# All Questions

27,478 questions
Filter by
Sorted by
Tagged with
55 views

### Why do we need nonce in the CTR mode given that Deterministic counter mode is semantically secure?

In the CTR mode, a nonce, a counter value and the key are needed to form the input of the PRF. However, the Deterministic counter mentioned in Dan Boneh's slides (https://crypto.stanford.edu/~dabo/...
4k views

### Is there a cryptographic algorithm that can make a "lottery ticket"?

With public-key cryptography, I know Alice can "seal" a message that only Bob can open. But in that case, Alice knows the message that she is sealing. What if Alice wants to seal a random ...
• 263
30 views

### How to extract a stored password using side channel attack, from a python program binary which performs a simple hash matching [closed]

To prevent the attacker from obtaining the password, we compute the hash of the password provided by the user and the hash of the stored password. Here is an implementation of a simple hash function. <...
37 views

### AES mode for decrypting a file in chunks

I have a use-case where I need to encrypt some binary data, which may not be 16 byte aligned, and save it for consumption later. When the data needs to be consumed, the encrypted data is sent over to ...
• 101
38 views

### Are side-channels a concern for AEAD key commitment fixes?

I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
21 views

### AES with a different implementation [duplicate]

suggested a new implementation for AES:byte substitution step will be replaced by a function that cyclic shift of one bit to the right instead the regular implementation of AES. How does this change ...
150 views

### ECCDH: direct or with temporary ECC keypairs?

I am moving from RSA to ECC for my application. Looking at these posts 1 2 3, they all suggest that Alice generates a temporary (ephemeral) ECC keypair eKP to send a message to Bob. The sessionkey sK ...
41 views

### Check if pubkey belongs to twisted Edwards25519

I want to check if some pubkey belongs to twisted edwards25519 (I guess this is used for ed25519 ?) The problem is that I have in theory some valid pubkeys like: ...
• 103
1 vote
51 views

### Vigenere Cipher Collision

I have been reading the book "Serious Cryptography" by Aumasson to begin learning about Cryptography. There was a part where the author suggested how encryption using permutation should have ...
62 views

### Is there a notion of information theoretic one-way function?

This is not a formal but intuitive concept of one-wayness. The intuition is that if you have a combinatorial object that requires $n$ bits to describe. A one way operation introduces noise in random ...
49 views

### False positive error rate of truncated hash match

I’m having difficulty calculating the false positive error probability of matching a prefix of a hash that was truncated to m bits. Say I have string S1 that produces a SHA256 hash H1. I then save the ...
1 vote
45 views

### Help with clarification/definitions of Oblivious Transfer (OT) flavors

Recently I across this cryptographic library for Oblivious Transfers. In the README file I saw many OT flavors that I haven't seen before, more specifically the following : General OT Correlated OT ...
• 661
1 vote
225 views

### RSA signature with restricted range of $d$

My question is: Alice signs messages using RSA with a public key $(e,N)$ and a private key $d$. Alice chooses $d$ in the range $N^{0.25} < d < N^{0.5}$. What is the time needed for Alice to ...
• 11
1 vote
52 views

### How to encrypt in garbled circuits

I’ve read a lot of articles and a lot of questions here to understand how the encryption is done in garbled circuits. As I understand double encryption is to encrypt the gates and the truth table. The ...
434 views

### How can a root CA be kept offline and function

Based on many suggestions I have seen around, this, that.etc. Best practice says to keep the root CA offline for very understandable reasons. But how can it be truly offline? Doesn't the root ca have ...
• 21
93 views

### Applications of ZK proofs without proof of knowledge?

With the appearance of cryptocurrencies several applications of ZK proofs were envisioned. However, to the best of my knowledge, all of these are proofs of knowledge. My question is: are there any ...
• 3,812
599 views

### AES with a different implementation of byte substitution step

I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me: suggested a new implementation for AES: The byte substitution step will be ...
• 21
139 views

### Where is the definition of one-way trap-door function used in public key cryptography

This is a rather simple question but I've been unable to find a proper answer for this online. When defining an asymmetric (public key) algorithm is the one-way trap-door function usage referring to ...
66 views

### Problem in finding the inverse element in modular arithmetic

I'm new to modular arithmetic but it still is something that I think is pure mathematics that I don't get. I have this problem 3 * d ≡ 1 mod 13. So I need to find ...
• 101
64 views

### Seeking name of encryption algorithm

I found an algorithm described in my old math notes that I wanted to dive into further, but the name I noted is apparently completely wrong ("Bolson Adding"), so now I am trying to find the ...
• 101
61 views

### Is "The only way to confirm the absence of a transaction is to be aware of all transactions" proven?

I have read the Bitcoin paper and there is one statement that I would like to know if it is really proven ir not: The only way to confirm the absence of a transaction is to be aware of all ...
44 views

### Bruteforcing the discrete logarithm with a decomposable prime modulus

I came across an interesting challenge recently. I need to find x such as : $s=n^x \mod m$ We suppose we have $s, n$ and $m$. The modulus $m$ is prime and $n$ is a primitive root modulo $m$. The ...
1 vote
60 views

### best encryption algorithm for encrypting a string

I am making a password manager , I am new to cryptography, so , can someone tell me if this can be a good solution? 1- the user inputs the email/password 2- all the payload gets encrypted with aes@...
1 vote
36 views

### How do I calculate number of multiplication, exponential, and pairing operations in a cryptographic algorithm (signcryption/unsigncryption)?

I have been working on signcryption scheme and its security proof. I want to compute the efficiency in terms of number of scalar multiplication operation, number of exponential operations, and number ...
• 11
33 views

### Would a consensus algorithm like the one I describe work?

Given n nodes(miners/validators), Every unspent transaction output is broadcasted to all n nodes. Each node will select a batch of transactions and add it to their block. The specific mechanism of ...
384 views

### Replacing Curve25519 with Ristretto255

Quoting Ristretto255 for the PHP Community, Ristretto255 is Ristretto defined over Curve25519, which allows cryptographers to extend the Ed25519 signature scheme to support complex zero-knowledge ...
• 2,775
1 vote
25 views

### Configuring entropy source for OpenSSL [closed]

I'm using OpenSSL 1.0.2 and FOM 2.16 and am trying to figure out a way to draw entropy from Intel (RDRAND/RDSEED) if it's available, and from the Linux OS (/dev/random or /dev/urandom) if it's not. ...
• 11
1 vote
25 views

### Are there any "hard lower bounds" to zero-knowledge proving space/time/commmunication complexity?

There is a lot of "retail investor" hype implying a zk revolution in the future where we have circuits for common instruction sets and many software backends are zk-proven. I'm wondering, ...
• 11
1 vote
47 views

### Type 1 Trapdoor Sampling in LWE

In the BGN-like LWE cryptosystem, section $2.2$, we sample a $m \times m$ trapdoor matrix $T$ that is full rank such that $TA = 0 \pmod q$. Suppose that $q$ is prime so we are in a finite field: if $T$...
48 views

### GnuPG - provide encryption key for AES rather than deriving it from passphrase

I'd like to encrypt a file with AES256 and provide my own 32-bytes for the encryption, rather than having GPG derive it from the passphrase. I could not find such option, but I'm thinking about a ...
197 views

• 33
1 vote