All Questions
29,857
questions
3
votes
2
answers
609
views
How much entropy is lost due to collision?
If entropy is hashed with SHA-256 for example, and the input has exactly 256 entropy bits, how much entropy is reduced after hashing due to collision? Is there any reference that explains how to ...
- 138k
0
votes
0
answers
9
views
Generating UUID from Keccak-256 hash
Is generating Keccak-256 hashes with timestamp + nonce (ensured to be unique for each run), and taking its most significant 16 bytes sufficient to generate random V4 UUIDs?
Obviously the 13th hex ...
- 101
2
votes
1
answer
59
views
1-out-of-2 Oblivious Transfer with RSA
I'm trying to implement a simple 1-out-of-2 Oblivious Transfer with RSA. I was checking the code and tried to work it step by step. The 2 messages by Alice, let's say, are $m_0 = 7$ and $m_1 = 9$. Bob'...
- 138k
1
vote
0
answers
85
views
Cannot protect GPG key using TPM2 on Ubuntu 22.04 [migrated]
I'm trying to protect a GPG key using the TPM2 available on my laptop, but I'm not having any success. Probably I'm doing something wrong, but I cannot figure out what this is.
My system is running <...
- 138k
2
votes
1
answer
29
views
Rationale for BLAKE2 message schedule?
BLAKE2 uses a message schedule I did not see before. It uses permutations of pieces of the message block.
The BLAKE2 book did not state the rationale for such a choice and how it contrasts with the ...
- 2,981
2
votes
1
answer
329
views
Disclosure of Catastrophic Cryptanalytic Breakthroughs
An efficient algorithm for factoring would be a major mathematical achievement giving the person who discovered it anstant fame. About two years ago, C. P. Schnorr claimed such a breakthrough but it ...
- 15.2k
0
votes
0
answers
20
views
Mysterious number series logic [closed]
(8,5,6)
(16,9,10,12,7)
(32,17,18,20,11,24,13,14)
(64,33,34,36,19,40,21,22,48,25,26,28,15)
Above four series are according to power of 2.
The first row is 2^3
second row is 2^4
third row is 2^5 and so ...
-1
votes
0
answers
14
views
How is sharegen computed without trusted third party in GHKL08 [closed]
https://eprint.iacr.org/2008/303
The protocol here relies on a subprotocol sharegen but i cannot understand how it is computed. Please explain.
0
votes
0
answers
71
views
Rate the security of the following MAC
Ok we know when we add a random IV in our encrypted MAC became useless and the IV can be forgery, then our encryption scheme becomes vulnerable to chosen plaintext attacks.
But the addition at the ...
- 1
25
votes
1
answer
19k
views
What are the odds of collisions for a hash function with 256-bit output?
There are some related questions on the net but I did not understand their solutions.
I am reading in a textbook about methods of finding a collision. It states to consider a collision for a hash ...
- 138k
0
votes
0
answers
31
views
Differential cryptanalysis of modes of operation
It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
- 223
2
votes
1
answer
250
views
Show that function isn't a PRF
Let $F$ be a PRF such that $|F(k,x)|=2n$ show that $F_2$ isn't a PRF. Let's assume $F(k,x)=(y_1,...,y_{2n})$ then $F_2(k,x)=(y_1\land y_2,...,y_{2n-1}\land y_{2n})$.
I want to prove $F_2$ isn't a PRF ...
CommunityBot
- 1
2
votes
1
answer
188
views
Implementing ECDSA threshold using a secret sharing scheme
My question might be a duplicate but I wasn't able to find a similar question.
I recently developed a wallet-like app and I am trying to implement some MPC features.
I searched a little and even asked ...
CommunityBot
- 1
0
votes
0
answers
56
views
Is a prime shifting method for RSA modulus generation safe?
I have a prime number, $p$, with $n$ bits. To generate a new prime number, $q$, I shift the bits of $p$ from left to right by a certain length. For example, if $p$ is represented as ...
- 497
-1
votes
0
answers
20
views
Is this forum ok to post a factoring problem and ask for help fixing it? [closed]
One of my factoring methods works correctly sometimes, but other times it misses the factors, or is off by a square number from the the target product (the product of output factors is off by a square ...
1
vote
1
answer
106
views
Matrix multiplication circuit
I am trying to understand which operations are computable by an $\texttt{NC}^1$ circuit. However, I am struggling to understand whether there is such a circuit for multiplying a matrix with a vector ...
