# All Questions

22,296 questions
Filter by
Sorted by
Tagged with
12 views

### What are the randomness requirements for inputs to PBKDF2?

I need to generate one 160-bit HMAC-SHA1 key for each user in my system. Can I use the username as the input to PBKDF2 function to generate the key? Is it safe to use known values like username as ...
35 views

### Pohlig Hellman and small subgroup attacks

While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime ...
21 views

### RSA code giving result after more than 10 minutes

I am trying to implement RSA algorithm. I got a code in python. When I run it, it takes more than 10 minutes even when the primes are within 100 and message size is 8 decimal digits. Plese suggest ...
869 views

### What is complexity leveraging

Complexity leveraging is a technique that is generally used to prove adaptive security of a selectively secure scheme. Eg: We can prove adaptive security of Yao's garbling scheme using complexity ...
4 views

### Verification of NIZK proof with algebraic MACs

The paper Algebraic MACs and Keyed-Verification Anonymous Credentials, includes a way to instantiate a NIZK proof with algebraic MAC. This is given in Appendix E where this NIZK is a part of the ...
69 views

### Combine signature with encryption

I have some embedded device for which I want to sign and encrypt firmware files. Firmware updates are generated by me and may be installed by the customer. The encryption is supposed to protect the ...
87 views

### Hard-core bits from RSA assumption

I am trying to understand better the hard-core bit property from the RSA assumption. The paper by Håstad and Nåslund shows that every single bit is hard-core. By the result itself, two or more bits ...
154 views

### What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?

In this blog post, Matthew Green says Forward secrecy (usually misnamed “perfect forward secrecy”)... The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says ...
75 views

### How to recover a message with shared modulus for textbook RSA

Same message sent to two users encrypted with textbook RSA, known $n$, $e_1$, $e_2$, $c_1$, $c_2$. Show how the attacker can recover the message. Problem statement Consider an RSA system with $n=143$,...
15 views

17 views

### Is it safe to store mnemonic seed in the email if I change random 2 words?

If I store 12 word seed in the email like gmail and my phone as well but change 3rd and 7th words in the seed for example with other bip-39 words and remember it, would that be safe? I can't think of ...
31 views

### Is there a way to change encryption scheme from AES to FHE without data leakage?

So let's say that we have encrypted some data using symmetric encryption in this case AES. And we want to change it to homomorphic encryption but without decrypting the data and encrypting it again ...
36 views

### One way permutation and its inverse

Is the following statement correct? Let $F$ be a OWP. Then the inverse $F^{-1}$ of $F$ is also a OWP.
103 views

### Proving the right encrypted message was sent

Total amateur to crypto here but I've searched and searched and am at the extent of my knowledge. I've gone down several avenues to satisfy what I'm looking for but I'm just going to describe what I'd ...
68k views

### How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
91 views

### Comparisons in zero-knowledge proofs

There is already a great survey on how to do range checks in a zero-knowledge setting. A range check allows to constrain a variable to be in a certain range. Comparisons seem to be similar, but they ...
19 views

### Sigma proofs for Pedersen commitments arithmetic under different bases

I was wondering if it's possible to prove an equality of openings between $3$ Pedersen commitments $P\cdot Q$ and $R$ when $P, Q, R$ have different commitment keys. Suppose that commitment $R$ commits ...
30 views

### Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$

Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
2k views

### What is “witness encryption”?

I recently skimmed over tho papers on time-lock encryption: “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan “How to Build Time-Lock Encryption” by Jager ...
2k views

### Composing two one-way functions such that the result is not a one-way function

Is it possible to have two distinct one-way functions (called, say, $h$ and $g$) such that their composition $h \circ g = [\, x \mapsto h(g(x)) \,]$ is not one-way?
42 views

### Is random.org truly reliable?

Can someone help me in gaining an understanding of the reliability of random.org being used by a University to select student applicants to extend invitations to?
45 views

### collision resistant hash functions and one-way functions

Is this theory correct: "if there is a collision resistant hash functions (CRH), then there exists a one-way function"?
127 views

### What are the benefits of using AEAD algorithms as MAC

I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report). And I see 2 ...
82 views

### Performing EdDSA/Ed448 employing Montgomery ladder

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...
94 views

### Constant size commitment to a bivariate polynomial

In this paper by Kate et al, a constant size polynomial commitment scheme is described. The commitment scheme assumes a public reference string: \begin{align*} \Big\{ \{ g^{ \tau^i }, g^{ \alpha \...
105 views

### Verification of data on an untrusted remote storage server

I was looking at tahoe-lafs which accepts a file, encrypts it, does erasure coding on it which generates n shares and then distributes it over the storage servers. The distribution is Share 1 = Server ...
1k views

### Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
53 views

### Could someone please elaborate on how $(c^d \bmod n) \bmod p = c^d \bmod p$, given that $n = pq$, where $p$ and $q$ are prime numbers?

