All Questions

ًًQuestion is : Consider the following variant of El Gamal encryption. Let $p= 2q+ 1$, let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of $Z_p^*$ of order $q$, and let $g$ be a ...

is this theory correct : "if there is a collision resistant hash functions (CRH), then there exists a one-way function" ?

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...

Consider $x^e \equiv a\pmod n$, given $n$, $a$, and $e>2$, with $n$ being a composite integer and unknown $x$. Can a hypothetical function $f(a)=x$, an $eth$ root extractor, be used / adapted to ...

I was reading on public encryption and I read that if you connect from somebody else network he cant figure the massage you send. but what if he commit simple man in middle just that instead passing ...

Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (...

I have a trivial question, and I hope someone can help me. I am reading several papers on formal security proofs based on the indistinguishably game. Specifically, the adversary is challenged in an ...

I am looking at Unruh's transform (ePrint 2014/587) and in particular the definition in §2.2 for computational special soundness in sigma protocols. Let $\cal{R} \subset \cal{X} \times \cal{Y}$ be ...

Generally speaking, Magma is faster than Sage on several crypto-related computations, however, I have encountered a DLP instance where Sage is significantly faster than Magma. Take the DLP over $GF(p)$...

I am designing a service which identifies records with public keys. All other fields are encrypted with that public key and protected by a HMAC. For authentication, I am thinking about signing ...

I'm trying to verify an RSA-PSS padding in an ethereum smart contract The code to compute the MGF step (i.e. calculating many SHA1 hashes) is very expensive in terms of computaiton costs (gas) on ...

I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question. I am writing a C# .NET application. For my application the ...

I want to implement RSA algorithm using C language. I have read the size of primes in RSA like p and q are 2048 bits long. How to declare such 2048 bit values in C. As i know that the data types like ...

Is it fine if algoritm will have $32$ 128-bit numbers that will be nothing-up-my-sleeve numbers to initialize key schedule? As I know from wikipedia the Hasty Pudding Cipher was criticized for its ...

Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ? I don't think it is because a lookup table is accesed very often, that's what makes it non ...

In this paper: Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials it is explained in Theorem 2 that the 3-pass protocol is statistically zero knowledge when the commitment ...

I'm following this (Chinese Remainder Theorem and RSA) post, but I don't understand how $(c^d \bmod n) \bmod p = c^d \bmod p$. Being told that it's because $n=pq$ is not enough for me to understand. ...

Same message sent to two users encrypted with textbook RSA, known $n$, $e_1$, $e_2$, $c_1$, $c_2$. Show how the attacker can recover the message. Problem statement Consider an RSA system with $n=143$,...

Let's say we have a message m of small size. I am looking for a system $S$ so that $S(m)$ is arbitrarily large, we can easily compute the inverse $I(S(m)) = m$, and any modification to $S(m)$ makes it ...

I'm currently working on a personal project using a special kind of crypto I've imagined (noooo please don't !!!), called the Anamorphic Cryptography. The project: create a complete keyless ...

In ROLLO - Rank-Ouroboros, LAKE & LOCKER, Ideal codes are definited in Definition 2.1.4. Thanks the Lemma 1, It is proved that every block of ideal matrix is non- singular. Now, why do they say &...

I found this scenario in CRYPTOOL2 templates but there is no explanation how entropy is used. There is just a short description "This template shows how to use a brute-force search to attack an ...

Let $\Lambda\subset \mathbb{Z}^n$ be an $n-$ dimensional lattice with determinant $d$. We know that the probability that a uniformly random integer vector $x$ is a point in $\Lambda$ is given by $\...

Assume that $G$ is any cyclic group where the discrete log problem is hard, such as the elliptic curve group. Let $g$ be some generator of $G$. The problem is as follows: Given $(g, g^x)$ for unknown $...

I'm looking at RFC 8446 section 7.1 and trying to understand the following: ...

Suppose we want to build a very basic hash function like this: $$c_i = h(c_{i-1},x_i) = c_{i-1}\oplus x_i \quad\quad mit \;\; i\geq1, c_0 = \operatorname{IV}$$ Now suppose we'd use this hash-function ...

In modern Secure Multi-party Computation (SMPC) protocols (informally) the notion of Fairness and Guaranteed Output Delivery (GOD) is defined as follows: Fairness: If the adversary gets the output of ...

I came across some password-based authenticated key exchange (PAKE) protocols that are based on the smooth projective hash function (SPHF) in the standard model. And I checked some related works, and ...

In classical cryptography, security proofs are often based on the (assumed) computational hardness of some mathematical problem. Using the principles of quantum mechanics might provide means to design ...

I want to manually create a GPG public key that can be imported into GPG, i.e. I want to create a file with a Public-Key Packet, a User ID Packet and a Signature Packet (for an example see here). I ...

I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report). And I see 2 ...

Let's say Bitcoin had these rules from the start: An address with balance cannot more receive money An address must use all its money in one transaction This would prevent address re-use. To what ...

I'm trying to sum up all Curve25519 parameter and specification reasons. Can you tell me if I missed some important reasons or parameters in the following list?: Curve: Montgomery Curve. $M_{A,B}: By^...

While Provable Data Possession seems to be a very useful and interesting tool for ensuring integrity of data outsourced into Cloud providers, I have never seen a reputed Cloud provider talk about this ...

I have a question about the AES-128 and AES-256 encryption method. I need to encrypt 64-bit size data in and out. I want to encrypt them with AES. So I turned to AES-OFB or AES-CFB because these ...

I am trying to implement a small encryption tool in as little code as possible as a learning exercise, and currently have managed to get everything to depend only on a HMAC construct. However, most ...

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...

I recently worked out a concept for a use-case, but I'm not sure if my approach is good enough. So I would appreciate feedback and things to look out for, as I'm fairly new to this field. A User can ...

(DISCLAIMER: I'm clearly seeking a point to be illustrated from a white paper as explained here, "How should questions be handled involving code?", and <...

According to blind RSA signature wiki the random value $r$ in $m^\prime=mr^e \bmod N$ needs to be relatively prime to $N$. Why is this a requirement? A follow up a related question: after $s$ (...

Problem When I browse this forum, I constantly read about the weaknesses of popular "secure" messaging applications such as Signal, Telegram, and WhatsApp. Some of the most notable critiques ...

In this blog post, Matthew Green says Forward secrecy (usually misnamed “perfect forward secrecy”)... The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says ...

The only clue I have is that the person who wrote this writes their letters like numbers The message: 182119154193 x 151815209815414 0457185519125 The key, I ...

Most of the articles and forums are stating that the Brute Force attack can test the strength of an encryption algorithm. However, I am looking for those attacks that AES can withstand for the testing ...

Someone sent me a PGP encrypted message (it's not a file but in a text message) and the private key to decrypt it is not given. But he gave me a hint, that the private key is a 4 digit number. I can ...

I came across different reputable sources quoting different equivalent symmetric key strengths for RSA/DH keys. This NIST paper (page 67) states the following offer corresponding security strenghts (...

Given $x$, a vector of $m$ distinct bit vectors of bit length $N$, I want to use an XOR-hash $h$ such that all $x_i$ collide to the same value. I define an XOR hash $h$ which takes bit vector $q$ as ...

I am experimenting clusters and formatting in veracrypt, and I have found that no matter how large or small I format the clusters in my veracrypt volumes, no matter how small the files I save, they ...

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...

I'm faced with an issue I can't seem to understand when it comes to RSA. Below are my values for all of the parameters, unfortunately I can't seem to get the expected decrypted values from my ...