All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

Adversay for attack on one variant of El-gmaml

ًًQuestion is : Consider the following variant of El Gamal encryption. Let $p= 2q+ 1$, let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of $Z_p^*$ of order $q$, and let $g$ be a ...
0
votes
0answers
14 views

Question about building CRH from OWF

is this theory correct : "if there is a collision resistant hash functions (CRH), then there exists a one-way function" ?
2
votes
1answer
125 views

Safely sorting secret data

Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "...
2
votes
1answer
22 views

Does knowing modular eth roots help in factoring n?

Consider $x^e \equiv a\pmod n$, given $n$, $a$, and $e>2$, with $n$ being a composite integer and unknown $x$. Can a hypothetical function $f(a)=x$, an $eth$ root extractor, be used / adapted to ...
0
votes
0answers
18 views

Man in the middle on public encryption by sending vecitem your public key and save the real one

I was reading on public encryption and I read that if you connect from somebody else network he cant figure the massage you send. but what if he commit simple man in middle just that instead passing ...
0
votes
0answers
9 views

Sigma-Protocol to prove a commitment to a commitment

Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (...
0
votes
0answers
19 views

Semantic Security in Formal Security Proofs

I have a trivial question, and I hope someone can help me. I am reading several papers on formal security proofs based on the indistinguishably game. Specifically, the adversary is challenged in an ...
2
votes
0answers
13 views

Differences in definitions of “Computational Special Soundness”

I am looking at Unruh's transform (ePrint 2014/587) and in particular the definition in §2.2 for computational special soundness in sigma protocols. Let $\cal{R} \subset \cal{X} \times \cal{Y}$ be ...
3
votes
1answer
58 views

Sage vs. Magma on DLP

Generally speaking, Magma is faster than Sage on several crypto-related computations, however, I have encountered a DLP instance where Sage is significantly faster than Magma. Take the DLP over $GF(p)$...
0
votes
0answers
30 views

Same private key for signing and decryption

I am designing a service which identifies records with public keys. All other fields are encrypted with that public key and protected by a HMAC. For authentication, I am thinking about signing ...
3
votes
0answers
11 views

Security of receiving RSA-PSS computed mask in verification step

I'm trying to verify an RSA-PSS padding in an ethereum smart contract The code to compute the MGF step (i.e. calculating many SHA1 hashes) is very expensive in terms of computaiton costs (gas) on ...
0
votes
1answer
27 views

How to devise cryptographic system with data-sharing ability and password reset

I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question. I am writing a C# .NET application. For my application the ...
-1
votes
1answer
46 views

How to declare 2048 bit key in RSA

I want to implement RSA algorithm using C language. I have read the size of primes in RSA like p and q are 2048 bits long. How to declare such 2048 bit values in C. As i know that the data types like ...
0
votes
0answers
18 views

How big could be nothing-up-my-sleeve numbers to initialize key schedule?

Is it fine if algoritm will have $32$ 128-bit numbers that will be nothing-up-my-sleeve numbers to initialize key schedule? As I know from wikipedia the Hasty Pudding Cipher was criticized for its ...
3
votes
1answer
45 views

Is precomputing AES-CTR key stream secure?

Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ? I don't think it is because a lookup table is accesed very often, that's what makes it non ...
2
votes
0answers
27 views

Sakumoto 3-pass MQ IDS Zero-Knowledge proof

In this paper: Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials it is explained in Theorem 2 that the 3-pass protocol is statistically zero knowledge when the commitment ...
1
vote
1answer
44 views

Could someone please elaborate on how $(c^d \bmod n) \bmod p = c^d \bmod p$, given that $n = pq$, where $p$ and $q$ are prime numbers?

