All Questions

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...

We're currently approaching the end of our semester, but I've found that our homework is starting to consist more of encrypting and decrypting using different types of algorithms instead of learning ...

Suppose there is a scheme where a message is first hashed and then sent to a PRP. If the hash is done using an $\epsilon$-bounded universal hash function and the PRP $K\times \{0,1\}^n\rightarrow\{0,1\...

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...

Since the signatures all generate the public keys, those can be derived from sig and proven by pre-commited XOR of every pub key compared with XOR of every signature end hash.

From what I understand an LFSR produces a maximal length sequence if its characteristic polynomial $p(x)$ of degree $n$ is irreducible, i.e. if it cannot be factored and the smallest integer $k$ for ...

I have read section 3.5 (algorithm 3.7) in "Guide to Elliptic Curve Cryptography", and have been trying to implement endomorphism on secpt256k1 to speed up calculating $kP$ by changing it into 2 point ...

How would one build an LSFR logical map, with a characteristic polynomial such as $$P(x) = x^4 + x^3 + 1$$? Also how would you interpret it, and what would you do to do the reverse it in order to ...

Let $R_q=\mathbb{Z}_q[x]/(x^n+1)$ as usual in the RLWE assumption. Suppoes that I choose a sample of the RLWE distribution, that is, I compute $(a,y=as+e)$ where $a$ is uniform in $R_q$ and $s,e\...

In Lenstra's ECM algorithm, $\#E(\mathbb{F}_{p})$ is required to have small prime factors. Why is this so? I understand that the p-1 method is efficient for factoring N with small factors. The ECM ...

This is a theoretical question to solve an argument with a friend.. Is there a working cryptographic system that do square root operations during the encryption process? "Working" means that it is ...

Just read about W-OTS, since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller vale for N when having access to original signature? I.e. just hash ...

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...

In part 4.2 of this paper, the writers introduced a technique called 'Multi-step Modification', here I got some questions. How does the Multi-step Modification ensure that we will not change any ...

I'm new to cryptography. I have a binary image with 64x64 pixel in size. I perform an encryption to the image using RSA Algorithm. I wanna ask something bothering me, why can I not use big prime ...

Reading here,I was confused in the proof of "A Multi-Signature Scheme based on Discrete Logarithms" proposed by authors.I felt strange to the technique(using array $T_0[]$、$T_1[]$、$T_2[]$ and state $...

The following definition is from Trappe and Washington, "Introduction to Cryptography with Coding Theory". Given a number $n$ and an integer $r > 0$ such that $a^r \equiv 1 \pmod{n}$ for all ...

I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware ...

I have coded an implementation of elliptic curves in order to apply some of the ECC algorithms. However, in most of them, Alice needs to choose a point P on a given curve. What is the general ...

Vector commitment allows to commit to an ordered sequence of $q$ value ($m_1,\cdots,m_q$) in such a way that one can later open the commitment at specific positions(e.g., prove that $m_i$ is the $i$-...

The objective is to broadcast information over a noisy digital channel (corruption rate of say, 10-20 %, where bits flip). Assume the broadcasting software is public and there is no possibility of ...

Given two plaintexts $p_1$ and $p_2$, is it possible to find two keys for AES(-CBC) so that $$E_{k_1}(p_1) = E_{k_2}(p_2) $$ I want to make sure that will never happen, or is there any way to ...

I am reading Programming Bitcoin. The author said: Another property of scalar multiplication is that at a certain multiple, we get to the point at infinity (remember, the point at infinity is the ...

While performing encryption using public key and decryption using the private key, I am always finding that encryption takes more time than decryption in elliptic curve cryptography (ECC). It's the ...

Given the sign capability from Go NaCl library (https://github.com/golang/crypto/tree/master/nacl/sign), how to sign a file, especially, a very large file as big as more than 1GB? Most of the internet ...

Consider the following custom crypto: We have a signed message M1 with corresponding signature S. We have the 1024-bit modulus <...

In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes. What does "Canonical ...

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....

How to produce a binary output sequence using LFSRs but with increased linear complexity? I have tried searching but i got confused on equation details. So can anyone help me with rather simple ...

If I have two cipher texts lets say $C_1$ and $C_2$ of the same length encrypted through stream cipher technique using the same keystream. Let's say they are: $$C_1: \texttt{96 C6 A1 08 E7 F2 33 3B ...

Lets say an attacker has gained permanent access to the password file and mounts an offline dictionary attack. The passwords are stored as hash values in the file together with a salt values, ...

I would like to encrypt certain data before logging it. Currently, I use a private key and a static IV. Looking at generating a suitable IV I am concerned about the overhead in generating CSPRNG ...

I need a compression function $F$ that uses only bitwise operations (AND, NOT, OR, XOR, shifts, rotations) and outputs one 32-bit word $W$ from four 32-bit words $w_1 \mathbin\Vert w_2 \mathbin\Vert ...

I have a set of 11 hex coded strings that have been encrypted using XOR operation each with the same stream cipher key. How do I decrypt the 11th hex-coded string to arrive at the plain-text without ...

How to motivate, that in ElGamal Alice the recipient keeps her keys fixed, while Bob the sender changes the key each time - why not both of them change their keys each time?

Is finding a public key that matches hash of pre-commited public key (second layer security) more computationally hard than finding private key to a known public key (attacking secp256k1)?

Assume my prime generation is as follows: Pick a number $p$ between 1000 and 9999. $p=abcd$. Make sure $p$ is prime Construct $q$ such by taking the last 2 digits of $p$ and the first 2 digits of $p$,...

This may be a difficult question So, C1 = Aes-GCM(k1, nonce, message) where nonce = HMAC(key,message). C2 = Aes-CBC(k2, iv, C1). Now, a security breach occurs. The adversary obtains k1 and C2 ...

The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...

For a sha512 hash of a secp256k1 public key, how many other public keys could generate that hash? I would assume zero since the key size is equal to the hash length (secp256k1 public keys are 64 bytes,...

I'm reading this paper: Quadratic Span Programs and Succinct NIZKs without PCP Is QAP NP-complete? as same as QSP?

I'm having a hard time pinning down an exact definition of the difference between information-theoretic and perfect types of security. A rigorous definition seems elusive... A. Wikipedia puts the ...

So Ethereum goes for RANDAO. The disadvantage with RANDAO is that the last validator in the commit-reveal scheme is able to hold his contributed value back and thereby influence the random outcome. ...

I'd like to encrypt Text with AES/CTR and a password defined by the user in java. I already checked the internet (and stackoverflow) for answers. The most used version is to hash the user password ...

What is computationally hardest, finding the private key corresponding to a given public key, or, finding a pre-image that hashes to a public key for a key pair (any pair) where you control the ...

Let's assume all operations are done on $\mathbb{Z}_p$ where $p$ is a large non-prime number. To mask a value $a$, we do the following: Pick a uniformly random value: $r$, from the ring. Do as ...

I have searched on Google the keywords "multi-signature, IOT", but it seems that not many papers related to that have been proposed. What I found most is related to blockchains. My motivation is, in ...

In their 2015 paper "More Rounds, Less Security?" Guo, Jean, Mouha and Nikolić claim in section 5.4 that one can recover a password $P$ given hashes of $D$ different passwords generated from $H^k(P)$ ...