All Questions

Filter by
Sorted by
Tagged with
1 vote
1 answer
78 views

Why is perfect secrecy defined under a ciphertext-only threat model?

I recently acquired Katz & Lindell's Introduction to modern cryptography (3d edition). Currently I'm on page 27 where we have the following definition: Definition 2.3: An encryption scheme (Gen, ...
Mr. B's user avatar
  • 128
2 votes
1 answer
127 views

How do I generate a sequence of numbers with unpredictable differences

This question relates to bit flip attacks on OTP encrypted messages. Lets say I've got a list of numbers from 0 to 2^24-1 I want to re-order the list so it has the following property: If you start at ...
Drew's user avatar
  • 141
-1 votes
0 answers
26 views

Padding oracle attack with known padding length

I have a question regarding the padding oracle attack. When I search the Internet the attack it seems that everyone has the same way of performing it. We learned another way in class and I try to ...
katibthemathematician's user avatar
1 vote
2 answers
46 views

Is this procedural code correct description of `g is a primitive root module of p`?

I am a web developer with only high school level knowledge of math. I wanted to understand how TLS 1.3 is better than TLS 1.2. Along the way, I bumped into the concept of Diffie Hellman Key Exchange ...
learningtech's user avatar
1 vote
0 answers
53 views

Do one-way functions imply target collision resistance?

I'm reading the paper: One-Way Functions are Necessary and Sufficient for Secure Signatures, by John Rompel, which gives answer to the question in the title; but I'm confused about these sketched ...
Zijun Zhuang's user avatar
1 vote
1 answer
68 views

Is it possible to use Diffie-Hellman protocol for symmetric group?

I was asked this question during one of my first cryptography classes, and I'm not sure if I understand it correctly. To begin, I know that after using the Diffie-Hellman protocol (which itself is ...
karolajoj_PL's user avatar
1 vote
0 answers
32 views

Should not we eliminate $\pm 1$ from $\mathbb{Z}^\times_N$ in RSA accumulators?

RSA accumulator is an authenticated set built from cryptographic assumptions in hidden-order groups such as $\mathbb{Z}^\times_N$. Any set $S=\{e_1,e_2,\ldots,e_n\}$ can be commited via a commitment $...
Somudro Gupto's user avatar
1 vote
0 answers
131 views

Need help with Cryptohack's ProSign 3 ECDSA problem [closed]

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
YazeedAllabadi24's user avatar
0 votes
2 answers
67 views

How can LCG based stream ciphers be broken?

I'm watching Christoph Paar's Introduction to Cryptography lecture series on youtube. In it he describes an example of an insecure stream cipher which uses XOR as the encryption and decryption ...
Nick's user avatar
  • 111
1 vote
1 answer
72 views

Why is zero knowledge defined via simulation w.r.t. inputs *in* the language?

In every definition of zero-knowledge (ZK) proof systems that I have seen (see, e.g., this one on Wikipedia, or this primer by Goldreich), a proof system $\langle p, v \rangle$ for a language $L$ is ...
Lewis Hammond's user avatar
2 votes
1 answer
81 views

Proving DES complementation property: y = DES(k,x) ⟹ /y = DES(/k, /x)

Below is my proof for this. I was not sure if this is correct and was also a little confused regarding the complementarity property of DES. Does this property mean there is a serious vulnerability in ...
sangaCat's user avatar
0 votes
0 answers
28 views

I want to find the Zero Value Points on SECP256R1 curve... Is there an alternative to Chien's method of finding roots over large Finite Fields?

This PDF explains that on certain elliptic curves, there exists ZVP (Zero Value Points) that cause zero value registers during the scalar-to-point multiplication (i.e during the double operation or ...
Cyth's user avatar
  • 1
1 vote
0 answers
53 views

Zero knowledge proof of a linear expression in the exponent [closed]

Alice sends to Bob a value $B$ in $\mathbb{G}$ a group of high order. There are distinct elements $h_1$ and $h_2$ of high order of $\mathbb{G}$, and Alice wants to prove to Bob that she knows some ...
Adam54's user avatar
  • 261
0 votes
0 answers
40 views

Reaching the bound of Boneh and Durfee Attack

According to the paper, theoretically,we can get $\delta=0.292 \lt 1-\frac{1}{\sqrt{2}}$,but how to set the lattice and implement it in sagemath? I generated some data by ...
Cred Mao's user avatar
0 votes
0 answers
40 views

Proving Insecure Hash Function Through Not Collision Resistant

There is a function H : {0, 1}* → {0, 1}^n. On input a message m and two shares of it x, w such that m = x ⊕ w, the function outputs y = H(m) = H(x) ⊕ H(w). How would I find that this NOT a collision ...
sangaCat's user avatar
0 votes
0 answers
56 views

Difficulty of factoring large semiprime N if given a second value y = (p-1)*r, where r is a random large prime?

