# All Questions

30,435 questions
Filter by
Sorted by
Tagged with
1 vote
78 views

### Why is perfect secrecy defined under a ciphertext-only threat model?

I recently acquired Katz & Lindell's Introduction to modern cryptography (3d edition). Currently I'm on page 27 where we have the following definition: Definition 2.3: An encryption scheme (Gen, ...
• 128
127 views

### How do I generate a sequence of numbers with unpredictable differences

This question relates to bit flip attacks on OTP encrypted messages. Lets say I've got a list of numbers from 0 to 2^24-1 I want to re-order the list so it has the following property: If you start at ...
• 141
26 views

I have a question regarding the padding oracle attack. When I search the Internet the attack it seems that everyone has the same way of performing it. We learned another way in class and I try to ...
1 vote
46 views

### Is this procedural code correct description of g is a primitive root module of p?

I am a web developer with only high school level knowledge of math. I wanted to understand how TLS 1.3 is better than TLS 1.2. Along the way, I bumped into the concept of Diffie Hellman Key Exchange ...
• 115
1 vote
53 views

### Do one-way functions imply target collision resistance?

I'm reading the paper: One-Way Functions are Necessary and Sufficient for Secure Signatures, by John Rompel, which gives answer to the question in the title; but I'm confused about these sketched ...
1 vote
68 views

### Is it possible to use Diffie-Hellman protocol for symmetric group?

I was asked this question during one of my first cryptography classes, and I'm not sure if I understand it correctly. To begin, I know that after using the Diffie-Hellman protocol (which itself is ...
1 vote
32 views

135 views

### Key Exhaustion Risks in Symmetric and Asymmetric Cryptography

For the symetric keys it is recommend that the same key should not be used to encrypt large number(2^32) of cipher blocks to avoid the key-exhaustion risk. Curious to know whether the asymmetric key ...
• 123
42 views

### How does the Functionality know whether a sender/receiver is malicious?

I am new to the field of MPC and I'm trying to learn VOLE. I can understand the maths in functionality and protocols but can't get a sense of the security implications behind them. For instance, I was ...
• 21
37 views

### How to attack the shuffling of correlated numbers?

Suppose I have a function that accepts vector input $x$ and outputs vector $y=f(x)$. I want to protect the output $y$ through shuffling numbers in it. I hope the shuffling can confuse the attacker by ...
24 views

### How to implement a SKE scheme supporting single-message multi-ciphertext using LowMC and GMW?

I currently have a LowMC scheme and a GMW scheme. How can I implement a symmetric encryption scheme that supports single-message multi-ciphertext? In simple terms, I want to implement a protocol like ...
• 11
190 views

### Is the cryptography scheme over lattice still secure？ [duplicate]

In https://eprint.iacr.org/2024/555, the author proposed a quantum algorithm to solve LWE problem. How serious is its impact on the existing scheme over lattice.
20 views

### Reduction For MAC systems

I am not too knowledgeable regarding reductions for message authentication code encryption. Here is an example I found: There is a MAC' based on a preliminary existing MAC as such: MAC'(k, m) = MAC(k,...
• 21
25 views

### User-friendly tutorial In JohnTheRipper (JtR) for beginners? [closed]

I have been struggling to understand the format in JtR. I am a pentesting student and trying to do a customized wordlist rule. How do you dictate the order of the password. like how do you tell the ...
10k views

### Polynomial-time Quantum Algorithms for Lattice Problems

A new paper, by Yilei Chen, whose title is Quantum Algorithms for Lattice Problems (https://eprint.iacr.org/2024/555) appeared on eprint and it claims to solve hard lattice problems, such as the ...
1 vote
98 views

### Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c))$ used multiple times with low bit keys $k$. Avoids MitmA?

More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a Xor key obfuscation $k'$ with ...
• 453
58 views

### wrting algorithm for torsion group elements

Yesterday,I took an exam. There are two questions I received very low points. I will write the first question in this post. The question says let $E:y^2:x^3+kx+1$ in GF(p) be an elliptic curve where p ...
1 vote
45 views

### Can two different AES keys have the KCV by chance?

I am trying to check KCVs of a few keys. I am generating the KCV for the keys using the method mentioned here https://crypto.stackexchange.com/a/11873/115990 Question: Can KCVs of two different AES ...
• 113
63 views

### Lightweight length preserving encryption

I'm in need of an encryption algorithm that can be easily implemented in c, doesn't drastically increase the size of the encrypted data (the data to be encrypted will be approximately 200 bytes and ...
1 vote
75 views

### In x25519kyber768 what is the use of the server kyber keys if only the client public kyber key is used for encapsulation in kem?

