# All Questions

27,427 questions
Filter by
Sorted by
Tagged with
126 views

### Breaking ecdsa with biased nonce

I'm trying to do this cryptopals challenge for breaking ecdsa with biased nonce but everything I do fail to work. I'm trying my attack with 4 signatures and 128 bit bias. ...
• 53
1 vote
71 views

### What is Plaintext-awareness?

Could you explain with an example what does it mean to be Plaintext-awareness. I have read the wiki definition. It says that "A cryptosystem is plaintext-aware if it cannot genenerate a valid ...
• 129
44 views

### is HMAC required if i am using AES-CFB and using Digital signatures for Authentication

I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-...
70 views

### Security level of the hash of the sum of two uniformly random keys

I generate two uniformly random 127-bit integers $a$ and $b$. I calculate $c=a+b$, which means $c$ can always be represented as a 128-bit integer. $c$ will not be uniformly randomly distributed, but I ...
• 3,112
86 views

### What is the lightest cipher that provides AES like security?

The lightest, or fastest cipher, that is well known and quite secure like AES. Is ChaCha20 a good option? Are there any better alternatives that are faster but still as secure?
60 views

### How do I decrypt an encrypted message with an RSA private key?

I have an encrypted password I must decrypt as part of a challenge. Along with the password came a few UNENCRYPTED RSA private keys From what I understand, all I need in order to decrypt the password ...
26 views

I have a question for those that might be familiar with the ligero protocol: Ligero In this protocol to be using an MPC in the head paradigm: described here. However, in the description of their ...
• 203
23 views

### Is there somthing like a portable certificate?

We are developing a software with a WebUI. The idea is, that you have a device (maybe a Raspberry if there are some available..., sometime in the future..., maybe...) where this Software is installed ...
1 vote
55 views

### Simplistic double ratchet implementation

Would something like this be a reasonable way to implement the double ratchet with libsodium? The sodium port that I'm using is quite limited and does not offer a ...
• 113
1 vote
80 views

### Is HMAC-SHA512 with 512 bit key Quantum Safe?

is HMAC-SHA512 quantum safe , I am planning to use it for encrypt-then-mac scheme with aes256-cfb mode for a post quantum safe PGP like protocol.
648 views

### Is Argon2 Quantum safe? [duplicate]

I am developing a post quantum safe GPG like program, is argon2 quantum safe cryptographically for GPG like application.
1 vote
55 views

### Comparison Hash, MAC, Signatures, Certificates

I saw a table comparing Hash/Mac/Signatures in this post. I was wondering if I can integrate digital certificates into it like this: Hash MAC Signature Certificate + Signature Integrity Yes Yes Yes ...
• 111
148 views

### I need an encryption algorithm that doesn't require keys and computationally easy to encrypt, hard to decrypt

I need an encryption algorithm that doesn't require keys and computationally easy to encrypt, hard to decrypt. Decrypting can involve brute force. If the algorithm can be applied again and again (...
1 vote
37 views

### No decryption algorithm for Hummingbird-2?

I stumbled upon hummingbird-2 encryption algorithm when I was looking for a lightweight encryption module that can be used in resorce-restrained environments like Network-on-Chips. A problem I faced ...
27 views

### Limit definition of negligible function

I am reading Dan Boneh's book and I am stuck on Theorem 2.11, whose proof is left as an exercise. The question is: prove that if $\lim_{n \rightarrow \infty} f(n)n^c = 0$ for all $c > 0$, then $f$ ...
• 23
82 views

### How does combining data affect the resulting file entropy?

If i add a password which has (X) bits of entropy as a tag to a picture which has (Y) bits of entropy, will the resulting image have an entropy equal to (X + Y) ? How many bits of entropy i get if i ...
• 57
1k views

### What's the point and use of 512-bit-style elliptic curves?

There is a plethora of elliptic curves that are close to the 256-bit security level (i.e., fields and groups of approximately 512 bits). Examples are Curve448, P-521, Brainpool-P512. The standard ...
• 2,153
1 vote
100 views

### XChaCha20 vs AES 128 security and speed

Is XChaCha20 with 256 bit key and 192 bit nonce more secure than 128 bit key 128 bit key nonce AES, due to using larger key/nonce sizes? Isn't it supposed to be faster due to being a stream cipher? (...
103 views

### Use blake2 permutation as a block cipher

Blake2(1024 bit state) permutation (compression function core) is basically a modified ChaCha permutation. One of the modifications is to mix in message bits (key schedule?). Given that blake2 is a ...
20 views

### Generalizations of designated verifier signatures?

Are you aware of any paper where the approach of Designated Verifier Proofs and Their Applications paper is generalized? The idea of the paper is that you can generate a signature that can be verified ...
• 67
1 vote
41 views

### How can I distribute a set of anonymous tokens digitally among a known limited population to do anonymous voting?

TL:DR How can I give a population of N people the chance to randomly pick one token each person guaranteeing those: Nobody knows noone else's token. Noone can pick more than one token. Every person ...
• 113
1 vote
45 views

### RSA: Does it worth to calculate missing CRT parameters when you have just N, E, D, P, Q?

OpenPGP defines RSA secret key in a way which differs from PKCS #1,having the aforementioned values plus U = P^-1 mod Q. However, OpenSSL seems to work only with <...
455 views

• 63
1 vote
184 views

### Does the AES-GCM specification require the tag-size to be bound to the GCM context?

Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)? Asked differently, is the following a legitimate adherence to ...
1 vote
81 views

### Probabilistic SHA-256 hash tending all values to 0.5

I wrote SHA-256 with arrays of integers representing the bits (e.g. [1,0,...,1]), and then I altered it to accept partial values (e.g. [0.5, 0.79, 0.0, 1]), as in each value has an x chance of being '...
1 vote
83 views

### I don't undertand the meaning of 'Authenticity' property

Considering an HMAC algorithm: it shall guarantee integrity and authenticity. I don't understand what authenticity means: that signature could be generated by anyone having the shared secret key (non ...
26 views

### How is BLS secure against adaptive selection message attacks when the message is known?

Maybe the below question is similar to what I was thinking, but I don't understand: Is BLS signature scheme strongly unforgeable? Below is the attack method I was thinking of. If know m, can't create ...
2k views

### Why did NIST select Kyber and Dilithium?

NIST selected Kyber for key agreement and Dilithium for digital signature applications some days ago. But IDF's MATZOV group, in their paper, broke Kyber and Dilithium and brought the security levels ...
• 121
1 vote
76 views

### Can I use content-derived deterministic encryption key with hybrid encryption?

My use case, making public-key encrypted backups, requires deterministic public-key authenticated encryption. I favour NaCl box, but the way it is generally used is probabilistic and it yields ...
• 11