All Questions

Filter by
Sorted by
Tagged with
3 votes
1 answer
315 views

How can I understand the gap between CPA and CCA1?

I have read lots of books about CPA,CCA1,CCA2. I understand how to get an example satisfies CPA but not CCA2. However, I can't find such a scheme which is CPA but not CCA1. What is the extra advantage ...
Wang Xingwang's user avatar
1 vote
1 answer
67 views

Does encrypting a billion short and similar jsons with known structure make encryption less secure?

Let's say we have a billion short individual json files with same regular structure: {"name": "<name>", "id": <id>}. Each ...
aackmann's user avatar
1 vote
1 answer
80 views

AES-128 ECB Standard Confusion

Forgive my ignorance, but I've run into some confusion in an AES implementation I'm testing. To the best of my understanding, ECB provides no diffusion, the same plaintext with the same key will yield ...
WackyTortoise's user avatar
1 vote
0 answers
107 views

One-more co-CDH assumption in pairing group

I am asking it again because no one answered my previous question with more clarity. I have deleted that question One more co-CDH in Type three pairing groups $G_1 \times G_2 \to G_T$: means given a ...
Manish Adhikari's user avatar
1 vote
1 answer
58 views

What does "gpg: RSA/AES256.CFB encrypted for" mean?

The output of command fortune | gpg -vaer <receipent-id> has a line that begins with: ...
aackmann's user avatar
0 votes
0 answers
13 views

in MA-ABE, what is the diference when prove a scheme is selective or static?

I have read [1]Decentralized Multi-authority ABE for NC1 from BDH, [2]Decentralizing Attribute-Based Encryption, [3]Fully Adaptive Decentralized Multi-Authority ABE, When I compare security proof in [...
Wang Xingwang's user avatar
0 votes
0 answers
46 views

What is insecure about adding salt to your plaintext before using RSA? [duplicate]

RSA can't be used securely as is as it is deterministic. So an encrypted "yes" always looks the same. A simple workaround, which is apparently not secure, is to add 100 bits, say, of random ...
Simd's user avatar
  • 299
6 votes
2 answers
277 views

Blinding an ECDSA private key without learning the private key

I am looking at ways to blind an ECDSA signing key (and verification key respectively). Looking at proposed solutions like the IETF KBSS draft, and the IETF ARKG draft it seems that the ECDSA key ...
Peter Altmann's user avatar
1 vote
1 answer
37 views

n-Party Garbled Circuit

Yao introduced a famous notion of securely computing any function between 2 users using a concept of Garbling circuit. How can this idea be extended for n-party case? That is there are n-1 garblers ...
Novice_researcher's user avatar
4 votes
1 answer
107 views

Is there any cryptography-based assured data deletion technique currently as a standard?

I've recently read part of a book exploring secure data deletion techniques for many storage mediums. In particular, I read about assured data deletion techniques developed for data outsourced to the ...
Aljndrop's user avatar
1 vote
1 answer
48 views

Implement reciprocal of a floating point number using Chebyshev approximation in CKKS

I am trying to obtain the reciprocal of a floating point value $x$ using the Chebyshev approximation, where $x$ is mostly in the order of $10^3$ to $10^5$. Subsequently, I am trying to implement that ...
Sumana Bagchi's user avatar
2 votes
2 answers
1k views

How do RSA implementations avoid cases where the ciphertext and N are not coprime?

I'm trying to better understand RSA. One attack I've read about is when the encrypted message $y$ and $N = p\cdot q$ share a common factor. If this happens, we can easily factor $N$ to obtain $p$ and $...
rookie's user avatar
  • 123
4 votes
2 answers
629 views

Utilizing block cipher (AES) while saving bandwith

I'm helping a company to redesign their cryptographic protocol for communication within a network of embedded devices. So far I have discovered several insecure practices, such as using very short (6 ...
JustSomeAccount's user avatar
5 votes
1 answer
1k views

Intentionally craft a 180 to 255 bits Integer that bypass this miller‑rabin test with having a known factor

I’ve a signature system using modular exponentiation where having the exponent being a composite with a known factor allows to forge signatures… In order to check if the exponent is a prime number, ...
user2284570's user avatar
3 votes
3 answers
870 views

Why is a modulus used in Elliptic Curve Cryptography?

In the eliptic curve cryptography, we use modulus $y^2 = (x^3 + ax + b) \ \ \text{mod} \ \ p$ So using modulus definitely changes the graph points completely - i.e gives a completely different graph ...
Giorgi Lagidze's user avatar
3 votes
2 answers
3k views

What’s the smallest known sha256 hash that was ever produced?

Basically the same question as this one, except in my case the value to be hashed doesn’t have to be a valid Bitcoin block, but is a bytearray of arbitrary length and content (and that my use case is ...
user2284570's user avatar
1 vote
1 answer
99 views

Discrete log problem - does luck exist?

