All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
27 views

Signature forgery in different adversarial settings

I'm currently studying the different adversarial settings for digital signatures. In Goldwasser, Micali and Rivests paper they propose three different chosen message attack settings, which are vastly ...
limeeattack's user avatar
0 votes
1 answer
157 views

Is the discrete root considered a hard problem?

I know that in groups from large prime order the discrete log problem is considered hard. For example, it is hard to compute $x$ from $g^x$ and $g$. Does the same holds for the root problem? For ...
Amit Keinan's user avatar
0 votes
0 answers
29 views

In Vigenère, if I encrypt a plaintext with a block cipher before applying the key, will it be possible to recover the key if it repeats?

This question may seem related to this one, but it is not the same. Let's suppose I take 1GiB of data, encrypt the data with a (secure) block cipher and apply the Vigenère key, being the key much ...
alpominth's user avatar
  • 393
0 votes
1 answer
45 views

Heys Differential Cryptanalysis Question

I'm wondering if anyone is aware of the best input difference to input into the system Heys outlines in his paper (http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf) to achieve a high probability ...
user115598's user avatar
1 vote
1 answer
112 views

Is concatenation of secure encryptions secure?

If I have $n$ secure assymetric encryption schemes, is their concatenation $Enc_{k_1,...,k_n}(m)=Enc_{k_1}(m)||...||Enc_{k_n}(m)$ secure? My intuition is that the concatenation is secure, but I can't ...
Amit Keinan's user avatar
0 votes
1 answer
100 views

Privacy-loss of an individual due their associated records

We utilize a differential privacy mechanism (Laplace noise, with scale $b$) to provide the privacy of records stored within a dataset. Each individual is associated with two, and at most $k$, records. ...
Amirhossein Adavoudi's user avatar
1 vote
0 answers
52 views

Single ecdsa signature valid for two different messages

I have been reading Flaws in Applying Proof Methodologies to Signature Schemes and ran into a bit I do not understand. In section 4.2 the authors describe a scheme where a malicious signer crafts a ...
immigrantswede's user avatar
0 votes
0 answers
52 views

Is there a square matrix with applications in Cryptography such that the determinant of this matrix is 0 and all its sub minors are non-singular?

I am looking for a square matrix whose determinant is 0, however, all sub-minors of this matrix are non singular. This matrix needs to have applications in Cryptography. The matrix may be over any ...
Kurious Koder's user avatar
0 votes
1 answer
63 views

EdDSA protection of deterministic algorithm against replay attacks

EdDSA generates the private nonce deterministically by hashing the private key and the message, and this means that the public nonce $r$ and the signature s will be same if the same message signed ...
Nawras Hussein's user avatar
0 votes
0 answers
41 views

ChaCha20 1Gb encryption speed question

I wrote a simple implementation of ChaCha20 encryptor for files in C using MbedTLS implementation. The process of encryption is standard - I set key, then for each block of fixed size I generate new ...
Enty AV's user avatar
3 votes
1 answer
181 views

Is DES/2DES/3DES still used?

I checked a related question, but I still did not find the answer I was looking for. Specifically, do we have any statistics on the usage of DES/2DES/3DES? It seems from here that credit card systems ...
tigerjack's user avatar
  • 131
0 votes
0 answers
52 views

Crypto standards

According to answer and status of PGP on RFC search, OpenPGP RFCs can be used as "technical reference for the applicable internet standard". The quote mentioned in previous sentence is a ...
aackmann's user avatar
5 votes
1 answer
174 views

New NIST Journey: Accordion Cipher Mode

NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
hardyrama's user avatar
  • 2,126
0 votes
3 answers
93 views

What can I use for encrypting by one key, decrypting by another key?

I have case when I need take payload to client with key for decrypting. But client mustn't encrypt another payload by this key. After some research, as I understand it's case of asymmetric encryption. ...
Nikita Davidenko's user avatar
3 votes
0 answers
38 views

How to efficiently avoid adding duplicate members to cryptographic accumulators?

I'm looking for a more efficient way to avoid adding duplicate members to a cryptographic accumulator. Currently, I require users to provide a non-membership proof, and only if the proof is valid, ...
lakers's user avatar
  • 31
0 votes
0 answers
77 views

What is the simplest method of protecting a one time pad encrypted message from bit flip attacks?

I'm building a micro-controller based encryption device that uses one time pads. System details The reason I'm going this route is that I want a system which secure, but also very simple and easy to ...
Drew's user avatar
  • 119
0 votes
1 answer
51 views

What does black box manner mean in Oblivious Transfer (OT)?

I read a statement that states OT (Oblivious transfers) cannot be constructed from public key encryption in a black box manner. What does it mean here by black box manner? Is Oblivious transfer a ...
Novice_researcher's user avatar
3 votes
1 answer
41 views

MPC Security- Need for Joint Distribution

The security of the multi-party computation protocol can be given by real/ideal world paradigm. The simulator based proof considers the joint distribution of adversary's output and honest parties ...
Novice_researcher's user avatar
1 vote
1 answer
79 views

Using HPKE, if I generate my key pair can I derive the public key from the private key just in case I lose the public key?

