All Questions
29,828
questions
1
vote
1
answer
242
views
Solving vs. verifying decision problems
I'm trying to understand the hardness of problems (e.g. in cryptography) from the point of view of complexity theory. For the complexity class NP, Wikipedia (11/2023) says
NP is the set of decision ...
- 139
1
vote
1
answer
47
views
How to write information in the 32-byte addresses of SLH-DSA?
Dear community,
I have a technical question regarding the use of the addresses in section 4.2 of FIPS 205, the NIST standard of SPHINCS+.
Taking for example the tree address, we want to copy an ...
- 13
1
vote
0
answers
75
views
Can the requirement to increase rounds with key size be bypassed?
When taking AES for example, the number of rounds increases as the key size increases.
This is done in order to adequately diffuse key bits into the state of the cipher.
Suppose you replace the AES ...
- 169
0
votes
0
answers
34
views
Is BGV encryption using different secret keys indistinguishable?
Assume that the same message is encrypted using two different keys within the BGV encryption scheme. Can we assume that the resulting ciphertext are indistinguishable?
I.e., given $c_1 = \text{Enc}(...
- 327
0
votes
0
answers
70
views
Reduction for distinguishing to elements
Given a composite number $n=pq$ of primes $p$ and $q$, a secret random element $r$, and two public random elements $x_1$ and $x_2$. An adversary is given two elements, $y_1= x_1^r \mod n$ and $y_2=x_2^...
- 79
1
vote
1
answer
103
views
Is it safe to derive Ed25519 and Kyber private keys from the same seed?
I am designing a Hybrid Key exchange library using x25519 and Kyber, and the scheme I have in mind is as follows:
Alice sending a file/message to Bob:
...
- 47
1
vote
0
answers
66
views
Can the byte overhead of an ECDH based hybrid cryptosystem be reduced by encoding data in ephemeral key?
Motivation
I have a use case that involves sending small (25-50 byte) encrypted messages over a very constrained channel. Many senders send public key encrypted messages to other receivers. Anonymity (...
- 1,701
0
votes
0
answers
83
views
Decrypt RSA knowing N, invp, and invq
im having a problem while solving a RSA problem, so i have python script to create a RSA key and cipher, from that i have n, invp, and invq. so my question is possible to decrypt the message only with ...
- 1
0
votes
0
answers
15
views
[error reducing techinique in lattice based commitment]
I am aware there are many techniques to reduce the error of lattice-based homomorphic encryption. But is there any technique to deal with lattice-based homomorphic commitment, e.g., More Efficient ...
- 327
0
votes
0
answers
44
views
Entropy output from 256-bit Argon2 input [duplicate]
I would like to deterministically derive two different 256-bit keys from a single passphrase -- one used as an ECDSA private key, the other as a symmetric key for AES-GCM.
Would a KDF output ...
1
vote
1
answer
92
views
Parse Algorithm in Kyber Specification
In the Kyber specification there is an algorithm "Parse", which receives a byte stream as input and from this the NTT representation $\hat{a} = \hat{a}_0+\hat{a}_1X + ... + \hat{a}_{n-1}X^{n-...
- 45
0
votes
1
answer
86
views
Is there a quantum-safe password-based authentication method that doesn't require giving the server too much data
I've been reading up on different authentication protocols recently while I implemented the sign-in functionality for my website. Many of the suggested methods password-based authentication seem to ...
- 435
1
vote
1
answer
46
views
Decryption of Naccache–Stern cryptosystem is not guaranteed for large keys
Naccache-Stern cryptosystem is mainly based on Chinese Remainder Theorem. According to its wiki page and Partially Homomorphic encryption book, I generated following keys.
1- Picked a family of k ...
- 229
0
votes
1
answer
64
views
How does FORS: Forest of Random Subsets work?
I saw a post named "How does signing with FORS work in SPHINCS+?" but in the post it seems like no one had explain how does the FORS works.
SK: Secret Key, PRF: Pseudo-Random Function
I'm ...
0
votes
0
answers
22
views
Understanding and Implementing fast base conversion (FastBConv, bconv) in Mathematica
According to Section 2.3 of Full-RNS CKKS:
More precisely, for a basis $ \left\{p_{0}, \ldots, p_{k-1}, q_{0}, \ldots, q_{\ell-1}\right\} $, let $ \mathcal{B}=\left\{p_{0}, \ldots, p_{k-1}\right\} $ ...
- 101
1
vote
1
answer
336
views
DHKE: Why using safe prime gives us "safe" subgroups?
I come from the question here: Safe primes subgroup in Diffie–Hellman key exchange
Where the accepted answer states that there are only 4 possible outcomes for the order of a subgroup when using a ...
- 175
-1
votes
0
answers
38
views
Suppose G1(s), G2(s) are PRGs that output elements in {0, 1}n. Then show that G1(s1) ⊕ G2(s2) is a secure PRG if either G1 or G2 is secure
I am trying to solve this numerical but I have difficulty to solve.
