All Questions

Filter by
Sorted by
Tagged with
1 vote
1 answer
183 views

How to know that MAC isn't modified in ECIES

I am new to ECC but I was wondering, If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still ...
user avatar
1 vote
2 answers
37 views

Reusing base Oblivious Transfers

I am new to Oblivious Transfer (OT) and am having trouble finding a definitive answer regarding if/when/how baseOTs can be reused in a computation when using OT-extension (for passive security only). ...
user avatar
  • 21
2 votes
2 answers
55 views

How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
user avatar
0 votes
1 answer
81 views

How do we calculate a power with a gigantic exponent?

In RSA, signing the hash of a message is doing the operation $h^{d} \bmod N$ where $d$ is the private key. Given that the size of $d$ is usually 2048 bits and $h$ is a quite big number, the ...
user avatar
3 votes
2 answers
128 views

TLS 1.3 and its use of HKDF-Extract

HKDF-Extract is defined in RFC 5869 as ...
user avatar
1 vote
0 answers
58 views

Assuming secp256k1 curve and given fixed (but random) $h$ and $d$ values, is it possible to calculate a $k$ such that $h\equiv(k\,G)_X\,(k-d)\pmod n$?

For generator point $G$ in the secp256k1 curve, I want to find a value $k$ such that: $$h\equiv(k\,G)_X\,(k-d)\pmod n$$ where $n$ is the group order, and $(k\,G)_X$ indicates the x-coordinate (mod n) ...
user avatar
0 votes
0 answers
65 views

Is there any relationship between avalanche and permutation in block ciphers?

Avalanche is one of the characteristics of S-Box or SP network(S and P boxes are used together).Is it possible for the permutation module, when tested alone, to show avalanche effect.? reference SP ...
user avatar
6 votes
2 answers
2k views

How to prove that both people know the same dictionary word?

What would be a way to prove that both you and I know the same dictionary word? If we both hashed the word, then we could compare the hashes, but anyone who saw the hash could find the original word ...
user avatar
-1 votes
1 answer
82 views

Step-by-step conversion of Private Key in Hex to WIF (Wallet Import Format)

According to this webpage: The process of encoding a private key into WIF format is as follows. Raw private keys are simply large numbers, which are represented as bytes. WIF format adds a prefix ...
user avatar
1 vote
1 answer
72 views

Byte-Serial implementation of AES

I am trying to make a byte-serial implementation of the AES 128-Bit in ECB-mode for my studies. I understand the "normal" (word-parallel) implementation of AES and the way of Eli Biham (bit-...
user avatar
1 vote
1 answer
46 views

Aes-Gcm how to perform decryption authentication without plaintext output in C#

I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file. One thing I ...
user avatar
  • 23
0 votes
1 answer
50 views

encrypting a document with 2 different keys

Is there a way to encrypt a file with 2 (or more) keys and then access it with only 1? scenario : Bob and Alice have a tight memory and can only remember ONE key. Bob and Alice encrypt a file with ...
user avatar
11 votes
1 answer
2k views

The death of isogeny-based cryptography?

Wouter Castryck and Thomas Decru recently broke SIDH. From the abstract: We present an efficient key recovery attack on the Supersingular Isogeny Diffie-Hellman protocol (SIDH), based on a "glue-...
user avatar
  • 111
1 vote
2 answers
87 views

Prove a plain text belongs to encrypted data

Given an encrypted (RSA) message and it's original plain text, is there a way to prove that the plain text belongs to the encrypted message ?
user avatar
-1 votes
0 answers
32 views

Hello, I want to generate and transfer TPK to a 3rd party.hence, I need to create 3 ZMK components and share with 3 custodians from 3rd party

Below are the steps I have figured out for the same. GC( generate component) or OC (generate cand print component) Component 1, 2, 3 In order to share clear components with 3rd party, guess have to ...
user avatar
  • 1
1 vote
1 answer
57 views

Cryptography methods that allow for multiple keys to be used?

