All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

How to securely design REST API for Password Manager app? [migrated]

I want to create Password Manager where users can create their accounts and store website passwords. For the frontend, it will be a mobile app, but I need REST API as the backend data where the data ...
0
votes
0answers
27 views

Voronoi regions of lattices with dimensions $\leq 16$

Is there any idea about calculating the exact Voronoi regions of lattices with dimensions $\leq 16$? Thank you!
0
votes
1answer
27 views

Key renewal when the sequence counter is only 32-bit

If we look at the use-case that our sequence counter within our TLS communication is only 32-bit, would an automatic key re-newal be necessary a lot more frequently? We're going to use state-of-the-...
0
votes
0answers
7 views

Unable to understand coin variable used in hash(H2)function querie

I have some hash function queries representations, which I find it hard to understand. I have searched a lot but didn't found anything helpful. Please help me understand the hash(H2) function query I ...
0
votes
1answer
30 views

Finding product of two unknown numbers each raised to a known power

Let $G$ be a group, and let $a, b\in G$, and let $[3] = \{0,1,2\}$. Let $(x_i,y_i)$ for $i\in[3]$ be known constants. Assume that I know the elements: $$c_i = a^{x_i}b^{y_i},\quad i\in[3]$$ Then, ...
0
votes
1answer
54 views

Symmetric Encryption, meet in the middle attack, effective key length

What is the effective key length of a deterministic encryption scheme, given a meet-in-the-middle attack scenario when you encrypt five times (64 bit keys for each)? . Say the encryption scheme has |...
3
votes
2answers
71 views

Questions regarding the one-wayness and collision-resistance of a hash function based on RSA-like problem

Problem statement: "Bob is a paranoid cryptographer who does not trust dedicated hash functions such as SHA1 and SHA-2. Bob decided to build his own hash function based on some ideas from number ...
0
votes
0answers
36 views

Short one-time pad security

I am somewhat new to Cryptography and I'm struggling with this proof I came across in my Intro to Cryptography course. I understand the proof of security for a one-time pad: Pr[M = m | C = c] = Pr[M = ...
0
votes
1answer
130 views

blockcipher-based MACs with variable length that are UF-CMA secure?

There are may papers and notes explain why CBC-MAC is only UF-CMA secure for fix length messages. Are there any other blockcipher-based (blockcipher and hash combined included) MACs that is UF-CMA ...
0
votes
1answer
60 views

Cryptographically secure PRBGs and the previous-bit test

I am reading Junod's paper about the Blum-Blum-Shub PRBG (BBS) and I am having trouble following his reasoning at on page 15, where he argues that the next-bit test can also be peformed for the ...
0
votes
0answers
62 views

CBC-MAC with length appended not UF-CMA secure followup

I know that CBC-MAC is not UF-CMA secure if the domain contains message of arbitrary length. Read from this post But what if we append the length of the message when run the MAC algorithm. (to MAC ...
1
vote
1answer
32 views

Asymmetric Encryption vs Shared secret via ECDH

I'm reading RFC8291. Here's a figure on how Web Push Notifications work in general: ...
3
votes
1answer
57 views

Repeated modular square roots to recover original base

I'm given a large prime $p$ and $c \equiv m^e \pmod p$, and $e = 2^{64}$. Typical RSA rules don't apply here, since $\phi(p) = p - 1$ is even, and $e$ is a power of two, so they share a common factor, ...
1
vote
1answer
36 views

What is Associated Data in AEAD?

I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of ...
1
vote
1answer
37 views

Is the MD5 algorithm only useful for bytes, rather than bits?