I search every where but I didn’t any solution related to it.
Can anyone write me the solution for this?
1
vote
1
answer
124
views
Is there an efficient way to check if a lattice has a point with all non-zero components?
Given a basis $\{v_1,\dots,v_k\}$ for a $q$-ary lattice $L$ in ${\mathbb Z}_q^n$, is there an efficient (deterministic/randomized) way to find a point in $L$ with all non-zero components, or decide ...
- 11
0
votes
1
answer
103
views
Does using multiple encryption algorithms with different keys on the same cipher text improve security?
I'm looking for maximum possible security. My current scheme is xChaCha20-Poly1305-xSalsa20-Poly1305-AES-CBC-HMACSHA-512. Does combining these algorithms increase security if implemented correctly? ...
0
votes
0
answers
38
views
Is it secure to encrypt an authentication token using another possibly hashed authentication token?
I'm working on a web app ("main") which acts as a central access hub for several other web apps ("children"). The users are supposed to authenticate in the main app, resulting in a ...
- 101
0
votes
1
answer
96
views
How to evaluate the minimum complexity of the key recovery when the success probability p is given？
Since the practical security of a symmetric-key primitive is determined by evaluating its resistance against an almost exhaustive list of known cryptanalytic techniques.
My problem is that could we ...
0
votes
0
answers
48
views
Efficiently using BSGS or other algorithms if key range is known on Elliptic Curves
Let $X$ be a point on an elliptic curve such that $X = [x]G$, where $G$ is a generator. Let us assume that we know $x$ is something $x = 65t + 1$ where $t$ is an integer.
Now if I know that the key ...
- 31
0
votes
0
answers
38
views
Zero Knowledge 3-coloring, but we allow malicious V to challenge two edges
So I think I understand how zero knowledge protocol with 3-coloring is supposed to work. But in an attempt to increase soundness of the protocol, we allow the verifier V to challenge two edges per ...
0
votes
0
answers
55
views
Proving if two samples hides a value?
Given two values
$r'-r \mod q$
$i - r \mod q$
Where
$r',r$ sampled randomly from $Z_q$
while i is pick arbitrarily from $Z_q$ and a secret
Can we claim that this hides $i$?
Here is my sketch:
...
0
votes
1
answer
153
views
Implementing Floor Division on secp256k1 Elliptic Curve in Python
I understand that the // operator is used for floor division in regular arithmetic
result = 7 // 3 # This will result in 2
but ...
- 9
0
votes
1
answer
38
views
Sumcheck Protocol: How to represent a matrix as an MLE which takes row & column numbers as parameters?
This is from Justin Thaler's book - Proofs, Arguments & Zero Knowledge
Page 43
For it to make sense to talk about multilinear extensions, we need to view the adjacency matrix $A$ not as a matrix, ...
- 2,169
1
vote
1
answer
175
views
Key exchange for encrypted firmware update
I'm trying to implement encrypted firmware update functionality for an embedded device. The goal is to prevent reverse engineering of our firmware when the update files are shared with our customers.
...
- 23
6
votes
1
answer
3k
views
What is malicious privacy?
This paper says in the appendix，
At a high-level, malicious privacy is defined similar to malicious security, but with a modified ideal functionality that is corruptible, meaning that the adversary ...
0
votes
0
answers
35
views
What is the security of XTS block cipher mode of operation if the key is much larger than the block size?
I made two Linux kernel modules of Hasty Pudding Cipher with key size of 16896-bits (16384-bits key + 512-bits tweak also called "spice), one has 512-bits of block size, the other 128-bits.
I ...
- 391
1
vote
1
answer
37
views
python argon2-cffi salt is different than the one passed
Here's the code:
salt = b'salt123123123'
password = 'password123'
hash_password = argon2.PasswordHasher().hash(password.encode('UTF-8'), salt = salt)
Returns
...
- 11
2
votes
1
answer
96
views
Recover Y coordinate from xz elliptic curve multiplication
I have an elliptice curve in the form
y² = x³ + ax + b (mod p)
And I have a multiplication algortihm which uses only x and z coordinate
How can I recover the Y coordinate ?
I tried to use the curve ...
- 21
1
vote
1
answer
78
views
Is gcd(e,p−1)=1=gcd(e,q−1) similar to gcd(e,phi(n))=1?
I wonder, is $\gcd(e,p−1)=1=\gcd(e,q−1)$ similar to $\gcd(e,\phi(n))=1$ ??
- 11
-2
votes
3
answers
168
views
All 32 bit primes on 1 640Mb CD-ROM , and then used as immediate lookup of resulting prime factors, is that even possible, in early 1990s? [closed]
I was having a conversation with a private key cryptologist who claimed they created and distributed, in the early 1990s, all 32 bit primes on 1 640Mb CD-ROM, which could also used for immediate ...
3
votes
1
answer
217
views
RSA/ ECC keygen HW vs SW
i have a pretty straightforward question but i can’t seem to find an answer :
Regardless of the physical protection provided by an HSM or TPM or any hardware cryptographic key storage system, are keys ...