Assume the discrete log problem: $g^x mod (p) = h$ For sure, $p$ is a prime number and $g$ is its primitive root or generator and assume that Alice sent $h$ to Bob and middle man caught it. So ...
Giorgi Lagidze's user avatar
0 votes
2 answers
170 views

sign a JWT with RS256 using a RSA-PSS SHA256 key pair?

Given a private key using algorithm RSA-PSS with SHA256 is it possible to use this key to sign a JWT using algorith RS256 (RSA with SHA256) instead of PS256 (RSA-PSS with SHA256)? The German ...
Basti's user avatar
  • 103
2 votes
1 answer
43 views

How to measure the denseness of Mod-LWR samples in some space?

I tried to understand how dense the Mod-LWR samples are in some space. I tried to see from a view similar to LWE, i.e. using GV-bound(maybe LPN is better example because GV-bound is for codes). But I ...
Sharon's user avatar
  • 23
1 vote
2 answers
69 views

App for Secure delivery of the gray images using AES, DH, DSA - Help in implemeting the system structure

I have this uni project that I have to implement in code: "App for Secure delivery of the gray images, encryption-decryption with AES in OFB mode + secret key delivery using Merkle–Hellman ...
Mustafa Shama's user avatar
0 votes
1 answer
82 views

Dumb question about brute force attacks

Let's assume that the password to be cracked is 15 characters long and consists of numbers (to keep the math simple). Let's assume the attacker has the following information about the password: It is ...
randomguy's user avatar
3 votes
1 answer
91 views

Rigorous Proof on Malicious Zero-Knowledge Property of Schnorr Protocol

Let us recall the Schnorr Protocol, following Chris Peikert's excellent Notes on the Theory of Cryptography. Protocol. Let $G=\langle g \rangle$ be a cyclic group of order $q$. We consider an ...
Chris's user avatar
  • 236
3 votes
1 answer
714 views

Is AES a group?

The question I'm wondering is whether the AES cipher is a closed cipher (which is equivalent to AES being a group). And this question interests me due to the lack of understanding of whether it is ...
Ss1996's user avatar
  • 53
1 vote
0 answers
55 views

Creating a weak BLS

I am exploring the implementation of a cryptographic signature that users can manually input, and I am willing to compromise security to a level where a hacker investing several thousand dollars in ...
Ehsan's user avatar
  • 51
0 votes
0 answers
55 views

What do we mean when we say we need more than polynomial time many cipher texts

What does it mean when we say something like „we need more than polynomial time many cipher texts“? I understand it as „an adversarial can run for polynomial time and try as many messages as possible ...
jilgolfo's user avatar
1 vote
1 answer
238 views

Zero knowledge proof applied to a chess position

I know next to nothing about cryptography. From what I have understood, anything that is provable can be done so using a zero knowledge proof (the result seems to be known from the 1980's or so, by S. ...
untreated_paramediensis_karnik's user avatar
1 vote
0 answers
23 views

Using longer key with PKCS#5 derive_key() function for AES256? [closed]

I have code where someone made the key 64 bytes (32*2) and passes to the derive_key() function. It then uses the key created for ...
user3161924's user avatar
0 votes
0 answers
33 views

Is it possible for a given plaintext and ciphertext to have two different keys? [duplicate]

This has probably been asked before but for a given ciphertext and plaintext pair, is it possible to have two different keys producing said pair? Or there are no collisions in AES, unlike hashing ...
user2338802's user avatar
0 votes
1 answer
107 views

How would I go about reverse engineering a hash function given input string and generated hash

I have a wireless capture of data and it's 12 bit hash. I am trying to identify the actual function that would have generated the hash data. I tried all the generic 12 bit CRC polynomials but none of ...
jay's user avatar
  • 1
3 votes
1 answer
191 views

Can DH be used for privacy-preserving proof of possession?

First time question poster so I hope the below is clear enough :). Problem summary: Can a Holder and Verifier safely use ECDH for a Challenge-Response protocol where: the Holder proves possession and ...
Peter Altmann's user avatar
0 votes
1 answer
210 views

Prove RSA scheme is insecure [closed]

Im reviewing my crypto and I would like to prove the following: RSA experiment where the adversary is given N, e, and y. The adversary knows p, q. I know the RSA scheme is built on the idea that it is ...
Ahmed Zaidan's user avatar
3 votes
1 answer
183 views

equivalence between entropic perfect secrecy and single probability

i'm new to information theory. I know the standard perfect secrecy definition: $$ P(M=m|C=c) = P(M=m) , $$ for all $m$ and $c$, respectively the message and the cypher. Now, i can use the entropic ...
forgetfuled's user avatar
0 votes
1 answer
44 views

TLS 1.3 digital certificates and ephemeral Diffie Hellman

There is a lot of confusing information out there regarding the role of digital certificates and the use of Ephimeral Diffie Hellman in how TLS 1.3 operates. Would it be correct to state that the the ...
termcap's user avatar
1 vote
2 answers
46 views

In order to achieve differentially private machine learning can one simply apply the Laplace mechanism after an SGD scheme? If so does it work well?

