# All Questions

25,896 questions
Filter by
Sorted by
Tagged with
66 views

### How can I understand the math behind crypto, especially that used in blockchains / distributed ledgers?

A bit of a background about me; Computer Engineer but during my studies I didn't dive too deep into the maths, especially the crypto maths that is used to make the blockchain and cryptography work. I'...
143 views

### Distinguishing the correct IV from incorrect IV in AES CBC when key is known

Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
9 views

### Which of the following is considered cryptographically hard/easy?

Which of the following are easy, if any? Which are hard? and why. Case 1) Given x^3 mod N, where N is a somposite number and we don't know any of the factors of N, find x. Case 2) Given x^3 mod p, ...
9 views

### Building an adversary for a OW-CCA game

Let K_rsa be a RSA genertor with associated security parameter k >= 1024. Let game OW-CCA_Krsa be as follows: How can I build a O(k^3)-time adversary A making at most 2 queries to Invert and ...
14 views

### How to create clone of solana bolckchain? [closed]

I want to create similar coin like solana. I have tried forking litecoin to know process, can you suggest me how can hard fork solana? share the link of article if any.
13 views

### How can we prove that the advantage for this hide game for any adversary is equal 0?

Here is the Scheme: Here is the HIDE game: Here is my idea but I am not quite sure. I would appreciate some input. We want to bring advantage = 0 for all adversaries. We can show that advantage = 0 ...
4k views

### Why is FIPS 140-2 compliance controversial?

I was reading the comments of an article about a proposed new implementation of /dev/random in Linux today, and someone remarked that it must be bothersome to go ...
19k views

### Can two files/strings have the same SHA-256 value?

I was wondering whether, theoretically, 2 files can have the same SHA-256 value. Since there are only $16^{256}$ or $2^{1024}$ SHA256 sums, all 1024-bit files (with $2^{1024}$ different combinations) ...
366 views

### RSA: Is it a security risk if an attacker knows the length of the values of P and Q?

Is it a security risk - or perhaps, how big of a security risk is it - if an attacker knows the length of the values of P and Q used when deriving a value for the parameter N in the RSA encryption ...
123 views

### Why are the parameters (such as modulus and dimension) of homomorphic encryption so large?

Compared with the common lattice-based PQC schemes, the modulus $q$ and dimension $n$ of homomorphic encryption are so large. For example, in Kyber, $n=256, n \times k = \{512,768,1024\}$, $q = 12289$...
119 views

### Is there a difference between the strength of Telgram's (MTproto) forward secrecy and Signal's?

If I understood correctly, the Signal protocol generates a new key after every message sent and forgets the previous one. Telegram, on the other hand, renews the key only after 100 messages or one ...
108 views

### Creating a stronger cryptographic hash given a cryptographic hash

I need a cryptographic hash function that will hopefully be strong even in 50 years. Performance is not an issue. Calculating and verifying can take a huge amount of time if needed. The size of the ...
351 views

### The backdoor of Telegram on Diffie-Hellman Key Exchange and possibly other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...
101 views

### Question about styles of reduction proofs

In cryptography security proofs mainly use the reduction proof technique. I now have read a lot of reductions proofs and also did some on my own and I think I understand it pretty well. While reading ...
48 views

### Collision finding method

The "birthday paradox" places an upper bound on collision resistance: if a hash function produces $N$ bits of output, an attacker who computes only $2^{N/2}$ (...) hash operations on random ...
21 views

I am trying to answer this question. But I think I got it wrong. I am not sure why and how I can improve it. This is the adversary I came up with. Is this correct? ...
57 views

### LWE - Encrypting/Decrypting messages bigger than 1 bit

I'd like to know if LWE (and its variants: RLWE and MLWE) can cipher messages bigger than 1 bit. Is it possible? I didn't find any reference yet. Could you explain it to me or give some good ...
221 views

### Secure multi-party private set intersection: Protocols supporting MULTI-party VS supporting TWO-party

Let assume party $B$ wants to receive secure multi-party computation (MPC) output. The are many private set intersection (PSI) protocols that support only two parties but they cannot support multi-...
166 views

### Verify that a point belongs to secp256r1

I need to verify that the point in this public key ...
34 views

### Current status of ring signatures/proof of set membership

I understand the original O(n) implementation of a ring signature, but I'm trying to figure out where the state of the art is on signing a message as an anonymous member of an ad hoc group without ...
130 views

### Verify that x, y coordinates given as hex string are valid points on an Elliptic Curve [duplicate]

Given the following information: "curve": "P-256", "qx": "729C51D177EBE2079A0FB7B0B3C2145159CF81EC61960E642A1744719AA9F913", "qy": "...
30 views

### What is the best way to use a keyed hash on IP addresses while retaining the ability to identify those that share a subnet?

Background: I'm developing an app that is based around registered users voting on stuff, and I want to create a heuristic that involves IP addresses as one way to flag accounts for further ...
24 views

### Showing that $F'(k, x) := F(F(k, 0^{n}), x)$ is a PRF [duplicate]

I wanted to do some practice on security reduction proofs, and I am stumped on this one from the Boneh-Shoup book. If $F(k, x)$ is a secure PRF, then show that $F'(k, x) := F(F(k, 0^{n}), x)$ is a ...
31 views

### Is it possible to crack a Linear Congruential Generator if I only know the modulus of the output?

$x_{n+1} = (a \cdot x_{n} + b) \mod m$ In normal situation, $x_{n+1}$ and $x_n$ are known. But now I only know $x_n\mod 6$ and $x_{n+1}\mod 6$. I have searched many website on google but I only find ...
44 views

