All Questions

1
vote
0answers
31 views

Simple reduction of commitments to one way functions

I am looking for an explicit and simple reduction of commitments to one way functions. I don't care about the number of rounds, only simplicity. I am aware of the simple reductions you can find in ...
0
votes
0answers
34 views

Helios voting system voting verification

In the decryption step in helios, why do we need Chaum-Pedersen to prove that a certain plaintext $m$ corresponds to a given ciphertext $c$? Why can we just encrypt $m$ and see if it's equal to $c$?
6
votes
1answer
84 views

Is it important to defend against key substitution attack in ECDSA?

When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack? ISO/IEC 14888-3:2018 NOTE 5 states: The ...
0
votes
1answer
54 views

What is multi-prime RSA (RSA-MP)?

I found some related question but no real explanation of what it is and when and why to use it. What are the benefits and downsides and is it recommended?
2
votes
1answer
54 views

Is padding of the digest needed in SHA256 with RSA-2048 scheme?

For a signing scheme involving generating a $256$ bit digest using SHA256 followed by RSA with $2048$ bit modulus, the signature would always be 256 bit without padding even though sigantures of up to ...
0
votes
1answer
44 views

How to compute a challenge c using Fiat Shamir?

I have a prover and verifier. They are engaged in a zero-knowledge proof protocol. A verifier sends a challenge $c$ to the prover so he can compute a proof using the value $c$. How to use Fiat Shamir ...
-2
votes
1answer
46 views

Elliptical Curve Actual Encryption

Im havirng a had time understanding ECC. For example, I have the equation below: ...
1
vote
0answers
71 views

show that G' is not a secure PRG even if G is

Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is. My first question is that in this case, how do I know what G ...
-1
votes
0answers
37 views

How to do the shortcut function in ECC when N (Private Key) is Known

When N or private key is known, we don't have to iterate through all the process just to get the final location given the two initial points. How is that shortcut function implemented given the ...
0
votes
0answers
26 views

Proxy decrypt algorithm in Extended Proxy-Assisted Attribute Based Encryption (ABE) Scheme

Context I'm trying to implement the Attribute-Based Encryption (ABE) scheme described in the paper - Extended Proxy-Assisted Approach: Achieving Revocable Fine-Grained Encryption of Cloud Data (Yang ...
1
vote
1answer
41 views

How to prove that weak one way functions cannot have polynomial-sized ranges?

I figured how to show that strong OWFs cannot have polynomial sized ranges. But I am unable to prove the same for weak OWFs.
0
votes
0answers
24 views

Javascript implemenation of ZK-Starks

I am looking to use ZK-Starks in one of my projects.Is there any javascript library for ZK-STARKS? or has anyone made any implementation of their own for ZK-STARKS?
0
votes
1answer
29 views

How to change the following commitment scheme to pederson commitment?

In my question here Zero knowledge set membership protocol The suggested solution allows a prover to choose a commitment $C$. Then, A trusted third party ($T$) can validate if $C$ is valid or not. ...
-1
votes
0answers
62 views

ECC: Counting points on $E:y^2+xy= x^3+5x+6$ over $GF(2^3)$

How to exactly count the number of rational points on the elliptic curve over the $GF(2^3)$ where the curve equation is $$E:y^2+xy= x^3+5x+6$$
0
votes
1answer
55 views

How do you get $d$ in textbook RSA

So people say to choose $d$ such that $e*d=1(mod((p-1)*(q-1)))$. However, $1\%$ anything always equals $1$. Maybe I am not understanding it correctly, but the only way to get $e \cdot d=1$ is just by ...
-1
votes
1answer
47 views

Add string to create specific MD5?

I have a file that include a long string , I can calc the md5 of this file . Is there any way to know which string I need to add for this file so the md5 of this file will be specific md5 that I want?...
2
votes
1answer
79 views

Does Java SunJCE Provider use AES for encrypting nonce in Poly1305?

RFC 8439 states: AES is used there for encrypting the nonce, so as to get a unique (and secret) 128-bit string, but as the paper states, "There is nothing special about AES here. One can replace ...
1
vote
1answer
47 views

Validating a shared secret between two parties, one bit at a time

What is the following protocol known as? Is it considered secure? Would it work? Background Alice and Bob each have a secret. They wish to determine if they both know the same secret. If they do ...
-2
votes
0answers
44 views

Zero knowledge vs Perfect zero knowledge proof

Considering I have a Discrete Logarithm problem and want to show that it is perfect zero knowledge. Is that then the same as just "zero knowledge" on the following link https://en.wikipedia.org/wiki/...
-2
votes
0answers
57 views

Why is $p(x) = e(x^2 \bmod n)$ a bad key for encryption when $n>2$?

