasonable amount of time (a day or less) using a decent consumer computer. If anyone has any information on this,...
6
votes
2answers
116 views

Algorithm for computing modular inverse in MPC

Is there any known algorithm for calculating $a^{-1} \pmod{q}$, where $ q < p$ and $F_{p}$ is the prime field of the MPC, in a linear secret sharing scheme ? I have tried using the standard ...
0
votes
1answer
80 views

How can a fully encrypted homomorphic program resist copying?

Let's say that we have an original homomorphically encrypted program with any possible code inside. What methods can it use to ensure that it is impossible to create an exact copy of it? Are there ...
1
vote
1answer
155 views

Zero-knowledge transfer of value protocol II [closed]

This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
-1
votes
0answers
34 views

Using one time pad to unlock data with or without me being present

I am trying to create a system where a box can unlocked with or without me, but if I want to unlock the box I need the user. Here is how I am achieving, I have been trying to think of ways that this ...
0
votes
0answers
10 views

I2P Tunnel Creation Build on Request Record Question en(de)cryption method

Not sure if anyone here can help, but if so, sure would appreciate the help. If we read the https://geti2p.net/spec/tunnel-creation documentation page on how I2P creates a tunnel, we can read on the ...
2
votes
1answer
54 views

Attacking AES using Round 1 output

I was reading the paper Differential Scan Attack on AES with X-tolerant and X-masked Test Response Compactor and I have a question in the section Differential Scan Attack on AES. What I understand is ...
2
votes
1answer
349 views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $\text{prv}$. It accepts as input any point $Q$ lying in the proper subgroup of the proper elliptic curve, then computes: $P =...
3
votes
1answer
68 views

Transparent Setup of SNARKs

The STARKs paper states Third, and most important, ZK-PCPs are transparent (or “public randomness” ), which means that the randomness used by the verifier is public; in particular, setting up a ...
3
votes
1answer
92 views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
2
votes
2answers
330 views

Could there be a floating point CSPRNG?

I recently answered no to Is there a floating point CSPRNG? Unpredictable rounding errors, especially across dissimilar hardware were my reasoning. In it's most basic form, a CSPRNG can be ...
22
votes
4answers
58k views

How to find modulus from a RSA public key?

I am studying the RSA cryptosystem. The public key consists of $(n, e)$, the modulus (product of two large primes), and the encryption exponent. I want to separate the modulus $n$ and exponent $e$. A ...
0
votes
0answers
17 views

How to use Windows User Certificate (S/MIME) to sign data

I am working on an internal ERP for my company. The portal is written in PHP and the current purchasing process is the following: Create a new order on the ERP portal Print the order (PDF) Ask for ...
2
votes
1answer
77 views

What is this called: encrypt $X$ with key $E$, decrypt $X$ with key $D$?

I am a software developer interested in developing an application with cryptography. I can explain what I want to accomplish, but I do not know the technical terms for the cryptographic functions I am ...
0
votes
1answer
49 views

Does encrypting a result of AES block cipher provide more security?

I would like to know if encrypting a result of AES256 block cipher provides more security. Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. ...
3
votes
2answers
13k views

How does one implement the Inverse of AES' MixColumns

I got an answer in the related question about Mixcolumn for encryption, but how about decryption? what will I do? Because it said that I will used this: During decryption the Mix Column the ...
0
votes
2answers
40 views

How is EC key encoded in PKCS#8?

I just started working with certificates and signatures. For an application I write I need a key pair for ECDSA signatures, using the elliptic curve secp384r1 (aka NIST P-384). I produced such a key ...
7
votes
2answers
235 views

Efficiency of oblivious algorithms vs non-oblivious algorithms?

Recently, plenty of researchers are looking at designing efficient data-oblivious algorithms. Roughly speaking, an algorithm is said to be data-oblivious if its data access patterns are independednt ...
2
votes
1answer
44 views

complete functionality for fair multiparty computation

In this paper I found the statement "We reduce the fairness problem in MPC to the problem of fair decryption [...] Fair decryption was shown to be a complete functionality for fair MPC in [GIM+10]". ...
7
votes
1answer
8k views

What is U2FsdGVkX1?

Using CryptoJS 3.1 I noticed that using 3Des, the encrypted message always start with U2FsdGVkX1 Why is the first part of the encryption always the same? What information does this hold and how ...

15 30 50 per page