All Questions

21,485 questions
Filter by
Sorted by
Tagged with
29 views

What does “Clocked” mean in alternating step generators

In the wiki article, it says "An ASG comprises three linear-feedback shift registers, which we will call LFSR0, LFSR1, and LFSR2 for convenience. The output of one of the registers decides which of ...
51 views

If ChaCha20 is being used just as a CSPRNG, is nonce needed?

I'm planning to use ChaCha20 just as a CSPRNG. Key is random (taken from strong initial entropy source) and will be constantly replaced via DJB's fast key-erasure scheme. What should I use as the ...
997 views

Is it safe to convert a 256-bit nonce into a 192-bit nonce by SHA-256ing and then truncating it?

I'd expect a 192-bit nonce derived from a 256-bit nonce by computing the SHA-256 hash and then truncating it to 24 bytes to behave like an approximately uniformly randomly generated 192-bit nonce and ...
48 views

What's a relatively fast way of checking if a string is decrypted English?

I asked this on Stack Overflow but I was told to ask here. I'm writing a program that decrypts text encrypted using a Vigenere cipher. It's been working very well so far, but my current issue is that ...
18 views

HSM: How multiple users are supported (using SAM)? [closed]

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
64 views

List of big strong primes

I want to make a Diffie Hellman key exchange code using Python, but I'm afraid of just randomly picking $g$. I read on the answer of Thomas Pornin to this question How does one calculate a primitive ...
28 views

How to use Whitebox aes

There are server programs and client programs. ・Prepare two keys (A, B) for AES. ・The A key creates an encryption table in advance with WhiteboxAes. ・The B key creates a decryption table in advance ...
29 views

How to solve polynomial modular equation to create a correct decryption algorithm

I recently had a variant of the following problem in my cryptography course and I had trouble solving it and was looking to get some help. Given the symmetric key cryptosystem: $\text{KG, Enc, Dec}$ ...
52 views

Extract adversary's secret input in simulation based security proofs

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
52 views

I am wondering if there is any reason to regularly update cryptographic keys, that are used for authentication purposes in a real-time system. A key should be updated if it is weak, broken, ...
68 views

Difference between using Schnorr Protocol and just compare hash function to prove knowing something?

I am studying Schnorr Protocol and I just come up a case. For example I am a Prover and have a secret $x$. By using Schnorr Protocol, I create $h=g^x \bmod p$ and save $h$ to a public place. When ...
36 views

19 views

Converting Smart Contracts into Arithmetic Circuits [migrated]

Are there any existing programs available to convert smart contracts into Arithmetic Circuits with which I can implement and experiment with Secure Multiparty Computation (MPC) protocols?
28 views

I try to generate other S_BOX for AES but I don't realize how to choose additive constants for S_BOX from decryption if for encryption it is 0x63 why is ...
21 views

Two ElGamal ciphertexts equivalence

Is there a way to prove that two ElGamal ciphertexts encrypt the same message with different public keys without knowing the private keys? The prover is the producer of both ciphertexts.
17 views

Whether there is a public key encryption system based on elliptic curve with the property of multiplication and addition homomorphism。

I want to implement it on the intelligent contract and then do the development，because use paillier i cant genereate 1024bits key,so i try to find if there is exit a public key encryption system based ...
203 views

A possible error in the book

So I have been reading this book called "Implementing SSL/TLS using Cryptography and PKI" While going through it, this snippet of code got me baffled ...
61 views

How to reduce Computational Diffie–Hellman problem and Decisional Diffie–Hellman problem to Discrete logarithm problem

I'm supposed make some reductions but don't even know where to start. Any help would or explanation on how to do this would be much appreciated.
41 views

How to perform the initial permutations 64-Bit DES to derive $K$?