CommunityBot
- 1
1
vote
1
answer
48
views
Difference between a a doubled point and a point from point addition
Are all doubled points on an elliptic curve even, meaning if you compress the point, it will have '02' plus the $x$ coordinate? If not, what distinguishes a doubled point from a point resulting from ...
- 138k
2
votes
1
answer
211
views
Which encryption technique should be adopted to keep the search functionalities?
I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on ...
CommunityBot
- 1
2
votes
1
answer
145
views
How do I encrypt a bunch of messages by different authors, shared with that group of people?
I'm still getting my head around public/private key cryptography, and I can't quite work out how to ask the right question to get an answer for this problem, but here goes!
Alice, Bob, Carol, and ...
CommunityBot
- 1
1
vote
0
answers
54
views
Identified Performance Discrepancy in my AES addRoundKey: Slower than Expected
Problem
I'm working on an AES implementation in C++, and I have been testing the performance of my code, and its functions. I've noticed a significant performance slowdown in my 'addRoundKey' function....
- 101
2
votes
2
answers
81
views
Regev's learning with error
If we talk about the security of public key encryption in Regev's lwe system, if attacker would have knowledge of $(u,u'):[\mathbf u=A\mathbf r, \mathbf u'=\mathbf b^t\mathbf r + \mu q/2, \mathbf r\in\...
CommunityBot
- 1
0
votes
1
answer
20
views
How IKE authentication happens? what's the role of HASH_I & HASH_R, and how it gets verified by each parties? and where SKEYID_a gets engaged?
Dears,
In RFC 2409 "The Internet Key Exchange (IKE)", its mentioned there are four available authentication methods for IKE, there are different calculations for SKEYID for each method and ...
- 145k
1
vote
1
answer
199
views
Recursive NTT for Kyber
since the NTT is a variant of the DFT respectively FFT, it seems possible to implement a recursive algorithm for the NTT of Kyber with a divide-and-conquer concept. This is the reason for my question ...
- 45
15
votes
2
answers
2k
views
The effect of truncated hash on entropy
Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
- 138k
0
votes
1
answer
56
views
Ring Signature's "solve for y_s" step in Rivest et al.'s "How to leak a secret"
I'm reading Rivest et al.'s "How to leak a secret", but I'm having a hard time understanding step 4 of the generation procedure. This could be because of my own lack of knowledge regarding ...
CommunityBot
- 1
8
votes
1
answer
717
views
Zero knowledge proof for Paillier addition under multiple keys
Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower)
Under a Paillier cryptosystem, set
$e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$
...
CommunityBot
- 1
1
vote
1
answer
59
views
LWE Decryption: Generating errors for (c1, c2) that match binary message m
In the encryption process, the ciphertexts c1 and c2 are added to errors e1 and ...
CommunityBot
- 1
1
vote
1
answer
96
views
Construction of Blake2 and Cha Cha
Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
CommunityBot
- 1
2
votes
0
answers
38
views
What's the lattice dimension of the uSVP for attacking CRYSTALS-Dilithium-128?
I am trying to understand the process of transitioning from a NIST standard to the attacks based on of the Unique Shortest Vector Problem (Unique-SVP). Specifically, I am working with Crystals ...
- 324
-1
votes
0
answers
34
views
Encrypted text question [closed]
I’m new here and I dont even know if I’m at the right place. I have a question about encrypted text. The thing I want to know is… let’s say someone sends me encrypted text
Example:
...
- 138k
1
vote
1
answer
43
views
The representation of truncation protocol in SecureML
The secure multiparty computation framework SecureML 1 has proposed a truncation protocol for decimal arithmetic in the integer field.
As mentioned in this paper,
In field $\mathbb{Z}_{2^l}$, $x\in [...
- 61
0
votes
1
answer
76
views
Hash Collision: Weak and Strong Resistance [closed]
On average, against a 128-bit-long key, how many more hash computations would an attacker need to perform to break weak collision resistance compared to breaking strong collision resistance? In other ...
- 47.6k
2
votes
1
answer
58
views
Ring LWE distribution definitions
This may be a stupid question but I've been stuck on parsing these definitions for a while.
I am reading the paper "On Ideal Lattices and Learning with Errors Over Rings" by Lyubashevsky, ...
