# All Questions

22,220 questions
Filter by
Sorted by
Tagged with
10 views

### A zero knowledge protocol with a deterministic verifier

Given a language $L$ and $ZKP$ between $v$ and $p$, when $v$ is deterministic polynomial time algorithm, I wish to obtain a probabilistic-polynomial algorithm which solves $L$. Which, if I am not ...
18 views

### Frequency Analysis on DES, AES, 3DES using Cryptool2

I am trying to analyze symmetric block ciphers like DES, 3DES and AES, using Cryptool 2. I want to do a frequency analysis on each of these ciphers, in order to comment whether this is an effective ...
18 views

### Why do we add error in the definition of LWE?

One of the various equivalent definitions of the LWE problem is the following: Let $n,q$ be integers ($q$ usually is a prime number), $\chi$ a discrete probability distribution over $\mathbb{Z}$ (...
26 views

### Is it fair to say that MACs use a signing algorithm?

The Wikipedia page on MAC calls the algorithm that is used to generate the MAC as a signing algorithm. Is that a fair use of that term? Can we then say that ...
21 views

### Hash into elliptic curves for private set intersection

Would it be insecure to hash a message $m$ to an elliptic curve point by multiplying it to some generator $G$ for the purpose of a private set intersection ? $$M = hash(m) * G$$ I keep seeing ...
13 views

### Why ideal lattices?

An ideal lattice is a lattice $\mathcal{L}(A)$ generated by a block matrix $A = \left[ A^{(1)} \mid \dots \mid A^{(m/n)} \right]$ whose blocks $A^{(i)}$ are constructed from a vector $a^{(i)}$ and a ...
8 views

### Is $f_N$ in this hash function is Matyas-Meyer-Oseas scheme?

I propose a hash function as following: H is an Merkle-Damgard hash function with a compression function $f: \{0,1\}^{3n} \to \{0, 1\}^{2n}$. Output function $f_N: \{0,1\}^{3n} \to \{0, 1\}^n$. M is ...
5 views

### Isogeny-based AKE: what is the difference between Gal 1 and FTTY 1?

What is the difference between (a) the AKE scheme proposed by Galbraith (based on TS2 protocol) in https://eprint.iacr.org/2018/266.pdf (page 9-10); and (b) the AKE scheme proposed by Fujioka et al. ...
14 views

40 views

### Curve25519 extension field

The paper regarding curve25519 presents a theorem in chapter 2 (specification). The extension field $F_{p^2}$ is used in this theorem. I don't understand why this extension field is needed for the ...
36 views

### How do I encrypt a long message using ElGamal encryption correctly?

According to ElGamal encryption, in order to encrypt a message I need to generate a shared secret s and after that I am to calculate ...
17 views

### How to prove properties of pre-image of random oracle in zero-knowledge proof?

A signature Sig is given as input to random oracle H, such that y = H(Sig) and Sig should be hidden from the verifier. How to prove in zero-knowledge to the verifier that y is the correct output from ...
46 views

### RNG randomization strength for PRF seed

Consider a use case that requires the creation of multiple asymmetric key pairs. There are two options for generating random seeds for a PRF: Use a software based RNG and generate a new seed for each ...
46 views

### What papers describe the rationale behind cryptography algorithms

I am trying to introduce myself to cryptographic hashing and encryption. I am looking for original papers of sorts, to describe the inspiration behind why they choose certain numbers, if they are ...
41 views

### Is it possible to create a 128-bit UUID from a weak entropy source?

I am looking at a seemingly popular piece of JavaScript code to generate a UUID which is supposed to be a 128-bit number: ...
381 views

### Calculating RSA Public Modulus from Private Exponent and Public Exponent

If I know the private and public exponents ($d$ and $e$) of an RSA key pair, is it possible to (efficiently) calculate the public modulus $n$?
24 views