I'm currently working on a webapp in which I'd like all nearly all user data to be encrypted, but accessible by multiple users (ie a doc encrypted should be decrypt-able by parties A, B, C, all ...
user avatar
0 votes
0 answers
40 views

How to secure confidential data in memory

I am currently working on password manager. So far I used one encrypted database file to store all the passwords and then decrypted it at runtime with a derived user-entered master password. All log-...
user avatar
  • 37
0 votes
0 answers
32 views

LSAG implementation in Python

Context I am implementing LSAG in python because I do not find a non-obviously insecure implementation. I am not a cryptographer myself, thus simplicity is key. The famous Linkable Spontaneous ...
user avatar
0 votes
2 answers
68 views

In SPDZ, difference between protocol in $\mathbb F_p$ and in $\mathbb F_{2^k}$

I have read SPDZ family protocol, the domain of the spdz_1 in 2012 is $\mathbb F_{p^k}$. Later mascot'16 supports both $\mathbb F_p$ and $\mathbb F_{2^k}$, where $p=2^k+u$. I want to know the ...
user avatar
  • 21
0 votes
0 answers
34 views

the difference between field $F_{2^k}$ and ring $Z_{2^k}$ in multi-party computation, especially in SPDZ family [duplicate]

I have seen different protocols in field or ring, I used to think ring is a special field when 2^k. But when I read the paper later, I doubted my understanding.
user avatar
  • 21
3 votes
0 answers
61 views

Does NIST SP800-56C r2 forbid using NIST-approved two-step KDFs for not-all-at-once key-derivations?

NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by ...
user avatar
1 vote
1 answer
87 views

Request for Ring signature numerical example or simple python code

I am reading about the Ring signature. However, I do not understand the verification process of this signature. Could you provide me a complete numerical example showing the signature creation and ...
user avatar
1 vote
1 answer
163 views

Does a self-build random 256-key based on substition and permutation have the same power as an AES-key?

As far as understand AES takes 16 bytes, shuffles them and replaces every of the 256 bits via XOR. Then the same procedure applies to the next 16 bytes, and then again - until the entire file is ...
user avatar
0 votes
0 answers
29 views

Assumptions used for Designing Homomorphic CRHF

What are the possible assumptions that have been used or can be used for designing the homomorphic Collision Resistant Hash function (CRHF)? I know Short Integer Solution (SIS) is one of the ...
user avatar
0 votes
0 answers
16 views

How to ensure the security of computation and transmition on Smart Contracts?

Suppose there is a smart contract with a bidding function, and the bidder can send the bid price to the smart contract after encrypting it. When the auction is over, a trusted third party sends the ...
user avatar
  • 186
0 votes
0 answers
16 views

Are real-or-random model and LR-model are equivalent?

Are real-or-random(rr) model and LR-model are equivalent? In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent. Here is ...
user avatar
1 vote
0 answers
63 views

Creating a basic SHA256 hasher in Circom

I want to create a SHA256 hasher in Circom so I can validate that a person knows the pre-image of a SHA256 hash without revealing the pre-image. This is my current code but it doesn't work: ...
user avatar
3 votes
1 answer
52 views

Bleichenbacher '06 signature forgery against modified PKCS1 v1.5 format

Bleichenbacher’s ’06 RSA signature forgery targets incorrect PKCS1 v1.5 implementations where padding checks are omitted and RSA keys with e = 3 are used. As per ...
user avatar
4 votes
3 answers
750 views

What is DES-EDE3-CBC?

I came across DES-EDE3-CBC and a quick search didn't yield a clear explanation of what it is. Clearly, DES is the Data Encryption Standard and CBC is the Cipher Block Chaining mode. EDE is probably ...
user avatar
  • 213
1 vote
1 answer
68 views

How to compute $\frac{1 + a_1 \times \dots \times a_n}{b_1 \times \dots \times b_n}$ where $a_i$ and $b_i$ are secret?

How can $n$ peers compute $$\frac{1 + a_1 \times \dots \times a_n}{b_1 \times \dots \times b_n}$$ such that the pair of values $a_i$ and $b_i$ remains secret to the $i$-th peer?
user avatar
  • 111
-2 votes
0 answers
25 views

padded RSA encryption: valid ciphertext from another

Considering padded RSA. Given an encrypted packet E(pubk, x) is It possible to generate a valid encryption E(pubk, x|y) without knowing the value x (but knowing only y)? For example merging in some ...
user avatar
  • 1
1 vote
1 answer
108 views

The XOR operation, is it a quantum resistant operation and why is that? if not, what is the most lightweight alternatives?

