All Questions

Filter by
Sorted by
Tagged with
1
vote
1answer
66 views

How can I understand the math behind crypto, especially that used in blockchains / distributed ledgers?

A bit of a background about me; Computer Engineer but during my studies I didn't dive too deep into the maths, especially the crypto maths that is used to make the blockchain and cryptography work. I'...
2
votes
2answers
143 views

Distinguishing the correct IV from incorrect IV in AES CBC when key is known

Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
1
vote
0answers
9 views

Which of the following is considered cryptographically hard/easy?

Which of the following are easy, if any? Which are hard? and why. Case 1) Given x^3 mod N, where N is a somposite number and we don't know any of the factors of N, find x. Case 2) Given x^3 mod p, ...
0
votes
0answers
9 views

Building an adversary for a OW-CCA game

Let K_rsa be a RSA genertor with associated security parameter k >= 1024. Let game OW-CCA_Krsa be as follows: How can I build a O(k^3)-time adversary A making at most 2 queries to Invert and ...
0
votes
0answers
14 views

How to create clone of solana bolckchain? [closed]

I want to create similar coin like solana. I have tried forking litecoin to know process, can you suggest me how can hard fork solana? share the link of article if any.
0
votes
0answers
13 views

How can we prove that the advantage for this hide game for any adversary is equal 0?

Here is the Scheme: Here is the HIDE game: Here is my idea but I am not quite sure. I would appreciate some input. We want to bring advantage = 0 for all adversaries. We can show that advantage = 0 ...
27
votes
4answers
4k views

Why is FIPS 140-2 compliance controversial?

I was reading the comments of an article about a proposed new implementation of /dev/random in Linux today, and someone remarked that it must be bothersome to go ...
6
votes
3answers
19k views

Can two files/strings have the same SHA-256 value?

I was wondering whether, theoretically, 2 files can have the same SHA-256 value. Since there are only $16^{256}$ or $2^{1024}$ SHA256 sums, all 1024-bit files (with $2^{1024}$ different combinations) ...
1
vote
2answers
366 views

RSA: Is it a security risk if an attacker knows the length of the values of P and Q?

Is it a security risk - or perhaps, how big of a security risk is it - if an attacker knows the length of the values of P and Q used when deriving a value for the parameter N in the RSA encryption ...
3
votes
1answer
123 views

Why are the parameters (such as modulus and dimension) of homomorphic encryption so large?

Compared with the common lattice-based PQC schemes, the modulus $q$ and dimension $n$ of homomorphic encryption are so large. For example, in Kyber, $n=256, n \times k = \{512,768,1024\}$, $q = 12289$...
4
votes
1answer
119 views

Is there a difference between the strength of Telgram's (MTproto) forward secrecy and Signal's?

If I understood correctly, the Signal protocol generates a new key after every message sent and forgets the previous one. Telegram, on the other hand, renews the key only after 100 messages or one ...
3
votes
2answers
108 views

Creating a stronger cryptographic hash given a cryptographic hash

I need a cryptographic hash function that will hopefully be strong even in 50 years. Performance is not an issue. Calculating and verifying can take a huge amount of time if needed. The size of the ...
11
votes
0answers
351 views

The backdoor of Telegram on Diffie-Hellman Key Exchange and possibly other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...
2
votes
1answer
101 views

Question about styles of reduction proofs

In cryptography security proofs mainly use the reduction proof technique. I now have read a lot of reductions proofs and also did some on my own and I think I understand it pretty well. While reading ...
0
votes
0answers
48 views

Collision finding method

The "birthday paradox" places an upper bound on collision resistance: if a hash function produces $N$ bits of output, an attacker who computes only $2^{N/2}$ (...) hash operations on random ...
0
votes
0answers
21 views

INT-CTXT game adversary

I am trying to answer this question. But I think I got it wrong. I am not sure why and how I can improve it. This is the adversary I came up with. Is this correct? ...
2
votes
1answer
57 views

LWE - Encrypting/Decrypting messages bigger than 1 bit

I'd like to know if LWE (and its variants: RLWE and MLWE) can cipher messages bigger than 1 bit. Is it possible? I didn't find any reference yet. Could you explain it to me or give some good ...
0
votes
1answer
221 views

Secure multi-party private set intersection: Protocols supporting MULTI-party VS supporting TWO-party