### Prior art: SSH key authn over TLS?

I’m developing an application that runs over TLS. In addition to password-based authentication we’d like to be able to use SSH keys. Is there any prior art in using SSH keys for authentication over ...
42 views

### Functional signatures vs homomorphic signatures

I found that homomorphic signatures allows an agency to carry out arbitrary computation $f$ on the signed data $m$ and accordingly gain a signature for the computation result $f(m)$ with respect to $f$...
60 views

### Sensible amateur usage of web crypto API

I want to know if my usage of the web crypto API is sensible. I want to use it for symmetric and public-key encryption and decryption, and signatures, but as a non-expert I am scared by the warning on ...
54 views

### Is storing salts encrypted a good idea?

I've read that storing password hashes in a database, you can store the salt in plaintext alongside the actual hash with no detriment to security. I was thinking that one could derive a key from the ...
44 views

### The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1. But I can not get the same result (the right corollary) from the ...
55 views

### Can I find a number, such that the its SHA-256 hash is all-0 [duplicate]

I want to find a number, such that the result of its SHA-256 hash is all 0. I don't know if this number exists.
68 views

### Can we defends against RSA Timing attack when we use java.math.BigInteger.modPow?

I think that Montgomery and sliding window techniques are applied within java.math.BigInteger.modPow (and more specifically ...
30 views

### CVC-PKCS#10 Generation and Signing

Good day, I have gotten a task at work which has turned out to be a rather interesting nightmare because of the lack of Information on the topic. My task is as follows: In order to ensure an ...
43 views

### RSA How many value for d

How many value can have a private key with this format? p,q,d = (19, 41, d) where 1< d <18x40? I want know how to calculate that.
92 views

### What is the difference between security parameter and $b$-bit security?

In a previous question, I read ... for $b$-bit security meaning $O(2^b)$ work for an attacker to break the system... While in Katz's Introduction to modern Cryptography, I read: The key-generation ...
23 views

### How to estimate the computation overhead of ECDSA?

I am using ECDSA as a digital signature scheme. Using Charm, I got the timing for the multiplication, exponentiation, and pairing operations; they take 0.005, 9, and 4.4 ms respectively. I want to ...
95 views

### Montgomery Multiplication with CRT

I am attempting to understand how to use Montgomery multiplication in an RSA private key operation: $X \equiv a^{e} \pmod{n}$ where $a$ is the message, $e$ is the exponent, $n$ is the modulus. Using ...
23 views

### Designing number of rounds of specific hashing process [closed]

Consider a certain encryption process/hash function which transform 128-bit blocks into 128-bit blocks. This is not a cipher or complete function yet. I am thinking about the theoretical process. We ...
45 views

### Multidimensional meet-in-the-middle attack on AES

Is an MD-MITM attack possible for AES? As I know, we can break 2 rounds of AES. So we could apply the MD-MITM attack 5 times. This should significantly reduce the security of AES. What stops us from ...
40 views
+50

### How hard is it to link a hardened BIP32 child public key to it's parent public key?

The BIP32 spec says this in the security section: ...
34 views

### My question is about Enigma rotors

I found this explanation of Enigma rotor movement on this website, but can't quite understand the methodology: Enigma rotation example A ⤑ B → D ⤑ C (rotor III in position B) C ⤑ C → D ⤑ D (rotor II ...
34 views

### How to fix the issue with Gimli full permutation distinguisher?

A new paper "New results on Gimli: full-permutation distinguishers and improved collisions" has been published stating a full 24-round permutation distinguisher with a cost of $2^{64}$ and ...
39 views

### OAuth(2) and friends

I've worked on low-level security (side-channel attacks etc.) for years and have a PhD in crypto. Web security is something I've never needed to touch beyond knowing how the TLS handshake works with ...
70 views

### How to generate Multiple Encryption Keys for use in RSA polymorphic multiplication

I am a long time scroller, first time poster in the crypto stack. I've recently been finding myself leaving the realm of mainstream/standard crypto (imo that consists of symmetric/asymmetric ...