- 3
2
votes
1
answer
256
views
Choosing (key,plain) to produce zero state in middle rounds of AES encrypt
I was told in passing that (key, plain) pairs could be chosen to produce a zero state in AES encrypt in some middle round (say 5). [The application here being to side-channel leakage assessment.] ...
- 145k
1
vote
6
answers
1k
views
Is it theoretically possible to create an unbreakable cipher?
I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
1
vote
0
answers
29
views
Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing
I'm working on a project where we have three different software systems—let's call them A, B, and C.
Systems A and B handle user data identified by phone numbers and want to send user actions to ...
- 111
0
votes
1
answer
78
views
Prove that if $e.d \equiv 1 \text{ mod } pq$ then it's impossible to have $e.d \equiv 1 \text{ mod } (p-1)(q-1)$
I am studying RSA cryptosystem and here is the question that came to my mind. Let's pick $p, q$ to be two primes and $n = p * q$. From that we calculate Euler's totient function:
$$
\phi(n) = (p - 1)(...
- 145k
2
votes
1
answer
48
views
Learning the LWE secret with advice
I am trying to argue about the hardness of LWE, but in a setting that is different from the standard one.
Consider the task of learning the LWE secret $s$ from noisy samples. The specifications of the ...
- 91.9k
9
votes
4
answers
2k
views
+500
Fast cryptographic hash function for short inputs
I am looking for a cryptographic hash function optimized for speed on short inputs, in order to implement a pseudorandom generator with expansion factor 2 (e.g. takes 16 bytes of input and outputs 32 ...
- 2,944
-1
votes
0
answers
36
views
Determining the vulnerability of BTC in the presence of output RSZ with the entropy of mutual relations [closed]
I found the program as I understood from the description of the search for mutual entropy of different groups of RSZ output signatures from one wallet to bitcoin. Who has heard anything about this ...
- 1
25
votes
1
answer
14k
views
When to use Argon2i vs Argon2d vs Argon2id?
I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case.
I want to securely encrypt passwords ...
1
vote
0
answers
18
views
Search the LWE problem
When designing the search LWE problem, how do you set the dimensions of the A matrix? Or under what circumstances can I use very few matrix dimensions to achieve 128-bit security? Up to noise level? ...
- 11
3
votes
2
answers
484
views
RSA perfect square phi
So I've been learning about RSA for quite a while (mainly by playing around in CTF competitions) and I came across an interesting problem.
The other day I was looking to create a challenge in which I ...
- 138k
4
votes
3
answers
1k
views
How to Understand Authenticated Key Exchange?
I am reading some articles about key exchange. I know classic key exchange, such as Diffie-Hellman key exchange. This type of algorithm is vulnerable to man-in-the-middle attack. However, when using a ...
- 2,868
6
votes
2
answers
635
views
Kyber 512 Security Level Issue
So I read parts of the following article:
https://blog.cr.yp.to/20231003-countcorrectly.html
But I quite dont understand it. NIST assumes Kyber 512 is just as hard as AES128 nowadays, in presence of ...
- 238
2
votes
0
answers
55
views
Tor Key Exchange Client - Middle Node
I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
- 21
0
votes
0
answers
28
views
Requesting some recommendations for research topics on Signal protocol [migrated]
I am a beginner in Signal protocol. In my opinion, Signal protocol is already a very mature protocol, so I would like to ask What are the other worthwhile problems about Signal protocol that can be ...
2
votes
1
answer
51
views
Choosing $C_0$ to make second row zero for Garbled Row Reduction (GRR3)
In GRR3,we make the first row of the Garbled table to be zero by choosing a special value of $C_1$.
Why don't we make the second row also zero by choosing a special value of $C_0$?
- 12k
1
vote
1
answer
77
views
Probability when representing message as a point on elliptic curve
There is a very popular method to represent a message $m$ (number) as a point on elliptic curve over a finite field:
Set $i = 0$
Check whether $m'=m\cdot K+i$ is on elliptic curve. If not, try again ...
- 91.9k
1
vote
1
answer
49
views
Why the full $r$-torsion group contains $r^2$ many elements and consists of $r+1$ subgroups
let $F$ be a finite field, $E(F)$ an elliptic curve of order $n$, $r$ a factor of $n$, $k(r)$ for the embedding degree of $E(F)$ with respect to $r$.
Then why the full $r$-torsion group contains $r^2$...
- 91.9k