All Questions

Filter by
Sorted by
Tagged with
3 votes
1 answer
142 views

Confusion in the security level offered by KYBER

I was looking at security level offered by KYBER. I have attached the table for the reference. I am little bit confused regarding the security level offered by KYBER. By definition, Level 1 in the ...
VIKAS SRIVASTAVA's user avatar
1 vote
1 answer
37 views

Is the Simplest OT universally composable against a semi-honest adversary?

I started learning about cryptography very recently, and I got interested in the Simplest-OT protocol of Chou and Orlandi. However (as the authors themselves noted) the protocol is not UC-secure ...
Daniel Turizo's user avatar
0 votes
1 answer
97 views

Should hash salt and public key be a part of cryptographic signature?

I'm updating some piece of software I wrote quite some time ago. It is supposed to sign some content. So at the moment I have the following process: I have a (private, public) keys pair. These can ...
freakish's user avatar
  • 103
11 votes
4 answers
7k views

How will the world learn that Q-Day has arrived?

I wonder how the world will come to know that scalable, fully fault-tolerant quantum computers capable of running Shor's algorithm have arrived. The day when this happens has been referred to as "...
Mark S's user avatar
  • 289
1 vote
1 answer
46 views

Zero Knowledge formalism for proof of knowlege of an exponent

I'm looking to understand the appropriate formalism to represent a protocol step where Alice sends Bob a proof of knowledge of an exponent. Is it accurate to depict this step using an arrow annotated ...
Adam54's user avatar
  • 261
0 votes
0 answers
90 views

Cryptographic strength of AES-GCM-256 for classical and Quantum

How can the strength be calculated, of both the GMAC and the encryption for AES-GCM-256, with AES key of 256 bit, for classical and quantum computers?
Evgeni Vaknin's user avatar
1 vote
0 answers
10 views

Is aggregator consider trustworthy in a CLAS scheme

In certificateless aggregate signature (CLAS) scheme, is an aggregator consider trustworthy? Can they act as an adversary, where they can alter the messages from the users and create a new valid ...
Rabindra Moirangthem's user avatar
1 vote
1 answer
104 views

Degree of inverse of f in NTRU?

In NTRU, we know that $f$ is a ternary polynomial in the ring $$R=\frac{\mathbb{Z}_q[x]}{x^n-1}.$$ Here $f$ has $d+1$ coefficients 1 and $d$ coefficients $-1$ and rest are zero. For computing the ...
PAMG's user avatar
  • 161
0 votes
0 answers
16 views

Understanding the Simplified Perspective in OCB Security Proof: Exploring the Role of Collisions and Oracle Models

In the security proof of OCB (Offset Codebook Mode), it appears that only collisions at the input and output of the block cipher are considered. Typically, security proofs for cryptographic modes ...
NogaCS's user avatar
  • 1
1 vote
0 answers
63 views

Curve448 ECC parameters for use with OpenSSL

I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
Logan R. Kearsley's user avatar
1 vote
0 answers
33 views

Fitness of Text Function, did I spot an error?

I am playing around with Enigma Encryption, and especially solving it piece-wise, like in https://www.youtube.com/watch?v=RzWB5jL5RX0 shown. The idea is, that the text gets clearer, if you get more ...
Ralf's user avatar
  • 181
0 votes
0 answers
37 views

Is known plaintext on Zipcrypto still possible using BK94 algorithm?

In my recent tests both pkcrack and bkcrack are no longer working, maybe it's my PC. I have zipped pkcrack.exe and chose compression level as store on both ...
terry franklin's user avatar
3 votes
1 answer
239 views

Are block ciphers still relevant in 2024?

Is the general approach of block ciphers still relevant when we have secure and performant pure stream ciphers? For example, TLS 1.3 supports both AES-GCM and chacha20-Poly1305. But I don't understand ...
Mr. B's user avatar
  • 128
0 votes
1 answer
118 views

How to know if an ECC public key is y or -y

I'm a beginner still learning how ecc works... And i think I understand that in secp256k1 public keys there is something called addictive and negative inverse for example private key:- ...
Melwyn's user avatar
  • 1
1 vote
1 answer
42 views

Signing a file vs. a manifest of cryptographic hashes

I’m interested in the tradeoffs of signing individual files vs. signing a manifest of cryptographic hashes and file names. Let’s say I do some work that results in a handful of files (10s to hundreds),...
baseboard49's user avatar
1 vote
2 answers
117 views

Providing a bound on the field-trace of a specific kind of polynomial to solve the finite-field isomorphism decisional problem

I am currently enrolled in a computer algebra class for engineers, and while I have some background in discrete algebra from a previous course, it's quite limited. I'm seeking assistance with ...
EngineerMathlover's user avatar
1 vote
0 answers
165 views

Mathematical approach to symmetric cryptography

I'm no mathematician but when thinking about block ciphers such as AES I find it much easier to think of them as a mathematical function $f$ (rather than an 'algorithm') such that $c=f(m,k)$ with $c$ ...
Mr. B's user avatar
  • 128
0 votes
1 answer
67 views

A question about Definition 3.8 in book IMC by Katz and Lindell

In the book IMC by Katz and Lindell, definition 3.8 says that "if for all PPT adversaries A, there is a negligible function negl such that for all n ......". I am confused about why it holds ...
Jeffrey's user avatar
  • 97
1 vote
0 answers
61 views

Random padding of RSA-signed message at end instead of beginning of the message

I’ve a signature scheme for 1024‒bit RSA with a 65537 exponent. The signed message is constructed as follows: 760‒Bits fully_user_controlled_message_content+8 Bits incremental nonce+sha256(...
user2284570's user avatar
0 votes
0 answers
21 views

What is the Halo2 zkp scheme's time complexity?