Let assume party $B$ wants to receive secure multi-party computation (MPC) output. The are many private set intersection (PSI) protocols that support only two parties but they cannot support multi-...
3
votes
1answer
166 views

Verify that a point belongs to secp256r1

I need to verify that the point in this public key ...
1
vote
1answer
34 views

Current status of ring signatures/proof of set membership

I understand the original O(n) implementation of a ring signature, but I'm trying to figure out where the state of the art is on signing a message as an anonymous member of an ad hoc group without ...
1
vote
1answer
130 views

Verify that x, y coordinates given as hex string are valid points on an Elliptic Curve [duplicate]

Given the following information: "curve": "P-256", "qx": "729C51D177EBE2079A0FB7B0B3C2145159CF81EC61960E642A1744719AA9F913", "qy": "...
3
votes
0answers
30 views

What is the best way to use a keyed hash on IP addresses while retaining the ability to identify those that share a subnet?

Background: I'm developing an app that is based around registered users voting on stuff, and I want to create a heuristic that involves IP addresses as one way to flag accounts for further ...
1
vote
0answers
24 views

Showing that $F'(k, x) := F(F(k, 0^{n}), x)$ is a PRF [duplicate]

I wanted to do some practice on security reduction proofs, and I am stumped on this one from the Boneh-Shoup book. If $F(k, x)$ is a secure PRF, then show that $F'(k, x) := F(F(k, 0^{n}), x)$ is a ...
0
votes
0answers
31 views

Is it possible to crack a Linear Congruential Generator if I only know the modulus of the output?

$x_{n+1} = (a \cdot x_{n} + b) \mod m$ In normal situation, $x_{n+1}$ and $x_n$ are known. But now I only know $x_n\mod 6$ and $x_{n+1}\mod 6$. I have searched many website on google but I only find ...
0
votes
1answer
44 views

Python code for 'Verifiable Canonical Generation of the Generator g', FIPS 186-4, returns False [closed]

Edit: if anyone, inexperienced like me, lands on this question, it has been answered at the stackoverflow. Why the Python code, see below, returns false? More context: I am going through the FIPS 186-...
7
votes
2answers
632 views

Shamir Secret Sharing - P not prime

I was wondering what will happen if I use the Shamir Secret Sharing scheme with $P$ not being a prime, let's say it is $255$. An adversary which holds $k'$ shares ($k'<$ threshold $k$ ) can attack ...
2
votes
1answer
36 views

LWE and pseudorandom functions

Consider the learning with errors problem. Assuming LWE (or a variant of LWE, like ring LWE) is hard for polynomial time algorithms, can we construct a family of pseudorandom functions from there?
1
vote
1answer
52 views

reversing hash function makes possibilities increase exponentially, yet there is a finite number of inputs. How?

When trying to reverse a hash function, there is loss, e.g. a+b=c given c=5, try to go back to a,b (previous step) (a,b)=(5,0),(4,1),(3,2),(2,3),(1,4),(0,5) but, ...
6
votes
2answers
641 views
+50

Are SSH key-pairs an example of a zero knowledge proof?

Quoting from source, authentication using SSH key pairs goes something like this: 1) The client begins by sending an ID for the key pair it would like to authenticate with to the server. 2) ...
0
votes
2answers
171 views

One-time-pad Encryption in C

I have been messing around with cryptography (for recreational use), and I created my own one-time-pad encryption script in C. Now, with that being said, I freely admit that I am by no means a ...
0
votes
1answer
76 views

How to Update Non-Membership Witness upon deletion in RSA Dynamic Universal Accumulator

The Universal Accumulator paper mentions the following for updating non-membership witness upon member deletion. Choose $r$ such that $a\hat x − rx ∈ Z$$2^l$ What is Z$2^l$ and how can we ...
2
votes
0answers
33 views

composing password hash functions

Firstly I know that what I'm asking about is not practical, so let's keep it theoretical. Let $B[H](x)$ be balloon hashing with $H$ as it's underlying hash. What happens if I do $B[H1](B[H2](x))$, ...
2
votes
0answers
41 views

For unequal set sizes in PSI: why should the party with fewer elements use cuckoo hash rather than simple hash?

