# All Questions

27,478 questions
Filter by
Sorted by
Tagged with
1 vote
183 views

### How to know that MAC isn't modified in ECIES

I am new to ECC but I was wondering, If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still ...
1 vote
37 views

### Reusing base Oblivious Transfers

I am new to Oblivious Transfer (OT) and am having trouble finding a definitive answer regarding if/when/how baseOTs can be reused in a computation when using OT-extension (for passive security only). ...
• 21
55 views

### How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
81 views

### How do we calculate a power with a gigantic exponent?

In RSA, signing the hash of a message is doing the operation $h^{d} \bmod N$ where $d$ is the private key. Given that the size of $d$ is usually 2048 bits and $h$ is a quite big number, the ...
• 101
128 views

### TLS 1.3 and its use of HKDF-Extract

HKDF-Extract is defined in RFC 5869 as ...
1 vote
58 views

### Assuming secp256k1 curve and given fixed (but random) $h$ and $d$ values, is it possible to calculate a $k$ such that $h\equiv(k\,G)_X\,(k-d)\pmod n$?

For generator point $G$ in the secp256k1 curve, I want to find a value $k$ such that: $$h\equiv(k\,G)_X\,(k-d)\pmod n$$ where $n$ is the group order, and $(k\,G)_X$ indicates the x-coordinate (mod n) ...
65 views

### Is there any relationship between avalanche and permutation in block ciphers?

Avalanche is one of the characteristics of S-Box or SP network(S and P boxes are used together).Is it possible for the permutation module, when tested alone, to show avalanche effect.? reference SP ...
2k views

### How to prove that both people know the same dictionary word?

What would be a way to prove that both you and I know the same dictionary word? If we both hashed the word, then we could compare the hashes, but anyone who saw the hash could find the original word ...
• 169
82 views

### Step-by-step conversion of Private Key in Hex to WIF (Wallet Import Format)

According to this webpage: The process of encoding a private key into WIF format is as follows. Raw private keys are simply large numbers, which are represented as bytes. WIF format adds a prefix ...
1 vote
72 views

### Byte-Serial implementation of AES

I am trying to make a byte-serial implementation of the AES 128-Bit in ECB-mode for my studies. I understand the "normal" (word-parallel) implementation of AES and the way of Eli Biham (bit-...
1 vote
46 views

### Aes-Gcm how to perform decryption authentication without plaintext output in C#

I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file. One thing I ...
• 23
50 views

### encrypting a document with 2 different keys

Is there a way to encrypt a file with 2 (or more) keys and then access it with only 1? scenario : Bob and Alice have a tight memory and can only remember ONE key. Bob and Alice encrypt a file with ...
2k views

### The death of isogeny-based cryptography?

Wouter Castryck and Thomas Decru recently broke SIDH. From the abstract: We present an efficient key recovery attack on the Supersingular Isogeny Diffie-Hellman protocol (SIDH), based on a "glue-...
• 111
1 vote
87 views

### Prove a plain text belongs to encrypted data

Given an encrypted (RSA) message and it's original plain text, is there a way to prove that the plain text belongs to the encrypted message ?
32 views

### Hello, I want to generate and transfer TPK to a 3rd party.hence, I need to create 3 ZMK components and share with 3 custodians from 3rd party

Below are the steps I have figured out for the same. GC( generate component) or OC (generate cand print component) Component 1, 2, 3 In order to share clear components with 3rd party, guess have to ...
1 vote
57 views

### Cryptography methods that allow for multiple keys to be used?

I'm currently working on a webapp in which I'd like all nearly all user data to be encrypted, but accessible by multiple users (ie a doc encrypted should be decrypt-able by parties A, B, C, all ...
• 13
40 views

### How to secure confidential data in memory

I am currently working on password manager. So far I used one encrypted database file to store all the passwords and then decrypted it at runtime with a derived user-entered master password. All log-...
• 37
32 views

### LSAG implementation in Python

Context I am implementing LSAG in python because I do not find a non-obviously insecure implementation. I am not a cryptographer myself, thus simplicity is key. The famous Linkable Spontaneous ...
68 views

### In SPDZ, difference between protocol in $\mathbb F_p$ and in $\mathbb F_{2^k}$

I have read SPDZ family protocol, the domain of the spdz_1 in 2012 is $\mathbb F_{p^k}$. Later mascot'16 supports both $\mathbb F_p$ and $\mathbb F_{2^k}$, where $p=2^k+u$. I want to know the ...
• 21
34 views

### the difference between field $F_{2^k}$ and ring $Z_{2^k}$ in multi-party computation, especially in SPDZ family [duplicate]

I have seen different protocols in field or ring, I used to think ring is a special field when 2^k. But when I read the paper later, I doubted my understanding.
• 21
61 views

### Does NIST SP800-56C r2 forbid using NIST-approved two-step KDFs for not-all-at-once key-derivations?

NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by ...
1 vote
87 views

### Request for Ring signature numerical example or simple python code

I am reading about the Ring signature. However, I do not understand the verification process of this signature. Could you provide me a complete numerical example showing the signature creation and ...
• 129
1 vote
163 views

### Does a self-build random 256-key based on substition and permutation have the same power as an AES-key?

As far as understand AES takes 16 bytes, shuffles them and replaces every of the 256 bits via XOR. Then the same procedure applies to the next 16 bytes, and then again - until the entire file is ...
29 views

### Assumptions used for Designing Homomorphic CRHF

What are the possible assumptions that have been used or can be used for designing the homomorphic Collision Resistant Hash function (CRHF)? I know Short Integer Solution (SIS) is one of the ...
16 views

