All Questions
29,825
questions
1
vote
1
answer
77
views
Construction of Blake2 and Cha Cha
Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
- 11
3
votes
2
answers
96
views
What is the difference between Post-Compromise Security and Backward Security?
Post-Compromise Security and Backward Security seem to mean that the attacker has obtained the communication key between two parties or groups in the current state, but cannot further obtain ...
- 31
0
votes
1
answer
35
views
Proof of work for large amount of data
I'm new to cryptography, sorry if this question is dumb.
I've just read the paper of Dwork and Naor Pricing via Processing or Combatting Junk Mail and understand the example of squaring on $\mathbb{Z}/...
- 103
0
votes
0
answers
124
views
CBC Predictable IV Help
I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
- 1
0
votes
0
answers
47
views
merging structured encrypted data
this is a followup of the post I made there: https://stackoverflow.com/questions/77428690/merging-structured-encrypted-data
Essentialy, I'd like to know if there is a way to merge bencoded data (or ...
- 1
1
vote
2
answers
1k
views
Why is SHA256 used as a layer on top of Digital Signature [duplicate]
Digital Signatures use an asymmetric algorithm, meaning that if I want to apply a digital signature to a document I sign it with my own private key and send it to the recipient.
The recipient, thanks ...
- 129
0
votes
0
answers
59
views
Article explaining Fortuna algorithm
Does anyone know an article that explains Fortuna algorithm for people without cryptographical background? If not, I would like to have an explanation because I don't manage to understand it.
1
vote
0
answers
53
views
Graph-based key exchange
Alice and Bob fix a largish $n$, say $n = 1000$, and they publish a simple, undirected graph $G$ on $n$ vertices (more precisely, its adjacency matrix, or a similar form of representation). Moreover ...
4
votes
1
answer
336
views
Is it possible to anonymously distribute a set of secret keys among individuals
Just like picking one of the papers in a bowl is used to anonymously distribute a given set of numbers among individuals which lets nobody (including the person who distributes them) know who got what....
- 41
3
votes
1
answer
454
views
Current Digital Signature Standards as of late 2023
Is my summary understanding of current (classical) Digital signature standards essentially correct? I may be totally wrong.
DSA is no longer to be used for new signature generation just for checking ...
- 21.2k
0
votes
0
answers
65
views
Is a reduced character space pre-image attack possible for SHA-1?
Given a hash cipher f(sha1($pepper . $plaintext)) where
f is some transformation to an 11-byte string
pepper is 24 bytes long with a character space of 62 (and is ...
2
votes
0
answers
99
views
Secret sharing scheme which cannot tell fake shares from real ones
I am looking for a secret sharing algorithm which accepts a large array, some elements of which are real shares and the rest are fake. The algorithm should satisfy the following conditions:
If all ...
- 121
0
votes
1
answer
104
views
Advantages of AES vs XOR on a plain text file
Currently, I am using AES-GCM to encode and decode a plain text file. The key is derived from a plain text password using PBKDF2 and a random salt with SHA-256. However, I have been thinking and came ...
- 1
0
votes
1
answer
103
views
Syndrome Computation Patterson's Algorithm
Suppose in Patterson's algorithm for the correction of binary Goppa codes, we wish to compute the syndrome polynomial when the defining polynomial is $g(x) = x^{4} + x + 1$, and the error polynomial ...
0
votes
0
answers
81
views
How is Blowfish not reversible when it contains the salt in the hash? [duplicate]
I'm learning PHP and I've come to the password hashing section of a course I'm following, but it's not explained well enough for my liking.
It seems that when using the crypt function, and using the ...
- 11
1
vote
1
answer
124
views
True Lovàsz condition and definition of a LLL-reduced basis
I am studying the Shortest Vector Problem and I have some troubles understanding the actual Lovàsz condition used in the LLL algorithm.
On the one hand, the original LLL article, the Springer book &...
- 23
1
vote
1
answer
48
views
Homomorphic encryption with multiple keys that is secure under the assumption of a compromise of the combined key
Is it possible to extend the general concept of homomorphic encryption:
$$f(m_1)\cdot f(m_2)=f(m_1+m_2)$$
to:
$$f(m_1)\cdot g(m_2)=f\cdot g(m_1+m_2)$$
is it further possible to construct the scheme in ...
- 125
2
votes
1
answer
106
views
Password Manager Architecture and Design
I'm working on a local, client-side password manager. I want to hash a master password with argon2 to store it safely in an SQLite database. This will be how a user could login and be authenticated. (...
