All Questions

Filter by
Sorted by
Tagged with
0
votes
1answer
12 views

What are the randomness requirements for inputs to PBKDF2?

I need to generate one 160-bit HMAC-SHA1 key for each user in my system. Can I use the username as the input to PBKDF2 function to generate the key? Is it safe to use known values like username as ...
1
vote
1answer
35 views

Pohlig Hellman and small subgroup attacks

While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime ...
1
vote
1answer
21 views

RSA code giving result after more than 10 minutes

I am trying to implement RSA algorithm. I got a code in python. When I run it, it takes more than 10 minutes even when the primes are within 100 and message size is 8 decimal digits. Plese suggest ...
13
votes
1answer
869 views

What is complexity leveraging

Complexity leveraging is a technique that is generally used to prove adaptive security of a selectively secure scheme. Eg: We can prove adaptive security of Yao's garbling scheme using complexity ...
0
votes
0answers
4 views

Verification of NIZK proof with algebraic MACs

The paper Algebraic MACs and Keyed-Verification Anonymous Credentials, includes a way to instantiate a NIZK proof with algebraic MAC. This is given in Appendix E where this NIZK is a part of the ...
0
votes
1answer
69 views

Combine signature with encryption

I have some embedded device for which I want to sign and encrypt firmware files. Firmware updates are generated by me and may be installed by the customer. The encryption is supposed to protect the ...
2
votes
1answer
87 views

Hard-core bits from RSA assumption

I am trying to understand better the hard-core bit property from the RSA assumption. The paper by Håstad and Nåslund shows that every single bit is hard-core. By the result itself, two or more bits ...
4
votes
4answers
154 views

What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?

In this blog post, Matthew Green says Forward secrecy (usually misnamed “perfect forward secrecy”)... The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says ...
2
votes
1answer
75 views

How to recover a message with shared modulus for textbook RSA

Same message sent to two users encrypted with textbook RSA, known $n$, $e_1$, $e_2$, $c_1$, $c_2$. Show how the attacker can recover the message. Problem statement Consider an RSA system with $n=143$,...
0
votes
0answers
15 views

Compositions of specific pseudorandom permutations

Let's consider some specific pseudorandom permutations (PRP). Most of their bits cannot be distinguished from a random permutation, but there is one exeption. If number of the set is divisible by $2^{...
1
vote
1answer
47 views

Adversary for attack on one variant of ElGamal

I came by the following question: Consider the following variant of ElGamal encryption. Let $p= 2q+ 1$, let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of $Z_p^*$ of order $q$, and ...
0
votes
0answers
18 views

How would I get started in auditing and finding vulnerabilities in encryption algorithms?

I know, it sounds dumb. Very dumb in fact. But regardless, I want to actually begin doing security research on cryptographic algorithms (SHA, RSA, ECDSA, etc.). I would prefer that this question be ...
0
votes
0answers
35 views

Semantic Security in Formal Security Proofs

I have a trivial question, and I hope someone can help me. I am reading several papers on formal security proofs based on the indistinguishably game. Specifically, the adversary is challenged in an ...
0
votes
2answers
34 views

How to calculate the entropy for a fixed length random passwords which has restrictions on the type of characters used

If we have a set amount of usable characters, but no other restrictions on the potential characters in a completely random fixed length password, we can easily calculate the entropy by doing: $\log_2(...
-1
votes
0answers
17 views

Is it safe to store mnemonic seed in the email if I change random 2 words?

If I store 12 word seed in the email like gmail and my phone as well but change 3rd and 7th words in the seed for example with other bip-39 words and remember it, would that be safe? I can't think of ...
0
votes
1answer
31 views

Is there a way to change encryption scheme from AES to FHE without data leakage?

So let's say that we have encrypted some data using symmetric encryption in this case AES. And we want to change it to homomorphic encryption but without decrypting the data and encrypting it again ...
0
votes
1answer
36 views

One way permutation and its inverse

Is the following statement correct? Let $F$ be a OWP. Then the inverse $F^{-1}$ of $F$ is also a OWP.
4
votes
2answers
103 views

Proving the right encrypted message was sent

Total amateur to crypto here but I've searched and searched and am at the extent of my knowledge. I've gone down several avenues to satisfy what I'm looking for but I'm just going to describe what I'd ...
104
votes
4answers
68k views

How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
0
votes
1answer
91 views

Comparisons in zero-knowledge proofs

There is already a great survey on how to do range checks in a zero-knowledge setting. A range check allows to constrain a variable to be in a certain range. Comparisons seem to be similar, but they ...
3
votes
0answers
19 views

Sigma proofs for Pedersen commitments arithmetic under different bases

I was wondering if it's possible to prove an equality of openings between $3$ Pedersen commitments $P\cdot Q$ and $R$ when $P, Q, R$ have different commitment keys. Suppose that commitment $R$ commits ...
0
votes
0answers
30 views

Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$

Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
14
votes
2answers
2k views

What is “witness encryption”?

I recently skimmed over tho papers on time-lock encryption: “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan “How to Build Time-Lock Encryption” by Jager ...
5
votes
2answers
2k views

Composing two one-way functions such that the result is not a one-way function

Is it possible to have two distinct one-way functions (called, say, $h$ and $g$) such that their composition $h \circ g = [\, x \mapsto h(g(x)) \,]$ is not one-way?
1
vote
1answer
42 views

Is random.org truly reliable?

