All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

A zero knowledge protocol with a deterministic verifier

Given a language $L$ and $ZKP$ between $v$ and $p$, when $v$ is deterministic polynomial time algorithm, I wish to obtain a probabilistic-polynomial algorithm which solves $L$. Which, if I am not ...
1
vote
0answers
18 views

Frequency Analysis on DES, AES, 3DES using Cryptool2

I am trying to analyze symmetric block ciphers like DES, 3DES and AES, using Cryptool 2. I want to do a frequency analysis on each of these ciphers, in order to comment whether this is an effective ...
0
votes
1answer
18 views

Why do we add error in the definition of LWE?

One of the various equivalent definitions of the LWE problem is the following: Let $n,q$ be integers ($q$ usually is a prime number), $\chi$ a discrete probability distribution over $\mathbb{Z}$ (...
1
vote
2answers
26 views

Is it fair to say that MACs use a signing algorithm?

The Wikipedia page on MAC calls the algorithm that is used to generate the MAC as a signing algorithm. Is that a fair use of that term? Can we then say that ...
1
vote
1answer
21 views

Hash into elliptic curves for private set intersection

Would it be insecure to hash a message $m$ to an elliptic curve point by multiplying it to some generator $G$ for the purpose of a private set intersection ? $$ M = hash(m) * G $$ I keep seeing ...
0
votes
0answers
13 views

Why ideal lattices?

An ideal lattice is a lattice $\mathcal{L}(A)$ generated by a block matrix $A = \left[ A^{(1)} \mid \dots \mid A^{(m/n)} \right]$ whose blocks $A^{(i)}$ are constructed from a vector $a^{(i)}$ and a ...
0
votes
0answers
8 views

Is $f_N$ in this hash function is Matyas-Meyer-Oseas scheme?

I propose a hash function as following: H is an Merkle-Damgard hash function with a compression function $f: \{0,1\}^{3n} \to \{0, 1\}^{2n}$. Output function $f_N: \{0,1\}^{3n} \to \{0, 1\}^n$. M is ...
0
votes
0answers
5 views

Isogeny-based AKE: what is the difference between Gal 1 and FTTY 1?

What is the difference between (a) the AKE scheme proposed by Galbraith (based on TS2 protocol) in https://eprint.iacr.org/2018/266.pdf (page 9-10); and (b) the AKE scheme proposed by Fujioka et al. ...
2
votes
1answer
14 views

Lemma KL-Divergence (Differential Privacy)

I am studying differential privacy and I got stuck again in proof of a lemma. Which is: "$D_{\infty}^\delta(Y||Z) \leq \epsilon$ if and only if there exists a random variable $Y'$ such that $\...
1
vote
0answers
18 views

Do practical blind signature schemes make compromises?

I am fascinated by the idea of blind signatures and their applications introduced by David Chaum for electronic cash and voting and his provided analogy with carbon copy is quite compelling. However ...
1
vote
0answers
41 views

Post-quantum crypto based on undecidable problems

Usual post-quantum crypto, like the isogeny-based algorithm, has its value lying in that no one yet has found a quick way to break it with quantum computer. This makes me wonder why don't we build ...
0
votes
1answer
32 views

How to find m so that RSA cipher end with '\x00'+SpesificString , if we freely input the plaintext?

I have an RSA encryption with public key $(3,n)$ with 2048 bits modulus $n$. I want to find the value of the plaintext $m$ so that the ciphertext (in bytes representation) value ends with ...
1
vote
1answer
37 views

Why is GnuPG changing first two characters of ascii armored public key after downloading it from the key server?

When I look at my public key on the key server, the first two characters of the ASCII-Armored data section (as defined in section 6.2 of RFC 4880, which defines the structure of the ASCII-Armored ...
3
votes
1answer
51 views

Curve25519 key structure

In the paper regarding Curve25519, the set of public keys $q$ is $\{q : q\in \{ 0,1,2,...,2^{256} - 1\}\}$ and the set of private keys $n$ is $\{n : n\in 2^{254} + 8 \cdot \{ 0,1,2,...,2^{251} - 1\}\}$...
2
votes
0answers
25 views

What is the fundamental difference between multipartite and multilevel secret sharing?