I'm following this (Chinese Remainder Theorem and RSA) post, but I don't understand how $(c^d \bmod n) \bmod p = c^d \bmod p$. Being told that it's because $n=pq$ is not enough for me to understand. ...
2
votes
1answer
51 views

How to recover a message with shared modulus for textbook RSA

Same message sent to two users encrypted with textbook RSA, known $n$, $e_1$, $e_2$, $c_1$, $c_2$. Show how the attacker can recover the message. Problem statement Consider an RSA system with $n=143$,...
2
votes
0answers
33 views

Looking for a way to enlarge a message so that any modification to the “enlarged” message makes recovering the original message impossible

Let's say we have a message m of small size. I am looking for a system $S$ so that $S(m)$ is arbitrarily large, we can easily compute the inverse $I(S(m)) = m$, and any modification to $S(m)$ makes it ...
1
vote
0answers
61 views

Anamorphic Cryptography, what do you think about it?

I'm currently working on a personal project using a special kind of crypto I've imagined (noooo please don't !!!), called the Anamorphic Cryptography. The project: create a complete keyless ...
1
vote
0answers
47 views

ROLLO: ideal codes

In ROLLO - Rank-Ouroboros, LAKE & LOCKER, Ideal codes are definited in Definition 2.1.4. Thanks the Lemma 1, It is proved that every block of ideal matrix is non- singular. Now, why do they say &...
1
vote
1answer
210 views

I do many searches but can't find any explanation about “AES analysis using entropy”

I found this scenario in CRYPTOOL2 templates but there is no explanation how entropy is used. There is just a short description "This template shows how to use a brute-force search to attack an ...
2
votes
0answers
17 views

Probability that length of shortest nonzero vector is less than a number

Let $\Lambda\subset \mathbb{Z}^n$ be an $n-$ dimensional lattice with determinant $d$. We know that the probability that a uniformly random integer vector $x$ is a point in $\Lambda$ is given by $\...
6
votes
0answers
108 views

What is this problem called and is it hard? given $g^x$ output ($g^y, xy$)

Assume that $G$ is any cyclic group where the discrete log problem is hard, such as the elliptic curve group. Let $g$ be some generator of $G$. The problem is as follows: Given $(g, g^x)$ for unknown $...
0
votes
1answer
37 views

Trying to understand the struct HkdfLabel from tls1.3 RFC8446

I'm looking at RFC 8446 section 7.1 and trying to understand the following: ...
0
votes
1answer
38 views

Design flaws when designing a MAC-function

Suppose we want to build a very basic hash function like this: $$c_i = h(c_{i-1},x_i) = c_{i-1}\oplus x_i \quad\quad mit \;\; i\geq1, c_0 = \operatorname{IV}$$ Now suppose we'd use this hash-function ...
1
vote
2answers
223 views

Imposibility of bias-resistant coin tossing (Cleve'86) and its connection to modern notion of fairness in Secure Multiparty Computation

In modern Secure Multi-party Computation (SMPC) protocols (informally) the notion of Fairness and Guaranteed Output Delivery (GOD) is defined as follows: Fairness: If the adversary gets the output of ...
1
vote
1answer
33 views

Could PAKE via smooth projective hash function protect agaist replay attacks?

I came across some password-based authenticated key exchange (PAKE) protocols that are based on the smooth projective hash function (SPHF) in the standard model. And I checked some related works, and ...
2
votes
1answer
122 views

Is there a notion of “computational security” in quantum cryptography?

In classical cryptography, security proofs are often based on the (assumed) computational hardness of some mathematical problem. Using the principles of quantum mechanics might provide means to design ...
1
vote
1answer
49 views

Manually creating a GPG Public Key

I want to manually create a GPG public key that can be imported into GPG, i.e. I want to create a file with a Public-Key Packet, a User ID Packet and a Signature Packet (for an example see here). I ...
3
votes
3answers
113 views

What are the benefits of using AEAD algorithms as MAC

I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report). And I see 2 ...
0
votes
1answer
80 views

To what extent would Bitcoin be private without address reuse?

