# All Questions

18,190 questions
1 view

### Elliptic curve as a product of 3 cyclic groups possible?

I'm looking for some kind of 3 dimensional Elliptic curve. As far as I know a normal Elliptic curve like $y^2 = x^3 + ax + b$ over $F_p$ consists of one or two cyclic groups $Z_m (\times Z_n)$. Given ...
37 views

### Elliptic curves on finite fields

I've been reading: https://github.com/bellaj/Blockchain/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf On page 22 it shows an eliptic curve over F17. I have added the orange lines ...
17 views

12 views

### Is there an advantage to using a hash in combination with a key-derivation function?

Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap. It is currently recommended by OWASP to use an adaptive key-derivation ...
17 views

### Given a cipher text, How to start the attack on it? How to identify what cipher has been used to encrypt it?

I have a cipher text which contains english alphabets only. How to figure out what method has been used to encrypt it. It doesn't seems a good idea to try all known encryption methods.
32 views

### Zero knowledge proofs for a Merkle Tree

Say I have a publicly available Merkle tree, and I want to prove the existence of a leaf (containing a number, maybe) in the tree. I could give the path along with the siblings, for a normal Merkle ...
22 views

### AES-256-CBC with random IV - storing same plaintext as same ciphertext

I am encrypting some information stored in a column of a MySQL database. The column can contain repeated values, let's say the table has 7 rows and the column to be encrypted has the following values:...
23 views

### One-way function with combination sets as output / image

One-way functions generally operate on bit strings, for the input and the output. Are there any examples of one-way functions that produce a combination set in output? Let's call this function $f$. ...
49 views

### Diffie hellman: fixed modulus a risk?

In DH, are algorithms with fixed modulus p (large safe prime) to be avoided? What if it was changed every x minutes?
46 views

### Can the Keccak sponge construction be used to create a random permutation of bit strings of length $n$, where $n$ can be any positive integer?

I need an efficient, invertible random permutation of $n$-bit strings, defined by a $128$-bit key. $n$ can be any positive integer from $6$ to $128$. I have no requirements on the security of the ...
63 views

### Is it possible to validate an email address without the user actually revealing the email address?

Say hypothetically I want a service where users express their opinions. But those opinions are heavily dependent upon where they work, and the best way to prove that they actually work at a specific ...
23 views

### berlekamp massey feedback polynomial

I have a couple of polynomials to find. Can anybody guide me with the steps to find the feedback polynomial using berlekamp massey's algorithm. Example: Key fragment: 10100100001001101001011 seed: ...
38 views

### Strong pseudo random permutation implies CCA-security

Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows: On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
78 views

### What is the difference between $\bmod{p - 1}$ and $\bmod p$

I have a doubt in my research work, can anyone tell me; What is the difference between $\bmod {p-1}$ and $\bmod p$
14 views

### Temporal or spatial digital signatures

Digital signatures allow authentication of content based on a secret held by the signing entity. Are there any existing schemes, proposals or even services for letting "location" or "time" sign the ...
34 views

### SEAL - binary encoded ciphertext

In SEAL, am I able to convert a ciphertext that is encoded with polynomial to a ciphertext that is encoded as binary?
1k views

### Is there a contingency plan in the event of a catastrophic attack on AES?

NIST selected Rijndael in 2000 to be AES. In a paper from the Serpent authors, they mention that there was the possibility of choosing a second cipher as a backup in the case of any severe breaks: ...
71 views

### AES based question

The minimum key length for the AES algorithm is 128 bit. Assume that a special-purpose hardware key-search machine can test one key in 10 ns on one processor. The processors can be parallelized. ...
28 views

### Store the public key and private key [on hold]

i want to implement digital signature scheme in my form sign up in my web, and i read all PKCS from PKI but it made me little confused. i have many questions, where i store my public and private key ? ...
55 views

Would it be more secure if we used multiple keys in a One-Time-Pad encryption?
627 views

### Concrete evidence for the asymptotics of $\lambda_1(\Lambda^\perp(A))$?

A recent eprint paper claims to bound $\lambda_1(\Lambda^\perp(\mathbf{A}))$ for $\mathbf{A}\in\mathbb{Z}^{n\times m}$, a uniformly random matrix, by $O(1)$, specifically by $4$. This has applications ...
35 views

### Why (N+1)sec's mDP Implementation does not check whether all the XORED received $z$ values are 0

In the original mDP protocol once all $z$ values received from each participant the following calculation is being done: If either $XOR(z_1,z_2,...,z_n) = 0$ or received invalid Signature then ...
21 views