Lets say we have 2 public values: N and y $$ N = pq $$ $$ y = r(p-1) $$ Where p, q, and r are large primes, are different, have a large distance between them and are kept secret. I have three ...
block103's user avatar
0 votes
0 answers
31 views

Key recovery attack on BIP32-Ed25519

BIP32 describes a method for deriving secp256k1 key-pairs. BIP32-Ed25519 is a similar method for Ed25519. For both, the derivations proceed from a root key-pair by adding a random-like integer to the ...
Permutahedron's user avatar
0 votes
1 answer
96 views

Row level database encryption scheme

I am developing a row level database encryption scheme. Ideally I would not do this and instead rely on something vetted, but I haven't been able to find such a scheme online. My primary concerns are: ...
Daniel's user avatar
  • 1
1 vote
0 answers
23 views

Proof of UOWHF construction from a strongly universal hash family

I am currently trying to rigorously prove Lemma 2.2 of [NY]. More specifically, a UOWHF family can be constructed from a composition of a strongly universal family $G_k = \{g : \{0, 1\}^k \rightarrow \...
Pontakorn Prasertsuk's user avatar
2 votes
2 answers
135 views

Key Exhaustion Risks in Symmetric and Asymmetric Cryptography

For the symetric keys it is recommend that the same key should not be used to encrypt large number(2^32) of cipher blocks to avoid the key-exhaustion risk. Curious to know whether the asymmetric key ...
Bhuvan's user avatar
  • 123
2 votes
0 answers
42 views

How does the Functionality know whether a sender/receiver is malicious?

I am new to the field of MPC and I'm trying to learn VOLE. I can understand the maths in functionality and protocols but can't get a sense of the security implications behind them. For instance, I was ...
John's user avatar
  • 21
0 votes
0 answers
37 views

How to attack the shuffling of correlated numbers?

Suppose I have a function that accepts vector input $x$ and outputs vector $y=f(x)$. I want to protect the output $y$ through shuffling numbers in it. I hope the shuffling can confuse the attacker by ...
Zhengyi Li's user avatar
0 votes
0 answers
24 views

How to implement a SKE scheme supporting single-message multi-ciphertext using LowMC and GMW?

I currently have a LowMC scheme and a GMW scheme. How can I implement a symmetric encryption scheme that supports single-message multi-ciphertext? In simple terms, I want to implement a protocol like ...
song's user avatar
  • 11
0 votes
0 answers
190 views

Is the cryptography scheme over lattice still secure? [duplicate]

In https://eprint.iacr.org/2024/555, the author proposed a quantum algorithm to solve LWE problem. How serious is its impact on the existing scheme over lattice.
guangyu liao's user avatar
0 votes
0 answers
20 views

Reduction For MAC systems

I am not too knowledgeable regarding reductions for message authentication code encryption. Here is an example I found: There is a MAC' based on a preliminary existing MAC as such: MAC'(k, m) = MAC(k,...
sangaCat's user avatar
0 votes
0 answers
25 views

User-friendly tutorial In JohnTheRipper (JtR) for beginners? [closed]

I have been struggling to understand the format in JtR. I am a pentesting student and trying to do a customized wordlist rule. How do you dictate the order of the password. like how do you tell the ...
TorJaks669's user avatar
61 votes
4 answers
10k views

Polynomial-time Quantum Algorithms for Lattice Problems

A new paper, by Yilei Chen, whose title is Quantum Algorithms for Lattice Problems (https://eprint.iacr.org/2024/555) appeared on eprint and it claims to solve hard lattice problems, such as the ...
Hilder Vitor Lima Pereira's user avatar
1 vote
0 answers
98 views

Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c)) $ used multiple times with low bit keys $k$. Avoids MitmA?

More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a Xor key obfuscation $k'$ with ...
J. Doe's user avatar
  • 453
0 votes
1 answer
58 views

wrting algorithm for torsion group elements

Yesterday,I took an exam. There are two questions I received very low points. I will write the first question in this post. The question says let $E:y^2:x^3+kx+1$ in GF(p) be an elliptic curve where p ...
user avatar
1 vote
1 answer
45 views

Can two different AES keys have the KCV by chance?

I am trying to check KCVs of a few keys. I am generating the KCV for the keys using the method mentioned here https://crypto.stackexchange.com/a/11873/115990 Question: Can KCVs of two different AES ...
humbleCoder's user avatar
0 votes
1 answer
63 views

Lightweight length preserving encryption

I'm in need of an encryption algorithm that can be easily implemented in c, doesn't drastically increase the size of the encrypted data (the data to be encrypted will be approximately 200 bytes and ...
Hristos's user avatar
1 vote
1 answer
75 views

In x25519kyber768 what is the use of the server kyber keys if only the client public kyber key is used for encapsulation in kem?

In x25519kyber768 what is the use of the server kyber keys if only the client public kyber key is used for encapsulation of the kyber shared secret in kem?
Shekhar Sivaraman's user avatar
1 vote
0 answers
38 views

Is it possible to compute the X25519 scalar multiplication of the SSH key exchange using the ED25519 sliding window implementation?

