# All Questions

29,857 questions
Filter by
Sorted by
Tagged with
609 views

### How much entropy is lost due to collision?

If entropy is hashed with SHA-256 for example, and the input has exactly 256 entropy bits, how much entropy is reduced after hashing due to collision? Is there any reference that explains how to ...
9 views

### Generating UUID from Keccak-256 hash

Is generating Keccak-256 hashes with timestamp + nonce (ensured to be unique for each run), and taking its most significant 16 bytes sufficient to generate random V4 UUIDs? Obviously the 13th hex ...
59 views

### 1-out-of-2 Oblivious Transfer with RSA

I'm trying to implement a simple 1-out-of-2 Oblivious Transfer with RSA. I was checking the code and tried to work it step by step. The 2 messages by Alice, let's say, are $m_0 = 7$ and $m_1 = 9$. Bob'...
1 vote
85 views

### Cannot protect GPG key using TPM2 on Ubuntu 22.04 [migrated]

I'm trying to protect a GPG key using the TPM2 available on my laptop, but I'm not having any success. Probably I'm doing something wrong, but I cannot figure out what this is. My system is running <...
29 views

### Rationale for BLAKE2 message schedule?

BLAKE2 uses a message schedule I did not see before. It uses permutations of pieces of the message block. The BLAKE2 book did not state the rationale for such a choice and how it contrasts with the ...
329 views

### Disclosure of Catastrophic Cryptanalytic Breakthroughs

An efficient algorithm for factoring would be a major mathematical achievement giving the person who discovered it anstant fame. About two years ago, C. P. Schnorr claimed such a breakthrough but it ...
20 views

### Mysterious number series logic [closed]

(8,5,6) (16,9,10,12,7) (32,17,18,20,11,24,13,14) (64,33,34,36,19,40,21,22,48,25,26,28,15) Above four series are according to power of 2. The first row is 2^3 second row is 2^4 third row is 2^5 and so ...
14 views

### How is sharegen computed without trusted third party in GHKL08 [closed]

https://eprint.iacr.org/2008/303 The protocol here relies on a subprotocol sharegen but i cannot understand how it is computed. Please explain.
71 views

### Rate the security of the following MAC

Ok we know when we add a random IV in our encrypted MAC became useless and the IV can be forgery, then our encryption scheme becomes vulnerable to chosen plaintext attacks. But the addition at the ...
19k views

### What are the odds of collisions for a hash function with 256-bit output?

There are some related questions on the net but I did not understand their solutions. I am reading in a textbook about methods of finding a collision. It states to consider a collision for a hash ...
31 views

### Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
250 views

### Show that function isn't a PRF

Let $F$ be a PRF such that $|F(k,x)|=2n$ show that $F_2$ isn't a PRF. Let's assume $F(k,x)=(y_1,...,y_{2n})$ then $F_2(k,x)=(y_1\land y_2,...,y_{2n-1}\land y_{2n})$. I want to prove $F_2$ isn't a PRF ...
188 views

### Implementing ECDSA threshold using a secret sharing scheme

My question might be a duplicate but I wasn't able to find a similar question. I recently developed a wallet-like app and I am trying to implement some MPC features. I searched a little and even asked ...
56 views

### Is a prime shifting method for RSA modulus generation safe?

I have a prime number, $p$, with $n$ bits. To generate a new prime number, $q$, I shift the bits of $p$ from left to right by a certain length. For example, if $p$ is represented as ...
20 views

### Is this forum ok to post a factoring problem and ask for help fixing it? [closed]

One of my factoring methods works correctly sometimes, but other times it misses the factors, or is off by a square number from the the target product (the product of output factors is off by a square ...
1 vote
106 views

### Matrix multiplication circuit

I am trying to understand which operations are computable by an $\texttt{NC}^1$ circuit. However, I am struggling to understand whether there is such a circuit for multiplying a matrix with a vector ...
1 vote
48 views

### Difference between a a doubled point and a point from point addition

Are all doubled points on an elliptic curve even, meaning if you compress the point, it will have '02' plus the $x$ coordinate? If not, what distinguishes a doubled point from a point resulting from ...
211 views

### Which encryption technique should be adopted to keep the search functionalities?

I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on ...
145 views

### How do I encrypt a bunch of messages by different authors, shared with that group of people?

I'm still getting my head around public/private key cryptography, and I can't quite work out how to ask the right question to get an answer for this problem, but here goes! Alice, Bob, Carol, and ...
1 vote
54 views

