All Questions

0
votes
0answers
35 views

Two parties looking to share data anonymously

I've been struggling to find good info on how to do the following: A(lice) and B(ob) each have a table of data (a and b ...
0
votes
0answers
50 views

Construct an adversary [on hold]

Fix $N$, $e$ with $\text{gcd}(e, \phi(N))$ = 1, and assume there is an adversary $A$ running in time $t$ for which $Pr[A([x^e \mod N]) = x] = 0.01$, where the probability is taken over uniform choice ...
0
votes
0answers
13 views

How should I generate a CSR to get my personal email's key pair be verified? [migrated]

So I'm currently looking to get my public/private key pair that I use to sign emails to get verified by SwissSign, and the service requires me to provide a CSR. So my first question is how should I ...
2
votes
1answer
32 views

Can HKDF be instantiated with HMAC-SWIFFT?

While reading through "Cryptographic Extraction and Key Derivation: The HKDF Scheme" by Hugo Krawczyk, I found the following text intriguing: In some cases, well-defined combinatorial assumptions ...
0
votes
0answers
15 views

What is the difference between these pairings classifications?

I know the basic definitions of bilinear groups. For example, there is a bilinear pairing that uses elliptic curves and has the following properties: For $G_1$, and $G_2$ are cyclic groups of prime ...
4
votes
1answer
69 views

Elliptic Curve Cryptography insecure when input does not lie on the curve?

I am new to Elliptic Curve Cryptography and I was reading up on it online when I came across this link. It stated the following. Unfortunately, there is a gap between ECDLP difficulty and ECC ...
-1
votes
0answers
25 views

Maple code for Decryption using RSA [on hold]

i am given a ciphertext 596912 along with n = 823091 and the private key e=17. is there a maple code that i can use to decrypt the ciphertext since i'm not given the value of d, p and q?
0
votes
1answer
29 views

Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?

When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are: Curves: P-256, P-384, or P-521 Hashes: SHA-1, SHA-256, SHA-384, or SHA-512 If I was ...
0
votes
1answer
32 views

Choice of delta-neighbors in Balloon Hash algorithm

Reference Document: https://eprint.iacr.org/2016/027.pdf According to appendix D section 4 definition 27 each vertex in V has predecessors sampled independently and uniformly at random from the ...
1
vote
1answer
43 views

Enigma rotation example

According to wikipedia: BDZGO is the expected outcome when doing the enigma chipher on the letters AAAAA with rotors I,II,III and reflector B. ...
2
votes
2answers
93 views

What is the difference between the adversary and the algorithm?

I recently saw a sketch relating to provable security in a book, regarding the amount of time it takes to factor N where N = pq and p,q are primes. It says that "There is a trivial algorithm which ...
0
votes
0answers
22 views

TPM Key Attestation with ECDSA keys

TPM 2.0, at least in Windows 10, seem only able to perform TPM Key Attestation for RSA-based keys. Is this a hardware limitation of the TPM 2.0 chips or a limitation of Windows 10?
0
votes
0answers
35 views

Reduction to security of proof system for proving knowledge

I want to prove security of my system by reduction to the security of an underlying non-interactive proof system for proving knowledge. I know a game that captures the desired security property of my ...
0
votes
0answers
40 views

Keyed Permutations [on hold]

I need some Keyed permutations names just like RC4 cipher, in which we can generate a pseudo random sequence based on the key. For example: If I enter key=abc123 it will generate a random sequence of ...
0
votes
1answer
49 views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
0
votes
0answers
62 views

AES encryption question

If we consider the generation of keys as $$\begin{aligned} K_0 &= E_K(IV); \\ K_{i+1} &= E_{K_i}(A) \end{aligned}$$ Where A is a block of zeroes, and the ciphertext blocks are computed as ...
1
vote
5answers
137 views

Why are password database breaches bad if cryptographic hashes can't be reversed? [on hold]

If companies such as Facebook store our passwords as hashes, when they are leaked how can this be a threat to the users? I thought of it because nowadays we do not have computational power to break ...
3
votes
2answers
134 views

How are these AES MixColumn multiplication tables calculated?

