All Questions

Filter by
Sorted by
Tagged with
0 votes
1 answer
55 views

Why do we need nonce in the CTR mode given that Deterministic counter mode is semantically secure?

In the CTR mode, a nonce, a counter value and the key are needed to form the input of the PRF. However, the Deterministic counter mentioned in Dan Boneh's slides (https://crypto.stanford.edu/~dabo/...
user avatar
16 votes
4 answers
4k views

Is there a cryptographic algorithm that can make a "lottery ticket"?

With public-key cryptography, I know Alice can "seal" a message that only Bob can open. But in that case, Alice knows the message that she is sealing. What if Alice wants to seal a random ...
user avatar
  • 263
0 votes
0 answers
30 views

How to extract a stored password using side channel attack, from a python program binary which performs a simple hash matching [closed]

To prevent the attacker from obtaining the password, we compute the hash of the password provided by the user and the hash of the stored password. Here is an implementation of a simple hash function. <...
user avatar
  • 1
0 votes
0 answers
37 views

AES mode for decrypting a file in chunks

I have a use-case where I need to encrypt some binary data, which may not be 16 byte aligned, and save it for consumption later. When the data needs to be consumed, the encrypted data is sent over to ...
user avatar
  • 101
2 votes
0 answers
38 views

Are side-channels a concern for AEAD key commitment fixes?

I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
user avatar
0 votes
0 answers
21 views

AES with a different implementation [duplicate]

suggested a new implementation for AES:byte substitution step will be replaced by a function that cyclic shift of one bit to the right instead the regular implementation of AES. How does this change ...
user avatar
  • 1
2 votes
2 answers
150 views

ECCDH: direct or with temporary ECC keypairs?

I am moving from RSA to ECC for my application. Looking at these posts 1 2 3, they all suggest that Alice generates a temporary (ephemeral) ECC keypair eKP to send a message to Bob. The sessionkey sK ...
user avatar
0 votes
0 answers
41 views

Check if pubkey belongs to twisted Edwards25519

I want to check if some pubkey belongs to twisted edwards25519 (I guess this is used for ed25519 ?) The problem is that I have in theory some valid pubkeys like: ...
user avatar
  • 103
1 vote
2 answers
51 views

Vigenere Cipher Collision

I have been reading the book "Serious Cryptography" by Aumasson to begin learning about Cryptography. There was a part where the author suggested how encryption using permutation should have ...
user avatar
0 votes
1 answer
62 views

Is there a notion of information theoretic one-way function?

This is not a formal but intuitive concept of one-wayness. The intuition is that if you have a combinatorial object that requires $n$ bits to describe. A one way operation introduces noise in random ...
user avatar
0 votes
1 answer
49 views

False positive error rate of truncated hash match

I’m having difficulty calculating the false positive error probability of matching a prefix of a hash that was truncated to m bits. Say I have string S1 that produces a SHA256 hash H1. I then save the ...
user avatar
1 vote
1 answer
45 views

Help with clarification/definitions of Oblivious Transfer (OT) flavors

Recently I across this cryptographic library for Oblivious Transfers. In the README file I saw many OT flavors that I haven't seen before, more specifically the following : General OT Correlated OT ...
user avatar
  • 661
1 vote
1 answer
225 views

RSA signature with restricted range of $d$

My question is: Alice signs messages using RSA with a public key $(e,N)$ and a private key $d$. Alice chooses $d$ in the range $N^{0.25} < d < N^{0.5}$. What is the time needed for Alice to ...
user avatar
  • 11
1 vote
1 answer
52 views

How to encrypt in garbled circuits

I’ve read a lot of articles and a lot of questions here to understand how the encryption is done in garbled circuits. As I understand double encryption is to encrypt the gates and the truth table. The ...
user avatar
2 votes
1 answer
434 views

How can a root CA be kept offline and function

Based on many suggestions I have seen around, this, that.etc. Best practice says to keep the root CA offline for very understandable reasons. But how can it be truly offline? Doesn't the root ca have ...
user avatar
  • 21
4 votes
0 answers
93 views

Applications of ZK proofs without proof of knowledge?

