All Questions

19,111 questions
35 views

Two parties looking to share data anonymously

I've been struggling to find good info on how to do the following: A(lice) and B(ob) each have a table of data (a and b ...
50 views

Fix $N$, $e$ with $\text{gcd}(e, \phi(N))$ = 1, and assume there is an adversary $A$ running in time $t$ for which $Pr[A([x^e \mod N]) = x] = 0.01$, where the probability is taken over uniform choice ...
13 views

How should I generate a CSR to get my personal email's key pair be verified? [migrated]

So I'm currently looking to get my public/private key pair that I use to sign emails to get verified by SwissSign, and the service requires me to provide a CSR. So my first question is how should I ...
32 views

Can HKDF be instantiated with HMAC-SWIFFT?

While reading through "Cryptographic Extraction and Key Derivation: The HKDF Scheme" by Hugo Krawczyk, I found the following text intriguing: In some cases, well-defined combinatorial assumptions ...
15 views

What is the difference between these pairings classifications?

I know the basic definitions of bilinear groups. For example, there is a bilinear pairing that uses elliptic curves and has the following properties: For $G_1$, and $G_2$ are cyclic groups of prime ...
69 views

Elliptic Curve Cryptography insecure when input does not lie on the curve?

I am new to Elliptic Curve Cryptography and I was reading up on it online when I came across this link. It stated the following. Unfortunately, there is a gap between ECDLP difficulty and ECC ...
25 views

Maple code for Decryption using RSA [on hold]

i am given a ciphertext 596912 along with n = 823091 and the private key e=17. is there a maple code that i can use to decrypt the ciphertext since i'm not given the value of d, p and q?
29 views

Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?

When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are: Curves: P-256, P-384, or P-521 Hashes: SHA-1, SHA-256, SHA-384, or SHA-512 If I was ...
32 views

Choice of delta-neighbors in Balloon Hash algorithm

Reference Document: https://eprint.iacr.org/2016/027.pdf According to appendix D section 4 definition 27 each vertex in V has predecessors sampled independently and uniformly at random from the ...
43 views

Enigma rotation example

According to wikipedia: BDZGO is the expected outcome when doing the enigma chipher on the letters AAAAA with rotors I,II,III and reflector B. ...
93 views

What is the difference between the adversary and the algorithm?

I recently saw a sketch relating to provable security in a book, regarding the amount of time it takes to factor N where N = pq and p,q are primes. It says that "There is a trivial algorithm which ...
22 views

TPM Key Attestation with ECDSA keys

TPM 2.0, at least in Windows 10, seem only able to perform TPM Key Attestation for RSA-based keys. Is this a hardware limitation of the TPM 2.0 chips or a limitation of Windows 10?
35 views

Reduction to security of proof system for proving knowledge

I want to prove security of my system by reduction to the security of an underlying non-interactive proof system for proving knowledge. I know a game that captures the desired security property of my ...
40 views

Keyed Permutations [on hold]

I need some Keyed permutations names just like RC4 cipher, in which we can generate a pseudo random sequence based on the key. For example: If I enter key=abc123 it will generate a random sequence of ...
49 views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
62 views

AES encryption question

If we consider the generation of keys as \begin{aligned} K_0 &= E_K(IV); \\ K_{i+1} &= E_{K_i}(A) \end{aligned} Where A is a block of zeroes, and the ciphertext blocks are computed as ...
137 views

Why are password database breaches bad if cryptographic hashes can't be reversed? [on hold]

If companies such as Facebook store our passwords as hashes, when they are leaked how can this be a threat to the users? I thought of it because nowadays we do not have computational power to break ...
134 views

How are these AES MixColumn multiplication tables calculated?

I'm using the mul2, mul3, mul9, mul11, mul13 and mul14 tables for the MixColumn and InvMixColumn steps in AES-128. However, I got these off some Github repository, and now I'm looking for an actual ...
39 views

aes invmixcolumns process? [duplicate]

I want to know how to obtain mixcolum -> invmixcolumns mixcolumn = [2 3 1 1 1 2 3 1 1 1 2 3 3 1 1 2 ] -> -1/35 [4 3 11 17 17 4 3 11 11 17 4 3 ...
38 views

Time locked cryptography using Bitcoin difficulty param and/or smart contract?