The Halo2 is the zero-knowledge proof scheme which is the improvement of HALO. However, it is not clear for me what is the time complexity of this scheme,including generating and verifying the proof. ...
John's user avatar
  • 1
1 vote
0 answers
53 views

Clarification regarding maximum size of a TLS 1.3 record

RFC8446 states that: the full encoded TLSInnerPlaintext MUST NOT exceed 2^14 + 1 octets It also states: length: The length (in bytes) of the following ...
miran80's user avatar
  • 123
1 vote
0 answers
59 views

Break RSA knowing N, e, dp+dq

In a cryptography exercise, I have to factor $N$ only knowing $e$ and $d_p+d_q$ (not $d_p$ and $d_q$ separately). I came up with the following equations: $$e*(d_p+d_q) = 2+K_p(p-1)+K_q(q-1)$$ $$e*d_p \...
yusufm's user avatar
  • 11
2 votes
2 answers
94 views

Probabilistic proof of multiplying two elements from non-prime finite field

I was reading this paper, and there, they use the ring $\mathbb{Z}_{\large p}[\alpha]/(\alpha^{\large n}+1)$ for all their operations. And that looks like a construction of finite field $\mathbb{F}_{\...
the thinker's user avatar
2 votes
0 answers
47 views

Can signature be repurposed?

Given public key $pk$, message $M$ and its signature $\sigma$, is it possible to get another $pk'\not =pk$, $M'$ with the totally same signature $\sigma$? In other word, the following ones are both ...
Twiforest's user avatar
1 vote
1 answer
42 views

Is there any reference about the half-trace when m is even in F(2^m)

There is a algorithm listed in D.1.6, Algorithm 3, it seems that it is used to solve the quadratic equation when $m$ is even in $F(2^m)$. However, I can not find any reference about this algorithm, as ...
Insecticide's user avatar
1 vote
0 answers
68 views

When using AES-NI as a high-speed permutation, does AESDEC offer better diffusion?

If I was to use AES-NI as a high performance 128-bit permutation/PRF would AESDEC offer faster/better diffusion than AESENC? The reason I ask is because both instructions have the same cost, but the ...
Chris_F's user avatar
  • 197
4 votes
1 answer
127 views

Changing ECDSA for Shorter Signatures: deterministic k

I am exploring a modification to ECDSA to produce shorter signatures, even though it compromises security (in a controllable way). My rationale behind this change is in this discussion. In my ...
Ehsan's user avatar
  • 51
5 votes
1 answer
161 views

Are USB TRNGs still useful given the recent /dev/(u)random merger?

I'm referencing Jason A. Donenfeld's Random number generator enhancements for Linux 5.17 and 5.18 available here. In summary:- significant outward-facing change is that /dev/random and /dev/urandom ...
Paul Uszak's user avatar
  • 15.4k
1 vote
1 answer
60 views

Zero knowledge commitment to a "strictly positive integer" and "nonzero element"

Suppose I want to commit to the following information: I have an integer $i\in\mathbb Z$ and I want to commit to $i$ and that $i\gneq 0$, without revealing $i$. I have an element of a prime field $x\...
Jim's user avatar
  • 111
3 votes
2 answers
475 views

Why is the bilinearity of an elliptic curve pairing shown as multiplicative rather than additive?

In vitalik's post here the below is mentioned, This is the pairing. Mathematicians also sometimes call it a bilinear map; the word “bilinear” here basically means that it satisfies the constraints: $...
Chirag Parmar's user avatar
1 vote
0 answers
30 views

Adaptive and Non Adaptive PRF

Is it possible to construct a PRF that is secure under non-adaptive queries but not secure under adaptive queries?
vignesh4999's user avatar
-1 votes
0 answers
55 views

When i know the value "c", How do I find factored numbers "a" and "b" : (a*b) == c (mod N) where, N is bitcoin order

When i know the value "c", How do I find factored numbers "a" and "b" : (a*b) == c (mod N) where, N is bitcoin order. For example, ...
sokraa2134's user avatar
1 vote
0 answers
38 views

One Way Functions with Non-Uniform Inputs

It is well-known that a One-Way Function is hard to invert on uniformly random inputs. As per Wikipedia, for [sic] all randomized algorithms $F$, all positive integers $c$ and all sufficiently large $...
Lt. Commander. Data's user avatar
2 votes
1 answer
73 views