With the appearance of cryptocurrencies several applications of ZK proofs were envisioned. However, to the best of my knowledge, all of these are proofs of knowledge. My question is: are there any ...
user avatar
  • 3,812
2 votes
1 answer
599 views

AES with a different implementation of byte substitution step

I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me: suggested a new implementation for AES: The byte substitution step will be ...
user avatar
  • 21
2 votes
1 answer
139 views

Where is the definition of one-way trap-door function used in public key cryptography

This is a rather simple question but I've been unable to find a proper answer for this online. When defining an asymmetric (public key) algorithm is the one-way trap-door function usage referring to ...
user avatar
0 votes
1 answer
66 views

Problem in finding the inverse element in modular arithmetic

I'm new to modular arithmetic but it still is something that I think is pure mathematics that I don't get. I have this problem 3 * d ≡ 1 mod 13. So I need to find ...
user avatar
  • 101
0 votes
1 answer
64 views

Seeking name of encryption algorithm

I found an algorithm described in my old math notes that I wanted to dive into further, but the name I noted is apparently completely wrong ("Bolson Adding"), so now I am trying to find the ...
user avatar
0 votes
2 answers
61 views

Is "The only way to confirm the absence of a transaction is to be aware of all transactions" proven?

I have read the Bitcoin paper and there is one statement that I would like to know if it is really proven ir not: The only way to confirm the absence of a transaction is to be aware of all ...
user avatar
0 votes
0 answers
44 views

Bruteforcing the discrete logarithm with a decomposable prime modulus

I came across an interesting challenge recently. I need to find x such as : $s=n^x \mod m$ We suppose we have $s, n$ and $m$. The modulus $m$ is prime and $n$ is a primitive root modulo $m$. The ...
user avatar
1 vote
1 answer
60 views

best encryption algorithm for encrypting a string

I am making a password manager , I am new to cryptography, so , can someone tell me if this can be a good solution? 1- the user inputs the email/password 2- all the payload gets encrypted with aes@...
user avatar
1 vote
1 answer
36 views

How do I calculate number of multiplication, exponential, and pairing operations in a cryptographic algorithm (signcryption/unsigncryption)?

I have been working on signcryption scheme and its security proof. I want to compute the efficiency in terms of number of scalar multiplication operation, number of exponential operations, and number ...
user avatar
  • 11
0 votes
1 answer
33 views

Would a consensus algorithm like the one I describe work?

Given n nodes(miners/validators), Every unspent transaction output is broadcasted to all n nodes. Each node will select a batch of transactions and add it to their block. The specific mechanism of ...
user avatar
7 votes
1 answer
384 views

Replacing Curve25519 with Ristretto255

Quoting Ristretto255 for the PHP Community, Ristretto255 is Ristretto defined over Curve25519, which allows cryptographers to extend the Ed25519 signature scheme to support complex zero-knowledge ...
user avatar
  • 2,775
1 vote
0 answers
25 views

Configuring entropy source for OpenSSL [closed]

I'm using OpenSSL 1.0.2 and FOM 2.16 and am trying to figure out a way to draw entropy from Intel (RDRAND/RDSEED) if it's available, and from the Linux OS (/dev/random or /dev/urandom) if it's not. ...
user avatar
  • 11
1 vote
0 answers
25 views

Are there any "hard lower bounds" to zero-knowledge proving space/time/commmunication complexity?

There is a lot of "retail investor" hype implying a zk revolution in the future where we have circuits for common instruction sets and many software backends are zk-proven. I'm wondering, ...
user avatar
1 vote
1 answer
47 views

Type 1 Trapdoor Sampling in LWE

In the BGN-like LWE cryptosystem, section $2.2$, we sample a $m \times m$ trapdoor matrix $T$ that is full rank such that $TA = 0 \pmod q$. Suppose that $q$ is prime so we are in a finite field: if $T$...
user avatar
0 votes
1 answer
48 views

GnuPG - provide encryption key for AES rather than deriving it from passphrase

I'd like to encrypt a file with AES256 and provide my own 32-bytes for the encryption, rather than having GPG derive it from the passphrase. I could not find such option, but I'm thinking about a ...
user avatar
2 votes
1 answer
197 views

In Schnorr identification protocol, what happens if the prover uses r+c+x or rx+c.. etc. rather than r+cx?

Consider the Schnorr identification protocol. Let $x$ be secret key, $u$ be public key, $r(\xleftarrow{$} \mathbb{Z}_q )$ be a random number with $u_r=g^r$ the commitment that prover uses at first ...
user avatar
4 votes
1 answer
147 views

Will a semi-hyperelliptic pairing be used in real-world cryptography if it is faster than state-of-the-art elliptic pairings?

Let $\mathbb{G}_1$, $\mathbb{G}_2$, $\mathbb{G}_T$ stand for three groups of the same large prime order $r$. I invented a pairing $e\!: \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T$ (with ...
user avatar
1 vote
1 answer
50 views

How should I interpret this definition of the Dolev Yao Closure?

Please see the image below which represents an algebraic definition of the Dolev Yao Closure. From reading around, it appears this is BAN logic and that the lines mean "If you believe the above ...
user avatar
  • 113
5 votes
1 answer
1k views

What does the modulo plus minus mean?

