All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
2 views

identify how to solve this cipher please! its fun and a mystery

I have roughly 25 three digit numbers between 0 and 200, that are a cipher. if i know what some letters are (for instance a=2, c= 9, and f-3) then how can i solve for this?
0 votes
1 answer
27 views

ed448 generator choice in supercop

Mike Hamburg proposed the Ed448-Goldilocks curve and submitted a software implementation for it to the SUPERCOP project. Below you can see that MH picked a generator (or base point) that has a y-...
2 votes
1 answer
157 views

Recover all keys on differential cryptanalysis

I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" . I am successful to get the last key $k_5$. Just to say some words about the ...
0 votes
0 answers
6 views

Data corruption to protect the encryption?

On KeePass help center it's stated that: ... if the header of the database (first few bytes) is corrupted, you're out of luck, too: the repair functionality won't be able to restore any entries (...
0 votes
0 answers
243 views

How do you find the cipher formula for a cipher like this?

I'm new to ciphers and cryptology in general, so apologies in advanced. ((When I say I'm new, I mean I only started looking up cryptography in response to being given this cipher this morning, so I ...
0 votes
0 answers
13 views

Does the p value in randomness tests provide any real value?

In the dieharder test suite there are things like:- diehard_3dsphere| 3| 4000| 100|0.56011310| PASSED and in the NIST IID (brief mode) and randomness ...
0 votes
0 answers
15 views

Why are ZK proofs so dominant in verifiable computing?

There seem to be many ways of verifying computation, and many classes of interactive proof systems which aren't ZK. That being said, most "validity proofs" in blockchain (which seems to be ...
1 vote
1 answer
348 views

Diffie-Hellman over $GF(2^{128})$

Can I use Diffie-Hellman over, say, $GF(2^{128}) \bmod$ irreducible poly in $GF(2^{128})$ instead of $GF(p)$? If not, why? Or increase it to $GF(2^{2^{\text{whatever}}})$.
0 votes
0 answers
13 views

Hash tree that covers 16 data block

For a hash tree that covers 16 data blocks, how many hash checks do you need to perform to localize the error? Assume that error occurred on only one block.
1 vote
2 answers
2k views

Deriving 2 keys using HKDF

I have an encryption scheme that uses a 256-bit master key, from which 2 separate keys (one for AES-256-CTR encryption and one for a HMAC-SHA256) are derived using HKDF. However, I'm not sure exactly ...
2 votes
2 answers
128 views

Understanding the small cofactor attack with Elliptic Curves of non-prime order

I came across 2 older answers (2 different but similar questions on the small cofactor attack) which cover this attack. https://crypto.stackexchange.com/a/12614/3941 Here the attacker replaces the $...
0 votes
1 answer
36 views

Difference between DSA and RSA in terms of signature generation

For DSA, if the same message is signed multiple times on different occasions, the signatures will differ because the random value k is generated for each signature. This is not true of RSA signatures....
1 vote
1 answer
137 views

Module LWE with an even modulus

Does module-LWE remains hard for an even modulus $q$, or a power of two? This is true for Ring-LWE (pseudorandomness) and Module-LWR (SABER). I can't find any reference to it!
7 votes
1 answer
287 views

Why is the maximum record size in TLS 1.3 limited to $2^{14}$ bytes?

RFC 8446 limits the maximum data carried withing single TLSv1.3 message to $2^{14}$ bytes, specifically in section 5.1: The record layer fragments information blocks into TLSPlaintext records ...
2 votes
1 answer
1k views

About the Algebraic Normal Form (ANF) of S-Box in DES

I've thought up a way to represent the transformation of S-Box in DES by ANF. Let $x_i\;(1\le i\le 6)$ be the input of an S-Box, $y_i\;(1\le i\le 4)$ be the output, for example, then $$y_1= 1\oplus ...
7 votes
2 answers
917 views

Post-quantum candidates for asymmetric cryptography with small key sizes

One of the things that I have come to like about elliptic curve cryptography is that the key only needs to be twice as long as the desired security level. That's a very small expansion (I also like it ...
0 votes
1 answer
195 views

Using Microsoft SIDH library for messages signing

SIDH library looks good but lacks documentation and samples. The only signature-related code was found at http://github.com/yhyoo93/isogenysignature/blob/master/tests/kex_tests.c appeared not able to ...
7 votes
1 answer
2k views

What's the difference beteween SIDH and SIKE?