I'm using the mul2, mul3, mul9, mul11, mul13 and mul14 tables for the MixColumn and InvMixColumn steps in AES-128. However, I got these off some Github repository, and now I'm looking for an actual ...
-1
votes
2answers
39 views

aes invmixcolumns process? [duplicate]

I want to know how to obtain mixcolum -> invmixcolumns mixcolumn = [2 3 1 1 1 2 3 1 1 1 2 3 3 1 1 2 ] -> -1/35 [4 3 11 17 17 4 3 11 11 17 4 3 ...
2
votes
1answer
38 views

Time locked cryptography using Bitcoin difficulty param and/or smart contract?

Outcome: Create a message with a count down timer. Once a top level password is entered, a countdown timer starts. Once timer expires, the message is decrypted. Known methods: Proof of work. ...
4
votes
0answers
72 views

Aside from Keccak, are there any keyed/unkeyed permutations where the choice of all rotation constants is not based on heuristic methods?

I am interested to see examples of cryptographic algorithms (namely, keyed or unkeyed permutations that transform an $n$-bit input to an $n$-bit output) where the choice of all rotation values is not ...
1
vote
3answers
342 views

What happens if you increment MAX counter in AES-CTR?

Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
1
vote
1answer
35 views

PRP, PRF change at next selection?

This is probably a silly question, and similar question was asked before; but I can not figure out what actually is PRP/PRF. For example, it is commented that: A Pseudo Random Function is a ...
2
votes
0answers
45 views

New Pairing Friendly Curves for SM9

A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9" http://xxhb.fjnu.edu.cn/_upload/tpl/06/5d/1629/template1629/papers/88.pdf SM9 is a Chinese National Identity Based ...
2
votes
1answer
45 views

Brute forcing the value of m in RSA

I looked into the math behind RSA and seem to understand the basic encryption and decryption scheme. Let's say there are two parties, Alice and Bob, who wish to communicate and secure their ...
0
votes
0answers
21 views

Verifiable Encryption of a Pedersen Commitment

Can the Verifiable Encryption of a Discrete Logarithm scheme of the paper https://www.shoup.net/papers/verenc.pdf (page 19) be used to verify that a ciphertext encrypts the same value committed in a ...
1
vote
1answer
45 views

Block cipher information leakage using same key

This is from a previous exam question and I'm not really sure how to approach this properly We're using a block-cipher mode that encrypts $C_i$ = $E_k$ ($P_i$ $\oplus$ $C_{i-1}$ $\oplus$ $P_{...
1
vote
0answers
39 views

Why does 3-way authentication need the 3rd nonce to be stored?

In the following 3-way authentication protocol: A -> B: $N_a$ || B || Signature_KprivA B -> A: $N_a+1$ || $N_b$ || A || Signature_KprivB A -> B: $N_b+1$ || Signature_KprivA ($N_a$ and $N_b$ are ...
6
votes
2answers
197 views

Do you really need a KDF when you have a PRF?

My understanding is that a KDF is like a PRF, except that it has a preliminary step that "extract" entropy. It is thus needed when the entropy is non-uniform (for example the output of ECDH is modulo ...
-1
votes
0answers
16 views

Are all uncomputable problems, undecidable? [migrated]

Is there a proof that shows that: "A problem is uncomputable iff it is undecidable"?
0
votes
0answers
19 views

I need Zero Knowledge Range Proofs in Java [closed]

I really want to use Zero Knowledge Range Proofs in a Java application! The notes to the Stanford java implementation say "don't use in production". Are there any other functionally equivalent ...
0
votes
1answer
74 views

Plain RSA with $3$ primes, find all integers $x$ so that $x$ is equal to $y$ when $y= e_K(x) = x^{b} \bmod n$