Hybrid argument for quantum states

The usual hybrid argument tells us that if two efficiently sampled ensembles are computationally indistinguishable based on a single sample, then, computational indistinguishability holds even for ...
manta's user avatar
  • 45
3 votes
3 answers
223 views

Katz and Lindell, proof of lemma 2.4

Can someone explain the logic behind the claim that the second equality is because we condition on the event that $M$ is equal to $m$ in the proof of Lemma 2.4 from "Introduction to Modern ...
MuchToLearn's user avatar
1 vote
2 answers
534 views

The future of cryptanalysis

I am an undergraduate (grade three). I am confused about the cryptanalysis. Because a lot people say that the modern ciphers are complete and they can't be cracked. Maybe the prospects for ...
Arthur Alexander's user avatar
2 votes
0 answers
62 views

Matrix-vector multiplication in Kyber implementation

I took a look at the implementation of Kyber, which can be found in this GitRepo. I made a small discovery in the indcpa.c in the function indcpa_keypair, starting ...
TreeBook1's user avatar
  • 117
0 votes
0 answers
47 views

RSA decrypt using Openssl error : Public Key operation error

Hello im got stuck at ctf crypto challenge, so at the challenge is given 3 file which is flag.enc pub.key priv.key , so i tried to decrypt using openssl here is ...
iykyk's user avatar
  • 1
0 votes
0 answers
35 views

Constraints needed to express a + b + c = d in zkp circuit

I am writing an ECC based zkp circuit and need to express the constraints: a + b + c = d a, b, c, d >= 0 a, b, c, d will be represented by points on the curve so addition can wrap around the ...
gws's user avatar
  • 101
2 votes
1 answer
297 views

Core-SVP Hardness of Kyber

This question is with reference to the python file model_BKZ.py provided in the GitHub repository https://github.com/pq-crystals/security-estimates/blob/master/...
VIKAS SRIVASTAVA's user avatar
2 votes
2 answers
103 views

Can you use ChaCha20 as one-time pad?

My knowledge of cryptography nothing beyond basic so I am by no means an expert, but I do know a bit of undergraduate mathematics including number theory. I know that stream ciphers like ChaCha20 is ...
cryptobro's user avatar
0 votes
0 answers
69 views

Recommendations for tools and libraries to aid implementation for a Private Key Generator

I'm currently tasked to implement this cryptographic scheme. But currently struggle to understand these hash functions of the scheme. Can anyone explain and suggest a way or some kind of tool to build ...
randomdude's user avatar
1 vote
0 answers
66 views

Efficiency of interactive versus non-interactive zero-knowledge proofs?

Some projects (e.g., https://zkpass.org/) are claiming that interactive ZKPs can be more efficient than non-interactive ZKPs. What is the rationale behind this?
mti's user avatar
  • 655
1 vote
1 answer
87 views

Montgomery Curve Point Multiplication in Projective Coordinates

Is the result of 4G the same when calculated as 3G + 1G or 2G + 2G in projective coordinates? Considering a curve like (y^2 = x^3 + 10x^2 + x (mod 83)) with a Generator point G = (3, 28) in affine ...
Nawras Hussein's user avatar
1 vote
1 answer
123 views

Is there supposed to be a unique polynomial when given t shares for (t,n) Shamir Secret Sharing scheme?

I always thought that part of the idea behind SSS was that there is only a single $t-1$ degree polynomial through $t$ unique points; that this holds when the polynomial coefficients are over the reals ...
Gordon's user avatar
  • 45
0 votes
0 answers
60 views

Is it possible to prove this function is computationally intistinguishable from PRF?

Background I have constructed a function $F':X × K → Y$, which has a characteristic that the quantity of $x\in X$ mapping to a single $y\in Y$ follows a binomial distribution $B(\frac{1}{2}, 2\frac{|X|...
queen killer's user avatar
-2 votes
0 answers
55 views

Understanding secp256k1 elliptic curve subtraction formula

Point doubling formula Calculate the slope $\lambda = (3\times Q_x^2) \times$ pow($2 \times Q_y$, -1, $p$) % $p$ Calculate the new point coordinates $R_x = (λ^2 - 2 \times Q_x)$ % $p$ $R_y = (\lambda \...
Favour's user avatar
  • 37
1 vote
0 answers
35 views

How to know the number of digits in the decimals place in elliptic curve division result?

$p$ - is the order of the finite field $n$ - is the order of the group. Private keys can range from $1$ (the generator point $G$) to $n - 1$. All the private keys ($Priv$) lie in certain ranges of 2. $...
Maltoon Yezi's user avatar
1 vote
1 answer
46 views

Is it impossible to improve plaintext attack on Zip crypto in trade of memory vs plaintext bytes requirement?

BKcrack and BK94 states that a minimum of 12 bytes plaintext is required to perform the attack but that was more than 20 years ago, even Michael Stay's improvement is not utilizing modern resources ...
terry franklin's user avatar
2 votes
0 answers
60 views

Can you sign messages using Wireguard's keys?

I was wondering if I could use Wireguard's keys to sign messages, and prove authenticity of a node that runs Wireguard with its known public key from other nodes, so that I can use it in a system to ...
Alex's user avatar
  • 121

15 30 50 per page