May someone please explain what the notations in the image means? In general, for a modulus $q$, what does the $+$ in here $\bmod^+ q$ indicate? What does the $\pm$ in here $\bmod^\pm q$ mean?
user avatar
2 votes
0 answers
56 views

Textbook RSA with $e=3$ and short random message

This is a simplified version of a question I made long ago, that never got an accepted answer. It's given $N$ of $n=2048$ bit, assumed hard to factor, which two prime factors each are $\equiv2\pmod3$, ...
user avatar
  • 125k
0 votes
0 answers
66 views

RSA with huge ciphertext

I am trying to find the flag from an RSA ciphertext, I am able to get the factors from factordb.com but the given e is not ...
user avatar
2 votes
0 answers
43 views

API design that maximizes the potential of parallel and tree hashing

Traditionally, hash functions are single-threaded, and have the 'Init-Update-Final' API style. This is true of MD5, SHA-1/2/3, BLAKE2, to name a few. However, there have been proposal of parallel hash ...
user avatar
  • 6,795
3 votes
1 answer
95 views

Groth'16 trapdoor for simulator

In the zero knowledge definition of the Groth16 scheme (https://eprint.iacr.org/2016/260.pdf) [Section 2.2], why would the simulator be allowed a trap-door in set up? The trap-door information ...
user avatar
  • 57
1 vote
1 answer
46 views

How to generate a SNARK arithmetic circuit for SHA256?

I am using zkSNARK to prove knowledge of preimage for SHA256. However, the library used only supports field operations (such as add and multiply), and it compiles down to arithmetic circuits. Thus, ...
user avatar
-1 votes
1 answer
100 views

AES vs Kuznechik (GOST R 34.12-2015) comparsion [closed]

Which algorithm is more crypto-resistant: AES or Kuznechik (GOST R 34.12-2015)?
user avatar
  • 109
0 votes
1 answer
34 views

Vector commitments using only symmetric cryptography

A vector commitment scheme is a scheme (dough!) that allows a prover to prove that $v_i$ is a component of a vector $v$ without revealing any other information about $v$ . (So the prover commits to $v$...
user avatar
0 votes
1 answer
50 views

Does TLS convert individual messages to ciphertext? If the network is breached, is the data exposed?

As far as I understand it, TLS creates a tunnel or channel or secure connection between the parties right? Where everything is protected? But hypothetically if the network gets breached, would the raw ...
user avatar
1 vote
1 answer
336 views

Why the definition of bilinearity property is different in cryptography compared to mathematics?

Background: In Wikipedia (bilinear map definition), a condition listed as the following: For any $\lambda \in F, {\displaystyle B(\lambda v,w)=B(v,\lambda w)=\lambda B(v,w)}$ In a ...
user avatar
1 vote
1 answer
73 views

Common applications and simple implementations of stream ciphers

I am learning about stream ciphers, which apparently are unpopular. I just want to have a better idea of some basic algorithms that are in use or were in use till recently. I checked: the OTP: ...
user avatar
2 votes
1 answer
147 views

Uniform rejection sampling by shifting or rotating bits from CSPRNG output, safe?

Given a CSPRNG (arc4random, using ChaCha20 keystream), one want to use rejection sampling to get random number on a smaller range avoiding modulo bias (arc4random_uniform()). OpenBSD's ...
user avatar
2 votes
1 answer
130 views

Breaking RSA with P,Q LSB bits

Let's say we have a certain amount of LSB bits of P and Q and we want to fully reconstruct them given N=P*Q. I know this problem was studied in literature by Coppersmith and that Lattice methods are ...
user avatar
  • 31
0 votes
1 answer
39 views

ChaCha Single-Use RNG with All Zero Plaintext + Nonce

I am creating an internal application that will be used to generate and manage self-signed certificates and certificate authorities. Its primary use will be for generating certificates used in SSL ...
user avatar
  • 145
1 vote
1 answer
42 views

How to break up plaintext for RSA?

Given a plaintext of length 20 over the latin alphabet {A, B, . . . , Z} and the RSA key (n, e) with n = 77. Find a way to break up the plaintext in as little as possible blocks of information, each ...
user avatar
  • 143
3 votes
1 answer
78 views

Quantifying the success probability of brute force attack against (search) LPN

I've been trying to learn about attacks on LPN ($n$-bit secret, noise rate $\eta$), and have found several allusions to a brute force algorithm that runs in time exponential in $n$ and requires a ...
user avatar
  • 33
1 vote
1 answer
22 views

Input-independence of base OT in OT extension

In [1], the authors state: [...] observe that unlike [32] the initial OT phase in Protocol 52 is completely independent of the actual inputs of the parties. Thus, the parties can perform the initial ...
user avatar
  • 21

15 30 50 per page