All Questions
29,526
questions
0
votes
0
answers
21
views
Nature of differentially private Laplace mechanisms
In the Wikipedia page on differential privacy, the section on $\varepsilon$-differential privacy for the Laplace mechanism says that the Laplace mechanism is specified for some output as $\mathcal{T}_{...
- 1
0
votes
0
answers
35
views
1
vote
1
answer
35
views
Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2
In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
- 11
1
vote
0
answers
72
views
Is it better to use PBKDF2 with SHA-512 and 1e6 iterations or SHA-256 and 6e6 iterations?
I'm implementing encryption in my browser extension that will allow users to encrypt their data and then share them with others. And since shared links can be leaked, I want to protect the data as ...
- 111
-1
votes
2
answers
107
views
Encrypt with private key decrypt with public key
I want to sign and transmit a short message, which contains a few simple hashes. My objective is not to prevent an attacker from inserting a fake message, but to ensure that the attacker cannot define ...
- 99
1
vote
0
answers
26
views
Function Secret Sharing
Bob has constructed a non-linear function $f: \mathbb{R}^n\rightarrow \mathbb{R}^m$ of moderate complexity (i.e., evaluation takes on the order of seconds on a modern computer). Is it possible to ...
- 11
0
votes
1
answer
49
views
Discrete Gaussian distribution on a lattice vs. the periodic Gaussian function on a lattice
Gaussian distribution on lattices generally seems esoteric (at least for me, for now). My question is:
Does Gaussian distribution on a lattice mean to add a Gaussian noise on a single point of a ...
- 347
2
votes
1
answer
69
views
Would encrypting several layers of a filesystem be a waste?
I've been thinking about ways to improve the security of my data stored and backed up using the "3-2-1" method.
Moreover by using several layers of encryption to encrypt and decrypt a ...
- 21
6
votes
0
answers
163
views
Who originally generated the elliptic curve now known as P256/secp256r1
Background: there is a theory going around that claims that P256 was backdoored by the NSA. The theory goes is that the NSA found a weakness that applies to a nontrivial fraction of elliptic curves (...
- 143k
0
votes
0
answers
82
views
How to "break" this PRF scheme?
I'm new to cryptography, and I'm working on exercises that involve "breaking" PRF schemes which involves writing a poly-time program that distinguishes between two particular programs, the ...
4
votes
0
answers
71
views
Masking countermeasures for AES-GCM
Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
- 327
0
votes
0
answers
18
views
Question on Aleo zkVM
Can we use array as the input of a transition/function? Just like:\
transition testarr(arr: [u32; 3]) {
}
I saw some tutorials that have examples of this but now ...
- 61
1
vote
3
answers
58
views
Zero-Knowledge Proof of Encryption with a Specific Key
Short version:
Given a hash of a plaintext, a public key, and a ciphertext (but not knowing the original plaintext), is there any way to verify that the ciphertext is the plaintext after being ...
- 111
2
votes
3
answers
479
views
Check if encrypted text is equal without decrypting or doing heavy calculation - AES
I implemented AES128-CBC algorithm and what I need is to be able to compare encrypted text without decrypting. Is the only way to use static or no iv to achieve this? . Any ideas?
Use in code -...
- 23
0
votes
0
answers
29
views
How IV value shapes the State Matrix of PHOTON AEAD?
In PHOTON-Beetle Authenticated Encryption algorithm, the state consists of 64 4-bit
elements, which is represented as a (8 × 8) matrix. The Initial Value which consists of Key and Nonce from the ...
1
vote
0
answers
45
views
Is the SNI extension signed in TLS 1.3?
In TLS 1.3, and since the server signs the entire handshake messages including the server hello message, in this case, is the SNI extension of the client hello message, is it included in the content ...
- 33
0
votes
0
answers
27
views
Interacting with Zksync sometimes returns an "invalid value for value.blockHash" error
I've been sometimes getting this error while interacting with zksync "invalid value.blockHash" and have been unable to find information about it elsewhere. What's curious to me is that it ...
2
votes
1
answer
132
views
Does using a block cipher in CBC mode *twice* result in an all-or-nothing transform (AONT)?
Use a block cipher in CBC mode with a public or all-0 key. Twice.
Wrapping the last block into (xor) the first on the second round.