I'm a semi newbie in crypto (I've had that uni course of discrete math that includes basic cryptography principles) and wanted to go a bit further in isogeny graphs. I have downloaded the C ...
2 votes
1 answer
140 views

Zk Proof to Prove that I know the secret x of y = HASH(x)

Lets say I know a secret value x. The hash of x, y = H(x) is public. Is there any zk way to ...
0 votes
1 answer
71 views

Should I use hash of passphrase as AES256 key

As title I have a password-like passphrase (8 chars at least) that is then hashed with argon2(with the salt is SHA256 of that passphrase). Then use it as AES256 key along with a random IV generated by ...
1 vote
1 answer
175 views

Constructing a mac scheme secure to regular definition but insecure to special case

The mac-forge security game for mac schemes looks like this: $k \leftarrow \operatorname{Gen}(1^n)$; $(m,t) \leftarrow A^{\operatorname{MAC}_k(⋅)}(1^n)$; Let $Q$ denote the set of all queries that $A$...
1 vote
1 answer
38 views

Security of Reusing a One-Time Pad with Complement Messages with Errors

Let's say I have two binary messages ($m_0$ and $m_1$) of length $n$ which are bitwise complements of each other such that $$m_0 \xleftarrow{r} \{0,1\}^n \text{ and } m_1 = \overline{m_0}$$ If I ...
0 votes
0 answers
36 views

Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?

As you can seen here, in hex, N and P are: N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F The ...
0 votes
1 answer
37 views

Equivalance of encryption and decryption in DES under bruteforce

I am studying the vulnerability of DES algorithm. Let there be a DES system with 5 keys, 56bits each. Encryption works as follows: (It's in this order on purpose) $C=DEC_{k1}(ENC_{k2}(ENC_{k3}(DEC_{k4}...
6 votes
1 answer
1k views

is XChaCha20 stronger than ChaCha20?

Some of the encrypted messenger apps and password managers use extended version of Bernstein's ciphers and some of them not. Viber-Salsa20 Wire-ChaCha20 Threema-XSalsa20 Sid-Salsa20 Nordpass-XChaCha20 ...
-1 votes
1 answer
38 views

How to read clock cycle from latency tables?

I see many papers that compare the latency of the signature schemes in terms of clock cycles by two-three numbers. I don't know why they write 2-3 numbers instead of one number to represent clock ...
0 votes
2 answers
78 views

Is it possible to create digital signature with specific p, q, e values by using OpenSSL?

I'm trying to create the digital signature by using these parameters and RSA algorithm: p = 645353605880701501120167331073 q = 350784310265709643169455170929 e = 19 message = "G’day mate! As we ...
12 votes
3 answers
7k views

AES Inverse Key Schedule

I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already ...
0 votes
1 answer
38 views

Encrypting data before Saas-solution

The compliance department is asking me for recommendations on encrypting data before Saas-solutions. Meaning that the Saas-solution should not be able to see the data when stored and processed. ...
-1 votes
0 answers
18 views

Elgamal Problem, cant find the right answer, If anyone could help, would appreciate it [closed]

Joe has a public and private key pair (u𝑘𝐴, p𝑘𝐴) for ElGamal signature. Suppose that Joe signs a message for Arthur every day. If Joe uses the same random number 𝑘 in all signatures. Analyse the ...
2 votes
1 answer
75 views

Show that function isn't a PRF

Let $F$ be a PRF such that $|F(k,x)|=2n$ show that $F_2$ isn't a PRF. Let's assume $F(k,x)=(y_1,...,y_{2n})$ then $F_2(k,x)=(y_1\land y_2,...,y_{2n-1}\land y_{2n})$. I want to prove $F_2$ isn't a PRF ...
0 votes
1 answer
31 views

Randomness of recursive sequence generation

How good from randomness point of view are recursively generated sequences using good encryption algorithms? Let us say I take AES128 which generates good random sequences of outputs for counter ...
2 votes
3 answers
116 views

RSA different ciphertext for the same plaintext

General My goal is to encrypt some strings and store them in a database. I am using RSA OAEP in Go (Golang): ...
-1 votes
1 answer
94 views

What is the importance of superencryption?