According to this paper , Multipartite secret sharing scheme is a scheme in which the set of participants is divided into disjoint parts and all participants in the same part play an equivalent role ...
2
votes
1answer
45 views

Is there a way of sharing a key without anyone knowing what the key is initially?

I started learning about key sharing and Shamir secret sharing, I'm wondering whether you need someone who knows the key initially and then distributes it, is this step necessary or not? In my case I ...
0
votes
1answer
48 views

Resources for mathematics of cryptology

I am an undergraduate student looking for resources (books or lectures) explaining the mathematics involved with cryptography. Such as number theory, elliptic curves etc. I found the book 'A Course in ...
0
votes
0answers
24 views

How does CL signature work?

I'm studying the CL signature that how can it works. However, I cannot understand how equation (42) is calculated. What is the last three factors? The value T is as follows: $$T \leftarrow(A')^{\...
11
votes
4answers
4k views

Is it easy to crack a hashed phone number?

I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?
0
votes
0answers
36 views

Security implication of concatenating two hashes using different algorithms

Background Hashing files is an expensive thing for CPU. I am tasked to write a secure digital signature scheme. For that, I decided to check the integrity of files using Hash/Digest. To be more secure,...
1
vote
0answers
22 views

Code for bilinear-map accumulator

I'm trying to implement a bilinear-map cryptographic accumulator from a research paper. I want to use it to prove sets of elements disjoint by generating a proof that can be used by a third party in ...
3
votes
1answer
83 views

randomness of encrypt

In the paper "Efficient Encryption from Random Quasi-Cyclic Codes" of Gaborit et al. p.14, I read "Encrypt$(pk=(G,Q,s),\mu,\theta)$: uses randomness $\theta$ to generate $\epsilon \...
3
votes
1answer
40 views

Curve25519 extension field

The paper regarding curve25519 presents a theorem in chapter 2 (specification). The extension field $F_{p^2}$ is used in this theorem. I don't understand why this extension field is needed for the ...
2
votes
1answer
36 views

How do I encrypt a long message using ElGamal encryption correctly?

According to ElGamal encryption, in order to encrypt a message I need to generate a shared secret s and after that I am to calculate ...
0
votes
0answers
17 views

How to prove properties of pre-image of random oracle in zero-knowledge proof?

A signature Sig is given as input to random oracle H, such that y = H(Sig) and Sig should be hidden from the verifier. How to prove in zero-knowledge to the verifier that y is the correct output from ...
0
votes
0answers
46 views

RNG randomization strength for PRF seed

Consider a use case that requires the creation of multiple asymmetric key pairs. There are two options for generating random seeds for a PRF: Use a software based RNG and generate a new seed for each ...
1
vote
1answer
46 views

What papers describe the rationale behind cryptography algorithms

I am trying to introduce myself to cryptographic hashing and encryption. I am looking for original papers of sorts, to describe the inspiration behind why they choose certain numbers, if they are ...
1
vote
1answer
41 views

Is it possible to create a 128-bit UUID from a weak entropy source?

I am looking at a seemingly popular piece of JavaScript code to generate a UUID which is supposed to be a 128-bit number: ...
7
votes
2answers
381 views

Calculating RSA Public Modulus from Private Exponent and Public Exponent

If I know the private and public exponents ($d$ and $e$) of an RSA key pair, is it possible to (efficiently) calculate the public modulus $n$?
0
votes
1answer
24 views

Prior art: SSH key authn over TLS?

I’m developing an application that runs over TLS. In addition to password-based authentication we’d like to be able to use SSH keys. Is there any prior art in using SSH keys for authentication over ...
0
votes
1answer
42 views

Functional signatures vs homomorphic signatures

I found that homomorphic signatures allows an agency to carry out arbitrary computation $f$ on the signed data $m$ and accordingly gain a signature for the computation result $f(m)$ with respect to $f$...
1
vote
1answer
60 views

Sensible amateur usage of web crypto API

I want to know if my usage of the web crypto API is sensible. I want to use it for symmetric and public-key encryption and decryption, and signatures, but as a non-expert I am scared by the warning on ...
-1
votes
1answer
54 views

Is storing salts encrypted a good idea?

