# All Questions

30,393 questions
Filter by
Sorted by
Tagged with
27 views

### Signature forgery in different adversarial settings

I'm currently studying the different adversarial settings for digital signatures. In Goldwasser, Micali and Rivests paper they propose three different chosen message attack settings, which are vastly ...
• 231
157 views

### Is the discrete root considered a hard problem?

I know that in groups from large prime order the discrete log problem is considered hard. For example, it is hard to compute $x$ from $g^x$ and $g$. Does the same holds for the root problem? For ...
• 143
29 views

### In Vigenère, if I encrypt a plaintext with a block cipher before applying the key, will it be possible to recover the key if it repeats?

This question may seem related to this one, but it is not the same. Let's suppose I take 1GiB of data, encrypt the data with a (secure) block cipher and apply the Vigenère key, being the key much ...
• 393
45 views

### Heys Differential Cryptanalysis Question

I'm wondering if anyone is aware of the best input difference to input into the system Heys outlines in his paper (http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf) to achieve a high probability ...
1 vote
112 views

### Is concatenation of secure encryptions secure?

If I have $n$ secure assymetric encryption schemes, is their concatenation $Enc_{k_1,...,k_n}(m)=Enc_{k_1}(m)||...||Enc_{k_n}(m)$ secure? My intuition is that the concatenation is secure, but I can't ...
• 143
100 views

### Privacy-loss of an individual due their associated records

We utilize a differential privacy mechanism (Laplace noise, with scale $b$) to provide the privacy of records stored within a dataset. Each individual is associated with two, and at most $k$, records. ...
1 vote
52 views

### Single ecdsa signature valid for two different messages

I have been reading Flaws in Applying Proof Methodologies to Signature Schemes and ran into a bit I do not understand. In section 4.2 the authors describe a scheme where a malicious signer crafts a ...
52 views

### Is there a square matrix with applications in Cryptography such that the determinant of this matrix is 0 and all its sub minors are non-singular?

I am looking for a square matrix whose determinant is 0, however, all sub-minors of this matrix are non singular. This matrix needs to have applications in Cryptography. The matrix may be over any ...
63 views

### EdDSA protection of deterministic algorithm against replay attacks

EdDSA generates the private nonce deterministically by hashing the private key and the message, and this means that the public nonce $r$ and the signature s will be same if the same message signed ...
41 views

### ChaCha20 1Gb encryption speed question

I wrote a simple implementation of ChaCha20 encryptor for files in C using MbedTLS implementation. The process of encryption is standard - I set key, then for each block of fixed size I generate new ...
181 views

### Is DES/2DES/3DES still used?

I checked a related question, but I still did not find the answer I was looking for. Specifically, do we have any statistics on the usage of DES/2DES/3DES? It seems from here that credit card systems ...
• 131
52 views

### Crypto standards

According to answer and status of PGP on RFC search, OpenPGP RFCs can be used as "technical reference for the applicable internet standard". The quote mentioned in previous sentence is a ...
• 33
174 views

### New NIST Journey: Accordion Cipher Mode

NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
• 2,126
93 views

### What can I use for encrypting by one key, decrypting by another key?

I have case when I need take payload to client with key for decrypting. But client mustn't encrypt another payload by this key. After some research, as I understand it's case of asymmetric encryption. ...
38 views

### How to efficiently avoid adding duplicate members to cryptographic accumulators?

I'm looking for a more efficient way to avoid adding duplicate members to a cryptographic accumulator. Currently, I require users to provide a non-membership proof, and only if the proof is valid, ...
• 31
77 views

### What is the simplest method of protecting a one time pad encrypted message from bit flip attacks?

I'm building a micro-controller based encryption device that uses one time pads. System details The reason I'm going this route is that I want a system which secure, but also very simple and easy to ...
• 119
51 views

### What does black box manner mean in Oblivious Transfer (OT)?

I read a statement that states OT (Oblivious transfers) cannot be constructed from public key encryption in a black box manner. What does it mean here by black box manner? Is Oblivious transfer a ...
41 views

### MPC Security- Need for Joint Distribution

The security of the multi-party computation protocol can be given by real/ideal world paradigm. The simulator based proof considers the joint distribution of adversary's output and honest parties ...
1 vote
79 views

### Using HPKE, if I generate my key pair can I derive the public key from the private key just in case I lose the public key?

Hypothetically, if I am using tink-java and I generate a keyset/keypair. If I lost my public key, can I get the public key from the private key?
• 183
46 views

### How does Fast Reed-Solomon Interactive Oracle Proof (FRI) protocol work using polynomial commitments in zk-STARKs?

Over a few days, I have been trying to understand the FRI protocol discussed in the link https://aszepieniec.github.io/stark-anatomy/fri . It explains Fast Reed-Solomon Interactive Oracle Proof (FRI) ...
82 views

• 123
1 vote
34 views

### Allow one of many encryption/signature algorithms for single public key certificate [migrated]

Let's say a user creates their primary gpg key pair for User Name <[email protected]> and selects an encryption and signing algorithm that isn't widely available ...
• 33
55 views

...
45 views

### The proof of Claim 5.2 in the "On Lattices, Learning with Errors, Random Linear Codes, and Cryptography"

When I'm reading this paper "On lattices, learning with errors, random linear codes, and cryptography" by O. Regev. I have trouble understanding the proof of claim 5.2. "Hence, it is ...
82 views

### "intermediate" PRNG

Two popular example dynamical systems for PRNG are LFSRs, basically the orbit $(x^ks)_{k>0}$ for some non-zero seed $s$ and (primitive) $x$ in $GF(2^n)^{\times}$ CTR_DRBG, say with AES128 and 256-...
• 421
31 views

### NTT implementation using matrix multiplication

I am trying to implement the NTT as done in this paper, but I keep getting the wrong result even when doing the math by hand. Is formula 9 of the paper wrong ? (I suspect that I am the wrong one but ...
1 vote
413 views

1 vote
58 views

### What does "gpg: RSA/AES256.CFB encrypted for" mean?

The output of command fortune | gpg -vaer <receipent-id> has a line that begins with: ...
• 33
13 views

### in MA-ABE, what is the diference when prove a scheme is selective or static?

I have read [1]Decentralized Multi-authority ABE for NC1 from BDH, [2]Decentralizing Attribute-Based Encryption, [3]Fully Adaptive Decentralized Multi-Authority ABE, When I compare security proof in [...
46 views