Let's say Bitcoin had these rules from the start: An address with balance cannot more receive money An address must use all its money in one transaction This would prevent address re-use. To what ...
2
votes
0answers
83 views

All Curve25519 Parameters with Explanation

I'm trying to sum up all Curve25519 parameter and specification reasons. Can you tell me if I missed some important reasons or parameters in the following list?: Curve: Montgomery Curve. $M_{A,B}: By^...
1
vote
0answers
27 views

Provable Data Possession

While Provable Data Possession seems to be a very useful and interesting tool for ensuring integrity of data outsourced into Cloud providers, I have never seen a reputed Cloud provider talk about this ...
0
votes
2answers
59 views

Find IV and the key ? AES with CFB or OFB

I have a question about the AES-128 and AES-256 encryption method. I need to encrypt 64-bit size data in and out. I want to encrypt them with AES. So I turned to AES-OFB or AES-CFB because these ...
0
votes
0answers
42 views

Small (code-size) hash functions

I am trying to implement a small encryption tool in as little code as possible as a learning exercise, and currently have managed to get everything to depend only on a HMAC construct. However, most ...
3
votes
1answer
127 views

Likelihood of signature collision with EdDSA

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...
1
vote
0answers
42 views

Content Key Encryption for Multi-User data access

I recently worked out a concept for a use-case, but I'm not sure if my approach is good enough. So I would appreciate feedback and things to look out for, as I'm fairly new to this field. A User can ...
-3
votes
0answers
73 views

Deterministic DSA by Thomas Pornin (Java Illustration, its Errors) [closed]

(DISCLAIMER: I'm clearly seeking a point to be illustrated from a white paper as explained here, "How should questions be handled involving code?", and <...
0
votes
1answer
23 views

Why blinding integer $r$ needs to be co-prime with $N$ in blind RSA signature

According to blind RSA signature wiki the random value $r$ in $m^\prime=mr^e \bmod N$ needs to be relatively prime to $N$. Why is this a requirement? A follow up a related question: after $s$ (...
0
votes
0answers
14 views

Is there any digital communication medium that provided close-to-perfect security? [migrated]

Problem When I browse this forum, I constantly read about the weaknesses of popular "secure" messaging applications such as Signal, Telegram, and WhatsApp. Some of the most notable critiques ...
3
votes
2answers
120 views

What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?

In this blog post, Matthew Green says Forward secrecy (usually misnamed “perfect forward secrecy”)... The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says ...
0
votes
0answers
31 views

I have a puzzle I can’t solve, need help [closed]

The only clue I have is that the person who wrote this writes their letters like numbers The message: 182119154193 x 151815209815414 0457185519125 The key, I ...
0
votes
0answers
54 views

Which cryptographic attacks can AES 128-bit withstand?

Most of the articles and forums are stating that the Brute Force attack can test the strength of an encryption algorithm. However, I am looking for those attacks that AES can withstand for the testing ...
0
votes
0answers
22 views

How to convert a 4 digit number (supposedly the PGP private key) into a PEM format and how to code this? [closed]

Someone sent me a PGP encrypted message (it's not a file but in a text message) and the private key to decrypt it is not given. But he gave me a hint, that the private key is a 4 digit number. I can ...
3
votes
0answers
60 views

Key strength comparison: symmetric key vs RSA/DH key

I came across different reputable sources quoting different equivalent symmetric key strengths for RSA/DH keys. This NIST paper (page 67) states the following offer corresponding security strenghts (...
1
vote
0answers
98 views

Generating a XOR Hash function for a given group of numbers to maximise collisions

Given $x$, a vector of $m$ distinct bit vectors of bit length $N$, I want to use an XOR-hash $h$ such that all $x_i$ collide to the same value. I define an XOR hash $h$ which takes bit vector $q$ as ...
0
votes
0answers
18 views

volume only saves files in clusters of 512 bytes, regardless of how large i select the cluster and format [closed]

I am experimenting clusters and formatting in veracrypt, and I have found that no matter how large or small I format the clusters in my veracrypt volumes, no matter how small the files I save, they ...
1
vote
0answers
75 views

Performing EdDSA/Ed448 employing Montgomery ladder

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...
0
votes
0answers
34 views

RSA encryption/decryption values not working as expected [duplicate]

I'm faced with an issue I can't seem to understand when it comes to RSA. Below are my values for all of the parameters, unfortunately I can't seem to get the expected decrypted values from my ...

15 30 50 per page
1
2 3 4 5
446