All Questions

I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...

I already built a supply chain that is able to collect product information on Ethereum. Now, that data can be confidential, but I still want to do Matrix calculations on it. I came across homomorphic ...

As I understand pkcs12 defines a container structure that can hold both a certificate and one or more private keys. ...

As I understand to obtain a Golden Block is to finding a nonce that matches a hash lower than a given target, as shown in this research-gate article. And here is a "py" kernel: Bitcoin mining python (...

Recently I started learning how the RSA algorithm works and there is one single part of the computation which really confuses me and can't get over it. Let's say I chose 2 prime numbers, namely $P ...

I started to read about the broadcast encryption problem, specifically, the first, seminal work of FN93 followed by the subset cover technique presented at NNL01, and something really trivial and ...

Suppose that the file linux.words is used as the "book". This is a publicly available list of just shy of half a million words. And suppose that this book is used, not in its native alphabetic order,...

I am new to cryptanalysis and interested in knowing cryptanalysis tools (black boxing or white boxing) for (not any specific) stream ciphers in general sense. Scenario: I am given an assignment to ...

I cannot find what "crypto_box" actually means. In general, and in specific cases, what does "box" do? I know that libsodium is authenticated encryption, but GPG is not. "Box" makes me think the ...

This is not a question targeted at a specific crypto implementation, but a question out of curiosity. What's the reason for calling the stream ciphers ChaCha/Salsa? I couldn't find any information ...

While reading some cryptographic RFCs, came across the Diffie Hellman prime computation formula: 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 } I am curious what the expression [2^894 pi] means ...

The second question my students have asked me about PQ/Classical Hybrids is about why we think they are good for protecting information with a long security lifetime. If we don't trust current PQ ...

My students have asked me some questions about why there are standards being developed for hybrid public key systems with both a classical and a post-quantum component. Given that when elliptic ...

In an answer to another question, it was suggested that the shared secret derived from Diffie–Hellman key exchange could then be used directly as a one-time pad to encrypt a message (by XORing the ...

In Section 6.3 from MP12 we have that $encode(m) = Sm$, for $S$ any basis of $\Lambda(G^t)$. Then I have: $S = \begin{pmatrix} 1 & 2 & 4 & 8 & 16 & 32 & 64 & 128 & 256\...

I tried to understand some crypto text but I am new to this. Does this: Let $X,X'$ be $\ell$-bit values, and $\Delta X=X\oplus X'$ means that $X$ and $X'$ have $\ell$ bits and $\Delta X=X-X'$ or ...

What are $d$ and $c$ in this factorization exercise? What order must $d$ and $c$ have for $p$ and $N$? If $N=pq$, $(p+q-4) =0 \bmod 8$, and $p \geq (p+q)/4$ $$N=66390187$$ $$(3*N-1)/8=24896320$$ ...

Here is the actual question that I need to answer: An RSA encryption scheme has the set-up parameters $p = 31$ and $q = 37$. The public exponent is $e = 17$. Decrypt the ciphertext $y = 2$ using the ...

I have a doubt about the Diffie-Hellman problem: Is it possible to send a message to someone using only the Diffie–Hellman key exchange? Since it's called a key exchange can you only make a key?

I have some doubts about RSA (the public key $n$ and $e$ is public): Note $n = pq$ and $\phi (n) = (p-1)(q-1)$ 1) Say if some hacker knew $p$, why would it be easy for them to find $q, \phi (n), d$? ...

Let’s say I want to find a partial rather than full preimage using the meet-in-the-middle attack. For example, my goal is to find a preimage so that the first 76-bit output of the hash are all ...

SP-cryptosystems Is the order of applying transformations in SP cryptosystems matter? What will change if we first apply the P-transformation and then the S-transformation? Will cryptographic strength ...

The signcryption and the authenticated encryption are both the combine of encryption and authentication with three natural composition (i.e., EtS, StE, E&S). I am not sure that if they are the ...

For a "Murder Mystery Party", one person is chosen anonymously to be the murderer (i.e., only the murderer knows who the murderer is) by shuffling cards with everyone randomly taking a private card (...

I have a question about AES-256-GCM encryption. Can I make a fixed-length encryption output? In my understanding, I cannot make a fixed-length ciphertext. To me, the fixed-length output is much more ...