Please, can any extensively explain the importance of super encryption in relation to attacks experienced by single standard algorithms
1 vote
1 answer
105 views

How do I encrypt a bunch of messages by different authors, shared with that group of people?

I'm still getting my head around public/private key cryptography, and I can't quite work out how to ask the right question to get an answer for this problem, but here goes! Alice, Bob, Carol, and ...
0 votes
1 answer
144 views

Which encryption technique should be adopted to keep the search functionalities?

I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on ...
0 votes
0 answers
34 views

RSA / RS256 Encryption with the public key I have

safe to say I'm a complete beginner when it comes to cryptography... I believe the example output below is some sort of RSA (or RS256) encrypted string, and was just curious whether it'd be possible ...
1 vote
0 answers
51 views

Is ChaCha20 + HMAC(SHA3) output indistinguishable from randomness?

I was wondering, if the output of following type of ChaCha + HMAC scheme is indistinguishable from randomness: ...
0 votes
0 answers
36 views

Clarification for CCA security (or - why is the following not a Rabin CCA attack?)

In three different, highly reputable sources (e.g. "Introduction to Modern Cryptography" by Katz and Lindell, 2007), the definition of CCA attack doesn't allow the adversary to decrypt the ...
0 votes
1 answer
48 views

How to verify an ES256 (ECDSA using P-256 and SHA-256) signature with window.crypto.subtle? [closed]

I'm having trouble figuring out the right parameters to verify a ES256 signature that was created with an ECDSA P-256 public key in web crypto. Below script outputs different results for Node.js vs ...
1 vote
1 answer
18 views

Clarification regarding Rabin Cryptosystem being CPA (Chosen Plaintext Attack) secure

Do I understand correctly that the textbook Rabin encryption scheme, where there is no random padding (as is also required in RSA for it to be CPA secure), is not CPA secure? (it is deterministic ...
7 votes
1 answer
590 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
1 vote
1 answer
65 views

Why Can't I Use an Nacl Sign Keypair for Encrypt and Decrypt Operations?

I'm aware that the difference between the NaCL sign keys vs the box keys is that the secret key that comes from the NaCL box keypair is the ...
5 votes
1 answer
59 views

Polynomial Breakdown in proof of lower bounds on Discrete Log in the Generic Group

In Shoup's proof of the hardness of discrete log in the generic group in this paper, he mentions that: At any step in the game, the algorithm has computed a list $F_1,\dots,F_k$ of linear polynomials ...
52 votes
2 answers
7k views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows $...
2 votes
2 answers
43 views

For an asymmetric bilinear pairing, can I get $g_2^t$ from $g_1^t$?

Let $e:G_1\times G_2\to G_t$ be an asymmetric bilinear pairing, $g_1$ be a generator of $G_1$ and $g_2$ be a generator of $G_2$. Can we compute $g_2^t$ from $g_1^t$ when $t$ is unknown?
0 votes
1 answer
55 views

Shamir secret sharing, recovery of keys which have 0 bytes in front of them?

From what I know SSS creates a polynomial with a0 = secret key and interpolates it on recovery using k coeffs. if a0 is a number,...
0 votes
3 answers
47 views

Do digital signatures without contextual information protect you against signed messages replay attacks?

Consider this scenario: A signs a message to B using A's private key. A then encrypts the signed message with B's public key. A sends both plaintext and encrypted message to B so that B can verify. ...
0 votes
0 answers
60 views

is it possible to secure password management using one time pad cipher. I have created a protocol which uses one time pad password storage [closed]

I thought of a secure protocol for password manager. It has single user .My one time pad supports 36 characters [ numbers 0 - 9 and all 26 alphabets , encryption process is similar to method mentioned ...
3 votes
1 answer
63 views

What is the purpose of the WireGuard handshake mac1 field?

The mac1 field in the WireGuard handshake messages is populated as: ...

15 30 50 per page
1
2 3 4 5
550