All Questions

Filter by
Sorted by
Tagged with
3 votes
0 answers
58 views

Algorithm for checking elliptic curve discrete log

Suppose the tuple $(P, a, Q)$ is given, where $P$ and $Q$ are points on an elliptic curve (I'm more interested in Montgomery curves but other curves are also fine), $a$ is a scalar and the notation $[...
user avatar
  • 982
1 vote
1 answer
33 views

Recovering original bit vectors that constituted XORed binary vectors

I am trying to unscramble received data packets. Each packet is divided into 3 parts (A, B and C) with equal lengths. In every packet, each of these parts are scrambled/encrypted with an unknown code ...
user avatar
  • 111
0 votes
1 answer
39 views

Unsolveability of the quintic on SNARK

All examples I find on SNARKs show polynomials of up to degree 3 or 4 but what about polynomials of degree over 5, what is the mechanism that allow SNARK not to be affected by the unsolvability of the ...
user avatar
  • 101
0 votes
1 answer
42 views

How to know who is an attacker in byzantine broadcast?

2 requirements of Byzantine broadcast (consistency and validity) only state honest node should output certain bit without mentioning what should malicious nodes do. How do we know the identity of each ...
user avatar
1 vote
1 answer
99 views

Almost similar, but still different algorithm names. What is the difference?

I was sent from Stack Overflow to here (original question). I'm quite new to cryptographic programming. I want to generate TLS certificates on application boot up time. It is a Spring Boot application,...
user avatar
1 vote
0 answers
25 views

Question about Mesquite signature size?

I have a question regarding William Wang's paper Shorter Signatures from MQ. According to him the (maximum) signature size is: $$ 2\kappa + 3\kappa\cdot \lceil\tau\log\frac{M}{\tau}\rceil + \tau\cdot\...
user avatar
4 votes
2 answers
411 views

Is there anything like "Proof of Computation"?

Is there any cryptographic method for Proof Of Computation ? If i am running my program on untrusted hardware (remote server), after some time i want to verify the ...
user avatar
  • 41
0 votes
1 answer
37 views

What are the parity bits in a (7,3)-linear code

If I have a linear (7,4)-Hamming Code I know that the last 3 bits are the parity bits but I just have seen that there are multiple linear codes like (7,3) for example the code with basis: $$\begin{...
user avatar
  • 103
3 votes
1 answer
122 views

Number of points on an elliptic curve

In his paper on pairing based cryptography, Menezes claims that for $$ E_1: y^2+y = x^3+x+1 $$ the number of $\mathbb{F}_{2^m}$-points is $2^m +1 - (1+i)^m - (1-i)^m$. Whereas this is clear, it is not ...
user avatar
0 votes
0 answers
32 views

MPC model used in Ligero and Limbo

Ligero (https://dl.acm.org/doi/10.1145/3133956.3134104) and Limbo (https://eprint.iacr.org/2021/215.pdf) use a somewhat unique MPC model for their zk-PCP where not all parties communicate with each ...
user avatar
  • 982
10 votes
2 answers
4k views

If I have enough examples of a private key's signature, can I discern it?

I understand that you can't discern a private key from a public key, but what if you have thousands of examples of the private key signatures, and you know what the message/cypher is? Basically, you ...
user avatar
0 votes
1 answer
36 views

Transforming a encryption of binary representation of a number to an encryption of vector representation

Suppose Alice chooses a number $n\in Z_q$ and decompose it to its binary representation $b_0,b_1,...,b_d$. Then Alice encrypts these bits (can be any encryption scheme). Is it possible for Bob (who ...
user avatar
  • 31
0 votes
0 answers
29 views

Encrypt user AES keys with AWS KMS RSA key

I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
user avatar
1 vote
0 answers
58 views

Is there any structure similar to GGM but more efficient?

Although Goldreich-Godlwasser-Micali (GGM) construction of a pseudo-random function (PRF) from a pseudo-random number generator (PRNG) is widely in many cryptographic applications, it needs to consume ...
user avatar
1 vote
0 answers
25 views

Can the proof only be the stateful?