- 123
2
votes
1
answer
71
views
Oribatida masking question
Why Oribatida uses previous capacity $V_{a+m-1}$ instead of current capacity $V_{a+m}$ for rate masking?
- 1,649
1
vote
1
answer
126
views
Double- and -add algorithm
I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
- 11
1
vote
1
answer
99
views
Is the Bit Flipping attack on CBC mode possible if the IV is not know to the attacker?
This is a follow up question to:
Bit Flipping Attack on CBC Mode
which demonstrates that a bit flipping attack with a known IV is possible on CBC mode.
Is it safe to assume that the bit flicking ...
user112328
0
votes
0
answers
97
views
A matching X25519 public from non-clamped Ed25519-public and Ed25519-secret
Given an Ed25519 key pair, can you think of any way to get to the same X25519 public key from the Ed25519 secret as from the non-clamped(!) Ed25519 public key?
...
0
votes
0
answers
17
views
Are there two curves that can be mapped between with a 2-isogeny that support pairing checks and Montgomery ladders?
Are there two curves that can be mapped between using a 2-isogeny that support pairing checks on on curve and Montgomery ladders on another?
Is there a paper?
- 11
1
vote
0
answers
24
views
Is there a curve that supports both pairing checks and Montgomery ladders?
Is there a curve that supports both?
Or are there two curves that can be mapped between using a 2-isogeny that support pairing checks on one and Montgomery ladders on the other?
Is there a paper on it?...
- 11
0
votes
1
answer
60
views
Is it possible to map points from curve BN254 to C25519 and back using a 2-isogeny?
If it is could you give me a paper that states it is possible?
Thank you
- 3
3
votes
1
answer
94
views
Implementation of centered binomial distribution in Kyber Key Encapsulation Mechanism?
In the implementation of centered binomial distribution of crystals-kyber, the authors load 24-bits of buffer to a 32 bit integer and then they and the answer with 0x00249249. The complete operations ...
0
votes
0
answers
26
views
Using asymmetric encryption + key rotation, is it possible to make an extra obfuscation layer?
I'm building a service, that works as the cipher and decipher for instant messages. It works by following the following steps:
The sender encrypts the text(not long, mostly chatting messages) using a ...
1
vote
2
answers
59
views
Should I Test A PRNG Using A Fixed Entropy Source For Its Seed?
I want to test a C implementation of Hash_DRBG—which test_demo.c file I will modify to produce random binaries indefinitely to STDOUT as to be used by piping its output—using DIEHARDER for a research. ...
- 13
3
votes
1
answer
91
views
Differences between the theory and implementation of a lattice attack against ECDSA
I know the theory of lattice attacks against ECDSA from Minerva. So, as far as I can understand, the lattice that they build is
$$
L_M = \begin{bmatrix}
2^ln & 0 & 0 & \cdots & 0 & ...
- 31
1
vote
1
answer
80
views
Why exclude the last group element when picking Elgamal secret key
Christof Paar explains in his lectures that Elgamal encryption scheme picks the private key from $\{2, \ldots, p-2\}$, is there a reason for excluding the last and first elements?
- 123
1
vote
1
answer
90
views
Hash-Then-Encrypt or Encrypt-Then-Hash on Keyed Hash Functions
I have seen other answers here on Stack Exchange regarding MAC-Then-Encrypt vs. Encrypt-Then-MAC (and this article regarding MAC-Then-Encrypt padding oracle attacks on SSL) as well as generic Hash-...
- 11
3
votes
2
answers
454
views
Modular multiplication of two k-bit numbers takes k^2 modular additions?
In Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman's book An Introduction to mathematical cryptography, 2nd edition, page 78, there is:
If we are working in the group $\mathbb F^∗_p$ and if ...
- 31
3
votes
3
answers
1k
views
Why is SHA-2 considered an ARX construction when it also uses non-ARX operations?
SHA-2 makes use of non-ARX non-linear operators such as the Choice and Majority functions:
\begin{align}
\mathsf{Ch}(E,F,G) &= (E \wedge F) \oplus (\neg E \wedge G)\\
\mathsf{Ma}(A, B, C) &= (...
- 169
0
votes
0
answers
30
views
Solving XOR modular system of equations
I have the following problem.
Here's a rephrased version of your problem, keeping the LaTeX commands unchanged:
We are given $n \in \mathbb{N}$, $p, q \in \mathbb{N}$, and $y \in \mathbb{N}^{n+2}$. ...