Perform DES encryption on the first 64-bit plaintext only, what are these 0's and 1's? Do they mean that I need to use this ...
36 views

Trivariate Coppersmith Implementation

Bivariate Coppersmith is standard package in math software with number theory support. Bauer and Antoine Joux introduced trivariate Coppersmith in https://www.iacr.org/archive/eurocrypt2007/45150361/...
20 views

Can you derive the AES key if both cleartext and ciphertext are known? [duplicate]

If you have a single 128-bit block data in cleartext and the exact same data encrypted with an unknown AES key (the key length is known, though), is there any possibility of determining that key other ...
46 views

Can I retrieve a re-hashed (hash) value, for instance by additional hashing?

I have a double-SHA-256 of some text $$h_2 = \operatorname{SHA256}(\operatorname{SHA256}(m)).$$ I don't need the plain text ($m$), but somehow I need to get first $$h_1 = \operatorname{SHA256}(m).$$ ...
48 views

Encryption with 2 symmetric keys and decryption with one key

Here is my use case: I need to keep encrypted data in Hadoop. The data is encrypted with symmetric key that is being changed every half a year. When data is retrieved it should be decrypted. Lets ...
33 views

How to encode SHA-256 as a quadratic span program?

I'm trying to understand the step-by-step zkSNARK's generation process for proving the knowledge of the hash pre-image (as in this example). However, I don't understand how exactly SHA-256 is turned ...
27 views

For this background, the prover knows a secret $x$ for $h=gx$. Prove to the verifier that he knows $x$. (I know $h=gx$ is not a NP problem, I just want to practice the Sigma Protocol) Step 1 : $P \... 2answers 44 views set of integers modulo an integer q in lattice Some literature about lattices set$\mathbb{Z}_{q}$in$[-\frac{q}{2}, \frac{q}{2})\cap \mathbb{Z}$but not$[0,q-1]$such as "lattice signatures without trapdoors" and "lattice based blind ... 1answer 101 views A hash functin based on XOR and matrix multiplication Imagine an$n$bit to$n$bit hash function defined as follows: Let$K$and$K'$be two random predetermined$n\times n$matrices. Then the hash function$h$of an$n$bit number$a$would be: $$h(a)=... 1answer 35 views Is Commitment Scheme with hash function is a perfectly hiding scheme? If I use a hash function to construct the commitment scheme, can I say it is perfectly hiding? m is the message r is a random value In commit stage,$$ c = C(m, r)$$In reveal stage, by ... 3answers 3k views Using cryptographically random password as both the password and the salt This question is theoretical, but will help with my understanding. All of my passwords are securely generated using 64 random letters (both uppercase and lowercase) and numbers. Using the argon2i ... 2answers 66 views Modes of operation that simply uses the tweak of a tweakable block cipher What is the name of the mode in which we simply change the tweak for each block without the need for complex chaining modes? Is this mode secure? Are there any other recommended modes for native ... 0answers 37 views Understanding a security proof I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions.... 0answers 56 views Why are integers considered “little endian” in ChaCha20 function? Why the ChaCha20 - IETF algorithm that generates 512 bit keystream per 32 bit counter (that gets incremented), considers "the input words" that form the internal state as little endian ? What will ... 0answers 18 views Append-only log with secret metadata? I need sets of encrypted records which need to be stored in an append-only log. It should be possible to efficiently recover just the headers of each record, so that specific records can be retrieved ... 1answer 111 views Is there any existing obfuscation scheme that makes cipher text indistinguishable from plain text? Suppose a totalitarian government (in the name of anti-terrorism / protection of intellectual property): has outlawed encryption itself - encryption is only approved for cases where the state has ... 0answers 32 views Importance of Backward and forward secrecy Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy 0answers 19 views Noise NK1 pattern identity hiding In the official documentation for the Noise Framework there is a section with an overview of the identity hiding for each pattern. The numbering of properties there, obviously, from weaker properties ... 2answers 131 views Chosen plain-text Attack on DES-X with roughly$2^{64}\$ DES operations

Here is the quote from P. Rogaway,The security of DESX "the effective key length of DESX with respect to key search is at least 55 + 63 - lg(m) bits" where m is the number of chosen plaintext/...