I've read that storing password hashes in a database, you can store the salt in plaintext alongside the actual hash with no detriment to security. I was thinking that one could derive a key from the ...
1
vote
0answers
44 views

The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1. But I can not get the same result (the right corollary) from the ...
0
votes
1answer
55 views

Can I find a number, such that the its SHA-256 hash is all-0 [duplicate]

I want to find a number, such that the result of its SHA-256 hash is all 0. I don't know if this number exists.
0
votes
0answers
68 views

Can we defends against RSA Timing attack when we use java.math.BigInteger.modPow?

I think that Montgomery and sliding window techniques are applied within java.math.BigInteger.modPow (and more specifically ...
1
vote
0answers
30 views

CVC-PKCS#10 Generation and Signing

Good day, I have gotten a task at work which has turned out to be a rather interesting nightmare because of the lack of Information on the topic. My task is as follows: In order to ensure an ...
0
votes
0answers
43 views

RSA How many value for d

How many value can have a private key with this format? p,q,d = (19, 41, d) where 1< d <18x40? I want know how to calculate that.
2
votes
2answers
92 views

What is the difference between security parameter and $b$-bit security?

In a previous question, I read ... for $b$-bit security meaning $O(2^b)$ work for an attacker to break the system... While in Katz's Introduction to modern Cryptography, I read: The key-generation ...
0
votes
0answers
23 views

How to estimate the computation overhead of ECDSA?

I am using ECDSA as a digital signature scheme. Using Charm, I got the timing for the multiplication, exponentiation, and pairing operations; they take 0.005, 9, and 4.4 ms respectively. I want to ...
2
votes
1answer
95 views

Montgomery Multiplication with CRT

I am attempting to understand how to use Montgomery multiplication in an RSA private key operation: $X \equiv a^{e} \pmod{n}$ where $a$ is the message, $e$ is the exponent, $n$ is the modulus. Using ...
0
votes
0answers
23 views

Designing number of rounds of specific hashing process [closed]

Consider a certain encryption process/hash function which transform 128-bit blocks into 128-bit blocks. This is not a cipher or complete function yet. I am thinking about the theoretical process. We ...
1
vote
1answer
45 views

Multidimensional meet-in-the-middle attack on AES

Is an MD-MITM attack possible for AES? As I know, we can break 2 rounds of AES. So we could apply the MD-MITM attack 5 times. This should significantly reduce the security of AES. What stops us from ...
0
votes
0answers
40 views
+50

How hard is it to link a hardened BIP32 child public key to it's parent public key?

The BIP32 spec says this in the security section: ...
0
votes
1answer
34 views

My question is about Enigma rotors

I found this explanation of Enigma rotor movement on this website, but can't quite understand the methodology: Enigma rotation example A ⤑ B → D ⤑ C (rotor III in position B) C ⤑ C → D ⤑ D (rotor II ...
1
vote
0answers
34 views

How to fix the issue with Gimli full permutation distinguisher?

A new paper "New results on Gimli: full-permutation distinguishers and improved collisions" has been published stating a full 24-round permutation distinguisher with a cost of $2^{64}$ and ...
1
vote
0answers
39 views

OAuth(2) and friends

I've worked on low-level security (side-channel attacks etc.) for years and have a PhD in crypto. Web security is something I've never needed to touch beyond knowing how the TLS handshake works with ...
3
votes
2answers
70 views

How to generate Multiple Encryption Keys for use in RSA polymorphic multiplication

I am a long time scroller, first time poster in the crypto stack. I've recently been finding myself leaving the realm of mainstream/standard crypto (imo that consists of symmetric/asymmetric ...
0
votes
0answers
73 views

Block cipher modes used in real life

There is a number of block cipher modes, including ECB, CBC, CFB, OFB, CTR and others. After reading "Serious Cryptography. A Practical Introduction to Modern Encryption" by Jean-Philippe ...
1
vote
2answers
109 views

Padding of SHA-3

SHA-3 uses Padding, so the original message has a certain length. In the case of SHA-3-512 each block has the size of 576, so any message must be padded, such that it is a multiple of the blocksize ...

15 30 50 per page
1
2 3 4 5
445