I'm using the notation from the book: Cryptography: Theory and Practice, Third Edition. I have a cryptosystem with the following information: $n = p_1 p_2 p_3$ and integer $x$ is encrypted using $y =...
0
votes
0answers
34 views

Meet-in-the-middle attack (different block cipher modes)

Does a meet-in-the-middle attack on depend on the used modes for block ciphers? encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = ...
2
votes
1answer
26 views

consequences of using fixed values with OAEP

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm ...
3
votes
3answers
96 views

Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version ...
0
votes
0answers
24 views

How can I combine Quorum and Zero Knowledge Range Proofs

I have 20 years of experience at java JEE coding, and 10 years in devops as well, but no experience with blockchains, or the Go language. I want to setup a cluster of Quorum blockchain nodes, ...
-1
votes
1answer
64 views

How does ECDHE fit with AES and SHA?

Hi I'm trying to piece together how AES, ECDHE, and SHA all work together. From what I understand ECDHE is uses asymmetric cryptography to generate a shared key from a public and private key which are ...
-2
votes
0answers
34 views

Riemann's Hypothesis and Miller-Rabin test for primality [closed]

please what is the complexity of Miller Rabin the case we accept Hypothesis of Riemann
1
vote
1answer
32 views

How to prove element equality in G1 using Groth-Sahai proofs

In the BeleniosRF e-voting scheme, Groth-Sahai proofs with the "Instantiation based on the SXDH assumption" are used (see https://eprint.iacr.org/2007/155, version 20160411:065033, page 24). In the ...
0
votes
1answer
49 views

Block Cipher CTR mode when offset is not known by receiver

When an encrypted message is received, it can be easily decrypted if the offset (=counter) of the received message is known (and also the required private key of course). This allows for random access ...
0
votes
1answer
27 views

Why do we approximate R-1 rounds during linear or differential cryptanalysis?

I am currently looking into differential and linear cryptanalysis. I am however unsure why do we only approximate only R-1 out of R rounds - is it because we already know the output or why ? I have ...
0
votes
1answer
54 views

Apple CryptoKit - Understanding its portability

I've been playing with Apple's CryptoKit (their effort to make their old CommonCrypto lib more modern and easy to use via Swift, their programming language). I'm interested to see how portable it is.....
1
vote
0answers
33 views

Gennaro multi trapdoor commitment scheme

In the Scheme Based on the SDH Assumption (page 11 of the paper https://link.springer.com/content/pdf/10.1007%2F978-3-540-28628-8_14.pdf), how does the commitment get revealed with the master trapdoor ...
2
votes
1answer
48 views

DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
-1
votes
2answers
56 views

How to find the key of XOR encryption in Java?

I am trying to find the key of an XOR-encrypted string in Java. It is very probable that the key is eight characters long. I have the encrypted string. I do not understand how to go backwards and ...
0
votes
0answers
23 views

How do BLS signatures prove a private key belongs to public key

In a Boneh-Lynn-Shacham sig the public key: Each of our devices has a signer’s number i = 1,2,3 that represent its place in a set, a private key pki and a corresponding public key Pi = pki×G. ...
0
votes
0answers
29 views

Are the factors for a number n, more likely to lie within a certain range of n?

Given $n=ab$ is $a$ or $b$ more likely to be between $1$ and $n/2$ as an example? Where $a$ and $b$ are prime
1
vote
0answers
67 views

Multivariate Cryptography: Security of the affine transform T

In this question, I'd like to discuss the security of the last transformation $T$ employed in the construction of a MV-scheme. MVCrypto is based on solving a system of polynomial equations, but ...
1
vote
1answer
48 views

Valid private keys on curve25519

Given that valid private keys on curve25519 must be less than the order of the curve which is (as I understand) already smaller than 2^256, AND a valid key must be clamped to be divisible by 8 and ...
2
votes
1answer
53 views

AES with no SubByte - recover the key

I was wondering if it was possible to recover an AES-128 blockcipher key, knowing that there is no substitution box (it can be seen as the identity mapping). I thought it would be feasible. I ...

15 30 50 per page