All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
4 views

Is there any trapdoor that can solve elliptic curve subgroup membership problem?

Given an elliptic curve $E$ over a finite field q(q is a prime), and $<G>$, the cyclic subgroup of $E$, where G is the generator. Is there any trapdoor $T$, that given a random group element $P\...
1
vote
0answers
25 views

Why is a hash function required for building Public Key Encryption from a Trap Door Function

This is from Dan Boneh's Coursera Lectures - Week 6 - Constructions. https://www.coursera.org/learn/crypto/lecture/nTRhL/constructions Here he picks a random x from X. And then Hashes X to get the ...
0
votes
1answer
36 views

Security of ChaCha compared to AES and Serpent

I'm trying to understand how secure XChaCha20 is in comparison with other ciphers. From what I know, ChaCha is more secure than AES, but less secure than Serpent. My question is how much more "...
0
votes
0answers
26 views

Execute 1 AES block

I'm working in a cipher and decipher project with a third party. They send us a ciphered file and I need to decipher that file, we are the owner of the key and have a need to know the IV. So, they are ...
0
votes
0answers
19 views

Recommended length for a nonce in hashed-based authentication

Considering the following variation of the SKID3 protocol (1) $A \rightarrow B: r_A$ (2) $B \rightarrow A: r_B || \operatorname{MAC}(r_B||r_A||A)$ (3) $A \rightarrow B: \operatorname{MAC}(r_B||r_A||B)$...
0
votes
0answers
21 views

Evaluate the time of Paillier decryption

If I have a 4kbyte of Paillier encrypted data. How can I know the time taken to decrypt this 4kbyte ?
0
votes
1answer
28 views

Message length in XMSS

I read that XMSS generates many private keys and one key must sign only one message. Does it mean though that I sign many different messages, or do I sign one message, which, if its longer than 256bit,...
1
vote
0answers
36 views

Does this describe an invalid key share attack?

I recently came across a mention of invalid key share attacks on this site. It is done with DH groups over $\mathbb{ℤ}_p$ :prime $p$, where $p = qh + 1$, where $q$ is the prime order of DH subgroup ...
8
votes
0answers
33 views

Do CCM and EAX provide key commitment?

In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
0
votes
0answers
18 views

SHA512/256 Round Calculation [closed]

I'm trying to calculate the first round of initialized hash value "H" in SHA2-512/256 Which will be as "A" in the Next Round. As this Document says the "H" value will be ...
1
vote
1answer
116 views

Using authenticated encryption along with signing

I know of a project that implemented e2e encryption using both authenticated encryption and public key signing. So the ciphertext produced for a message would be: ...
6
votes
1answer
639 views

Outlook of trustworthiness of SHA-2

On the Wikipedia page of SHA-2, the following is written: Currently, the best public attacks break preimage resistance for 52 out of 64 rounds of SHA-256 or 57 out of 80 rounds of SHA-512, and ...
2
votes
1answer
63 views

Key Committing AEADs

There are multi-key attacks against some AEADs. In other words, multiple keys can be used to decrypt a message since multiple keys can be valid for an authentication tag. How would one go about adding ...
0
votes
1answer
38 views

Modular equation system

I have $N=p\cdot q$ and the following system where I know $A,B,C,D, k$: $$A = B \cdot q^k \pmod N$$ and $$C = D \cdot p^k \pmod N$$ Is there an easy way to recover $p$ and $q$?
0
votes
1answer
40 views

Making a secure file sharing scheme usable

I am trying to realize a secure file sharing scheme based on asymmetric crypto. Users will access this via browser. In short, it works like this: Users register and set their username and password. ...
0
votes
0answers
19 views

Is there a LPN estimator like LWE?

I recently studied the LPN problem and BKW algorithm for solving LPN problem. Several papers deal with the concrete parameters of LPN to be secure against BKW algorithm, but I cannot measure the ...
0
votes
0answers
12 views

How an ID based encryption system simplified certificate management in e-mail systems?