Outcome: Create a message with a count down timer. Once a top level password is entered, a countdown timer starts. Once timer expires, the message is decrypted. Known methods: Proof of work. ...
72 views

Aside from Keccak, are there any keyed/unkeyed permutations where the choice of all rotation constants is not based on heuristic methods?

I am interested to see examples of cryptographic algorithms (namely, keyed or unkeyed permutations that transform an $n$-bit input to an $n$-bit output) where the choice of all rotation values is not ...
342 views

What happens if you increment MAX counter in AES-CTR?

Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
35 views

PRP, PRF change at next selection?

This is probably a silly question, and similar question was asked before; but I can not figure out what actually is PRP/PRF. For example, it is commented that: A Pseudo Random Function is a ...
45 views

New Pairing Friendly Curves for SM9

A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9" http://xxhb.fjnu.edu.cn/_upload/tpl/06/5d/1629/template1629/papers/88.pdf SM9 is a Chinese National Identity Based ...
45 views

Brute forcing the value of m in RSA

I looked into the math behind RSA and seem to understand the basic encryption and decryption scheme. Let's say there are two parties, Alice and Bob, who wish to communicate and secure their ...
21 views

Verifiable Encryption of a Pedersen Commitment

Can the Verifiable Encryption of a Discrete Logarithm scheme of the paper https://www.shoup.net/papers/verenc.pdf (page 19) be used to verify that a ciphertext encrypts the same value committed in a ...
45 views

34 views

Meet-in-the-middle attack (different block cipher modes)

Does a meet-in-the-middle attack on depend on the used modes for block ciphers? encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = ...
26 views

consequences of using fixed values with OAEP

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm ...
96 views

Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version ...
24 views

How can I combine Quorum and Zero Knowledge Range Proofs

I have 20 years of experience at java JEE coding, and 10 years in devops as well, but no experience with blockchains, or the Go language. I want to setup a cluster of Quorum blockchain nodes, ...
64 views

How does ECDHE fit with AES and SHA?

Hi I'm trying to piece together how AES, ECDHE, and SHA all work together. From what I understand ECDHE is uses asymmetric cryptography to generate a shared key from a public and private key which are ...
34 views

Riemann's Hypothesis and Miller-Rabin test for primality [closed]

please what is the complexity of Miller Rabin the case we accept Hypothesis of Riemann
32 views

How to prove element equality in G1 using Groth-Sahai proofs

In the BeleniosRF e-voting scheme, Groth-Sahai proofs with the "Instantiation based on the SXDH assumption" are used (see https://eprint.iacr.org/2007/155, version 20160411:065033, page 24). In the ...
49 views

Block Cipher CTR mode when offset is not known by receiver

When an encrypted message is received, it can be easily decrypted if the offset (=counter) of the received message is known (and also the required private key of course). This allows for random access ...
27 views

Why do we approximate R-1 rounds during linear or differential cryptanalysis?

I am currently looking into differential and linear cryptanalysis. I am however unsure why do we only approximate only R-1 out of R rounds - is it because we already know the output or why ? I have ...
54 views

Apple CryptoKit - Understanding its portability

I've been playing with Apple's CryptoKit (their effort to make their old CommonCrypto lib more modern and easy to use via Swift, their programming language). I'm interested to see how portable it is.....
33 views

Gennaro multi trapdoor commitment scheme

In the Scheme Based on the SDH Assumption (page 11 of the paper https://link.springer.com/content/pdf/10.1007%2F978-3-540-28628-8_14.pdf), how does the commitment get revealed with the master trapdoor ...
48 views

DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
56 views

How to find the key of XOR encryption in Java?

I am trying to find the key of an XOR-encrypted string in Java. It is very probable that the key is eight characters long. I have the encrypted string. I do not understand how to go backwards and ...
23 views

How do BLS signatures prove a private key belongs to public key

In a Boneh-Lynn-Shacham sig the public key: Each of our devices has a signer’s number i = 1,2,3 that represent its place in a set, a private key pki and a corresponding public key Pi = pki×G. ...
29 views

Are the factors for a number n, more likely to lie within a certain range of n?

Given $n=ab$ is $a$ or $b$ more likely to be between $1$ and $n/2$ as an example? Where $a$ and $b$ are prime
67 views

Multivariate Cryptography: Security of the affine transform T

In this question, I'd like to discuss the security of the last transformation $T$ employed in the construction of a MV-scheme. MVCrypto is based on solving a system of polynomial equations, but ...