There are many different ED25519/Curve25519/X25519 implementations around. I focus on two of them: https://github.com/jedisct1/libsodium https://github.com/floodyberry/ed25519-donna The libsodium ...
bebbo's user avatar
  • 156
1 vote
1 answer
112 views

What is the purpose of making salted passwords public?

So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
mantot123's user avatar
0 votes
2 answers
59 views

How does MixColumn collapse 4 active S-boxes into 1?

In AES Proposal: Rijndael, page 34, there is the following figure with MixColumn transformation pattern for two columns: I'm trying to reproduce these paterns. The pattern in the column marked in ...
Alexey Kalmykov's user avatar
1 vote
1 answer
64 views

Is it possible to homomorphically evaluate an encryption circuit?

I know that it is possible to homomorphically evaluate a decryption circuit as it is the main idea behind bootstrapping, but I was wondering if it was possible to evaluate an encryption circuit ...
ProfCornDog's user avatar
0 votes
1 answer
42 views

Vulnerabilities of a word-level substitution cipher

What kind of attacks would be possible against this kind of substitution cipher? Every word in the plaintext is to be replaced with a random string of the same length The encryption of any given word ...
u2892's user avatar
  • 1
1 vote
1 answer
74 views

Is there a in-depth paper published about the Cloudflare's Lavarand and their CSPRNG?

I am diving into Cloudflare's Lavarand and its Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) [1]. Does anyone know of any comprehensive papers or documentation that provide an in-...
Aidre Cabrera's user avatar
1 vote
0 answers
29 views

On public coin zero knowledge protocols

Goldwasser and Sipser proved that a private coin interactive proof system can be converted into a public coin system. This conversion preserves round complexity (up to an additive factor of 2), but ...
884d88baaa's user avatar
1 vote
1 answer
57 views

What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?

I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in Small sub group ...
whatisLimlee's user avatar
4 votes
2 answers
3k views

What is better source of random bytes: Yubikey or /dev/random (or both)? [closed]

Let's say I need to generate a key, I have these three options as to where to get random data: Yubikey (gpg-connect-agent 'SCD RANDOM 16384' /bye) ...
DimanNe's user avatar
  • 151
1 vote
2 answers
87 views

MAC question i got in a test, would like your opinion on my answer

Given a MAC secure scheme $(\text{Gen}, \text{Mac}, \text{Vrfy})$, a new scheme is suggested: $\text{Gen}' \rightarrow \text{Gen} = (pk_1, sk_1), \text{Gen} = (pk_2,sk_2)$ $\text{Mac}'(m) = (\text{...
binyamin alony's user avatar
1 vote
0 answers
38 views

CRYSTAL-KYBER for Cloud-native storage [duplicate]

I'm trying to use CRYSTAL-KYBER encryption to protect Cloud-native storage against both normal and quantum attacks. I've read Cloud-native-security-whitepaper and found out that ...
LilLee's user avatar
  • 51
0 votes
0 answers
65 views

Why do we use elliptic curves instead of just the discrete logarithm problem?

We have a cyclic field Fp where p is a prime number, a generator g, and an order n. A generator is an element such that $g^n=1$. A random number x has been chosen as the private key, selected from the ...
Saku's user avatar
  • 101
2 votes
2 answers
95 views

What does the leftover hash lemma guarantee for a specific hash function?

Suppose I sample a matrix $h$ from $\mathbb{Z}_2^{l \times n}$ where each entry in $h$ is $1$ with probability 1/2. Suppose I also have a set $S\subset \{0,1\}^n$, and I define a random variable $X$ ...
Germ's user avatar
  • 121
0 votes
0 answers
4 views

Why I need to pass Secure Random when I am loading the key from PKCS8 format [migrated]

I am using Ring lib in Rust to generate ECDSA_P256 and I am passing SystemRandom, and I am getting PKCS8 key pair format. Until ...
Koptan's user avatar
  • 1
1 vote
0 answers
26 views

Security of RSW96 Timelock puzzles

I am looking to implement Time lock puzzles in a toy project I'm working on. I found this very elegant paper from Rivest et at. describing a technique for time lock puzzles. I'm wondering if the ...
enricobottazzi's user avatar
0 votes
0 answers
18 views

Differential Privacy: when the tokenizer is related to the dataset

So I want to train a model with DP-SGD. However, I noticed that by how my input dataset is constructed, the tokenizer is actually related to the input data. (e.g., picking out a sample may affect how ...
Glock K's user avatar
2 votes
1 answer
119 views

Confused about use of Euler totient function in RSA

I'm reading a book and I arrived at the part that explains 'textbook' RSA. It explains that given a modulus $n=pq$ and public exponent $e$ that we can encrypt $x \in \mathbb{Z}^{*}_n$ by setting $y=x^...
Mr. B's user avatar
  • 128
1 vote
0 answers
52 views

Optimizing MPC multiplicative inverse protocol

My question is regarding a well-known protocol for computing the multiplicative inverse of a nonzero secret-shared field element. Given $[x]$, the parties generate shares $[r]$ of a uniformly random ...
anticommutative's user avatar

15 30 50 per page