I was reading a paper on Identity Based Signature. A line in it reads: The original motivation to build an encryption system based on ID was to simplify certificate management in e-mail systems. Can ...
1
vote
1answer
39 views

Why should a distribution being pseudorandom strictly be a sequence of distributions being pseudorandom

According to Katz Lindell book, Let Dist be a distribution on l-bit strings. Informally, Dist is pseudorandom if the experiment in which a string is sampled from Dist is indistinguishable from the ...
-1
votes
0answers
20 views

Diffie Hellman protocol connect to DES [closed]

I have working Diffie Hellman protocol, it works fine on ports and randomly generated P, G, A. And I need to connect DES key to this Secret Key from DH. My DES file works like this: Type name of the ...
0
votes
0answers
24 views

Deterministic generation of secure private keys from parent private key

is it possible to generate set of child private keys from one parent private key, generated by ECC for example, securely? So that new private key (and derive public key) could be used for encryption ...
1
vote
1answer
50 views

Need help to understand this RSA common modulus attack Python code

I am reading Practical Cryptography in Python. I have problem understanding the common_modulus_decrypt() function. I think the prerequisite of RSA Common Modulus Attack is that two public exponents ...
1
vote
1answer
34 views

Can we build two messages with same MD5 but different size? [duplicate]

Can we build two messages with same MD5 but different size? I researched MD5 collisions, but everything I found targets messages of the same size.
1
vote
1answer
69 views

What encryption mode should I use to protect CAN bus communication?

I have a CAN bus project and I should encrypt the communication between nodes using the AES algorithm. Which encryption mode should I use?
1
vote
1answer
35 views

Why this function isn't preimage resistant?

Prove that the function $$ G(z) = \mathcal{H}(z) \, || \, \text{LSB}(z) $$ (where $\mathcal{H}$ is a collision resistant hash function, $||$ is concatenation and $\text{LBS}$ is the least significant ...
1
vote
1answer
39 views

Significance of parameter q in NTRU lattice attack

In NTRU (N,p,q,d), N is usually chosen to be prime and q be a power of 2. Why is it that if I increase the parameter q, the probability of finding a key or spurious key that can decrypt the message is ...
0
votes
2answers
35 views

Question about SSH host key algorithms

I'm currently writing a report for my Master's degree on the SSH protocol. Quite interesting! However I'm having trouble getting into the inner workings of the host key algorithms. For example, ...
1
vote
0answers
23 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
2
votes
0answers
33 views

How reliable is sagecipher?

Recently I found the sagecipher project, which uses ssh-agent's signing operation as a way to produce a symmetric key and encrypt data with it. It appears to work with ssh-ed25519 keys, but my ...
0
votes
0answers
22 views

In RSA, what happens if the plaintext $m$ is not coprime to $n$? [duplicate]

Coming from the Wikipedia page on RSA, I think I understand the following: RSA is based on generating an integer $n$ as the product of two large primes, $p$ and $q$, and encryption/decryption ...
2
votes
1answer
59 views

Proof of the Diffie-Hellman Key Exchange

Could someone please provide the math proof; $$ ((g^a)\bmod p)^b \bmod p = ((g^b)\bmod p)^a \bmod p $$
0
votes
0answers
27 views

Decrypting RSA which has no inverse? [duplicate]

Is there any way to decrypt RSA ciphertext $c = m^e \bmod n$ when $\gcd(p-1,e) > 1$?
2
votes
1answer
26 views

What language classes beyond NP allow constant-round zero-knowledge proofs?

While discussing proving a language in $\Sigma_2$ from a client to a server with a friend we realized that while we know that such a language is provable in zero-knowledge, we didn't know whether it ...
2
votes
0answers
20 views

NTRU HPS98 vs NTRU-HRSS-KEM vs new NTRU

What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation? Round 1 - ...
0
votes
1answer
34 views

Is this zero knowledge protocol for honest verifiers?

Assume the zero knowledge protocol where the prover knows a $x$ such that: $g^x = h \pmod{p}$. The prover chooses a random $t \in \mathbb{Z}^*_m$ and sends $y = g^t \pmod{p}$ The verifier sends ...
0
votes
1answer
54 views

Discrete logarithm with 2 solutions? A clarification request

I need some clarification on the discrete logarithm problem... When a friend and I were solving for the discrete logarithm problem of 9 = 2 ^ x mod 11, we got two ...
0
votes
0answers
24 views

Is overflow-ing possible in CKKS FHE scheme?