The MD5 algorithm is designed to accept a message of any length and produce a 512-bit message digest. Because of the way it pads the original message, by adding a 1-bit then a number of 0-bits, the ...
1
vote
1answer
62 views

Salt: best practice

I'm a complete novice at this and in need of advice. I'm building an app that I've implemented a password encrypted backup feature into. I'm wondering about the best practice for handling the salt. ...
-1
votes
0answers
23 views

secret sharing scheme in crypt [closed]

What is the degree of the polynomial used to generate shares in secret sharing scheme? Why we need degree polynomial in secret sharing scheme?
1
vote
1answer
50 views

Getting a random number on an STM32L0x1 device for SRP6a

I'm trying to get a random number for a STM32L0x1 MCU to use it in protocol SRP6a. (I know that there are MCUs with an embedded hardware random number generator. But it would cost twice as much as the ...
1
vote
0answers
42 views

Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
1
vote
3answers
99 views

Using sha3 as a deterministic source of psuedo-random bytes for xor encryption

The following code generates a deterministic stream of pseudo-random bytes, using SHA3. ...
0
votes
1answer
25 views

Using platform-level RNGs for key derivation with hash functions like BLAKE3?

So I've read stack overflow questions like this one. What I'm wondering is a bit more specific though: I'm really liking what I'm seeing with BLAKE3. (I suspect that this hash function is relatively ...
1
vote
1answer
73 views

How long would it take to calculate the hash of a password by hand?

Suppose one had no computer (or rainbow tables), but had access a pen and paper as well as all the necessary documentation for modern (best practice, not outdated) hashing algorithms and mathematical ...
0
votes
1answer
36 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
2
votes
1answer
116 views

Curve25519 choice of the prime

In the paper for curve25519 is described how the prime was chosen. But I don't understand why the biggest 255-Bit prime was chosen instead of a 256 Bit prime. Can someone explain this to me?
0
votes
0answers
38 views

Shamir's Secret sharing for Key encryption

I have studied Shamirs Secret Sharing(SSS) scheme. Now my doubt is to how to apply this in real time applications. I have an application which receives encrypted data from server and decrypts the data ...
-1
votes
0answers
47 views

Padding requirements for a stream cipher

You are given a stream cipher and a block cipher with a block size of 64 bits. The data input is 32 bits. How many bits do you need to pad before processing the data input using a stream cipher?
-1
votes
0answers
34 views

Difference between a Cryptosystem and a Protocol [closed]

Could you please describe the difference between a cryptosystem and a protocol?
0
votes
0answers
31 views

Can we make cryptography signature or encryption algorithm based on hardness of isomorphism? [closed]

In public key cryptography, Alice knows functions $f$ and its inverse $f^{-1}$. $f$ is public and $f^{-1}$ is secret. To sign a message $m$, she gives $(m,a=f^{-1}(m))$. To verify a signature, the ...
0
votes
0answers
38 views

Is there anyone intrested in quantum fully homomorphic encryption?

Recently, I have read a paper named "Classical Homomorphic Encryption for Quantum Circuits". The author claims a quantum scheme that can apply an encrypted (like GSW encryption) bit to ...
0
votes
1answer
63 views

Proof of (in)distinguishability based on DDH/CDH/DL

I am wondering whether or not it is known that the following problem is computationally infeasible while working in a group for which the DDH (or CDH or DL) assumption holds (as usual, g is a group ...
0
votes
0answers
31 views

Java large file AES Encryption is very slow [migrated]

I'm trying to encrypt a 512 Mb file with AES/CBC algorithm. It is taking around 7 sec which is too much. How to reduce the encryption time and make it faster. I'm using a fixed key and tried using ...
0
votes
0answers
19 views

How does APE: Authenticated Permutation-Based Encryption work?

I am trying to understand the encryption and decryption process of the APE: APE: Authenticated Permutation-Based Encryption for Lightweight Cryptography Full paper The Encryption what is exactly the <...
0
votes
1answer
42 views

Lehmer random number generator - cipher?

Let's consider linear congruential generator: $X_{k+1} = a \cdot X_{k} \mod 2^{128}$ Such that $a$ is some number which for every 128-bit input $X_{k}$ from $0$ to $2^{128}-1$ will give us different ...
3
votes
1answer
72 views

Are these two methods of differential cryptanalysis different?

