All Questions

1
vote
0answers
81 views

RSA encryption extremely large public exponent

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...
1
vote
1answer
89 views

Methods of Learning Cryptography [closed]

We're currently approaching the end of our semester, but I've found that our homework is starting to consist more of encrypting and decrypting using different types of algorithms instead of learning ...
1
vote
0answers
25 views

How to prove security of scheme constructed by Hash then PRP

Suppose there is a scheme where a message is first hashed and then sent to a PRP. If the hash is done using an $\epsilon$-bounded universal hash function and the PRP $K\times \{0,1\}^n\rightarrow\{0,1\...
0
votes
0answers
41 views

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
0
votes
1answer
40 views

In W-OTS, could you XOR all public keys?

Since the signatures all generate the public keys, those can be derived from sig and proven by pre-commited XOR of every pub key compared with XOR of every signature end hash.
1
vote
1answer
54 views

LFSR: finding the period for an irreducible Polynomial

From what I understand an LFSR produces a maximal length sequence if its characteristic polynomial $p(x)$ of degree $n$ is irreducible, i.e. if it cannot be factored and the smallest integer $k$ for ...
0
votes
1answer
35 views

Question on using endomorphism on secp256k1 and negative results

I have read section 3.5 (algorithm 3.7) in "Guide to Elliptic Curve Cryptography", and have been trying to implement endomorphism on secpt256k1 to speed up calculating $kP$ by changing it into 2 point ...
1
vote
1answer
35 views

Building an LSFR Logical bit map using characteristic polynomials

How would one build an LSFR logical map, with a characteristic polynomial such as $$P(x) = x^4 + x^3 + 1$$? Also how would you interpret it, and what would you do to do the reverse it in order to ...
1
vote
0answers
33 views

Probability of an RLWE sample

Let $R_q=\mathbb{Z}_q[x]/(x^n+1)$ as usual in the RLWE assumption. Suppoes that I choose a sample of the RLWE distribution, that is, I compute $(a,y=as+e)$ where $a$ is uniform in $R_q$ and $s,e\...
2
votes
1answer
32 views

Lenstra's ECM Algorithm - field requirement

In Lenstra's ECM algorithm, $\#E(\mathbb{F}_{p})$ is required to have small prime factors. Why is this so? I understand that the p-1 method is efficient for factoring N with small factors. The ECM ...
4
votes
2answers
203 views

Is there a crypto system doing sqrt during encryption?

This is a theoretical question to solve an argument with a friend.. Is there a working cryptographic system that do square root operations during the encryption process? "Working" means that it is ...
0
votes
1answer
27 views

In W-OTS, is it trivial to forge smaller N values?

Just read about W-OTS, since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller vale for N when having access to original signature? I.e. just hash ...
2
votes
1answer
73 views

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
1
vote
1answer
56 views

DSA: why using mod p mod q and not just mod p

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...
0
votes
0answers
44 views

Formal security-definition reference

Is there a reference where all common formal security-definitions are summarized (such as OW-CPA, IND-CPA, IND-CCA1, IND-CCA2, EUF-CMA and so on)? I need a PUBLISHED reference (paper, book) which ...
0
votes
0answers
26 views

When looking for collisions of MD4, how does the 'Multi-step Modification' work in the paper of Wang et. al?

In part 4.2 of this paper, the writers introduced a technique called 'Multi-step Modification', here I got some questions. How does the Multi-step Modification ensure that we will not change any ...
0
votes
1answer
230 views

Can not use big prime number for pair of key of RSA Algorithm [closed]

I'm new to cryptography. I have a binary image with 64x64 pixel in size. I perform an encryption to the image using RSA Algorithm. I wanna ask something bothering me, why can I not use big prime ...
1
vote
0answers
17 views

Proof in “New Multi-Signatures in the Plain Public-key Model and a General Forking lemma”

Reading here,I was confused in the proof of "A Multi-Signature Scheme based on Discrete Logarithms" proposed by authors.I felt strange to the technique(using array $T_0[]$、$T_1[]$、$T_2[]$ and state $...
2
votes
0answers
46 views

Bounds on failure probability for universal exponent method?

