All Questions

Filter by
Sorted by
Tagged with
2 votes
1 answer
126 views

Breaking ecdsa with biased nonce

I'm trying to do this cryptopals challenge for breaking ecdsa with biased nonce but everything I do fail to work. I'm trying my attack with 4 signatures and 128 bit bias. ...
user avatar
  • 53
1 vote
2 answers
71 views

What is Plaintext-awareness?

Could you explain with an example what does it mean to be Plaintext-awareness. I have read the wiki definition. It says that "A cryptosystem is plaintext-aware if it cannot genenerate a valid ...
user avatar
0 votes
0 answers
44 views

is HMAC required if i am using AES-CFB and using Digital signatures for Authentication

I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-...
user avatar
2 votes
1 answer
70 views

Security level of the hash of the sum of two uniformly random keys

I generate two uniformly random 127-bit integers $a$ and $b$. I calculate $c=a+b$, which means $c$ can always be represented as a 128-bit integer. $c$ will not be uniformly randomly distributed, but I ...
user avatar
  • 3,112
0 votes
1 answer
86 views

What is the lightest cipher that provides AES like security?

The lightest, or fastest cipher, that is well known and quite secure like AES. Is ChaCha20 a good option? Are there any better alternatives that are faster but still as secure?
user avatar
0 votes
0 answers
60 views

How do I decrypt an encrypted message with an RSA private key?

I have an encrypted password I must decrypt as part of a challenge. Along with the password came a few UNENCRYPTED RSA private keys From what I understand, all I need in order to decrypt the password ...
user avatar
2 votes
0 answers
26 views

Question about Ligero protocol

I have a question for those that might be familiar with the ligero protocol: Ligero In this protocol to be using an MPC in the head paradigm: described here. However, in the description of their ...
user avatar
0 votes
0 answers
23 views

Is there somthing like a portable certificate?

We are developing a software with a WebUI. The idea is, that you have a device (maybe a Raspberry if there are some available..., sometime in the future..., maybe...) where this Software is installed ...
user avatar
1 vote
1 answer
55 views

Simplistic double ratchet implementation

Would something like this be a reasonable way to implement the double ratchet with libsodium? The sodium port that I'm using is quite limited and does not offer a ...
user avatar
  • 113
1 vote
1 answer
80 views

Is HMAC-SHA512 with 512 bit key Quantum Safe?

is HMAC-SHA512 quantum safe , I am planning to use it for encrypt-then-mac scheme with aes256-cfb mode for a post quantum safe PGP like protocol.
user avatar
5 votes
1 answer
648 views

Is Argon2 Quantum safe? [duplicate]

I am developing a post quantum safe GPG like program, is argon2 quantum safe cryptographically for GPG like application.
user avatar
1 vote
0 answers
55 views

Comparison Hash, MAC, Signatures, Certificates

I saw a table comparing Hash/Mac/Signatures in this post. I was wondering if I can integrate digital certificates into it like this: Hash MAC Signature Certificate + Signature Integrity Yes Yes Yes ...
user avatar
  • 111
0 votes
2 answers
148 views

I need an encryption algorithm that doesn't require keys and computationally easy to encrypt, hard to decrypt

I need an encryption algorithm that doesn't require keys and computationally easy to encrypt, hard to decrypt. Decrypting can involve brute force. If the algorithm can be applied again and again (...
user avatar
  • 3
1 vote
0 answers
37 views

No decryption algorithm for Hummingbird-2?

I stumbled upon hummingbird-2 encryption algorithm when I was looking for a lightweight encryption module that can be used in resorce-restrained environments like Network-on-Chips. A problem I faced ...
user avatar
2 votes
1 answer
27 views

Limit definition of negligible function

I am reading Dan Boneh's book and I am stuck on Theorem 2.11, whose proof is left as an exercise. The question is: prove that if $\lim_{n \rightarrow \infty} f(n)n^c = 0$ for all $c > 0$, then $f$ ...
user avatar
2 votes
2 answers
82 views

How does combining data affect the resulting file entropy?

If i add a password which has (X) bits of entropy as a tag to a picture which has (Y) bits of entropy, will the resulting image have an entropy equal to (X + Y) ? How many bits of entropy i get if i ...
user avatar
  • 57
6 votes
2 answers
1k views

What's the point and use of 512-bit-style elliptic curves?