Can someone help me in gaining an understanding of the reliability of random.org being used by a University to select student applicants to extend invitations to?
2
votes
0answers
45 views

collision resistant hash functions and one-way functions

Is this theory correct: "if there is a collision resistant hash functions (CRH), then there exists a one-way function"?
3
votes
3answers
127 views

What are the benefits of using AEAD algorithms as MAC

I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report). And I see 2 ...
1
vote
1answer
82 views

Performing EdDSA/Ed448 employing Montgomery ladder

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...
2
votes
1answer
94 views

Constant size commitment to a bivariate polynomial

In this paper by Kate et al, a constant size polynomial commitment scheme is described. The commitment scheme assumes a public reference string: \begin{align*} \Big\{ \{ g^{ \tau^i }, g^{ \alpha \...
0
votes
1answer
105 views

Verification of data on an untrusted remote storage server

I was looking at tahoe-lafs which accepts a file, encrypts it, does erasure coding on it which generates n shares and then distributes it over the storage servers. The distribution is Share 1 = Server ...
9
votes
1answer
1k views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
1
vote
1answer
53 views

Could someone please elaborate on how $(c^d \bmod n) \bmod p = c^d \bmod p$, given that $n = pq$, where $p$ and $q$ are prime numbers?

I'm following this (Chinese Remainder Theorem and RSA) post, but I don't understand how $(c^d \bmod n) \bmod p = c^d \bmod p$. Being told that it's because $n=pq$ is not enough for me to understand. ...
5
votes
1answer
92 views

Sage vs. Magma on DLP

Generally speaking, Magma is faster than Sage on several crypto-related computations, however, I have encountered a DLP instance where Sage is significantly faster than Magma. Take the DLP over $GF(p)$...
2
votes
1answer
132 views

Does the authenticity of messages by Alice still holds if the state of bob is compromised in Double Ratchet

In the double ratchet algorithm, let's say if bob's device is compromised including his long term key. Does the ephemeral keys generated by Alice during the half Diffie–Hellman key exchange produces ...
2
votes
1answer
30 views

Does knowing modular eth roots help in factoring n?

Consider $x^e \equiv a\pmod n$, given $n$, $a$, and $e>2$, with $n$ being a composite integer and unknown $x$. Can a hypothetical function $f(a)=x$, an $eth$ root extractor, be used / adapted to ...
0
votes
0answers
24 views

Man in the middle on public encryption by sending vecitem your public key and save the real one

I was reading on public encryption and I read that if you connect from somebody else network he cant figure the massage you send. but what if he commit simple man in middle just that instead passing ...
0
votes
0answers
11 views

Sigma-Protocol to prove a commitment to a commitment

Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (...
2
votes
1answer
117 views

Any ideas on login using Digital Signature PKCS

I am curious to know about possibility to login into web application just by identifying the user based on digital signature in usb token. any reference in this direction?
2
votes
0answers
19 views

Differences in definitions of “Computational Special Soundness”

I am looking at Unruh's transform (ePrint 2014/587) and in particular the definition in §2.2 for computational special soundness in sigma protocols. Let $\cal{R} \subset \cal{X} \times \cal{Y}$ be ...
3
votes
1answer
46 views

Is precomputing AES-CTR key stream secure?

Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ? I don't think it is because a lookup table is accesed very often, that's what makes it non ...
7
votes
0answers
116 views

What is this problem called and is it hard? given $g^x$ output ($g^y, xy$)

Assume that $G$ is any cyclic group where the discrete log problem is hard, such as the elliptic curve group. Let $g$ be some generator of $G$. The problem is as follows: Given $(g, g^x)$ for unknown $...
0
votes
1answer
113 views

Advise key management protocol

Assume that sender and recipient both already have each others public keys(certificates). Sender needs to generate session key to encrypt some data and sends encrypted data to recipient. All offline - ...
0
votes
1answer
31 views

How to devise cryptographic system with data-sharing ability and password reset

I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question. I am writing a C# .NET application. For my application the ...
2
votes
0answers
29 views

Sakumoto 3-pass MQ IDS Zero-Knowledge proof

In this paper: Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials it is explained in Theorem 2 that the 3-pass protocol is statistically zero knowledge when the commitment ...
3
votes
0answers
12 views

Security of receiving RSA-PSS computed mask in verification step

I'm trying to verify an RSA-PSS padding in an ethereum smart contract The code to compute the MGF step (i.e. calculating many SHA1 hashes) is very expensive in terms of computaiton costs (gas) on ...
4
votes
1answer
679 views

In zkSNARKS, does R1CS require every step of the calculation, or just statements which confirm the calculation was performed correctly?

I was attempting to figure out a way to implement the modulo operation as a set of gates in an Rank-1 Constraint System, detailed by Vitalik Buterin here However, it occurred to me that maybe we don'...
0
votes
0answers
35 views

Same private key for signing and decryption

I am designing a service which identifies records with public keys. All other fields are encrypted with that public key and protected by a HMAC. For authentication, I am thinking about signing ...
-1
votes
1answer
49 views

How to declare 2048 bit key in RSA

I want to implement RSA algorithm using C language. I have read the size of primes in RSA like p and q are 2048 bits long. How to declare such 2048 bit values in C. As i know that the data types like ...
0
votes
0answers
19 views

How big could be nothing-up-my-sleeve numbers to initialize key schedule?

Is it fine if algoritm will have $32$ 128-bit numbers that will be nothing-up-my-sleeve numbers to initialize key schedule? As I know from wikipedia the Hasty Pudding Cipher was criticized for its ...
1
vote
1answer
214 views

I do many searches but can't find any explanation about “AES analysis using entropy”

I found this scenario in CRYPTOOL2 templates but there is no explanation how entropy is used. There is just a short description "This template shows how to use a brute-force search to attack an ...

15 30 50 per page
1
2 3 4 5
446