### How to ensure the security of computation and transmition on Smart Contracts?

Suppose there is a smart contract with a bidding function, and the bidder can send the bid price to the smart contract after encrypting it. When the auction is over, a trusted third party sends the ...
• 186
16 views

### Are real-or-random model and LR-model are equivalent?

Are real-or-random(rr) model and LR-model are equivalent? In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent. Here is ...
• 25
1 vote
63 views

### Creating a basic SHA256 hasher in Circom

I want to create a SHA256 hasher in Circom so I can validate that a person knows the pre-image of a SHA256 hash without revealing the pre-image. This is my current code but it doesn't work: ...
52 views

### Bleichenbacher '06 signature forgery against modified PKCS1 v1.5 format

Bleichenbacher’s ’06 RSA signature forgery targets incorrect PKCS1 v1.5 implementations where padding checks are omitted and RSA keys with e = 3 are used. As per ...
• 131
750 views

### What is DES-EDE3-CBC?

I came across DES-EDE3-CBC and a quick search didn't yield a clear explanation of what it is. Clearly, DES is the Data Encryption Standard and CBC is the Cipher Block Chaining mode. EDE is probably ...
• 213
1 vote
68 views

### How to compute $\frac{1 + a_1 \times \dots \times a_n}{b_1 \times \dots \times b_n}$ where $a_i$ and $b_i$ are secret?

How can $n$ peers compute $$\frac{1 + a_1 \times \dots \times a_n}{b_1 \times \dots \times b_n}$$ such that the pair of values $a_i$ and $b_i$ remains secret to the $i$-th peer?
• 111
25 views

### padded RSA encryption: valid ciphertext from another

Considering padded RSA. Given an encrypted packet E(pubk, x) is It possible to generate a valid encryption E(pubk, x|y) without knowing the value x (but knowing only y)? For example merging in some ...
• 1
1 vote
108 views

### The XOR operation, is it a quantum resistant operation and why is that? if not, what is the most lightweight alternatives?

The XOR operation is an important part of most of the existing end-to-end authentication protocols. Will it be part of the post-quantum authentication protocols?.
• 11
30 views

### Double hashing scheme on not collision resistant hash

Given an hash H that is not collision resistant, for example 80-bit digest, if we use the following double hashing scheme: H(SHA2-256(x)). Does this scheme increase the collision resistance?
• 1
37 views

• 404
19 views

### About notations that are used to describe probability that A wins the game(probabilistic algorithm?)

I am studying cryptography by myself, especiall and there are somewhat confusing notations. Here are two examples in digital signature that I want to check: Pr \left[ 1 \leftarrow \mathcal{V}(\hat{\...
• 25
54 views

### pros and cons of cryptographic session token

I designed a simple library (golang) for use as session token for web applications. The idea is simple: the token will be 16-byte long, denote it as t generate a ...
• 135
1 vote
62 views

### What is the meaning of the power notation in the access structure?

In the paper about ABE (like this), the access structure is defined as follow: Let ${P_1,P_2,...,P_n}$ be a set of parties. A collection $A⊆2^{\{P_1,P_2,...,P_n\}}$ is monotone if $∀B,C$: if $B∈A$ ...
• 13
521 views

### How to select e for RSA test questions?

I know I am not supposed to ask for answers, which I am not. I have the solution but I don't understand how 'e' is selected, pls see my explanation below. I am doing practice questions for my Cyber ...
• 21
178 views

### Are digital signatures unique for the messages they sign?

Practical implementations of digital signature algorithms (DSAs) employ hash functions to ensure that input is small and of a fixed sized; otherwise, DSAs would be too slow for most real-world ...
24 views

### Ipsec dh key generation doubt

I have doubt like when in the ipsec we use dh group for key exchange it take prime number and g value from group bit but in the msg 3&4 exchange how the key exchange payload and nonce will help to ...
15 views

### fastest method of CNF equation solution verification

I am trying to find a way to mine bitcoin faster than an ASIC by using a CNF representation of sha(sha(hash)), which would be an equation containing a few hundred thousand clauses, let's call it n ...
58 views

### Can salt for HKDF be hardcoded within a program

i am new to cryptography , i am using article https://medium.com/asecuritysite-when-bob-met-alice/hmac-and-hkdf-df4e194752d1 for reference , while using salt with hkdf to derive multiple keys from a ...
33 views

### Provable security with over-computing power

Suppose we are trying to construct a cryptographic scheme, say public key encryption, and I can prove the IND-CPA security of the PKE scheme when any adversaries perform at least $T$ queries. That is, ...
• 129
60 views

### Provably secure and Practical ciphers

Are there any ciphers that are provably secure (reducable to a hard problem (including like factorization, not necessarily to NP-Complete or harder) ) are practical (not necessarily for too much ...
• 41
58 views

### Constructing a PRF from PRG, with more parallelism

The famous result of Goldreich, Goldwasser, and Micali (GGM) constructs a PRF $F$ from a PRG $G$: ...
• 10.8k
245 views

### What does "key version" refer to when talking about AES 128 in NXP's datasheet?

I'm going through the datasheet for MifareDesfire ICs. Throughout the document, there are mentions of "key version". For example, section 9.3 of the document states: Hardware AES using 128-...
• 143
69 views

### Simplest recursive SNARK working example

I have been doing some research into recursive SNARKs. But I haven't found a working code example such as this one using Zokrates or this one using snarkjs. Anyone knows one such example, say, for ...
• 145
43 views

### what is the difference between a substitution cipher and an oracle

I was looking into the opaque authentication protocol and they discuss an oracle, which, if I understand it correctly is a projection Z from f to g (g at least the size of f), which maps inputs from f ...
I am assuming a set of $n$ players and a central "dealer" $C$ through which all communication is routed. The state I want to end up with is that each player $i$ has a secret $s_i$ unknown to ...