Hypothetically, if I am using tink-java and I generate a keyset/keypair. If I lost my public key, can I get the public key from the private key?
c_idle's user avatar
  • 183
2 votes
0 answers
46 views

How does Fast Reed-Solomon Interactive Oracle Proof (FRI) protocol work using polynomial commitments in zk-STARKs?

Over a few days, I have been trying to understand the FRI protocol discussed in the link https://aszepieniec.github.io/stark-anatomy/fri . It explains Fast Reed-Solomon Interactive Oracle Proof (FRI) ...
INDUKURI MANI VARMA 21911012's user avatar
2 votes
1 answer
82 views

Example of CM field discriminant of elliptic curves

From this answer I am able to understand that if CM field discriminant for a particular curve is small then it provide us a fast endomorphism which in turn allow rho method to speed up by $\sqrt{\frac{...
madhurkant's user avatar
1 vote
0 answers
36 views

Rogue key attack vs key cancellation attack

Are the rogue key attack and the key cancellation attack identical within digital multi signature? In both cases the attacker generates a valid signature instead of other cosigners, to my ...
Nawras Hussein's user avatar
2 votes
1 answer
59 views

Is it hard to find m, R to make RG^H(m||R)=C?

Assuming the generator of one group $\mathbb G$ is $G$. Given an element $C\in \mathbb G$ and a cryptographic hash function $H(\cdot)$, is it hard for one adversary to find a pair of message $m$ and ...
Twiforest's user avatar
0 votes
1 answer
111 views

How to know if a random number is a probable semiprime?

Simple question : given a randomly generated number $N$ from a hash that is hard to factor, how to check if $N$ is probably a semi‑prime in a faster way than factoring it ? My problem is while it’s ...
user2284570's user avatar
1 vote
2 answers
50 views

Comparison in Multi-party Computation without bit decomposition

There are MPC comparison protocols which can securely compute $(a<^?0):=\begin{cases}1,\text{ if }a<0\\ 0,\text{ otherwise}\end{cases}$, where $a$ is an element of a prime-order field (of course ...
anticommutative's user avatar
1 vote
1 answer
92 views

BLAKE3 for Block and Stream ciphers?

When assuming the following idea for ciphers: For a block cipher, a 4-round balanced Feistel network where the PRF is BLAKE3 and the key schedule is: input key, input key with every odd bit flipped, ...
user115528's user avatar
0 votes
1 answer
48 views

Can f(S) also be replaced by PRP(S) in a Sponge consruction?

I have difficulties understanding the PRP in the absorb phase of a sponge construction: a block is XORed to the r part of the state memory,and then the entire state sent through a blockcipher-like ...
Even darker than dark's user avatar
-1 votes
0 answers
49 views

example for 2 data with same sha256 sum [duplicate]

Is there any example for data that has the same sha256sum value? Or is it impossible to find out with current computational power?
Amruth A's user avatar
0 votes
0 answers
18 views

Masking Bits in n-party Garbled Circuit

Let us consider the scenario where there are n-1 garblers and a single evaluator. The garblers together need to generate a garbled circuit. We use a distributed garbling protocol such as [BLO16] and ...
Novice_researcher's user avatar
1 vote
1 answer
63 views

How should I map E'(Fp6) --> E'(Fp) starting from Bitcoin public key coordinates(x,y)?

Let $p$ be the prime number 115792089237316195423570985008687907853269984665640564039457584007908834671663 and let $E$ and $E'$ be the curve equations $$E(\mathbb ...
bnsage123's user avatar
1 vote
1 answer
77 views

Adaptive corruption in MPC

Adaptive adversaries are a class of adversaries who can decide to corrupt parties in the protocol execution process. However, I want more information about this model and the proof skills. There are ...
Jeffrey's user avatar
  • 97
0 votes
3 answers
87 views

Is it possible to construct a (pseudo-)continuous PRF or MAC?

Is it possible to construct an efficient-to-compute function $F: X \rightarrow Y$ such that Given samples $(x_1, F(x_1))...(x_n, F(x_n))$, any efficient adversary ($F$ itself is kept secret) can't ...
Marc_12's user avatar
  • 41
0 votes
0 answers
41 views

HillCipher, cannot get the key, Given the plaintext and the ciphertext

I'm doing a project for my Data security course, and it's to implement the HillCipher Algorithm in C#.I've successfully Implemented the Encryption and Decryption. however there is one function missing ...
Mark Maher's user avatar
-1 votes
0 answers
29 views