I'm following this (Chinese Remainder Theorem and RSA) post, but I don't understand how $(c^d \bmod n) \bmod p = c^d \bmod p$. Being told that it's because $n=pq$ is not enough for me to understand. ...
92 views

### Sage vs. Magma on DLP

Generally speaking, Magma is faster than Sage on several crypto-related computations, however, I have encountered a DLP instance where Sage is significantly faster than Magma. Take the DLP over $GF(p)$...
132 views

### Does the authenticity of messages by Alice still holds if the state of bob is compromised in Double Ratchet

In the double ratchet algorithm, let's say if bob's device is compromised including his long term key. Does the ephemeral keys generated by Alice during the half Diffie–Hellman key exchange produces ...
30 views

### Does knowing modular eth roots help in factoring n?

Consider $x^e \equiv a\pmod n$, given $n$, $a$, and $e>2$, with $n$ being a composite integer and unknown $x$. Can a hypothetical function $f(a)=x$, an $eth$ root extractor, be used / adapted to ...
24 views

### Man in the middle on public encryption by sending vecitem your public key and save the real one

I was reading on public encryption and I read that if you connect from somebody else network he cant figure the massage you send. but what if he commit simple man in middle just that instead passing ...
11 views

Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (... 1answer 117 views ### Any ideas on login using Digital Signature PKCS I am curious to know about possibility to login into web application just by identifying the user based on digital signature in usb token. any reference in this direction? 0answers 19 views ### Differences in definitions of “Computational Special Soundness” I am looking at Unruh's transform (ePrint 2014/587) and in particular the definition in §2.2 for computational special soundness in sigma protocols. Let$\cal{R} \subset \cal{X} \times \cal{Y}$be ... 1answer 46 views ### Is precomputing AES-CTR key stream secure? Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ? I don't think it is because a lookup table is accesed very often, that's what makes it non ... 0answers 116 views ### What is this problem called and is it hard? given$g^x$output ($g^y, xy$) Assume that$G$is any cyclic group where the discrete log problem is hard, such as the elliptic curve group. Let$g$be some generator of$G$. The problem is as follows: Given$(g, g^x)$for unknown$...
113 views

Assume that sender and recipient both already have each others public keys(certificates). Sender needs to generate session key to encrypt some data and sends encrypted data to recipient. All offline - ...
31 views

### How to devise cryptographic system with data-sharing ability and password reset

I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question. I am writing a C# .NET application. For my application the ...
29 views

### Sakumoto 3-pass MQ IDS Zero-Knowledge proof

In this paper: Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials it is explained in Theorem 2 that the 3-pass protocol is statistically zero knowledge when the commitment ...
12 views

### Security of receiving RSA-PSS computed mask in verification step

I'm trying to verify an RSA-PSS padding in an ethereum smart contract The code to compute the MGF step (i.e. calculating many SHA1 hashes) is very expensive in terms of computaiton costs (gas) on ...
679 views

### In zkSNARKS, does R1CS require every step of the calculation, or just statements which confirm the calculation was performed correctly?

I was attempting to figure out a way to implement the modulo operation as a set of gates in an Rank-1 Constraint System, detailed by Vitalik Buterin here However, it occurred to me that maybe we don'...
35 views

### Same private key for signing and decryption

I am designing a service which identifies records with public keys. All other fields are encrypted with that public key and protected by a HMAC. For authentication, I am thinking about signing ...
49 views

### How to declare 2048 bit key in RSA

I want to implement RSA algorithm using C language. I have read the size of primes in RSA like p and q are 2048 bits long. How to declare such 2048 bit values in C. As i know that the data types like ...
Is it fine if algoritm will have $32$ 128-bit numbers that will be nothing-up-my-sleeve numbers to initialize key schedule? As I know from wikipedia the Hasty Pudding Cipher was criticized for its ...