There is a plethora of elliptic curves that are close to the 256-bit security level (i.e., fields and groups of approximately 512 bits). Examples are Curve448, P-521, Brainpool-P512. The standard ...
user avatar
1 vote
1 answer
100 views

XChaCha20 vs AES 128 security and speed

Is XChaCha20 with 256 bit key and 192 bit nonce more secure than 128 bit key 128 bit key nonce AES, due to using larger key/nonce sizes? Isn't it supposed to be faster due to being a stream cipher? (...
user avatar
0 votes
2 answers
103 views

Use blake2 permutation as a block cipher

Blake2(1024 bit state) permutation (compression function core) is basically a modified ChaCha permutation. One of the modifications is to mix in message bits (key schedule?). Given that blake2 is a ...
user avatar
0 votes
0 answers
20 views

Generalizations of designated verifier signatures?

Are you aware of any paper where the approach of Designated Verifier Proofs and Their Applications paper is generalized? The idea of the paper is that you can generate a signature that can be verified ...
user avatar
  • 67
1 vote
1 answer
41 views

How can I distribute a set of anonymous tokens digitally among a known limited population to do anonymous voting?

TL:DR How can I give a population of N people the chance to randomly pick one token each person guaranteeing those: Nobody knows noone else's token. Noone can pick more than one token. Every person ...
user avatar
1 vote
1 answer
45 views

RSA: Does it worth to calculate missing CRT parameters when you have just N, E, D, P, Q?

OpenPGP defines RSA secret key in a way which differs from PKCS #1,having the aforementioned values plus U = P^-1 mod Q. However, OpenSSL seems to work only with <...
user avatar
2 votes
2 answers
455 views

Are all quadratic twists of an elliptic curve equivalent?

I'm studying ECC, so this is focused on elliptic curves over finite fields. I've always seen the quadratic twist $E'$ of an elliptic curve $E$ defined as the elliptic curve with equation $dy^2=x^3 + ...
user avatar
  • 35
0 votes
1 answer
21 views

Randomness of recursive sequence generation

How good from randomness point of view are recursively generated sequences using good encryption algorithms? Let us say I take AES128 which generates good random sequences of outputs for counter ...
user avatar
1 vote
1 answer
53 views

Does RIPEMD-320 provides the same level of security as RIPEMD-160?

This article from Wikipedia claims that "256- and 320-bit versions of RIPEMD provide the same level of security as RIPEMD-128 and RIPEMD-160, respectively". Is that true or false ? And why ?
user avatar
  • 57
2 votes
1 answer
59 views

Show that function isn't a PRF

Let $F$ be a PRF such that $|F(k,x)|=2n$ show that $F_2$ isn't a PRF. Let's assume $F(k,x)=(y_1,...,y_{2n})$ then $F_2(k,x)=(y_1\land y_2,...,y_{2n-1}\land y_{2n})$. I want to prove $F_2$ isn't a PRF ...
user avatar
  • 51
2 votes
1 answer
71 views

Dieharder tests on ATmega328p floating analogue pin A0 passing unexpectedly

Out of interest I wanted to test the results of using a floating analogue pin on my Arduino to generate a sequence of random numbers using dieharder. My working assumption was that it would be a poor ...
user avatar
  • 21
0 votes
0 answers
34 views

Is Whitebox Encryption not just a fancy obfuscation? [duplicate]

Whitebox Encryption embedds the key inside the encryption algorithm in a way that makes it difficult to reverse engineer. However it seems all implementations can be efficiently broken. So, is a ...
user avatar
  • 111
1 vote
1 answer
82 views

ECDSA | How to determine if a public key `y` value is positive or negative?

As we know every x value has two y values which are reversed. Just by having the public key, is there a way to determine which side the y value is? My first ...
user avatar
  • 11
2 votes
1 answer
147 views

Discovery of Ed25519 128-bit private key where a KDF has not been used

If there is a uniformly random 128-bit private key scalar $x$, with the corresponding public key $X=xG$ (where $G$ is a well-known base point), how difficult would it be to discover $x$ from $X$? I am ...
user avatar
  • 3,112
1 vote
2 answers
64 views

Argon2id creating key for cryptography, how acceptable is it to use the same salt for the same encryption operation?

Everyone knows Argon2id is a slow hashing algorithm, and that's on purpose, all is good. When creating an Argon2id object a lot of parameters are needed to be taken into consideration ultimately ...
user avatar
  • 23
-2 votes
2 answers
66 views

Can we change the content of an encrypted message without changing the public key?

A supplier is sending me very private information. For security, we are using thedecryptor.com website to encrypt the message. The website provides public and private keys. We agreed that he will ...
user avatar
0 votes
1 answer
43 views

What's the best approach to make PRNGs favourably deterministic a.k.a. biased and how to protect yourself against this?

