All Questions

Filter by
Sorted by
Tagged with
3 votes
1 answer
33 views

Multivariate Cryptography: What is the secret oil space in the MAYO signature scheme?

IN UOV schemes, I understand that you need to choose a secret subspace $O \in \mathcal{F}^q_n$ such that $P(\mathbf{o}) = 0$ for all $\mathbf{o} \in O$. According to the paper Improved cryptanalysis ...
7 votes
2 answers
2k views

Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
1 vote
1 answer
46 views

Is there any notion of key-recovery attacks security (perhaphs using games) that is equivalent to IND-CPA?

I am talking about Symmetric Cryptography only in the following. We know that Semantic Security (in the presence of eavesdropper) implies security against message recovery (in the presence of ...
1 vote
1 answer
939 views

What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
-1 votes
3 answers
107 views

can we modify the prime field by increasing it in secp256k1?

If in ECDSA secp256k1 we have the prime field p=2256 - 232 - 29 - 28 - 27 - 26 - 24 - 1, can we increase it to p=2256, if we keep the double and add operations the same, the curve equation the same ...
1 vote
3 answers
184 views

Exponentiation Problem of G2 in MNT curve

I made a simple python program in the Charm framework (https://github.com/JHUISI/charm): ...
0 votes
1 answer
265 views

Good Diffie-Hellman Encryption Method

I've just made my own implementation of Diffie-Hellman in nodejs (it's for a project of mine). However, the shared keys are integers; I want to use those integers as a key to encrypt data. This is an ...
55 votes
6 answers
12k views

Kerckhoffs’ principles – Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
4 votes
1 answer
2k views

Find ECDSA PrivKey to PubKey = 0

I know it should be impossible (or at least infeasibly hard) to extract a ECDSA Private Key from a given Public Key (discrete logarithm problem). But I'm not deep enough into ECC to find an answer to ...
-2 votes
2 answers
1k views

How to find at least one private key from a large list of compressed public keys secp256k1

Not long ago I saw a discussion on the Bitcoin Talk forum: https://bitcointalk.org/index.php?topic=5060735.msg50736695#msg50736695 Please give advice and working methods? Is it possible to find at ...
4 votes
3 answers
3k views

Why is it impossible to find the private key from the public key?

From what I understand, based on the article A Beginner’s Guide: Private and Public Key Cryptography Deciphered, the public key is generated by performing $n$ tangent plus mirroring operations from ...
1 vote
1 answer
125 views

How to generate 24 bytes CMAC using AES-192 or AES-256

Is it possible to generate a 24 bytes CMAC using AES-192 or AES-256 and if so, how? According to AN10922AN10922.0df,looks like we can generate 24 bytes and 32 bytes key using div constant ?
0 votes
2 answers
43 views

Why not flip random bits of the encrypted message for additional security? (hybrid system)

Suppose a binary word of $n$ bits is the result of encryption (doesn't matter with what algorithm) that now has to be sent from person A to person B. Suppose additionally, A and B have a symmetric key ...
0 votes
2 answers
49 views

Instantiation of norm bound in SIS

Recall Short Integer Solution: $\textbf{SIS}_{n, q, \beta, m}$: Given $\textbf{A} \in \mathbb{Z}^{n\times m}_q$, $\vec{b} \in \mathbb{Z}^{n}$, find $\vec{z} \in \mathbb{Z}^{m}$ of norm $||z|| \le \...
2 votes
1 answer
62 views

Linear Message Authentication Codes

I am studying the message authentication codes introduced in this paper. These MACs are linear in the sense that, if $f(m,k)$ denotes the tag appended to the message $m$ when the agreed upon key is $k$...
1 vote
2 answers
558 views

Can we retrieve his private key using his public key in ECC?

A paper wallet is the name given to an obsolete and unsafe method of storing bitcoin which was popular between 2011 and 2016. It works by having a single private key and bitcoin address, being printed ...
3 votes
1 answer
278 views

How do we know one-way functions can be iterated?