The following definition is from Trappe and Washington, "Introduction to Cryptography with Coding Theory". Given a number $n$ and an integer $r > 0$ such that $a^r \equiv 1 \pmod{n}$ for all ...
1
vote
0answers
57 views

Weak/Vulnerable AES Implementations [closed]

I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware ...
1
vote
1answer
50 views

Generating a random point on an elliptic curve over a finite field

I have coded an implementation of elliptic curves in order to apply some of the ECC algorithms. However, in most of them, Alice needs to choose a point P on a given curve. What is the general ...
3
votes
0answers
33 views

What's the difference among Vector Commitment, Zero-knowledge Set, Zero-knowledge Accumulator, and Zero-knowledge Elementary Database?

Vector commitment allows to commit to an ordered sequence of $q$ value ($m_1,\cdots,m_q$) in such a way that one can later open the commitment at specific positions(e.g., prove that $m_i$ is the $i$-...
1
vote
0answers
63 views

Ciphertext indistinguishability under a noisy channel w/ error correction

The objective is to broadcast information over a noisy digital channel (corruption rate of say, 10-20 %, where bits flip). Assume the broadcasting software is public and there is no possibility of ...
0
votes
1answer
55 views

AES: Given two deterministic plaintexts, compute two keys let the ciphertext is the same, is it possible?

Given two plaintexts $p_1$ and $p_2$, is it possible to find two keys for AES(-CBC) so that $$E_{k_1}(p_1) = E_{k_2}(p_2) $$ I want to make sure that will never happen, or is there any way to ...
2
votes
1answer
139 views

Can you tell me why doing scalar multiplication of a point on a Elliptic curve over a finite field gets to a point at infinity?

I am reading Programming Bitcoin. The author said: Another property of scalar multiplication is that at a certain multiple, we get to the point at infinity (remember, the point at infinity is the ...
1
vote
1answer
105 views

Why is encryption slower than decryption in elliptic curve cryptography (ECC)?

While performing encryption using public key and decryption using the private key, I am always finding that encryption takes more time than decryption in elliptic curve cryptography (ECC). It's the ...
0
votes
0answers
4 views

How to use NaCl to sign a file? [migrated]

Given the sign capability from Go NaCl library (https://github.com/golang/crypto/tree/master/nacl/sign), how to sign a file, especially, a very large file as big as more than 1GB? Most of the internet ...
0
votes
0answers
49 views

RSA Signature Forgery - Low Public Exponent + Improper Padding Validation? [duplicate]

Consider the following custom crypto: We have a signed message M1 with corresponding signature S. We have the 1024-bit modulus <...
3
votes
1answer
60 views

What does it mean : “Canonical representative of Sbox is 0123468A5BCF79DE”? and How can we calculate this representative for Sbox?

In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes. What does "Canonical ...
0
votes
0answers
28 views

Signature Generation with RSA PKCS#1 v.15

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
2
votes
2answers
75 views

How to produce a binary output sequence using LFSRs but with increased linear complexity?

How to produce a binary output sequence using LFSRs but with increased linear complexity? I have tried searching but i got confused on equation details. So can anyone help me with rather simple ...
1
vote
2answers
132 views

How to know the difference between two ciphertexts without key stream in stream ciphers [duplicate]

If I have two cipher texts lets say $C_1$ and $C_2$ of the same length encrypted through stream cipher technique using the same keystream. Let's say they are: $$C_1: \texttt{96 C6 A1 08 E7 F2 33 3B ...
-1
votes
0answers
37 views

Unix salt for passwords - length doesn't matter in offline dictionary attack?

Lets say an attacker has gained permanent access to the password file and mounts an offline dictionary attack. The passwords are stored as hash values in the file together with a salt values, ...
0
votes
0answers
40 views

What is the most secure way to encrypt certain properties in logs

I would like to encrypt certain data before logging it. Currently, I use a private key and a static IV. Looking at generating a suitable IV I am concerned about the overhead in generating CSPRNG ...
1
vote
1answer
97 views

Does there exist a compression function (from four 32-bit words to one 32-bit word) that always detects any modification of a single word?