- 51
0
votes
0
answers
59
views
Does something like Symmetric reencryption exist?
I'm an amateur so bear with me.
I was thinking about an E2E solution for data-at-rest proxy scenarios (like cloud storage provider) that allows you to issue and revoke users via symmetric keys.
I'm ...
- 140
2
votes
2
answers
90
views
Is it possible to check pedersen commitment is of postive or negative number without knowing the original value
I generated a Pedersen commitment for a given account balance (say, 10) and stored it in the ledger. Now, when I debit 15 tokens from the same account, I first retrieve the Pedersen commitment of 10 ...
- 21
0
votes
0
answers
29
views
Three ECDSA signatures sharing first component r, verifying against same message and public key?
For some common curve, can we exhibit three distinct ECDSA signatures $(r,s_1)$, $(r,s_2)$, $(r,s_3)$, a message $m$, and valid public key $Q$, such that the signatures verify?
Can we also generate ...
- 138k
0
votes
0
answers
28
views
Is hashing really enough for data integrity or needs signing? [duplicate]
Hashing functions are used for data integrity when integrated with signing asymmetric algorithms but I miss a step. In multiple sources like here or here I read for granted that hashing algorithm per ...
- 129
0
votes
1
answer
40
views
Does the use of a passkey (FIDO) link your physical device id, eg IMEI, to that specific passkey?
Passkeys are being introduced.
From what I understand so far, a passkey involves the storage of a private key, and retention of a public key with the internet service. Eg Google, Apple, Microsoft, ...
- 103
2
votes
1
answer
305
views
Disclosure of Catastrophic Cryptanalytic Breakthroughs
An efficient algorithm for factoring would be a major mathematical achievement giving the person who discovered it anstant fame. About two years ago, C. P. Schnorr claimed such a breakthrough but it ...
- 21.2k
0
votes
0
answers
46
views
In RSA Encryption, Can I choose the public exponent e > m (modulus) ? or e > φ(n)? [duplicate]
In RSA ,the encryption, Can we choose the public exponent (e) greater than m (modulus) or e > φ(n) ? I wonder about choosing public key exponents (e) because the most information on the internet or ...
- 11
1
vote
2
answers
111
views
Can ECDSA be broken if same nonce is used with the same message?
I have a scenario where $k_2 = -k_1$ while $z_1$ and $z_2$ are identical but the values $s_1$ and $s_2$ are different.
So we have $r_1 = r_2$ and $z_1 = z_2$ but $s_1 \neq s_2$.
Does this mean an ...
2
votes
0
answers
40
views
SRP on elliptic curves: replacing + and - operations?
I was thinking about how SRP might be used with Curve25519 or Curve448. In this question, Can SRP be used with Elliptic Curves?, the answer is that you can't directly translate SRP to a group that ...
- 2,513
0
votes
1
answer
40
views
What are the statefulness and signature count limits of SPHINCS+?
SPHINCS+ is an interesting post-quantum algorithm, and I'm curious about what its limitations are. What I know about hash-based signature formats in the past are that you needed to remember which ...
- 2,513
0
votes
1
answer
95
views
Hybrid key exchange in TLS 1.3
In Hybrid key exchange in TLS 1.3, they mention that with a hybrid approach, we concatenate the shared secret from each method (say KEM like Kyber768 + classical ECDH X25519 = X22519Kyer768).
...
- 147
3
votes
1
answer
94
views
How much can we compress RSA public keys with two equal size factors?
Can we define an RSA variant in which the public key with $n$-bit public modulus $N$ has a compact representation of $\kappa\ll n/2$ bits, with a security argument that it is as safe as regular RSA ...
- 138k
3
votes
1
answer
370
views
SHA3-256 vs SHAKE256_256 in XMSS and SPHINCS
By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256
i.e. SHAKE256_256(M) = SHAKE256(M,256)
What is the motivation of choosing SHAKE256_256 ...
- 153
0
votes
0
answers
30
views
How can I determine if the result of subtracting two Pedersen commitments is negative or positive?
I'm using Pedersen commitments to maintain the account balance in the ledger.
Assume that when I create the account, I record the Pedersen commitment of 0 in a ledger (here, the blinding factor and ...
- 21
4
votes
1
answer
149
views
Is this new bound for Wiener Attack well accepted?
I found this recent paper The Wiener Attack on RSA Revisited:
A Quest for the Exact Bound, which reported a new bound $d\le \frac 1 {\sqrt[4]{18}} N^\frac 1 4$. Is this well accepted in the ...
- 159
0
votes
0
answers
39
views
Is using a CPA secure public key encryption twice on two halves of the message with different keys secure?
If $\Pi=(\mathrm{Gen},\mathrm{Enc},\mathrm{Dec})$ is a CPA secure public key encryption protocol, is the following public key encryption CPA secure?
$\Pi'$:
$\mathrm{Gen'}$: Run $\mathrm{Gen}$ twice ...