In our problem, we are asked to prove why $p(x) = e(x^2 \bmod n)$ can't be used as a key when $n=26$. This was fairly simple because all of the values for $e(x )$ will be repeated twice and that would ...
1
vote
0answers
22 views

Non-Repudiation vs Identity-Binding

There are 3 properties offered by a cryptographic digital signature scheme: Integrity guarantee of the message signed. Authenticity guarantee of the message signed. Non-repudiation of the message ...
2
votes
1answer
37 views

HKDF on output key material of previous HKDF

I understand the typical way to use HKDF is to make one call to HKDF to obtain multiple keys. Is it safe to use HKDF the following way to generate different keys ? If not, why? key0 = HKDF-extract-...
1
vote
1answer
60 views

Find Lower bound on key space with relaxed definiton of perfect secrecy

Consider a relaxed definition of security. Let $\epsilon < 1$ be a constant and say we only require that for any distribution over $M$ ,any $m \in M $, and any $ c \in C$ $$ |Pr[M=m|C=c] - Pr[M=m]|...
0
votes
1answer
53 views

How does Euler's Theorem show that $(m^e)^d ≡ m \bmod n$

In this thread Henrick Hellström says that when $ed \equiv 1\ (mod\ \phi(n))$ then $(m^e)^d \equiv m\ (mod\ n)$. So I thought this is how Euler's theorem is related to RSA. But at least I thought that ...
2
votes
2answers
88 views

Security of RSA for padding $\texttt{0x00|message|random_bytes}$

I've read this and this but I'm not understanding why padding a message with a simple random is not secure. For example, consider a 256 bytes modulus. We can agree that the first byte from the ...
3
votes
0answers
31 views

Equivalents of Yao's Xor lemma to rounds, or other hardness amplification methods?

Simple question: I just learn the existence of the great Yao's Xor lemma (see a quick sum-up at the end of this post). I'd like to use a similar argument, but instead of a simple function, I've a two ...
1
vote
1answer
54 views

How can you derive a P-256 public key from the X and Y points

Deriving a secp256k1 public key is also possible. For whatever reason, I'm only being provided X and Y, not the public portion. I just need to get the binary representation of the public key given ...
1
vote
0answers
45 views

In RSA, what is $P[x \notin \mathbb{Z}_N^*]$

In the RSA problem one tries to avoid to pick a message $x \in \mathbb{Z}_N$. Thus, one may ask the question: Given $x$ uniformly distributed over $\mathbb{Z}_N$ what is the probability that $x \...
4
votes
3answers
423 views

Pedersen commitment in elliptic curves

I try to understand Pedersen commitment in elliptic curves over finite fields. I could use some clarification. Let's say we have two generators $G$ and $H$. Is that required that $G$ and $H$ are ...
2
votes
2answers
83 views

How do I create a cryptographic signature and commitment scheme with accountable evidence?

This is a weird one... I am looking for a method which I don't even know how to call, nor whether it actually exists! Given a pair of asymmetric keys $s_{k}/P_{k}$ and defining $Sig_{k} \dagger B_{i}$...
0
votes
0answers
37 views

Problem while decrypting Hill cipher

I have a plaintext "monday" and ciphertext "IKTIWM" and $m=2$. I want to find the key of the Hill cipher. I made a matrix $$ \begin{bmatrix} a_1 & a_2 \\ a_3 & a_4 \end{bmatrix}\begin{...
2
votes
1answer
46 views

What is meant by domain separation in the context of KDF?

This is a quote from my cryptography notes: If $h$ is a random function oracle of output length $n$ then also the two KDF constructions: $K(x) = h([0] \| x) \ldots \| h([L] \| x)$ $K(x) = ...
1
vote
0answers
51 views

Brute force against custom algorithm [closed]

In my free time, I write an algorithm for fun (and it may be the best hobby I had so far). Currently, the output this algorithm produces is indistinguishable. I ran multiple analysis process and ...
3
votes
1answer
164 views

What are the values of $w$ such that the corresponding $\text{Keccak-}f[25w]$ function is invertible (bijective)?