In x25519kyber768 what is the use of the server kyber keys if only the client public kyber key is used for encapsulation of the kyber shared secret in kem?
1 vote
38 views

### Is it possible to compute the X25519 scalar multiplication of the SSH key exchange using the ED25519 sliding window implementation?

There are many different ED25519/Curve25519/X25519 implementations around. I focus on two of them: https://github.com/jedisct1/libsodium https://github.com/floodyberry/ed25519-donna The libsodium ...
• 156
1 vote
112 views

### What is the purpose of making salted passwords public?

So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
59 views

### How does MixColumn collapse 4 active S-boxes into 1?

In AES Proposal: Rijndael, page 34, there is the following figure with MixColumn transformation pattern for two columns: I'm trying to reproduce these paterns. The pattern in the column marked in ...
1 vote
64 views

### Is it possible to homomorphically evaluate an encryption circuit?

I know that it is possible to homomorphically evaluate a decryption circuit as it is the main idea behind bootstrapping, but I was wondering if it was possible to evaluate an encryption circuit ...
42 views

### Vulnerabilities of a word-level substitution cipher

What kind of attacks would be possible against this kind of substitution cipher? Every word in the plaintext is to be replaced with a random string of the same length The encryption of any given word ...
1 vote
74 views

### Is there a in-depth paper published about the Cloudflare's Lavarand and their CSPRNG?

I am diving into Cloudflare's Lavarand and its Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) [1]. Does anyone know of any comprehensive papers or documentation that provide an in-...
1 vote
29 views

### On public coin zero knowledge protocols

Goldwasser and Sipser proved that a private coin interactive proof system can be converted into a public coin system. This conversion preserves round complexity (up to an additive factor of 2), but ...
1 vote
57 views

### What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?

I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in Small sub group ...
3k views

### What is better source of random bytes: Yubikey or /dev/random (or both)? [closed]

Let's say I need to generate a key, I have these three options as to where to get random data: Yubikey (gpg-connect-agent 'SCD RANDOM 16384' /bye) ...
• 151
1 vote
87 views

Given a MAC secure scheme $(\text{Gen}, \text{Mac}, \text{Vrfy})$, a new scheme is suggested: $\text{Gen}' \rightarrow \text{Gen} = (pk_1, sk_1), \text{Gen} = (pk_2,sk_2)$ $\text{Mac}'(m) = (\text{... 1 vote 0 answers 38 views ### CRYSTAL-KYBER for Cloud-native storage [duplicate] I'm trying to use CRYSTAL-KYBER encryption to protect Cloud-native storage against both normal and quantum attacks. I've read Cloud-native-security-whitepaper and found out that ... • 51 0 votes 0 answers 65 views ### Why do we use elliptic curves instead of just the discrete logarithm problem? We have a cyclic field Fp where p is a prime number, a generator g, and an order n. A generator is an element such that$g^n=1$. A random number x has been chosen as the private key, selected from the ... • 101 2 votes 2 answers 95 views ### What does the leftover hash lemma guarantee for a specific hash function? Suppose I sample a matrix$h$from$\mathbb{Z}_2^{l \times n}$where each entry in$h$is$1$with probability 1/2. Suppose I also have a set$S\subset \{0,1\}^n$, and I define a random variable$X$... • 121 0 votes 0 answers 4 views ### Why I need to pass Secure Random when I am loading the key from PKCS8 format [migrated] I am using Ring lib in Rust to generate ECDSA_P256 and I am passing SystemRandom, and I am getting PKCS8 key pair format. Until ... 1 vote 0 answers 26 views ### Security of RSW96 Timelock puzzles I am looking to implement Time lock puzzles in a toy project I'm working on. I found this very elegant paper from Rivest et at. describing a technique for time lock puzzles. I'm wondering if the ... 0 votes 0 answers 18 views ### Differential Privacy: when the tokenizer is related to the dataset So I want to train a model with DP-SGD. However, I noticed that by how my input dataset is constructed, the tokenizer is actually related to the input data. (e.g., picking out a sample may affect how ... 2 votes 1 answer 119 views ### Confused about use of Euler totient function in RSA I'm reading a book and I arrived at the part that explains 'textbook' RSA. It explains that given a modulus$n=pq$and public exponent$e$that we can encrypt$x \in \mathbb{Z}^{*}_n$by setting$y=x^...
• 128
1 vote
My question is regarding a well-known protocol for computing the multiplicative inverse of a nonzero secret-shared field element. Given $[x]$, the parties generate shares $[r]$ of a uniformly random ...