I know that perturbation should be proportional to the $\text{L}_1$-sensitivity of the function if someone wants ($\epsilon,0$)-differential privacy, and proportional to the $\text{L}_2$-sensitivity ...

I write this code in nodejs for decrypt 459508BB6B65C5A304D3EFB133038A14 with TripleDES: <...

Google Timeline claims (e.g. here) that "Your Timeline is private, so only you can see it." What does that mean? As a cryptographer I would take that to mean that the Timeline data is encrypted using ...

If I have some bytes, and I want to compute a secure hash into a prime field which is 300 bits long I can: Use a nice hash, like sha3_512, and then modulo my prime field (introduces some bias). ...

I am having some troubles understanding the power of an adversary in attack against a MAC. In chapter 4 in Introduction of Modern Cryptography by Jonathan Katz and Yehuda Lindell, specifically in the ...

With the RSA algorithm implemented using the Chinese Remainder Theorem (CRT), the private key has to be provided with not only $p$, $q$ and the private exponent $d$, but often also with the pre-...

Has the decisional version of the discrete logarithm problem been studied somewhere? I mean, for known $G$ in a group, distinguishing $xG$ and $Y$ for unknown integer $x$ and group element $Y$?

Suppose I construct a Pedersen commitment as $g^m h^r$. I could pick the randomness in a "pseudo-random" fashion, such that $r = H(m)$. My questions are as follows: Given that $H$ is collision-...

Here is a brief description: We have two parties, Alice and Bob. Each party must choose either a positive key or a negative key. Subsequently, Alice will generate a 0 or a 1 at random and send it to ...

Certain password strength estimators (for instance, zxcvbn) give estimates that vary with the speed of the hash and the assumed resources of the attacker. I am curious what hash is used by the MacOS ...

Suppose that I give you the challenge of successfully factoring any very big random number. That is, you pick a big random number (say, 65536 bits) and try to factor it. If you manage to, you win. If ...

I know that normally a one-way function takes in a completely random input, but can a one-way function take in something pseudorandom instead of completely random? Will it still be a one-way function? ...

I'm trying to build a PKI for document signing but only using 2nd party auth and no client persistence. I'm assuming I'd need to use something like a SCrypt key of the user credentials for the user'...

I am facing the following challenge and have to find an answer by tomorrow. How many days/years/centuries does it approximately take to perform a brute force attack against a sub-stitution cipher ...

I have two different hexadecimal strings (of same length) that I think are encoded plain text strings. Out of curiosity I XORed them and I found a single hex byte repeated for the length of the two ...

Observing the code example from pqcrypto-kyber, is the decapsulate function $d$ homomorphic? If $d(ct, sk_i) = ss_i$, is it true that $d(ct, \sum_i sk_i) = \sum_i ss_i$ ?

I was trying to implement the RSA algorithm myself. I have written the key generation part. My question is if I have the word "apple" which I want to encrypt, do I have to convert each alphabet to ...

I'm looking to implement a performant revocation method for JWTs. I'm reading a paper, in which the following section's second paragraph states: If we use the client hashing approach described ...

These are contents from the paper Trapdoors for Hard Lattices and New Cryptographic Constructions(GPV08). I do not know the reason about the last sentence. Why these two distributions D_{\Lambda, s, c}...

I have a RNG producing sequences of binary numbers, ad I would like to run Dieharder test using them as an ascii txt input file. However I haven't been able to do it properly. Should I use a header ...

I apologize that this is a rather trivial question, but I haven't been able to find an answer anywhere. If the one-time pad is unconditionally secure and impossible to crack (with just ciphertext), ...

I am using a self implementation of ChaCha20 with Poly1305. Since the nonce is only 96 bits it cannot be chosen at random. Can anyone suggest an efficient method to generate nonce from the key ?

I want to be able to securely (1) create and (2) validate a PIN, typed by a user primarily in a mobile app. There is no 'typical' password, although there is another 2nd factor. The starting point ...

I'm learning some IT security and during practice I found an exercise I couldn't solve. I have an encrypted message with block cipher in CBC mode. The blocks are one byte long and the first block is ...

What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required. does it bring any ...