Consider a standard supervised machine learning problem on private data. Instead of using DPSGD, suppose that one uses a non-private SGD scheme to produce optimal model parameters $\theta$ (done in ...
travelingbones's user avatar
4 votes
1 answer
105 views

In Zero Knowledge Proofs (ZKP) why does the simulator and extractor get the power to rewind "time" and not some other superpower?

Why was the simulator/extractor specifically given the power to rewind "time" instead of a different super power? Was it defined in the first ZKP paper that the simulator and extractor would ...
Reggad's user avatar
  • 141
0 votes
0 answers
40 views

Security of using predefined shares in Shamir's Secret Sharing

This is related to Is it possible to create a mix of predefined and generated shares for Shamir's Secret Sharing?, but I have unfortunately lost access to that question and can't merge accounts ...
euandeas's user avatar
0 votes
0 answers
35 views

Why is firmware implementation not preferred for more lfsr based encryption schemes?

Given that an algorithmic implementation of a linear feedback shift register based encryption scheme is (much?) more secure against side channel attacks; why are hardware platforms usually used? I get ...
Me2's user avatar
  • 1
2 votes
0 answers
73 views

Fast algorithm for finding parity of an RNS number

Does anybody have a library of fastest parity finding algorithms in RNS representation? By parity I mean $x \bmod 2$ where $x$ is the number between $0$ and $N=\Pi m_i$ and all moduli are odd. I have ...
Benoit Avril's user avatar
1 vote
1 answer
97 views

Cryptographic assumptions with bilinear pairings

I have two statements which I think are correct: $\beta, s$ are unknown. Only $g^\beta$ is known to the prover but not any of $g^{\beta s^i}$ for $i \ge 1$. If the prover is able to find group ...
Nikolay Zakirov's user avatar
0 votes
0 answers
76 views

Can we be certain that Signal doesn't log metadata (e.g. message graphs)?

I know Signal uses public/private key E2E encryption to ensure it's impossible for them to read the contents of messages. WhatsApp does too, hence Signal's main attraction is that it additionally ...
Seán Healy's user avatar
2 votes
1 answer
75 views

Signature Chains: Ensuring Authenticity and Trust

I'm studying for an exam and came across this question: When an electronic signature of a message claimed to be produced by Alice is verified we typically verify (at least the first time): that the ...
user1's user avatar
  • 35
1 vote
1 answer
101 views

Is it secure for A to allow B to run a garbled circuit twice with different inputs? [duplicate]

I was reviewing past exam questions and came across this one: Is it secure for A (the garbler) to allow B (the evaluator) to run a garbled circuit twice with different inputs? They aim to compute the ...
user1's user avatar
  • 35
0 votes
1 answer
94 views

Do I need to use unique IVs if all encrypted data is unique?

I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
Ryan Hilbert's user avatar
1 vote
1 answer
73 views

Is a Shift Cipher with Random Insertions Unbreakable?

Imagine an Encryption Algorithm which applies a classic Shift Cipher (also called Caesar or ROT-X) to a text (with only lowercase [a-z] and the space ...
v3l0c1r4ptx0r's user avatar
2 votes
1 answer
171 views

How to identify if a legacy encryption algorithm used in my programming language is secure?

I used an open-source programming language called Lucee / Cfscript that is closely related to Adobe Coldfusion. The default function that developers use to encrypt and decrypt data (usually for ...
ialexander's user avatar
1 vote
0 answers
64 views

Encryption + EUF-CMA => SUF-CMA

Does there exist a proof (paper reference welcome) that if a signature scheme is EUF-CMA, and the signatures are always encrypted, then the resulting signature scheme is SUF-CMA? That is: let SIG be ...
Mario's user avatar
  • 31
1 vote
1 answer
105 views

GKR Protocol - is it one Sum-Check per layer or is it one Sum-Check per gate?

I am reading about GKR protocol from Justin Thaler's book - Proofs, Arguments & Zero Knowledge On Page 59, In the first message, $P$ tells $V$ the (claimed) output(s) of the circuit. The protocol ...
user93353's user avatar
  • 2,201
0 votes
0 answers
24 views

Resources for Private Information Retrieval

I'm studying Private Information Retrieval for my class. I couldn't find any good resources online apart from various papers written on it. Can somebody recommend a textbook, lecture or any other good ...
Boran Erol's user avatar
0 votes
1 answer
74 views

Adding hashes together

Say I have three 64 byte values that I hash into three sha256 hashes (H1, H2, H3). The data does not contain any secrets and it all public data. I am instead hashing the data for integrity purposes. ...
beegmon's user avatar
1 vote
1 answer
88 views

Is this theoretical encryption device secure? [closed]

I'm trying to design an encryption and decryption device that is extremely secure, but simple in design so that it can be understood and audited. Here is my attempt, do you see any vulnerabilities? ...
Drew's user avatar
  • 127

15 30 50 per page
1
3 4
5
6 7
608