From this answer, I see that from a mathematical point of view, one could define the $\text{Keccak-}f[25w]$ permutation for an arbitrary value of $w$. I am interested in the following question: ...
1
vote
1answer
66 views

Zero knowledge set membership protocol

I read that paper Efficient Protocols for Set Membership and Range Proofs of Camenisch et. al that describes the zero knowledge range proof. The paper applications looks interesting like if you want ...
0
votes
1answer
61 views

How do I figure out the number of unique combinations

I am developing an algorithm that uses a lookup table to process the data, I want to know how many unique tables can be created. If I have a table of 256 values I know that 256! would tell me how many ...
1
vote
2answers
200 views

Can an RSA (private) modulus contain (hex) zeroes?

Consider a public modulus that is supposedly 4096 bits. But since it contains two hex pairs of zeroes, i.e. ...:00:...:00... such that the bit length of the decimal value instead becomes 4093 bits, is ...
2
votes
0answers
30 views

Precomputation attacks against ECDH

Diffie-Hellman groups are vulnerable to sieving precomputation attacks. These attacks allow a one-time computation against a given DH modulus that makes it practical to attack all subsequent key ...
0
votes
1answer
38 views

Finding a secret key corresponding to a public key

As far as I know, a secret key corresponding to a given public key is not unique. So, for example, there are actually multiple secret keys that can produce the same digital signature under RSA ...
0
votes
1answer
33 views

What is the purpose of multiple key addition layers in AES?

I understand the purpose of the SubBytes layer (confusion) and the ShiftRows and MixColumns layers (diffusion). But I don't see the purpose of having more than one key addition layer. What I've been ...
0
votes
0answers
24 views

If finding a private key from a public key is [co-]NP-complete, does NP=co-NP?

In a given public key cryptosystem, if the problem of determining the private key from the public key is NP-complete or co-NP-complete, does that imply that NP = co-NP? Complexity theory is ...
1
vote
0answers
30 views

Privacy Preserving Authentication Protocol

I am learning this new concept. I found different algorithms (similar bases) in different papers. example1 (Fig. 1) example2 (Fig. 5) I was wondering if some one can explain it in simple words. ...
0
votes
0answers
10 views

Maximum number of certificates generated by a CA [migrated]

What is the maximum number of certificates that can be generated from a CA? The use case is a VPN using certificate authentication and I would like to know what is the theoretical number of unique ...
3
votes
2answers
74 views

Are relatively prime numbers used in RSA

We know that the Totient function is multiplicative. Which means that when $p$ and $q$ are relatively prime, then $\varphi(p q)$ is equal to $\varphi(p) \varphi(q)$. My question is, are only prime ...
1
vote
0answers
15 views

Private key which becomes invalid after specific timestamp

Sorry for my dumb question, as I'm not crypto guy. Is there any algorithm, which allows to encrypt some message with the public key, but the associated private key is only valid for specific period ...
0
votes
0answers
34 views

Could any one suggest alternative Zero knowledge proof protocol to Schnorr protocol ZKP?

I read that Schnorr protocol cannot be proved zero knowledge on that link: Perfect zero knowledge for the Schnorr protocol? Could any one suggest alternative Zero knowledge proof protocol so a prover ...
1
vote
0answers
17 views

What are ZK and Fusion algorithms in image steganography

in the literature I have found some algorithms mentioned as ZK and Fusion in image steganography. But I couldn't find any detailed information about these algorithms. Could someone please help to ...
2
votes
1answer
92 views

Unbreakable Hill cipher

Why don't we use hill cipher of 100 × 100? or even bigger. That would be closely unbreakable. The number of keys possible 2 × 2 hill cipher is 157248. for 100 × 100 number is beyond limits.
7
votes
2answers
850 views

Using a hash function as a random number generator

Using MD5 or SHA1 for instance, and applying integers (as seed so to speak) to the hash function, in sequence, and only keeping, say, the first 64 bits of the resulting hash, do we always have a ...
3
votes
0answers
42 views

Password Derived Signature Authentication

I'd like to avoid sending user passwords over the wire. Would the following challenge response protocol be secure (served over TLS)? I know this is similar to SRP. Sign-up Client takes password and ...

15 30 50 per page