Let SE be stateful encryption. Then, it is well known that the oracle for the security proof becomes stateful too. (We only consider the IND-CPA security game.) On the other hand, assume that E is ...
user avatar
  • 11
1 vote
2 answers
97 views

LWE with a binary matrix A

In LWE, we know that given reasonable public parameter $A\in \mathbb{Z}_q^{n\times \lambda}$, secret $s\in \mathbb{Z}_q^{\lambda}$ and noise $e\in \mathcal{X}^{n}$, random $r\in \mathbb{Z}_q^{n}$, $(A,...
user avatar
1 vote
0 answers
30 views

How does Diogenes prove equivalence of discreet logs despite the candidates not being composed of safe primes

In the paper describing a protocol for distributed RSA modulus generation, Diogenes, "[they] employ a special-purpose $\Sigma$-protocol based on [Sho00] for proving correctness of exponentiations ...
user avatar
  • 488
0 votes
0 answers
4 views

how to sign a payload with existing private key [migrated]

I have an existing private key like "4FcPXsrv3cr2rD5PULq3LYBnjYHXqvdvnCrJje1A2kMoVyFZgK5RTSM8msmQNeirvDSaR9LhPeZVyaV69oLx1WLz" (changed for obvious reason). I want to use this to sign a ...
user avatar
1 vote
1 answer
25 views

HMAC-based one-time password, norm for how many counter events to check forwards in time (to see if user skipped a few)?

My bank seems to use something like HMAC-based one-time password, and it generates a new code every time I open it, and I could in theory skip a thousand codes (not use them to log in), and then the ...
user avatar
  • 11
1 vote
0 answers
31 views

What issues does the following Distributed Shamir Secret Sharing scheme have?

What (obvious) security issues does the following "onion" Distributed Shamir Secret Sharing scheme on a blockchain for the purpose of e-voting have? The blockchain in this context, is an ...
user avatar
0 votes
1 answer
47 views

Encrypting content with assymetric key pairs as a form of signing

The use-case is as follows: There is a signer, call it $S_A$ that have a claim or document $D_j$. $S_A$ wants any client $C_k, \forall k$ to be able to verify that it has not been tampered with. I ...
user avatar
1 vote
1 answer
47 views

OTP like Identity

I am a developer with very little experience on the crypto part, and I'm looking for a secure solution (OTP Like) for identifying between client (browser) and server. this is what i need: Web Page at ...
user avatar
4 votes
0 answers
52 views

How to get started with Simulation and UC proofs?

I've been in my PhD program for a few months, and every time I try to understand the simulation and UC proof-paradigms I get so confused. I feel like what I really need is an easy set of (guided) ...
user avatar
-2 votes
1 answer
113 views

Why does the comb of Natasha Otomoski have 21 teeth? [closed]

What is the signature size of Natasha Otomoski haircomb? What is the number of invocations of the underlying one way hash function for key generation, signature, and verification? How does it compare ...
user avatar
0 votes
0 answers
54 views

What is the best choice of the base g in El-Gamal PKC

I have just read in a book that in El-Gamal PKC, the best choice of a base g is a number whose order in the field ($\mathbb{F}_p$) is a large prime, and added: "approximately = $\frac{p}{2}$"...
user avatar
0 votes
2 answers
94 views

bitcoin public address cryptography

I was learning about bitcoin cryptography and seen some strange bitcoin public addresses like this 1Lets1xxxx1use1xxxxxxxxxxxy2EaMkJ 1fuLL1xxxx1power1xxxxxxxxxxzatvCK ...
user avatar
3 votes
1 answer
73 views

Information Theoretic Security for Public Key Encryption

Do there exist information theoretic secure public key crypto-systems? Are they useful in any way, or are they just mathematical curiosities?
user avatar
0 votes
0 answers
19 views

Mersenne Twister - Get all outputs from several outputs

First of all, I'm not a programmer nor a cyrptography expert. I was doing some reading at StackExchange on mathematics subjects, and came across Mersenne Twister. And after some readings, many said ...
user avatar
1 vote
1 answer
82 views

What do you think of my plan to secure on-chain sensitive data using asymetric encryption?

I’m new to development using web3 technologies and I have a use case where I want to store private data about the user in the public blockchain Polygon. This data should be recorded to be tamper proof ...
user avatar
  • 11
3 votes
2 answers
828 views

Is the Euler totient shared in the RSA algorithm?