### RSA-based encryption scheme and random oracle

I don't really get how this problem should be solved. My main issue is with the random oracle generally, a short explanation of ROs and how they are used in such proofs maybe with this example will ...
19 views

### is a safe prime subgroup length important?

For most cryptographers, my question may appear silly. Context: Diffie Hellman. Object: finding good primes. Code: given that NodeJS program: ...
30 views

### Secure comparison protocol

I want to implement the existing comparison protocol using SEAL. For private comparison checking the existence of a 0 is possible with DGK scheme. Is there any other way to do it without DGK scheme? ...
32 views

### ElGamal variant

I came across this problem, while currently reading "Introduction to Modern Cryptography" by Katz and Lindell. I am new to crypto and just trying to go through the book and solve the exercises, ...
21 views

### How to select best safe primes for DH <-> subgroups?

I run a test on some safe primes. Here is the code: ...
57 views

### Can POS devices really generate random numbers?

I am doing an implementation of a system designed by a payment company and I am a little skeptical about the way they have designed the end to end cryptography. The system is as follows: There are ...
17 views

### Which Auxiliary Hash Function to use for Pointcheval's mDP protocol

I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David ...
13 views

### Is my method of identifying remote ZMQ clients secure?

ZMQ provides a CURVE based authorization / encryption system based on certs/keys. After endpoints are authenticated to the server, they can send an "identity" with each request. Unfortunately they ...
31 views

### Plaintext Size Limit for ECIES with AES-128 CBC mode

Using the ECIES (Elliptic Curve Integrated Encryption Scheme), is there a limit size of plaintext? (what is the maximum allowed number of bytes to be encrypted with ECIES).
34 views

### Verification of the NI-ZK Proof

I'm currently learning about ZKP and Non-interactive zero knowledge (NI-ZK) but I'm confused in the process of NI-ZK verification. I have taken the following example to learn about NI-ZK from this ...
769 views

### Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
50 views

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting ...
43 views

### Why does libSTARK use binary fields as opposed to prime fields for zk-SNARKs?

zk-STARKs make use of FRI for low degree testing of polynomials. The zk-STARKs paper states on page 11: we stress that ZK-STARK could also operate over prime fields but we have not realized this ...
45 views

### Sharing secret content with multiple recipients

I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email. I am no expert in crypto ...
42 views

### Combination of Homomorphic Encryption and Homomorphic Signature

Is there any scheme that can combine homomorphic encryption and homomorphic signatures? If not, is there any paper, which shows why they can't be combined together? And is Homomorphic Signature ...
41 views

### AES decryption algorithm [on hold]

I'm quite new to Cryptography. How does the decryption work for AES? We know that it implements encryption using confusion and diffusion technique, how does it work for decryption?
59 views

### CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈$ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
42 views

### Simple but secure method to share secret (128 bit AES key) though an untrusted relay

I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
20 views

### Is my reasoning sound in the included scenario?

There is a package that contains a device, the device is activated/deactivated over a short range radio signal - it's function is to detect any unauthorised tampering of the package during the time it ...
25 views

### Identify encrypton method [on hold]

I'm trying to emulate the ID parameter in my system but can't able to as I don't know the encryption method. Can anyone please help me - Here is the thing I'm trying to do. I successfully generate ...
3 views

### Watch-only addresses inside segwit transactions [migrated]

I'm using bitcoin core (via rpc api). I've generated one 2of2 multisig address on electrum wallet, and after that, I've imported that address into bitcoin core by using importaddress rpc method. When ...
96 views

### Why threshold number number of shares is required to construct secret?

In this paper of Asmuth–Bloom threshold SSS, the algorithm is as follows: Shares Distribution To distribute n shares of a secret $K$ among the set of participants $P = \{ p_i : 1 ≤ i ≤ n\}$, the ...
25 views

### Refreshing Procedure in FHEW: membership test

I am facing an issue regarding the paper FHEW: Bootstrapping Homomorphic Encryption in less than a second. It concerns the MSBextract algorithm during the refresh procedure. Especially, they ...
12 views

### how to decrypt columnar transposition cipher with a permutation as a key [on hold]

I'm trying to decipher a columnar transposition cipher. Using a key that has a permutation. Currently, I'm not sure how to go about permuting the rows according to the key, in other words basically ...
If I know an element $x$ in a group, and it's inverse $x^{-1}$, can I guess the modulo, or with a probability?