### Identified Performance Discrepancy in my AES addRoundKey: Slower than Expected

Problem I'm working on an AES implementation in C++, and I have been testing the performance of my code, and its functions. I've noticed a significant performance slowdown in my 'addRoundKey' function....
81 views

76 views

### Hash Collision: Weak and Strong Resistance [closed]

On average, against a 128-bit-long key, how many more hash computations would an attacker need to perform to break weak collision resistance compared to breaking strong collision resistance? In other ...
58 views

### Ring LWE distribution definitions

This may be a stupid question but I've been stuck on parsing these definitions for a while. I am reading the paper "On Ideal Lattices and Learning with Errors Over Rings" by Lyubashevsky, ...
256 views

### Choosing (key,plain) to produce zero state in middle rounds of AES encrypt

I was told in passing that (key, plain) pairs could be chosen to produce a zero state in AES encrypt in some middle round (say 5). [The application here being to side-channel leakage assessment.] ...
1 vote
1k views

### Is it theoretically possible to create an unbreakable cipher?

I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
1 vote
29 views

### Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing

I'm working on a project where we have three different software systems—let's call them A, B, and C. Systems A and B handle user data identified by phone numbers and want to send user actions to ...
78 views

### Prove that if $e.d \equiv 1 \text{ mod } pq$ then it's impossible to have $e.d \equiv 1 \text{ mod } (p-1)(q-1)$

I am studying RSA cryptosystem and here is the question that came to my mind. Let's pick $p, q$ to be two primes and $n = p * q$. From that we calculate Euler's totient function:  \phi(n) = (p - 1)(...
48 views

### Learning the LWE secret with advice

I am trying to argue about the hardness of LWE, but in a setting that is different from the standard one. Consider the task of learning the LWE secret $s$ from noisy samples. The specifications of the ...
2k views
+500

### Fast cryptographic hash function for short inputs

I am looking for a cryptographic hash function optimized for speed on short inputs, in order to implement a pseudorandom generator with expansion factor 2 (e.g. takes 16 bytes of input and outputs 32 ...
36 views

### Determining the vulnerability of BTC in the presence of output RSZ with the entropy of mutual relations [closed]

I found the program as I understood from the description of the search for mutual entropy of different groups of RSZ output signatures from one wallet to bitcoin. Who has heard anything about this ...
14k views

### When to use Argon2i vs Argon2d vs Argon2id?

I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case. I want to securely encrypt passwords ...
1 vote
18 views

### Search the LWE problem

When designing the search LWE problem, how do you set the dimensions of the A matrix? Or under what circumstances can I use very few matrix dimensions to achieve 128-bit security? Up to noise level? ...
484 views

### RSA perfect square phi

So I've been learning about RSA for quite a while (mainly by playing around in CTF competitions) and I came across an interesting problem. The other day I was looking to create a challenge in which I ...
1k views

### How to Understand Authenticated Key Exchange?

I am reading some articles about key exchange. I know classic key exchange, such as Diffie-Hellman key exchange. This type of algorithm is vulnerable to man-in-the-middle attack. However, when using a ...
635 views

### Kyber 512 Security Level Issue

So I read parts of the following article: https://blog.cr.yp.to/20231003-countcorrectly.html But I quite dont understand it. NIST assumes Kyber 512 is just as hard as AES128 nowadays, in presence of ...
55 views

### Tor Key Exchange Client - Middle Node

I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
28 views

### Requesting some recommendations for research topics on Signal protocol [migrated]

I am a beginner in Signal protocol. In my opinion, Signal protocol is already a very mature protocol, so I would like to ask What are the other worthwhile problems about Signal protocol that can be ...
51 views

### Choosing $C_0$ to make second row zero for Garbled Row Reduction (GRR3)

In GRR3,we make the first row of the Garbled table to be zero by choosing a special value of $C_1$. Why don't we make the second row also zero by choosing a special value of $C_0$?
1 vote
77 views

### Probability when representing message as a point on elliptic curve

There is a very popular method to represent a message $m$ (number) as a point on elliptic curve over a finite field: Set $i = 0$ Check whether $m'=m\cdot K+i$ is on elliptic curve. If not, try again ...
1 vote
### Why the full $r$-torsion group contains $r^2$ many elements and consists of $r+1$ subgroups
let $F$ be a finite field, $E(F)$ an elliptic curve of order $n$, $r$ a factor of $n$, $k(r)$ for the embedding degree of $E(F)$ with respect to $r$. Then why the full $r$-torsion group contains $r^2$...