The XOR operation is an important part of most of the existing end-to-end authentication protocols. Will it be part of the post-quantum authentication protocols?.
user avatar
  • 11
0 votes
1 answer
30 views

Double hashing scheme on not collision resistant hash

Given an hash H that is not collision resistant, for example 80-bit digest, if we use the following double hashing scheme: H(SHA2-256(x)). Does this scheme increase the collision resistance?
user avatar
  • 1
2 votes
0 answers
37 views

Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them

Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
user avatar
2 votes
0 answers
26 views

A Question on the "rewinding" technique in secure computation

Consider secure two-party computation against malicious adversaries in the standalone model. I know that the "rewinding" technique can be used to extract the corrupt party's input, e.g., in $...
user avatar
  • 404
0 votes
0 answers
19 views

About notations that are used to describe probability that A wins the game(probabilistic algorithm?)

I am studying cryptography by myself, especiall and there are somewhat confusing notations. Here are two examples in digital signature that I want to check: $$Pr \left[ 1 \leftarrow \mathcal{V}(\hat{\...
user avatar
0 votes
1 answer
54 views

pros and cons of cryptographic session token

I designed a simple library (golang) for use as session token for web applications. The idea is simple: the token will be 16-byte long, denote it as t generate a ...
user avatar
  • 135
1 vote
1 answer
62 views

What is the meaning of the power notation in the access structure?

In the paper about ABE (like this), the access structure is defined as follow: Let ${P_1,P_2,...,P_n}$ be a set of parties. A collection $A⊆2^{\{P_1,P_2,...,P_n\}}$ is monotone if $∀B,C$: if $B∈A$ ...
user avatar
  • 13
2 votes
2 answers
521 views

How to select e for RSA test questions?

I know I am not supposed to ask for answers, which I am not. I have the solution but I don't understand how 'e' is selected, pls see my explanation below. I am doing practice questions for my Cyber ...
user avatar
2 votes
2 answers
178 views

Are digital signatures unique for the messages they sign?

Practical implementations of digital signature algorithms (DSAs) employ hash functions to ensure that input is small and of a fixed sized; otherwise, DSAs would be too slow for most real-world ...
user avatar
0 votes
1 answer
24 views

Ipsec dh key generation doubt

I have doubt like when in the ipsec we use dh group for key exchange it take prime number and g value from group bit but in the msg 3&4 exchange how the key exchange payload and nonce will help to ...
user avatar
  • 1
0 votes
0 answers
15 views

fastest method of CNF equation solution verification

I am trying to find a way to mine bitcoin faster than an ASIC by using a CNF representation of sha(sha(hash)), which would be an equation containing a few hundred thousand clauses, let's call it n ...
user avatar
0 votes
1 answer
58 views

Can salt for HKDF be hardcoded within a program

i am new to cryptography , i am using article https://medium.com/asecuritysite-when-bob-met-alice/hmac-and-hkdf-df4e194752d1 for reference , while using salt with hkdf to derive multiple keys from a ...
user avatar
0 votes
0 answers
33 views

Provable security with over-computing power

Suppose we are trying to construct a cryptographic scheme, say public key encryption, and I can prove the IND-CPA security of the PKE scheme when any adversaries perform at least $T$ queries. That is, ...
user avatar
0 votes
0 answers
60 views

Provably secure and Practical ciphers

Are there any ciphers that are provably secure (reducable to a hard problem (including like factorization, not necessarily to NP-Complete or harder) ) are practical (not necessarily for too much ...
user avatar
  • 41
4 votes
1 answer
58 views

Constructing a PRF from PRG, with more parallelism

The famous result of Goldreich, Goldwasser, and Micali (GGM) constructs a PRF $F$ from a PRG $G$: ...
user avatar
  • 10.8k
4 votes
1 answer
245 views

What does "key version" refer to when talking about AES 128 in NXP's datasheet?

I'm going through the datasheet for MifareDesfire ICs. Throughout the document, there are mentions of "key version". For example, section 9.3 of the document states: Hardware AES using 128-...
user avatar
  • 143
0 votes
1 answer
69 views

Simplest recursive SNARK working example

I have been doing some research into recursive SNARKs. But I haven't found a working code example such as this one using Zokrates or this one using snarkjs. Anyone knows one such example, say, for ...
user avatar
0 votes
1 answer
43 views

what is the difference between a substitution cipher and an oracle

I was looking into the opaque authentication protocol and they discuss an oracle, which, if I understand it correctly is a projection Z from f to g (g at least the size of f), which maps inputs from f ...
user avatar
0 votes
0 answers
11 views

Algorithms to secretly distribute elements from a known set / with a known global characteristic

I am assuming a set of $n$ players and a central "dealer" $C$ through which all communication is routed. The state I want to end up with is that each player $i$ has a secret $s_i$ unknown to ...
user avatar
  • 1

15 30 50 per page