All Questions

Forward Secrecy, also perfect forward secrecy, gives assurance about session keys even the private key is compromised. This is achieved by generating a random key per session without using a ...

Using the simple rules of modular arithmetics for Elliptic Curves, including associative and commutative rules for $+$ and $*$, where uppercase letters are points and lowercase are scalars on the ...

I was reading about random numbers and their usage in security. I'd like to verify with more experienced people how good this method of generating random numbers will be. Human beings are very hard ...

I have a specific use case I am interested in. I have spent the better part of the night reading research papers. I am beginning to believe what I want is not possible so I wanted to confirm here. ...

I did some researches about forgery attack and chosen-message attack. For me, forgery attacks are more focused on the verifiability whereas chosen-message attacks are similar to brute-force attacks. ...

I can't understand how Niederreiter cryptosystem works. If $c=mH^{'T}$ than why we cannot compute $m$ directly by multiplying $c$ with the $(H^{'T})^{-1}$? Can you give me an example of a "fast ...

https://news.ycombinator.com/item?id=19111707 https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/ No ...

Google made the headlines with its new Adiantum encryption method, and i read (TechCrunch) that: In the meantime don’t expect any instant gains, but future low-power devices may offer better ...

From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA. Is this the general case?

[Clarification edit further down.] To distinguish already existing one-time pad files by their content instead of just their name ... ... is hashing meaningful? Or would the first X bytes (Length ...

My understanding of security level is that for a crypto scheme to have n-bit security means it would take $2^n$ operations to break it. For something like AES with a 128-bit key, it's straight-...

Let's assume a text file that grows at its very end but is otherwise not edited. We now have 100 transmissions of this, but OTP-encrypted (different OTP each time, of course). The first 50% of the ...

Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be ...

I have two peers with RSA keys; they want to encrypt a non-trivially sized message between them, so I want a random AES symmetric secret key, which is encrypted with Bob's public RSA key, and sent ...

If I hash the word SOUND, where the word SOUND appears five times inside the file, will each of the five instances of SOUND appear as identical hash values?

I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them. In the browser, ...

I learned about the NIST hash function competition which generated SHA3. It says it inspired a Password hashing competition too, which resulted in Argon2. What I'm wondering is what people generally ...

For a given elliptic curve $E$ like this $y^2 = x^3 + Ax + B \pmod p$, can we find the point $P$ if we know that the $Q = 2\times P = (a, b)$? For example $E:\ y^2 = x^3 + x + 1 \pmod {10007}$, we ...

I've read this post but I'm still unable to understand some things. I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...

I would like to learn how hashing functions are discovered / created. In part of this process I think it would be helpful to see the original works or papers of any authors of cryptographic or non-...

I am using this https://github.com/gburca/ssss-js Shamir implementation. I generated 4 shares from secret (threshold of 2). I am wondering if I can recreate (interpolate) original polynomial from ...

AEAD encryption schemes produce something referred to as an "authentication tag." What does this tag consist of, what is its purpose, and is the tag itself human-readable data such as a plaintext ...

I am reading up on Sonic: Zero Knowledge SNARKS from Linear - Sized Universal And Updateable Structured Reference Strings. An excerpt: For soundness, we do not use the standard definition of ...

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in ...

I am trying to solve this question and I have no idea how to find the value for $q$. I know that I am supposed to find the probability of $q>3q/512$ in terms of the equation $q$, but not sure how? ...

I am currently reading a research paper that uses the term 2-flat. However, I don't understand what this term means. For example, the paper mentions in its definition of APN that for all distinct $a$,...

The question is about "formal" analysis, proofs, etc... What is a correct definition of a formal proof, or a formal analysis? Is there a good way and a bad way to formally prove something. What is the ...

Say we have a classic Diffie-Hellman key exchange. We have the following parameters of a public key: p,g,y Where $p$ is the modulus, $g$ is the base, $y$ is the ...

We are trying to distinguish two RSA prime generators: Prime generator 1 draw uniformly at random an integer $p$ with $2^{1023.5}<p<2^{1024}$, until it is prime output $p$. Prime generator 2 ...

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...

I'm trying to understand the new PSS scheme, but having trouble figuring out how to parse it properly. When receiving a certificate with OID of RSASSA-PSS, how can I know which hash and signing ...

I would like to use IES (x25519 and AES-GCM), but every message used a new session key, does that affect the performance of the system? do I need to used session key to refer to the key that used by ...

In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...

Statistical security definition has a condition that the adversary is not computationally bounded which makes it stricter than Computational security but how would one mathematically prove it using ...

I feel like I'm completely missing something there. The quarter-round proceeds as follows: ...

I read that random numbers are being used in cryptography and security. I think I have idea how to truly generate true random, non-deterministic number. But before continuing further I'd like to ask ...

First, what is the difference between hardware and software tokens? Tokens are "what you have" for example a car key or a chipcard. This would be (I think) hardware tokens? But what are software ...

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...

I've been looking into rewinding techniques for proving ZK and got a bit confused. This answer is good, but I still have questions about challenge size and the number of rewinds. Consider an ...

Assuming I cannot use DH scheme, and the long term key is known to both sides, is there a known algorithm / standard that defines how to derive a short term key from a long term key?

In Dan Boneh's crypto book, there is a section describing the "Rewinding Lemma", however I cannot find it explained in other sources on the internet. How does this differ from the forking lemma?

I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest ...

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...

I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting $0, 1, 0, 1, 0, ...$ and having the maximum entropy as given by $E(S)$. Shouldn't $E(S)$ measure ...

Asymmetric encryption schemes do leak something about the encrypted plaintext: the length of the plaintext. How can this be mitigated? My solution: Padding the plaintext with some string of the ...

In ciphertext policy attribute based encryption 1 we use a tree structure with different keys into order to access attributes and the attributes are embedded to the ciphertext. Could you please let ...

I have created a text file called test.txt and the content of the file is Hello World I would like to change the SHA checksum hash without modifying the contents and filename. Is there any way to do ...

The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...

I've to mask data into some different value but to keep their property such as order an exact match (substring is yet impossible) What's the state of the art in data masking? I've some data on which ...

I have a need to anonymise phone numbers so that I can carry out testing and analysis work on telecoms data sets and comply with GDPR. I typically receive a batch of a few hundred thousand events ...