Suppose we have some one-way function $h$. Without further specification of $h$, how can we be sure that we can define another function $g(n) = h(h(n))$? That is, how do we know the range of $h$ is a ...
0 votes
1 answer
45 views

Authenticate with roles without a server

Introduction part I'm writing an application that requires authentication to be used, specifically the database and config file can only be read an authenticated user. However this authentication is ...
0 votes
1 answer
64 views

"Appendable" encryption scheme

Are there any encryption schemes that could be classified as "appendable"? By appendable I mean being able to add new data to the end of already encrypted data, without needing to decrypt ...
0 votes
1 answer
50 views

Getting the slope of a public key given its x and y coordinates

Is it possible to get the slope of a public key given its $x$ and $y$ coordinates? Since all the ECC calculations come from geometry, I thought this calculation might be possible.
1 vote
2 answers
99 views

Looking for a lightweight hashing algorithm

I'm looking for a hashing algorithm with some unique properties: Most important: It has to be small. Ideally ~400 bytes of x86 assembly Resistant to preimage & collision attacks with no known ...
0 votes
1 answer
132 views

Is there a benefit in cryptography to return 0 in square and mutliply algorithm when a modulo is 0?

When a modulo is 0, the result of squaring or multiplying modulo will always be 0 as well. Therefore the loop could break and return 0. It can be a mean to compute faster the result of square and ...
1 vote
2 answers
564 views

Proof of knowledge and replay attacks

I was reading the ZK proof of knowledge of Schnorr and fiat shamir transformation, and I figured out that replay attacks are possible. Why these protocols don't take into account this attack? That ...
0 votes
0 answers
64 views

Simple and efficient auth scheme to prevent replay attacks

This is a machine-to-machine authentication proposal with the following requirements: Avoid replay attacks. Leaked or intercepted auth tokens cannot be reused at all. Impersonation resistant. The ...
31 votes
3 answers
11k views

repeating-key xor and hamming distance

I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
11 votes
2 answers
539 views

Sum of two squares problem

I would like to know if there is any existing research on the following problem: $$\text{For }a, b \in \mathbb Z \text{, given }n = a^2 + b^2, \text{output }a, b$$. Searching for "sum of squares", "...
1 vote
2 answers
93 views

Example of elliptic curves endomorphism construction

I've started learning about complex multiplication (CM) on elliptic curves. For clarity (and intuition), I want to make some basic example of elliptic curves endomorphism construction for a concrete ...
0 votes
1 answer
50 views

diffie hellman key exchange compared with ECDH [closed]

I have to write a paper about the Diffie Hellman key agreement. I want to focus on the implementation with elliptic curves and comparing the safety for selected attacks such as Pollards Rho and ...
5 votes
2 answers
903 views

Weaker alternative to Ed25519?

For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast. However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
3 votes
1 answer
108 views

Hybrid argument for quantum states

The usual hybrid argument tells us that if two efficiently sampled ensembles are computationally indistinguishable based on a single sample, then, computational indistinguishability holds even for ...
0 votes
1 answer
47 views

SPHINCS+ signature calculation and FORS public key

I was trying to understand the SPHINCS+ document from https://sphincs.org/data/sphincs+-r3.1-specification.pdf and have the below doubts. Consider the example of SPHINCS+-128s , the value of n,h,d,log(...
1 vote
1 answer
223 views

How do the notch and window positions on an Enigma machine correlate?

I am having difficulty visualizing the stepping process. The permutation of Wheel I of Enigma I is as follows: ...
1 vote
0 answers
49 views

Test data for AES based F8 encryption, F9 authentication

I am working on implementation of F8 confidentiality scheme for encryption/decryption and F9 based authentication scheme. These are specified by 3GPP standard, but the implementation in standard is ...
0 votes
1 answer
98 views

Password entropy, or at least establishing reasonable upper and lower bounds on it

I use, and have always used, cryptographically secure randomness as a source for my passwords. However, the final coding of that random stream into something a website will accept as a password has ...
-7 votes
1 answer
126 views

Are Schnorr's algorithm really subject to q-computer attacks?