First of all, I'm not an expert or even a novice in Cryptography. I mean this has certainly been implemented by some scummy PRNG developers, which thought of the economics behind it (especially in the ...
user avatar
1 vote
2 answers
46 views

How does a CertificateVerify message prevent MITM attacks in TLS 1.3

I' following along the book "Realworld Cryptography", in chapter 9 where the TLS protocol is introduced, they mention: Following [authentication], the server can use its certified long-term ...
user avatar
  • 113
1 vote
0 answers
56 views

How to choose the large noise when using noise flooding technique in FHE?

In LWE based multi party FHE schemes, the parties should choose a much larger noise when perform joint decryption. In this paper, the author just said that using noise flooding technique to avoid the ...
user avatar
  • 409
0 votes
2 answers
114 views

Is there a proof that guarantees strength of password?

Is there any proof that guarantees that a password with specified features (eg. with random special characters, combination of numbers & letters, some length etc) is secure? If there is such a ...
user avatar
1 vote
2 answers
118 views

Is there a scheme to enforce a random seed without leaking the seed?

End-to-end encrypted web services (like cryptpad) often include a 128-bit seed in the hash part of the URL (that is not sent to the server), to derive both an identifier that is sent to the server, ...
user avatar
  • 113
0 votes
1 answer
72 views

Is this possible?

So I've been working on a project that aims to allow online distribution of one-time-pads securely. I understand that a pad cannot be reused and must be truly random, and that if it is compromised, ...
user avatar
0 votes
0 answers
8 views

How to write a function that performs reentrant calls to an ERC20 token transfer() and transferFrom() functions? [migrated]

Description I was writing security tests for an ERC20 token. I was researching online about reentrancy attacks and found that it is mainly accomplished by using a <...
user avatar
3 votes
1 answer
104 views

NIST expression for HMAC security strength

In NIST SP800-107, NIST claims that the security strength of HMAC is MIN(security of HMAC key, $2L$). $L$ is the length of the output of the underlying hash function. Let's take HMAC-SHA256 as an ...
user avatar
0 votes
0 answers
14 views

What is stored in a register method using the OPAQUE protocol?

I am currently studying OPAQUE, and have no prior deep experience with cryptography. I am currently trying to develop a login/register system using OPAQUE for the authentication process. Should I ...
user avatar
0 votes
1 answer
92 views

Is it possible to break SHA-256 with hash tables?

If x is the value you're hashing, $t(x)$ is the hash of that value, and $t(x+s)$ is that value with salt, then hashed. You could create a hash table where the key is $t(x+s)$, the value is $x+s$, and ...
user avatar
0 votes
0 answers
20 views

How to select the top two highest (or smallest) value in Two/Three Party Computation?

I want to select the top two secret-shared values from a vector of secret-shared values among 2/3 parties. Formally, given secret-shared (assume using additive/replicated secret sharing) vector $<V&...
user avatar
  • 63
1 vote
2 answers
184 views

Does the AES-GCM specification require the tag-size to be bound to the GCM context?

Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)? Asked differently, is the following a legitimate adherence to ...
user avatar
1 vote
1 answer
81 views

Probabilistic SHA-256 hash tending all values to 0.5

I wrote SHA-256 with arrays of integers representing the bits (e.g. [1,0,...,1]), and then I altered it to accept partial values (e.g. [0.5, 0.79, 0.0, 1]), as in each value has an x chance of being '...
user avatar
1 vote
1 answer
83 views

I don't undertand the meaning of 'Authenticity' property

Considering an HMAC algorithm: it shall guarantee integrity and authenticity. I don't understand what authenticity means: that signature could be generated by anyone having the shared secret key (non ...
user avatar
0 votes
1 answer
26 views

How is BLS secure against adaptive selection message attacks when the message is known?

Maybe the below question is similar to what I was thinking, but I don't understand: Is BLS signature scheme strongly unforgeable? Below is the attack method I was thinking of. If know m, can't create ...
user avatar
12 votes
1 answer
2k views

Why did NIST select Kyber and Dilithium?

NIST selected Kyber for key agreement and Dilithium for digital signature applications some days ago. But IDF's MATZOV group, in their paper, broke Kyber and Dilithium and brought the security levels ...
user avatar
  • 121
1 vote
0 answers
76 views

Can I use content-derived deterministic encryption key with hybrid encryption?

My use case, making public-key encrypted backups, requires deterministic public-key authenticated encryption. I favour NaCl box, but the way it is generally used is probabilistic and it yields ...
user avatar
  • 11
2 votes
0 answers
52 views

What is the key-derivation used in pdf2, is there a secure option?

I recently needed (for legitimate reasons) to crack an encrypted pdf sent by a local bank. It was pdf1.7 and the password was 6 digits. cracking it with John the ripper took no time at all. In fact it ...
user avatar
  • 10.6k

15 30 50 per page