Every block will depend on all previous and all successive blocks. ...
0
votes
0
answers
64
views
HMAC-SHA256 key length against key recovery attack
I have trouble finding information on the security strength of HMAC-SHA256 against key recovery attacks with respect to the key size.
To fit a certain application I must use a 128-bits key with a HMAC-...
0
votes
0
answers
47
views
Sagemath help: Introduction to Lattices
Hi im doing a problem from the Chapter Lightweight Introduction to Lattices in "Learning and Experiencing Cryptography with CrypTool and SageMath"
I'm curious if my implementation is wrong ...
- 1
0
votes
0
answers
37
views
2 XORed AES-ECB ciphertexts, zero key and piece of plaintext
I have $C_1 \oplus C_2$ where $C_1$ = $AES128_k(P_1)$ and $C_2$ = $AES128_k(P_2)$.
I know the k, it is 0 (i.e. 16 bytes of zeros).
I know the piece of $P_1$ (7 ...
- 1
0
votes
0
answers
11
views
what is (n, n’, δ, u) generalized BBS assumption？
This assumption appeared in the 2000 'timed commitment' to justify privacy in the scheme. But it is not known what the relevant symbols mean in this hypothesis.
0
votes
1
answer
37
views
On the exposition of SHA-1 attack (known_prefix + user_input + backend_secret)
In this question on sha1(known_prefix + user_input + backend_secret), an answer states that is realistically possible to find the first few bytes of ...
- 101
2
votes
1
answer
99
views
SHAKE256 XOF: Absorb incrementally vs all at once
I'm diving into SHAKE256's XOF (Extendable Output Function), and I've got a bit of a head-scratcher.
I'm wondering if there's any difference between incrementally absorbing bytes and absorbing ...
- 31
0
votes
1
answer
71
views
How secure is a file encrypted with GnuPG, a strong passphrase, and the symmetric option?
Suppose I encrypt a file, of, say, 10 MB, with a secure, suitable passphrase, and the command:
gpg --symmetric my_file.txt
What level of expertise and hardware ...
0
votes
0
answers
18
views
How to express the Boolean cardinality constraint to CNF formulas
A Boolean cardinality constraint
$$\sum_{j=0}^{n-1}x_j=k,$$
where $x_j$’s are Boolean
variables, and $k$ is a non-negative integer.
How to express the Boolean cardinality constraint to CNF formulas?
- 25
1
vote
1
answer
745
views
Extracting a secret from a SHA-1 hashing algorithm
Assuming there is a web service that returns the following to an unauthenticated user:
SHA-1(known_prefix + user_input + backend_secret)
where ...
- 113
0
votes
0
answers
33
views
Security Analysis: Adversary's Ability to Recover Concatenated and Hashed Secret with Partial String Knowledge
Suppose I have the following secret, calculated by concatenating and hashing the results of two random strings:
secret = H( H( random_string1 ) || H( random_string2 ) )
Let's assume that the adversary ...
0
votes
0
answers
77
views
Is it possible to uncover the plaintext if IV is used twice but the key is different?
I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.
Let's say I have the following:
IV which is reused
only 1 cipher text
authentication tag
...
- 101
0
votes
1
answer
63
views
Chacha20 key/nonce/counter correct usage
Setting all 48 ChaCha state bytes (key, nonce, initial counter) from one result of strong hash function like sha3-384 or blake2b - correct usage? or bad practice?
PS: using original chacha20 (8bytes ...
0
votes
0
answers
29
views
Definition of $\left(\epsilon,\delta,\gamma\right)$-Random Differential Privacy
$\left(\epsilon,\delta,\gamma\right)$-Random Differential Privacy as defined in rubenstein17:
$$\begin{align*}Pr\left[\forall S \subset \mathbb{R}, Pr\left(A(D) \in S\right) \leq e^{\epsilon} \cdot Pr\...
- 101
0
votes
1
answer
66
views
Trying to understand the basic principle of RSA from Wikipedia
Quote from https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Operation
A basic principle behind RSA is the observation that it is practical
to find three very large positive integers $e$, $d$, and $n$,...
- 103
0
votes
1
answer
67
views
Secret Sharing Floating point numbers in IEEE-754 Format
Various papers in the literature (such as https://eprint.iacr.org/2022/322.pdf, https://eprint.iacr.org/2013/850.pdf) use the sign, exponent, and significand values to additively secret share the ...