I was wondering whether quantum-computers really break Schnorr's signature scheme. Schor's algorithm works via the quantum Fourier transform, which reveals the cycle time and thus phi. However, with a ...
2 votes
2 answers
73 views

On a diffie hellman related oracle

Given an oracle that can compute $g^{x^{-1}}\bmod p$ from $g^x\bmod p$ is it possible to compute $g^{x^2}\bmod p$ in polynomial time ($p$ is a prime and $g$ generates the multiplicative group modulo $...
0 votes
1 answer
95 views

NTRU: Does the ```*``` indicates something more than a simple multiplication, so for that reason omitted from ```ph``` instead of ```p*h```?

I read the literature and more specific a book describing NTRU encryption. Somewhere (among other things) it describes the "encrpyption", etc... between Alice and Bob. The author writes: $e\...
246 votes
2 answers
144k views

What are the differences between a digital signature, a MAC and a hash?

A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind. Which assurances does each primitive provide to the recipient? What kind of keys are needed?
0 votes
1 answer
101 views

Looking for a modifiable signature!

I am a graduate student and have encountered some problems in my research. When I generate a signature on the data block of the file, and the signature is composed of the user's private key, the data ...
2 votes
1 answer
170 views

Questions related to Hyper Elliptic Curve Cryptography

I have read the wikipedia section related to HECC (Hyper Elliptic Curve Cryptography) and various questions opened in the current Cryptography Stackexchange site. But I need some help on the following ...
1 vote
1 answer
43 views

Effects of and prevention of leaking a private key in an public key encryption scheme

Suppose we have a public key encryption scheme and the private key of the client is stored locally as to never leave the client. But this makes me wonder what would happen when the device of the ...
1 vote
4 answers
195 views

Would calculating the nth prime ruin encryption?

I'm sure there is some proof that the nth prime can be found. But if we knew, would encryption that relies on primes be easy to decrypt?
2 votes
0 answers
48 views

Producing existential forgery against CBC-MAC

Given the above MAC scheme, I want to ask how to form existential forgery of this scheme? I have looked through a couple explanations on existential forgery but still struggle understanding the ...
0 votes
1 answer
51 views

Question on SRP implementation

I'm comparing the Wikipedia description of SRP to the BouncyCastle implementation and some differences and I want to be sure the BouncyCastle implementation is suitable for my purpose. Wikipedia ...
2 votes
1 answer
109 views

Why does Argon2 truncate BLAKE2b outputs?

The Argon2 variable-length hash function uses BLAKE2b directly if the user requests an output less than or equal to 64 bytes in length. However, if the user requests an output longer than this, each ...
2 votes
2 answers
132 views

Short software license keys with asymmetric verification

Would it be possible to implement a modern version of the old software license key scheme that uses an asymmetric signing approach, while keeping the length of the key short, say 40 chars of base64? ...
0 votes
0 answers
30 views

CryptoPals spoiler: Stuck on Set 1, Challenge 4 (in Rust)

I'm completely stuck on the named problem. (I am totally fresh to crypto code and not particularly familiar with particularly numerical code in general). My code looks like this: ...
0 votes
0 answers
54 views

In RSA, can having a part of e allow for solving it? [closed]

I encountered this problem,the core is as follows.I have n and c,but I only have part of e,The 200 bits of e are zeroed out. ...
2 votes
1 answer
174 views

Hashed Password Kerberos PKDF2 AES - ActiveDirectory

I know that in Active Directory environments passwords are stored in the form of hashes depending on encryption types used in the environment. I understand also that when using AES as a symmetric ...
0 votes
0 answers
31 views

Request for Assistance in Deciphering Encrypted Message [closed]

I would like to decipher this message: d%qgL[MuV$7HEb4pePO3t4?BhS`1R84cV,?<Lw9dE, and ChatGPT suggested that you might be able to help me. Please assist me with ...

15 30 50 per page
1
2 3 4 5
612