BMR Protocol Explanation

The idea of n-1 parties being garblers and 1 party being evaluator is not clear to me. Can I get an explanation of how the BMR protocol runs stage by stage with an example. I guess the keys to each ...
Novice_researcher's user avatar
3 votes
0 answers
71 views

Deriving a cryptographic PRNG from a publicly random sequence

Consider a model of computation where we have a public oracle that provides access to a random sequence $R$. Given an index $i$ the oracle returns either 0 or 1, with the responses being deterministic,...
1110101001's user avatar
0 votes
1 answer
68 views

Zero-Knowledge Proof of Graph-Isomorphism with a union relation

In question (1.b) in Homework 10 for Brown University's Cryptography course, they present the problem of providing a zero-knowledge proof for $L = \{ ((G_0, G_1), (G'_0, G'_1)) \mid G_0 \cong G_1 \vee ...
Stevie's user avatar
  • 123
1 vote
0 answers
34 views

Allow one of many encryption/signature algorithms for single public key certificate [migrated]

Let's say a user creates their primary gpg key pair for User Name <[email protected]> and selects an encryption and signing algorithm that isn't widely available ...
aackmann's user avatar
0 votes
1 answer
55 views

Can I construct a incomplete Merkle Tree without denting its security?

...
Chirag Parmar's user avatar
0 votes
1 answer
45 views

The proof of Claim 5.2 in the "On Lattices, Learning with Errors, Random Linear Codes, and Cryptography"

When I'm reading this paper "On lattices, learning with errors, random linear codes, and cryptography" by O. Regev. I have trouble understanding the proof of claim 5.2. "Hence, it is ...
Solaris's user avatar
2 votes
1 answer
82 views

"intermediate" PRNG

Two popular example dynamical systems for PRNG are LFSRs, basically the orbit $(x^ks)_{k>0}$ for some non-zero seed $s$ and (primitive) $x$ in $GF(2^n)^{\times}$ CTR_DRBG, say with AES128 and 256-...
yoyo's user avatar
  • 421
0 votes
0 answers
31 views

NTT implementation using matrix multiplication

I am trying to implement the NTT as done in this paper, but I keep getting the wrong result even when doing the math by hand. Is formula 9 of the paper wrong ? (I suspect that I am the wrong one but ...
José Miguel's user avatar
1 vote
2 answers
413 views

Factoring 350 to 400 bits long rsa number with a factor that has a known bitlength… But in less than 5 to 7 minutes and less than $100

the gnfs is the most efficient algorithm for factoring numbers formed of equal composites. But it’s sequential/Linea Algebra parts mean (If I’m not wrong), that it requires at least 10 minutes on ...
user2284570's user avatar
3 votes
1 answer
314 views

How can I understand the gap between CPA and CCA1?

I have read lots of books about CPA,CCA1,CCA2. I understand how to get an example satisfies CPA but not CCA2. However, I can't find such a scheme which is CPA but not CCA1. What is the extra advantage ...
Wang Xingwang's user avatar
1 vote
1 answer
67 views

Does encrypting a billion short and similar jsons with known structure make encryption less secure?

Let's say we have a billion short individual json files with same regular structure: {"name": "<name>", "id": <id>}. Each ...
aackmann's user avatar
1 vote
1 answer
80 views

AES-128 ECB Standard Confusion

Forgive my ignorance, but I've run into some confusion in an AES implementation I'm testing. To the best of my understanding, ECB provides no diffusion, the same plaintext with the same key will yield ...
WackyTortoise's user avatar
1 vote
0 answers
107 views

One-more co-CDH assumption in pairing group

I am asking it again because no one answered my previous question with more clarity. I have deleted that question One more co-CDH in Type three pairing groups $G_1 \times G_2 \to G_T$: means given a ...
Manish Adhikari's user avatar
1 vote
1 answer
58 views

What does "gpg: RSA/AES256.CFB encrypted for" mean?

The output of command fortune | gpg -vaer <receipent-id> has a line that begins with: ...
aackmann's user avatar
0 votes
0 answers
13 views

in MA-ABE, what is the diference when prove a scheme is selective or static?

I have read [1]Decentralized Multi-authority ABE for NC1 from BDH, [2]Decentralizing Attribute-Based Encryption, [3]Fully Adaptive Decentralized Multi-Authority ABE, When I compare security proof in [...
Wang Xingwang's user avatar
0 votes
0 answers
46 views

What is insecure about adding salt to your plaintext before using RSA? [duplicate]

RSA can't be used securely as is as it is deterministic. So an encrypted "yes" always looks the same. A simple workaround, which is apparently not secure, is to add 100 bits, say, of random ...
Simd's user avatar
  • 299
6 votes
2 answers
277 views

Blinding an ECDSA private key without learning the private key

I am looking at ways to blind an ECDSA signing key (and verification key respectively). Looking at proposed solutions like the IETF KBSS draft, and the IETF ARKG draft it seems that the ECDSA key ...
Peter Altmann's user avatar

15 30 50 per page