All Questions

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

What does “Clocked” mean in alternating step generators

In the wiki article, it says "An ASG comprises three linear-feedback shift registers, which we will call LFSR0, LFSR1, and LFSR2 for convenience. The output of one of the registers decides which of ...
2
votes
1answer
51 views

If ChaCha20 is being used just as a CSPRNG, is nonce needed?

I'm planning to use ChaCha20 just as a CSPRNG. Key is random (taken from strong initial entropy source) and will be constantly replaced via DJB's fast key-erasure scheme. What should I use as the ...
4
votes
2answers
997 views

Is it safe to convert a 256-bit nonce into a 192-bit nonce by SHA-256ing and then truncating it?

I'd expect a 192-bit nonce derived from a 256-bit nonce by computing the SHA-256 hash and then truncating it to 24 bytes to behave like an approximately uniformly randomly generated 192-bit nonce and ...
0
votes
2answers
48 views

What's a relatively fast way of checking if a string is decrypted English?

I asked this on Stack Overflow but I was told to ask here. I'm writing a program that decrypts text encrypted using a Vigenere cipher. It's been working very well so far, but my current issue is that ...
0
votes
0answers
18 views

HSM: How multiple users are supported (using SAM)? [closed]

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
0
votes
1answer
64 views

List of big strong primes

I want to make a Diffie Hellman key exchange code using Python, but I'm afraid of just randomly picking $g$. I read on the answer of Thomas Pornin to this question How does one calculate a primitive ...
0
votes
0answers
28 views

How to use Whitebox aes

There are server programs and client programs. ・Prepare two keys (A, B) for AES. ・The A key creates an encryption table in advance with WhiteboxAes. ・The B key creates a decryption table in advance ...
1
vote
1answer
29 views

How to solve polynomial modular equation to create a correct decryption algorithm

I recently had a variant of the following problem in my cryptography course and I had trouble solving it and was looking to get some help. Given the symmetric key cryptosystem: $\text{KG, Enc, Dec}$ ...
2
votes
1answer
52 views

Extract adversary's secret input in simulation based security proofs

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
2
votes
2answers
52 views

Motivation for frequent key updates

I am wondering if there is any reason to regularly update cryptographic keys, that are used for authentication purposes in a real-time system. A key should be updated if it is weak, broken, ...
0
votes
1answer
68 views

Difference between using Schnorr Protocol and just compare hash function to prove knowing something?

I am studying Schnorr Protocol and I just come up a case. For example I am a Prover and have a secret $x$. By using Schnorr Protocol, I create $h=g^x \bmod p$ and save $h$ to a public place. When ...
-3
votes
0answers
36 views

Computing modular squares and square roots of the form $n=pq$ with large $p$ and $q$

If I was given $n=pq$, where $p$ and $q$ are large primes (eg: $2^{61}-1$ and $2^{89}-1$), and I was given $t=w^2=c (\bmod(n))$, where $c$ is already given. How do I find the square root function $w=\...
0
votes
1answer
45 views

Using encryption as authentication

I am building an app in which I would like to encrypt user data and support offline login. From this answer about using passwords for encryption: Best practice is to use a PBKDF to generate a 'key ...
0
votes
0answers
28 views

Relation between signature size and message-digest length in RSA PKCS#1v1.5 sign/verify

When using RSA-PKCS#1v1.5 to sign and verify a message-digest, is there a compulsory relation between the sizes of message-digest and the key/signature ? For example, If I use key/signature length of ...
0
votes
0answers
24 views

Proving anonymous credential presentation

In a CL-based or CKS-based anonymous credential system, how can a verifier $V$ prove that a credential holder $H$ has presented it a credential that has been issued by an issuer $I$ without ...
1
vote
1answer
72 views

Prime fields vs non-prime fields

I was watching this class about AES in this LINK and I was trying to grasp the concept of prime fields, which is a finite field with prime order $p$. The non-prime field part (order is $p^n$) is ...
0
votes
1answer
64 views

Elliptic Curves - Proving that the group is not cyclic

I have a question from Stinson: 7.14. The question states: Suppose that $p > 3$ is an odd prime, and $a,b$ is an element of $\mathbb Z_p$. Further, suppose that the equation $x^3 + ax + b$ is ...
0
votes
1answer
28 views

DCT Steganography - Where to embed the data

Just a quick question about DCT Steganography. Do you embed the data before or after you send the 8*8 block through the quantization table?
1
vote
2answers
304 views

Why is Math.floor(Math.random()*9000) not secure in JavaScript?