I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round ...
1
vote
0answers
33 views

Differential analysis for dummies, how key position impact on tactic? [closed]

Im new to cryptoanalysis and started reading A Tutorial on Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody ...
0
votes
0answers
11 views

Bitcoin: Why can the difficulty parameter not be ignored? [migrated]

by the longest-chain-rule, the chain with the most blocks is considered to be the main chain in Bitcoin. I understand that an adversary needs to have more than 50% of the network's computing power in ...
1
vote
0answers
44 views

Schoofs Algorithm

I studied Schoofs Algorithm described by Washington. On page 125 he says that we could write $y'/y$ as a function of $x$, which makes sense since earlier on the page he denotes $y'= r_{2,j}(x)y$. But ...
4
votes
1answer
310 views

“Memory-Hard” vs. “Memory-Bound” Functions?

One of the approaches in order to prevent Sybil or DoS attacks is CPU-bound PoW. However, because of the influence of Moore’s law, the memory-based approaches are suggested. As actually there are two ...
0
votes
1answer
26 views

Why is SKEYSEED derived using the nonce as a key?

In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as SKEYSEED = prf(Ni | Nr, g^ir)...
2
votes
1answer
98 views

How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$

I have been reading about MDS matrices. It is defined as (paraphrased from Section 2.1) An $n \times n$ matrix $M$ is MDS if and only if $bn(M) = n + 1$ where $bn$ (branch number) is defined as: $bn(...
0
votes
1answer
32 views

In CBC mode of encryption, what happen if the IV is changed when it arrives at the receiver end? [duplicate]

What will happen if the Initialiazation Vector (IV), i.e, the initial randomness fed in to the first block arrives mangled at receiver end? How will this affect the decryption? Will the receiver be ...
0
votes
1answer
48 views

Message mapping to elliptic curve in BLS signature

In the BLS signature the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. The point $S$ is map (image) of $h(m)$ ...
2
votes
0answers
20 views

Is there an interactive proof protocol for proving that a preimage in a map $g: Z_{q}^{n} → G_{T}$ is mapped to a given public value, say y?

There already exist interactive proof protocols with logarithmic communication for proving that a secret multi-exponent $x ∈ Z^{n}_{q}$ for a public multi-exponentiation $P = \textbf{g}^{\textbf{x}} ∈ ...
0
votes
1answer
35 views

Is BBS+ 1. a multi-messages signing protocol or 2. a group signature signed by a member of a group anonymously?

There's no doubt that the BBS Signature was born from this classic Short Group Signature paper in 2004. It's capable of Zero-knowledge. In the paper, section 5, it describes how a member of a group, ...
-2
votes
1answer
106 views

Does the following protocol of secure a matrix satisfy one-time-pad?

Problem Definition: Alice wants to send a matrix $MR_A$ which encrypts its original private matrix $M_A$ ($M\times N$ size, all elements in $M_A$ is in {0,1,2,3,4,5}) to Bob without letting Bob knows ...
2
votes
2answers
75 views

Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
1
vote
1answer
42 views

Importance of supersingularity of elliptic curves

I'm struggling to understand the high-level idea of "Verifiable Delay Functions from Supersingular Isogenies and Pairings" (https://eprint.iacr.org/2019/166.pdf) by De Feo et al. I will ...
0
votes
0answers
21 views

When using openssl enc -camellia256, what block mode does it use? [migrated]

When encrypting a file with openssl using the Camellia 256-bit cipher, you can explicitly specify the block mode (e.g. ...
0
votes
0answers
56 views

AES homomorphic updates

I am looking for some help regarding something I am trying to do and I think to solution might be in Homomorphic encryption. Person A and B encrypt the same number(unsinged long) N using AES with ...
2
votes
1answer
104 views

Mapping the hash of message to a point of elliptic curve for signature

Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...

15 30 50 per page