### Python code for 'Verifiable Canonical Generation of the Generator g', FIPS 186-4, returns False [closed]

Edit: if anyone, inexperienced like me, lands on this question, it has been answered at the stackoverflow. Why the Python code, see below, returns false? More context: I am going through the FIPS 186-...
632 views

### Shamir Secret Sharing - P not prime

I was wondering what will happen if I use the Shamir Secret Sharing scheme with $P$ not being a prime, let's say it is $255$. An adversary which holds $k'$ shares ($k'<$ threshold $k$ ) can attack ...
36 views

### LWE and pseudorandom functions

Consider the learning with errors problem. Assuming LWE (or a variant of LWE, like ring LWE) is hard for polynomial time algorithms, can we construct a family of pseudorandom functions from there?
52 views

### reversing hash function makes possibilities increase exponentially, yet there is a finite number of inputs. How?

When trying to reverse a hash function, there is loss, e.g. a+b=c given c=5, try to go back to a,b (previous step) (a,b)=(5,0),(4,1),(3,2),(2,3),(1,4),(0,5) but, ...
641 views
+50

### Are SSH key-pairs an example of a zero knowledge proof?

Quoting from source, authentication using SSH key pairs goes something like this: 1) The client begins by sending an ID for the key pair it would like to authenticate with to the server. 2) ...
171 views

I have been messing around with cryptography (for recreational use), and I created my own one-time-pad encryption script in C. Now, with that being said, I freely admit that I am by no means a ...
76 views

### How to Update Non-Membership Witness upon deletion in RSA Dynamic Universal Accumulator

The Universal Accumulator paper mentions the following for updating non-membership witness upon member deletion. Choose $r$ such that $a\hat x − rx ∈ Z$$2^l$ What is Z$2^l$ and how can we ...
33 views

Firstly I know that what I'm asking about is not practical, so let's keep it theoretical. Let $B[H](x)$ be balloon hashing with $H$ as it's underlying hash. What happens if I do $B[H1](B[H2](x))$, ...
41 views

### For unequal set sizes in PSI: why should the party with fewer elements use cuckoo hash rather than simple hash?

Most PSI papers usually use hash-to-bin to improve the number of comparsons. For unequal set sizes in 2PSI, I have read CCS17, which designs a PSI protocol for unequal size. The party with fewer ...
97 views

### Efficient private set intersection protocol for small sets

I need to implement a PSI that will be used on mobile devices to find mutual contacts. Assuming the set cardinality from both parties A and B are less than 1000, what would be the most efficient PSI ...
42 views

### Is there an algorithm to compute the wNAF for an exponent faster than quadratic?

For doing exponentiation in a group for which inversion is trivially easy, such as elliptic curve groups, is there an algorithm for computing the $w$NAF ("$w$-ary non-adjacent form") array ...
439 views

### Can we convert a pseudorandom function (PRF) to an Oblivious PRF (OPRF) through an Oblivious Transfer (OT) protocol?

I'm a software engineer, so I generally think in building blocks. And I'm not so familiar with the Math notation in Crytography, so I'll stick with function calls and function blueprints (which I ...
68 views

### How to have a hash function that maps any binary string of size n to binary string of size n?

I am implementing certificateless cryptography from this research paper in python language. Essentially, I want to have the following hash function mapping. This hash function is mentioned in the ...
36 views

### Can an adversary distinguish QROM from ROM with a single query?

I acknowledge that QROM differs from ROM (which can be considered as a specific QROM which performs a measurement to the input). For example, one can find a preimage for an arbitrary value with $O(N)$ ...
45 views

### Using one seed to create signing key pair and encryption key

I'm working on creating a secure digital vault. I'm using mnemonic to generate a seed. The seed is used to generate a signing key pair for identity verification. However I want to also encrypt the ...
485 views

### How to decide if a point on a elliptic curve belongs to a group generated by a generator g?

In the elliptic curve encryption scheme, there is a cyclic group generated by a base point $G$ on the elliptic curve. Given a random point on the elliptic curve, is there a way to decide if the random ...
230 views

### Is the security of a Schnorr signature dependent on the hash function that is used?

When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
15 views

### what is difference between CKKS bootstrapping an TFHE bootstrapping? [closed]

Compare the libraries how they are different. all the libraries are implement using LWE hard problem. compare with HElib
282 views

I am currently working on a hardware project that will utilize the native USB and keyboard emulation capabilities of the Teensy device. Essentially, the user will store an encrypted password database ...
97 views

### Do organizations like NSA use racial profiling in the screening process? [migrated]

some sources seem to indicate that they do: https://www.bloomberg.com/news/features/2019-12-10/the-u-s-government-s-mistrust-of-chinese-americans I realize this is a sensitive question. I'm a second-...
2k views

### Why does Smart's attack only work on anomalous curves?

Nigel Smart's attack solves the discrete logarithm problem in linear time. It requires the curve, however, to be anomalous, i.e. to have a trace of Frobenius equal to one or, equivalently, to be of ...
11 views

### How to sign CAM/DENM messages using mbed LTS libray with ECDSA (EEE Std 1609.2)

I have read ETSI TS 103 097 and EEE Std 1609.2 which gives me the security data structure defined in ASN.1 notation. I want to use mbed LTS to calculate the ECDSA signature. I understand that I should ...
83 views

### When do we redo the Diffie-Hellman Exchange?

I'm planning on making a chat application for fun, in C++. I just have a few questions in order to maintain forward/future secrecy across messages. If one party is offline, but the other isn't, what ...
66 views

### truncated sha3-512

Let's say I need performance on 64-bit machine, then SHA3-512 is the way to go. SHA-512/256(x) is SHA-512(x) with output truncated to 256 bits, according to https://pycryptodome.readthedocs.io/en/...