For what I know from the RSA algorithm, the receiver of an encrpyted message needs the Euler totient to generate its private decryption key. If the sender has chosen two primes p and q, then the Euler ...
user avatar
  • 139
2 votes
1 answer
32 views

How does the blinding become perfect in Ferguson's Randomized Blind Signature Scheme

Trying to figure out how the scheme works I came across the last paragraph of the page. As stated, for any possible additional factor we multiply by the specified power v of the element g. How did ...
user avatar
  • 23
3 votes
1 answer
78 views

AES-GCM with different IVs but close enough for counter to cause duplicates

I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
user avatar
3 votes
1 answer
129 views

Alter SPHINCS+ to have collision probability=0 and remove entropy source when signing

If you alter the SPHINCS+ signature scheme such that the number of signatures it can sign is the same as the number of hashes the hashing algorithm can output such that for example if you have a 2^256 ...
user avatar
0 votes
1 answer
36 views

IPS systems and AES Encrypted data [closed]

I was wondering how "IPS" systems process and react to the AES encrypted data than the DES
user avatar
0 votes
0 answers
23 views

Understanding LSB extraction

I am not able to understand LSB extraction as explained in protocol 3.4 of this paper Improved Primitives for Secure Multiparty Integer Computation Specifically, the protocol samples random number $r'...
user avatar
  • 229
0 votes
0 answers
18 views

secure 2pc bit extraction?

I want to solve following problem Give secret shared [x] I want to extract MSB of x, in other words I want to get sign(x). Just to ensure I do not want to sure Yao Garbled circuit. I found one ...
user avatar
  • 229
0 votes
1 answer
45 views

Can the indistinguishability obfuscator leak the password when obfuscating the password checking function?

Suppose I have a dumb password checking function: def dumb_checker(password): return password == "my_secret_key_that_should_not_be_revealed" One can ...
user avatar
1 vote
1 answer
434 views

Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?

Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes, And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
user avatar
0 votes
0 answers
32 views

High leakage in Dual Execution

In all the papers I saw which mention garbled circuits Dual Execution (each party garbles and evaluates the same circuit and then an equality test is run), the ...
user avatar
0 votes
1 answer
41 views

Millionaire problem where one entry is public?

I want to evaluation following functionality: Parties have secret shares of private input [a] and public input b, they want to measure if a>b, additionally only one party should learn the output ...
user avatar
  • 229
1 vote
0 answers
58 views

On a public e-voting, how do I keep the votes from being disclosed prematurely without a trustee?

I am trying1 to build a Proof Of Concept of a e-voting scheme on a blockchain. Before the elaboration, the question: On a public e-voting, how do I keep the votes from being disclosed prematurely ...
user avatar
0 votes
1 answer
286 views

Why are quantum-proof cryptography algorithms being developed?

I noticed some new quantum cryptography algorithms are being developed. I know very little about quantum computing but my understanding is that it will just be a much more powerful computer and ...
user avatar
1 vote
1 answer
69 views

Why does the random oracle H contain the index?

I'm reading the paper Extending OT. In the extending OT protocol, the sender using $H(j, \textbf{q}_j)$ as the mask, why not use $H(\textbf{q}_j)$ directly?
user avatar
  • 409
1 vote
0 answers
47 views

Montgomery algorithms for Lattice based schemes [closed]

Why most of Lattice based scheme use Montgomery Multiplication algorithm?
user avatar
0 votes
4 answers
140 views

Is 32 bytes enough for a hash and would anything else be 'overengineering'?

For data integrity, specifically for small blocks of data, rather than using a SHA-256 hash, or simply truncating a SHA-512 hash, I am playing with the following idea: ...
user avatar
1 vote
1 answer
43 views

How to interpret algorithm diagrams

It's been a while since I know about cryptography, and always end up seing diagrams like this. However I have never been able to understang their meaning. I hope someone can explain in detail. Thank ...
user avatar
1 vote
1 answer
61 views

Do snapshots of Encrypted Disk Images weaken security?

I have read/write disk images encrypted with 128 AES using Mac's disk utility. If I snapshot the encrypted disk images daily (sometimes with changes other times without), and an attacker has access to ...
user avatar
0 votes
1 answer
67 views

Is a static IV really less secure than an IV generated from a master key?

As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication. ...
user avatar
0 votes
1 answer
26 views

When would we need a bigger IV than 2 bytes when the IV is derived of a master key?

As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText to offer both authentication and prevent identical cipherTexts. ...
user avatar
0 votes
1 answer
54 views

Determine if an elliptic point is negative

How to determine if an elliptic point $kG$ is negative? Is $k<0?$ By example, for $k=1234$, the coordinate of the point $1234G$ using secp256k1 = $X= ...
user avatar

15 30 50 per page
1
3 4
5
6 7
549