I'm using the CKKS Fully homomorphic scheme using Microsoft SEAL, and wonder what will be the result of overflowing a certain floating point variable? Is it even possible to do so? I found a statement ...
2
votes
1answer
45 views

AES-128/CTR/NoPadding HMAC vs Signature

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with an HMAC or Digital Signature (SHA256withRSA)...
0
votes
1answer
21 views

Do you need both client and server side support for TLS 1.3 record padding?

When you enable record padding for a client, does a server need a specific option to support this? Or does the other end only need to support TLS 1.3 as well and can handle the padding automatically?
0
votes
0answers
15 views

PQC: XMSS L-Trees

I understand how WOTS+ signing works, I create a secret key and put it into leaves of my binary tree and hash it with some random values in the binary tree with my chaining function until the root is ...
0
votes
1answer
24 views

Winternitz Parameter in WOTS+ and XMSS

What is the parameter for? I read that in XMSS it is a member of the set {4, 16} but what does it exactly mean? I also read that the bigger the w parameter, the shorter the signatures but the keygen, ...
0
votes
1answer
55 views

What is the public key length of RSA and Ed25519?

I have made some research but doesn't understand fully: In this link, it says ed25519 has a length of 64 characters. Questions: Is this base64 encoded characters? And does ed25519 limit to only 64 ...
0
votes
0answers
20 views

How GGH/HNF public key cryptosystem encryption process works

I'm reading paper Lattice based cryptography which at section 5 page 14 it describes GGH\HNF scheme that i can not quite get it and i need help. The private key is a “good” lattice basis $B$. ...
0
votes
0answers
29 views

How to use TPM for key management [closed]

I have read about TPM that these are the secured ways of storing cryptographic keys. I want to know how can I use it. I have an application running on a PC which has TPM. This application has hard ...
6
votes
1answer
188 views

Curve25519 Key Validation

According to the original paper of Bernstein, there is no key validation needed when using Curve25519 for Diffie-Hellman Key Exchange. However, where does this property come from? Is there any proof ...
0
votes
0answers
20 views

Is there a secure way of allowing users of my app to selectively share data from an external service?

Is there a secure way of allowing users of my app to selectively share data from an external service with my app? In order for the users of my app to get their personal data from the external service ...
1
vote
1answer
62 views
+50

Finding the private key for this signature scheme

Assume the signature scheme where $x$ is the private key and the public key $y = g^x \pmod{p}$. The signature works as: Choose $h \in \{0, \dots, p-2 \}$ s.t.: $\mathcal{H}(m) + x + h \equiv 0 \pmod{...
-1
votes
0answers
26 views

How does this algorithm work? ( SHA-2 as its core function) [closed]

Given the following customed hashing algorithm, which uses SHA-2 as its core function [F], it is proven that 2 main hash characteristics 1) One Way Hash and 2) Collision Resistance can be compromised ...
1
vote
2answers
104 views

How long would it take all of the supercomputers or cloud computing on Earth to bruteforce a significantly long password?

I was arguing with a colleague who thinks that SHA256 (password + 64 character static salt) is "insecure." My argument is that nothing in cryptography is "secure," it's all a ...
0
votes
0answers
7 views

How is the second digram a legal mapping? (Playfair Cipher)

So this is a partly completed key I have: _ R _ _ _ _ T _ _ _ _ _ H _ _ _ _ L _ _ _ P _ _ W And this is my plaintext/ciphertext: ...
1
vote
0answers
64 views

Converting a point in a finite field to its real (x, y) coordinate [closed]

Let curve $A: y^2 = x^3 + 7$ and curve $B: y^2 \equiv x^3 + 7 \pmod{p}$ Curve $B$ is secp256k1, assume the usual parameters for that curve. Let $k$ be any private key, and compute the corresponding ...

15 30 50 per page
1
2 3 4 5
475