I need a compression function $F$ that uses only bitwise operations (AND, NOT, OR, XOR, shifts, rotations) and outputs one 32-bit word $W$ from four 32-bit words $w_1 \mathbin\Vert w_2 \mathbin\Vert ...
0
votes
0answers
22 views

XOR operation to uncover plain-text out of given cipher-texts [duplicate]

I have a set of 11 hex coded strings that have been encrypted using XOR operation each with the same stream cipher key. How do I decrypt the 11th hex-coded string to arrive at the plain-text without ...
0
votes
0answers
40 views

Beginners question regarding ElGamal

How to motivate, that in ElGamal Alice the recipient keeps her keys fixed, while Bob the sender changes the key each time - why not both of them change their keys each time?
0
votes
1answer
39 views

finding sha256 preimage or secp256k1 private key, which is harder?

Is finding a public key that matches hash of pre-commited public key (second layer security) more computationally hard than finding private key to a known public key (attacking secp256k1)?
3
votes
2answers
951 views

RSA: Danger of using p to create q

Assume my prime generation is as follows: Pick a number $p$ between 1000 and 9999. $p=abcd$. Make sure $p$ is prime Construct $q$ such by taking the last 2 digits of $p$ and the first 2 digits of $p$,...
0
votes
1answer
87 views

What is the Risk of Rotating Keys

This may be a difficult question So, C1 = Aes-GCM(k1, nonce, message) where nonce = HMAC(key,message). C2 = Aes-CBC(k2, iv, C1). Now, a security breach occurs. The adversary obtains k1 and C2 ...
1
vote
1answer
41 views

When do clients use TLS in PSK mode?

The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
1
vote
2answers
82 views

Hash collisions in sha512 hash of secp256k1 public keys

For a sha512 hash of a secp256k1 public key, how many other public keys could generate that hash? I would assume zero since the key size is equal to the hash length (secp256k1 public keys are 64 bytes,...
3
votes
1answer
66 views

Is Quadratic Arithmetic Program NP-complete?

I'm reading this paper: Quadratic Span Programs and Succinct NIZKs without PCP Is QAP NP-complete? as same as QSP?
3
votes
2answers
133 views

What is the difference between information-theoretic and perfect types of security?

I'm having a hard time pinning down an exact definition of the difference between information-theoretic and perfect types of security. A rigorous definition seems elusive... A. Wikipedia puts the ...
1
vote
0answers
37 views

Why is ethereum not using threshold signatures like dfinity for randomness? What's the drawback?

So Ethereum goes for RANDAO. The disadvantage with RANDAO is that the last validator in the commit-reveal scheme is able to hold his contributed value back and thereby influence the random outcome. ...
6
votes
1answer
3k views

AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?

I'd like to encrypt Text with AES/CTR and a password defined by the user in java. I already checked the internet (and stackoverflow) for answers. The most used version is to hash the user password ...
0
votes
0answers
27 views

Computational hardness in two different cryptographic problems [closed]

What is computationally hardest, finding the private key corresponding to a given public key, or, finding a pre-image that hashes to a public key for a key pair (any pair) where you control the ...
0
votes
1answer
57 views

Is the One Time Pad secure in additive Rings?

Let's assume all operations are done on $\mathbb{Z}_p$ where $p$ is a large non-prime number. To mask a value $a$, we do the following: Pick a uniformly random value: $r$, from the ring. Do as ...
0
votes
0answers
33 views

Are there any multi-signature scheme used in IoT?

I have searched on Google the keywords "multi-signature, IOT", but it seems that not many papers related to that have been proposed. What I found most is related to blockchains. My motivation is, in ...
4
votes
1answer
45 views

How to get a speedup linear in the number of iterations on unsalted iterated password hashing?

In their 2015 paper "More Rounds, Less Security?" Guo, Jean, Mouha and Nikolić claim in section 5.4 that one can recover a password $P$ given hashes of $D$ different passwords generated from $H^k(P)$ ...

15 30 50 per page