Most PSI papers usually use hash-to-bin to improve the number of comparsons. For unequal set sizes in 2PSI, I have read CCS17, which designs a PSI protocol for unequal size. The party with fewer ...
2
votes
1answer
97 views

Efficient private set intersection protocol for small sets

I need to implement a PSI that will be used on mobile devices to find mutual contacts. Assuming the set cardinality from both parties A and B are less than 1000, what would be the most efficient PSI ...
2
votes
1answer
42 views

Is there an algorithm to compute the wNAF for an exponent faster than quadratic?

For doing exponentiation in a group for which inversion is trivially easy, such as elliptic curve groups, is there an algorithm for computing the $w$NAF ("$w$-ary non-adjacent form") array ...
3
votes
2answers
439 views

Can we convert a pseudorandom function (PRF) to an Oblivious PRF (OPRF) through an Oblivious Transfer (OT) protocol?

I'm a software engineer, so I generally think in building blocks. And I'm not so familiar with the Math notation in Crytography, so I'll stick with function calls and function blueprints (which I ...
2
votes
1answer
68 views

How to have a hash function that maps any binary string of size n to binary string of size n?

I am implementing certificateless cryptography from this research paper in python language. Essentially, I want to have the following hash function mapping. This hash function is mentioned in the ...
1
vote
1answer
36 views

Can an adversary distinguish QROM from ROM with a single query?

I acknowledge that QROM differs from ROM (which can be considered as a specific QROM which performs a measurement to the input). For example, one can find a preimage for an arbitrary value with $O(N)$ ...
1
vote
1answer
45 views

Using one seed to create signing key pair and encryption key

I'm working on creating a secure digital vault. I'm using mnemonic to generate a seed. The seed is used to generate a signing key pair for identity verification. However I want to also encrypt the ...
4
votes
3answers
485 views

How to decide if a point on a elliptic curve belongs to a group generated by a generator g?

In the elliptic curve encryption scheme, there is a cyclic group generated by a base point $G$ on the elliptic curve. Given a random point on the elliptic curve, is there a way to decide if the random ...
3
votes
1answer
230 views

Is the security of a Schnorr signature dependent on the hash function that is used?

When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
0
votes
0answers
15 views

what is difference between CKKS bootstrapping an TFHE bootstrapping? [closed]

Compare the libraries how they are different. all the libraries are implement using LWE hard problem. compare with HElib
0
votes
1answer
282 views

Hardware, Handheld Password Manager

I am currently working on a hardware project that will utilize the native USB and keyboard emulation capabilities of the Teensy device. Essentially, the user will store an encrypted password database ...
1
vote
0answers
97 views

Do organizations like NSA use racial profiling in the screening process? [migrated]

some sources seem to indicate that they do: https://www.bloomberg.com/news/features/2019-12-10/the-u-s-government-s-mistrust-of-chinese-americans I realize this is a sensitive question. I'm a second-...
7
votes
2answers
2k views

Why does Smart's attack only work on anomalous curves?

Nigel Smart's attack solves the discrete logarithm problem in linear time. It requires the curve, however, to be anomalous, i.e. to have a trace of Frobenius equal to one or, equivalently, to be of ...
0
votes
0answers
11 views

How to sign CAM/DENM messages using mbed LTS libray with ECDSA (EEE Std 1609.2)

I have read ETSI TS 103 097 and EEE Std 1609.2 which gives me the security data structure defined in ASN.1 notation. I want to use mbed LTS to calculate the ECDSA signature. I understand that I should ...
0
votes
1answer
83 views

When do we redo the Diffie-Hellman Exchange?

I'm planning on making a chat application for fun, in C++. I just have a few questions in order to maintain forward/future secrecy across messages. If one party is offline, but the other isn't, what ...
-1
votes
1answer
66 views

truncated sha3-512

Let's say I need performance on 64-bit machine, then SHA3-512 is the way to go. SHA-512/256(x) is SHA-512(x) with output truncated to 256 bits, according to https://pycryptodome.readthedocs.io/en/...
3
votes
4answers
447 views

Multi Factor Encryption?

I got an alert last night to the keywords above and was curious, so took a look at the tor site flagged which is the following one: http://nsrz5iogimqwgeax3clpp6hvfy6viom2woy7dghgxes4sqk63r7svoqd....
1
vote
1answer
42 views

Decrypt AES-128-CBC encypted partial RSA Key

I am given a private RSA key, which header indicates that it is AES-128-CBC encypted. Note that the last ten lines of the key are missing. (This is part of an educational task.) ...

15 30 50 per page
1
2 3 4 5
518