# All Questions

22,836 questions
Filter by
Sorted by
Tagged with
7 views

### How to securely design REST API for Password Manager app? [migrated]

I want to create Password Manager where users can create their accounts and store website passwords. For the frontend, it will be a mobile app, but I need REST API as the backend data where the data ...
27 views

### Voronoi regions of lattices with dimensions $\leq 16$

Is there any idea about calculating the exact Voronoi regions of lattices with dimensions $\leq 16$? Thank you!
27 views

### Key renewal when the sequence counter is only 32-bit

If we look at the use-case that our sequence counter within our TLS communication is only 32-bit, would an automatic key re-newal be necessary a lot more frequently? We're going to use state-of-the-...
7 views

### Unable to understand coin variable used in hash(H2)function querie

I have some hash function queries representations, which I find it hard to understand. I have searched a lot but didn't found anything helpful. Please help me understand the hash(H2) function query I ...
30 views

### Finding product of two unknown numbers each raised to a known power

Let $G$ be a group, and let $a, b\in G$, and let $[3] = \{0,1,2\}$. Let $(x_i,y_i)$ for $i\in[3]$ be known constants. Assume that I know the elements: $$c_i = a^{x_i}b^{y_i},\quad i\in[3]$$ Then, ...
54 views

### Symmetric Encryption, meet in the middle attack, effective key length

What is the effective key length of a deterministic encryption scheme, given a meet-in-the-middle attack scenario when you encrypt five times (64 bit keys for each)? . Say the encryption scheme has |...
71 views

### Questions regarding the one-wayness and collision-resistance of a hash function based on RSA-like problem

Problem statement: "Bob is a paranoid cryptographer who does not trust dedicated hash functions such as SHA1 and SHA-2. Bob decided to build his own hash function based on some ideas from number ...
36 views

I am somewhat new to Cryptography and I'm struggling with this proof I came across in my Intro to Cryptography course. I understand the proof of security for a one-time pad: Pr[M = m | C = c] = Pr[M = ...
130 views

### blockcipher-based MACs with variable length that are UF-CMA secure?

There are may papers and notes explain why CBC-MAC is only UF-CMA secure for fix length messages. Are there any other blockcipher-based (blockcipher and hash combined included) MACs that is UF-CMA ...
60 views

### Cryptographically secure PRBGs and the previous-bit test

I am reading Junod's paper about the Blum-Blum-Shub PRBG (BBS) and I am having trouble following his reasoning at on page 15, where he argues that the next-bit test can also be peformed for the ...
62 views

### CBC-MAC with length appended not UF-CMA secure followup

I know that CBC-MAC is not UF-CMA secure if the domain contains message of arbitrary length. Read from this post But what if we append the length of the message when run the MAC algorithm. (to MAC ...
32 views

### Asymmetric Encryption vs Shared secret via ECDH

I'm reading RFC8291. Here's a figure on how Web Push Notifications work in general: ...
57 views

### Repeated modular square roots to recover original base

I'm given a large prime $p$ and $c \equiv m^e \pmod p$, and $e = 2^{64}$. Typical RSA rules don't apply here, since $\phi(p) = p - 1$ is even, and $e$ is a power of two, so they share a common factor, ...
36 views

### What is Associated Data in AEAD?

I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of ...
37 views

### Is the MD5 algorithm only useful for bytes, rather than bits?

The MD5 algorithm is designed to accept a message of any length and produce a 512-bit message digest. Because of the way it pads the original message, by adding a 1-bit then a number of 0-bits, the ...
62 views

### Salt: best practice

I'm a complete novice at this and in need of advice. I'm building an app that I've implemented a password encrypted backup feature into. I'm wondering about the best practice for handling the salt. ...
23 views

### secret sharing scheme in crypt [closed]

What is the degree of the polynomial used to generate shares in secret sharing scheme? Why we need degree polynomial in secret sharing scheme?
50 views

### Getting a random number on an STM32L0x1 device for SRP6a

I'm trying to get a random number for a STM32L0x1 MCU to use it in protocol SRP6a. (I know that there are MCUs with an embedded hardware random number generator. But it would cost twice as much as the ...
42 views

### Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
99 views

### Using sha3 as a deterministic source of psuedo-random bytes for xor encryption

The following code generates a deterministic stream of pseudo-random bytes, using SHA3. ...
25 views

### Using platform-level RNGs for key derivation with hash functions like BLAKE3?

So I've read stack overflow questions like this one. What I'm wondering is a bit more specific though: I'm really liking what I'm seeing with BLAKE3. (I suspect that this hash function is relatively ...
73 views

### How long would it take to calculate the hash of a password by hand?

Suppose one had no computer (or rainbow tables), but had access a pen and paper as well as all the necessary documentation for modern (best practice, not outdated) hashing algorithms and mathematical ...
36 views

### Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
116 views

### Curve25519 choice of the prime

In the paper for curve25519 is described how the prime was chosen. But I don't understand why the biggest 255-Bit prime was chosen instead of a 256 Bit prime. Can someone explain this to me?
38 views

### Shamir's Secret sharing for Key encryption

I have studied Shamirs Secret Sharing(SSS) scheme. Now my doubt is to how to apply this in real time applications. I have an application which receives encrypted data from server and decrypts the data ...
47 views

### Padding requirements for a stream cipher

You are given a stream cipher and a block cipher with a block size of 64 bits. The data input is 32 bits. How many bits do you need to pad before processing the data input using a stream cipher?
34 views

### Difference between a Cryptosystem and a Protocol [closed]

Could you please describe the difference between a cryptosystem and a protocol?
31 views

### Can we make cryptography signature or encryption algorithm based on hardness of isomorphism? [closed]

In public key cryptography, Alice knows functions $f$ and its inverse $f^{-1}$. $f$ is public and $f^{-1}$ is secret. To sign a message $m$, she gives $(m,a=f^{-1}(m))$. To verify a signature, the ...
38 views

### Is there anyone intrested in quantum fully homomorphic encryption?

Recently, I have read a paper named "Classical Homomorphic Encryption for Quantum Circuits". The author claims a quantum scheme that can apply an encrypted (like GSW encryption) bit to ...
63 views

### Proof of (in)distinguishability based on DDH/CDH/DL

I am wondering whether or not it is known that the following problem is computationally infeasible while working in a group for which the DDH (or CDH or DL) assumption holds (as usual, g is a group ...
31 views

### Java large file AES Encryption is very slow [migrated]

I'm trying to encrypt a 512 Mb file with AES/CBC algorithm. It is taking around 7 sec which is too much. How to reduce the encryption time and make it faster. I'm using a fixed key and tried using ...
19 views

### How does APE: Authenticated Permutation-Based Encryption work?

I am trying to understand the encryption and decryption process of the APE: APE: Authenticated Permutation-Based Encryption for Lightweight Cryptography Full paper The Encryption what is exactly the <...
42 views

### Lehmer random number generator - cipher?

Let's consider linear congruential generator: $X_{k+1} = a \cdot X_{k} \mod 2^{128}$ Such that $a$ is some number which for every 128-bit input $X_{k}$ from $0$ to $2^{128}-1$ will give us different ...
72 views

### Are these two methods of differential cryptanalysis different?

I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round ...
33 views

### Differential analysis for dummies, how key position impact on tactic? [closed]

Im new to cryptoanalysis and started reading A Tutorial on Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody ...
11 views

### Bitcoin: Why can the difficulty parameter not be ignored? [migrated]

by the longest-chain-rule, the chain with the most blocks is considered to be the main chain in Bitcoin. I understand that an adversary needs to have more than 50% of the network's computing power in ...
44 views

### Schoofs Algorithm

I studied Schoofs Algorithm described by Washington. On page 125 he says that we could write $y'/y$ as a function of $x$, which makes sense since earlier on the page he denotes $y'= r_{2,j}(x)y$. But ...
310 views

### “Memory-Hard” vs. “Memory-Bound” Functions?

One of the approaches in order to prevent Sybil or DoS attacks is CPU-bound PoW. However, because of the influence of Moore’s law, the memory-based approaches are suggested. As actually there are two ...
26 views

### Why is SKEYSEED derived using the nonce as a key?

In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as SKEYSEED = prf(Ni | Nr, g^ir)...
98 views

35 views

### Is BBS+ 1. a multi-messages signing protocol or 2. a group signature signed by a member of a group anonymously?

There's no doubt that the BBS Signature was born from this classic Short Group Signature paper in 2004. It's capable of Zero-knowledge. In the paper, section 5, it describes how a member of a group, ...
106 views

### Does the following protocol of secure a matrix satisfy one-time-pad?

Problem Definition: Alice wants to send a matrix $MR_A$ which encrypts its original private matrix $M_A$ ($M\times N$ size, all elements in $M_A$ is in {0,1,2,3,4,5}) to Bob without letting Bob knows ...
75 views

### Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
42 views

### Importance of supersingularity of elliptic curves

I'm struggling to understand the high-level idea of "Verifiable Delay Functions from Supersingular Isogenies and Pairings" (https://eprint.iacr.org/2019/166.pdf) by De Feo et al. I will ...
21 views

### When using openssl enc -camellia256, what block mode does it use? [migrated]

When encrypting a file with openssl using the Camellia 256-bit cipher, you can explicitly specify the block mode (e.g. ...
Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle$. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...