I heard that one can predict the output from Math.Random() of JavaScript, but another day I had an idea to combine Math.random() ...
0
votes
0answers
17 views

What does the final term 'se' give us in Noise Protocol IK?

I am trying to learn about the Noise Protocol Framework. Noise Protocol IK is used in WireGuard. For some client initiator and server responder, I think the idea is to hide the client's identity (...
0
votes
1answer
58 views

DCT Steganography Problem

I'm creating an implementation of the DCT Steganography algorithm in Java and I'm having a slight problem. When I embed a message into a cover-image, I am doing so by initially obtaining the DC ...
-1
votes
1answer
28 views

how we can display each round of PRESENT algorithm [closed]

how i can display each round of PRESENT algorithm knowing that i'm using the code c and i'm using a Key: 00000000000000000000 (80-bit)
1
vote
0answers
31 views

Regarding security of blind signature schemes

I'm new to blind signatures, trying to understand security notions of it: blindness and one-more unforgeability. I found out that in the security game for blindness property, the adversary $\mathcal{...
0
votes
0answers
19 views

Converting Smart Contracts into Arithmetic Circuits [migrated]

Are there any existing programs available to convert smart contracts into Arithmetic Circuits with which I can implement and experiment with Secure Multiparty Computation (MPC) protocols?
0
votes
0answers
28 views

AES S_BOX Generator additive constants

I try to generate other S_BOX for AES but I don't realize how to choose additive constants for S_BOX from decryption if for encryption it is 0x63 why is ...
1
vote
0answers
21 views

Two ElGamal ciphertexts equivalence

Is there a way to prove that two ElGamal ciphertexts encrypt the same message with different public keys without knowing the private keys? The prover is the producer of both ciphertexts.
0
votes
0answers
17 views

Whether there is a public key encryption system based on elliptic curve with the property of multiplication and addition homomorphism。

I want to implement it on the intelligent contract and then do the development,because use paillier i cant genereate 1024bits key,so i try to find if there is exit a public key encryption system based ...
2
votes
1answer
203 views

A possible error in the book

So I have been reading this book called "Implementing SSL/TLS using Cryptography and PKI" While going through it, this snippet of code got me baffled ...
0
votes
1answer
61 views

How to reduce Computational Diffie–Hellman problem and Decisional Diffie–Hellman problem to Discrete logarithm problem

I'm supposed make some reductions but don't even know where to start. Any help would or explanation on how to do this would be much appreciated.
0
votes
1answer
41 views

How to perform the initial permutations 64-Bit DES to derive $K$?

Perform DES encryption on the first 64-bit plaintext only, what are these 0's and 1's? Do they mean that I need to use this ...
0
votes
0answers
36 views

Trivariate Coppersmith Implementation

Bivariate Coppersmith is standard package in math software with number theory support. Bauer and Antoine Joux introduced trivariate Coppersmith in https://www.iacr.org/archive/eurocrypt2007/45150361/...
0
votes
0answers
20 views

Can you derive the AES key if both cleartext and ciphertext are known? [duplicate]

If you have a single 128-bit block data in cleartext and the exact same data encrypted with an unknown AES key (the key length is known, though), is there any possibility of determining that key other ...
1
vote
1answer
46 views

Can I retrieve a re-hashed (hash) value, for instance by additional hashing?