- 101
4
votes
1
answer
192
views
Origin of "abort" in cryptography proofs
It's a very standard move in a game-based security proof to have a transition in which we "abort" on some event such as a hash collision; the two games are identical apart from the abort ...
- 215
1
vote
0
answers
65
views
Weaknesses of AES-GCM [duplicate]
Besides the limited nonce size of 96 bits, are there any other weaknesses to the GCM mode of AES?
I am creating a password vault and am trying to narrow down my options of encryption schemes.
Also, is ...
- 11
1
vote
1
answer
77
views
Proof of non membership in a Verkle Tree?
According to the author of the original paper[1],
Verkle Trees basically let you save space (typically bandwidth, which
can be expensive) by replacing a secure hash with a vector commitment
scheme, ...
- 111
0
votes
0
answers
33
views
Enigma - Bombe - Understanding the relative values of ring settings to key settings
For a project, I am writing Enigma and Bombe simulators in Python.
I have coded up both and so far so good.
My Enigma simulator gives the same results as the online simulator here:
https://people....
3
votes
1
answer
107
views
Separation between CDH and DDH
Do there exist cryptographic primitives that have proved that they cannot be constructed from CDH assumption only but can from DDH assumption?
More generally, do there exist cryptographic primitives ...
- 33
2
votes
1
answer
120
views
Understanding $\mathbb{Z}_q[X]/(X^N + 1)$ notation in cryptography paper
I can't seem to understand what $A_{N,q}$ represents in this paper (Section 2.1 - Notations). More specifically, I'm struggling to grasp the meaning of $\mathbb{Z}_q[X]/(X^N + 1)$. Could someone ...
- 33
0
votes
1
answer
106
views
Does "Signing" always mean encrypting a hash
Does signing always involve encrypting a hash or can we call private key encryption of an unhashed message signing too?
- 103
0
votes
0
answers
34
views
Non-lattice NIST candidates affected by SVP problems
I would like to know if there are non-lattice based NIST submissions that are affected by a polynomial time algorithm to Shortest Vector Problem. Are there known reduction from (e.g.) code based ...
- 304
0
votes
1
answer
152
views
Why does symmetric encryption not provide authentication and integrity? Is it only this type of encryption or cryptology in general have this issue?
Studying for Cryptology and came across a presentation regarding on "Integrity vs Authenticity" where the discussion briefly mentions how Encryption "does not provide integrity or ...
- 67
1
vote
1
answer
171
views
Finding scalar in scalar multiplication on secp256k1 elliptic curve
In elliptic curve cryptography using the secp256k1 curve, how can I determine the number of times the base point $G$ has been multiplied to derive a new point? The formula is as follow:
$k * G = Q$
...
- 21
2
votes
1
answer
79
views
Use zk-STARK for post-quantum signature scheme?
Could you not use zk-STARK for a post-quantum signature scheme?
Your private key is a random symmetric encryption key, your public key is the hash of the encryption key.
To sign you run an algorithm ...
- 169
2
votes
1
answer
61
views
n-bit addition over $GF(2^n)$ vs. addition modulo $2^n$
I am currently studying the cryptanalysis of Speck, but I am feeling confused about the addition in Speck. I am not sure whether the addition in Speck is done through n-bit addition over $GF(2^n)$ or ...
- 23
1
vote
1
answer
45
views
Why the refresh (modulus and key switching) is required in BGV after addition?
I am reading the BGV paper. On page 18, after addition, the protocol will also refresh (modulus and key switching), may I ask why is this required? It seems to me that I can still use the same secret ...
- 327
0
votes
1
answer
101
views
Can we make Discrete Log (significant) more secure by introducing non-commutative algebra (e.g. matrices, hypercomplex numbers, )
$$g^a = c \bmod{N} \text{ }\rightarrow \text{ }G_{i_1}G_{i_2}G_{i_3}...G_{i_n} = C \bmod N $$
At the Discrete Log problem we try to find the exponent ($a$) of a generator ($g$) over a finite filed....
- 573
2
votes
1
answer
79
views
What would be the security consequences of replacing $H(R, A, M)$ with $H(R, M)$ in EdDSA?
The question is mainly stated in the title. We don't consider any other changes to the scheme except for the following:
We replace $S = H(R,A,M) \cdot a + r$ with $S = H(R,M) \cdot a + r$.
My thoughts ...
- 878
0
votes
0
answers
42
views
Is this ECDSA's protection mechanism or something wrong with it?
Over the past few months, I have been reading and trying to understand how ECDSA works and how safe is it.
So now something does not add up between its signature verification and generation.
But maybe ...