1
vote
1
answer
97
views
A RSA crypto CTF chanllenge with known private key ,cipher text and modules factor n
Here is a CTF chanllege about RSA(The competition has ended for serval hours),and here is the critical encryption code:
...
- 23
1
vote
0
answers
25
views
Efficient oblivous test of plaintext equality for pairs of sets
Suppose we have two sets of ElGamal cipher texts encrypted with the same public key $y$ in a prime order group:
$C_i = (g^{r_i}, a_i y^{r_i}) $ for $ i \in \{1 ... n\}$
and
$D_j = (g^{s_j}, b_j y^{s_i}...
- 21
0
votes
1
answer
39
views
Can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography?
Sorry, this is sort of a beginner question.
But providing that it is possible to find the same options, can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography ?
Let'...
- 103
0
votes
1
answer
56
views
Does BearSSL Library Support ECC Encryption/Decryption Functionality?
I'm researching cryptographic libraries for a project I'm working on, and I'm particularly interested in the BearSSL Library due to its lightweight nature. But I'm not sure if it supports ECC (...
- 1
0
votes
2
answers
88
views
ChaCha20-Poly1305 and AES-GCM-SIV output size
Background information:
I need to encrypt 168bit messages, the ciphertext should, preferably, match the plaintext size. Message Authentication and Integrity is not a must, but a really important ...
- 43
4
votes
1
answer
1k
views
Why do Mersenne Twister use Mersenne prime but not regular prime numbers
I'm trying to figure out why Mersenne Twister use exactly Mersenne prime numbers but not regular primes. What makes Mersenne prime numbers more appropriate for this role than regular primes?
- 207
0
votes
0
answers
55
views
Formula for deriving the x-coordinate using the y-coordinate (decompressing a compress public key)
According to my understanding a public key is made up of x and y coordinate and a compress public key is made up of the y-coordinate since it's possible to directly calculate the uncompress public key ...
- 31
1
vote
1
answer
85
views
Encryption scheme with variable and provable key-length
I'm currently studying the possibility of a novel ransomware technique, where an adversary instead of forcing the victim to pay a ransom, forces them to brute force a key of given length and thus ...
- 231
1
vote
2
answers
46
views
[Questions about a proof in the prelim of paper "Lattice-Based Zero-Knowledge Proofs and Applications"]
May I ask that in section 2.7 challenge space in the paper Lattice-Based Zero-Knowledge Proofs and Applications:
Shorter, Simpler, and More General
What is rot(c), why does rot(c) $\in Z^{d*d}$, and ...
- 173
0
votes
1
answer
95
views
Is there a counterpart of /dev/random and /dev/urandom in Windows NT systems?
I am trying to implement a TRNG on Windows and among other entropy sources, I want to extract raw bytes from various kinds of CPU and process info.
As per my knowledge, BCryptGenRandom is a CRNG in ...
0
votes
1
answer
46
views
Initial Permutation in DES
Why is the Initial Permutation Step necessary in DES? How does it strengthen the cipher since we are reversing the permutation in the output?
- 103
0
votes
0
answers
32
views
How by changing ciphertext can the attacker know the length of the padding in POODLE attack
I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
- 31
0
votes
0
answers
29
views
Generic encryption & decryption module - question regarding password stretching & salt
We want to implement an encryption / decryption module that we want to provide to different internal components of our system (internal library for internal components).
The component will provide (...
- 766
0
votes
1
answer
56
views
KangarooTwelve based Random-Access PRNG
Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?...
- 1
0
votes
0
answers
60
views
Distinct sequences in a Fibonacci LFSR
How many distinct sequences can a $128$-bit Fibonacci LFSR (considering $4$ taps set for the maximum period) generate? Will all $2^{128} - 1$ distinct seeds produce distinct sequences?
Also, let's say ...
1
vote
1
answer
37
views
Amplifying the completeness and soundness of a proof scheme
A (interactive) proof system for a language $\mathcal{L}$ is defined by two algorithms $\mathcal{P}$, a prover, and $\mathcal{V}$, an efficient verifier, with the following requirements:
Completeness:...
- 445
1
vote
1
answer
48
views
DDT for boolean functions must contain only powers of two
I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