I have a double-SHA-256 of some text $$ h_2 = \operatorname{SHA256}(\operatorname{SHA256}(m)).$$ I don't need the plain text ($m$), but somehow I need to get first $$h_1 = \operatorname{SHA256}(m).$$ ...
2
votes
1answer
48 views

Encryption with 2 symmetric keys and decryption with one key

Here is my use case: I need to keep encrypted data in Hadoop. The data is encrypted with symmetric key that is being changed every half a year. When data is retrieved it should be decrypted. Lets ...
0
votes
0answers
33 views

How to encode SHA-256 as a quadratic span program?

I'm trying to understand the step-by-step zkSNARK's generation process for proving the knowledge of the hash pre-image (as in this example). However, I don't understand how exactly SHA-256 is turned ...
0
votes
0answers
27 views

Is it correct using Sigma Protocol to do the knowledge proof?

For this background, the prover knows a secret $x$ for $h=gx$. Prove to the verifier that he knows $x$. (I know $h=gx$ is not a NP problem, I just want to practice the Sigma Protocol) Step 1 : $P \...
0
votes
2answers
44 views

set of integers modulo an integer q in lattice

Some literature about lattices set $\mathbb{Z}_{q}$ in $[-\frac{q}{2}, \frac{q}{2})\cap \mathbb{Z}$ but not $[0,q-1]$ such as "lattice signatures without trapdoors" and "lattice based blind ...
2
votes
1answer
101 views

A hash functin based on XOR and matrix multiplication

Imagine an $n$ bit to $n$ bit hash function defined as follows: Let $K$ and $K'$ be two random predetermined $n\times n$ matrices. Then the hash function $h$ of an $n$ bit number $a$ would be: $$h(a)=...
0
votes
1answer
35 views

Is Commitment Scheme with hash function is a perfectly hiding scheme?

If I use a hash function to construct the commitment scheme, can I say it is perfectly hiding? $m$ is the message $r$ is a random value In commit stage, $$ c = C(m, r)$$ In reveal stage, by ...
9
votes
3answers
3k views

Using cryptographically random password as both the password and the salt

This question is theoretical, but will help with my understanding. All of my passwords are securely generated using 64 random letters (both uppercase and lowercase) and numbers. Using the argon2i ...
1
vote
2answers
66 views

Modes of operation that simply uses the tweak of a tweakable block cipher

What is the name of the mode in which we simply change the tweak for each block without the need for complex chaining modes? Is this mode secure? Are there any other recommended modes for native ...
0
votes
0answers
37 views

Understanding a security proof

I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions....
1
vote
0answers
56 views

Why are integers considered “little endian” in ChaCha20 function?

Why the ChaCha20 - IETF algorithm that generates 512 bit keystream per 32 bit counter (that gets incremented), considers "the input words" that form the internal state as little endian ? What will ...
0
votes
0answers
18 views

Append-only log with secret metadata?

I need sets of encrypted records which need to be stored in an append-only log. It should be possible to efficiently recover just the headers of each record, so that specific records can be retrieved ...
1
vote
1answer
111 views

Is there any existing obfuscation scheme that makes cipher text indistinguishable from plain text?

Suppose a totalitarian government (in the name of anti-terrorism / protection of intellectual property): has outlawed encryption itself - encryption is only approved for cases where the state has ...
0
votes
0answers
32 views

Importance of Backward and forward secrecy

Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy
1
vote
0answers
19 views

Noise NK1 pattern identity hiding

In the official documentation for the Noise Framework there is a section with an overview of the identity hiding for each pattern. The numbering of properties there, obviously, from weaker properties ...
1
vote
2answers
131 views

Chosen plain-text Attack on DES-X with roughly $2^{64}$ DES operations

Here is the quote from P. Rogaway,The security of DESX "the effective key length of DESX with respect to key search is at least 55 + 63 - lg(m) bits" where m is the number of chosen plaintext/...
1
vote
1answer
41 views

Storing values under different keys (e.g. during key rotation)

If you are encrypting some secrets (database passwords, access tokens, etc). When it comes to key rotation, you'll need to store those encrypted values twice, for a short period of time (under the ...
4
votes
1answer
72 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...

15 30 50 per page