All Questions
27,427
questions
3
votes
0
answers
58
views
Algorithm for checking elliptic curve discrete log
Suppose the tuple $(P, a, Q)$ is given, where $P$ and $Q$ are points on an elliptic curve (I'm more interested in Montgomery curves but other curves are also fine), $a$ is a scalar and the notation $[...
- 982
1
vote
1
answer
33
views
Recovering original bit vectors that constituted XORed binary vectors
I am trying to unscramble received data packets. Each packet is divided into 3 parts (A, B and C) with equal lengths. In every packet, each of these parts are scrambled/encrypted with an unknown code ...
- 111
0
votes
1
answer
39
views
Unsolveability of the quintic on SNARK
All examples I find on SNARKs show polynomials of up to degree 3 or 4 but what about polynomials of degree over 5, what is the mechanism that allow SNARK not to be affected by the unsolvability of the ...
- 101
0
votes
1
answer
42
views
How to know who is an attacker in byzantine broadcast?
2 requirements of Byzantine broadcast (consistency and validity) only state honest node should output certain bit without mentioning what should malicious nodes do.
How do we know the identity of each ...
- 3
1
vote
1
answer
99
views
Almost similar, but still different algorithm names. What is the difference?
I was sent from Stack Overflow to here (original question). I'm quite new to cryptographic programming. I want to generate TLS certificates on application boot up time. It is a Spring Boot application,...
- 13
1
vote
0
answers
25
views
Question about Mesquite signature size?
I have a question regarding William Wang's paper Shorter Signatures from MQ. According to him the (maximum) signature size is:
$$
2\kappa +
3\kappa\cdot \lceil\tau\log\frac{M}{\tau}\rceil
+
\tau\cdot\...
- 203
4
votes
2
answers
411
views
Is there anything like "Proof of Computation"?
Is there any cryptographic method for Proof Of Computation ?
If i am running my program on untrusted hardware (remote server), after some time i want to verify the ...
- 41
0
votes
1
answer
37
views
What are the parity bits in a (7,3)-linear code
If I have a linear (7,4)-Hamming Code I know that the last 3 bits are the parity bits but I just have seen that there are multiple linear codes like (7,3) for example the code with basis:
$$\begin{...
- 103
3
votes
1
answer
122
views
Number of points on an elliptic curve
In his paper on pairing based cryptography, Menezes claims that for
$$
E_1: y^2+y = x^3+x+1
$$
the number of $\mathbb{F}_{2^m}$-points is $2^m +1 - (1+i)^m - (1-i)^m$. Whereas this is clear, it is not ...
- 177
0
votes
0
answers
32
views
MPC model used in Ligero and Limbo
Ligero (https://dl.acm.org/doi/10.1145/3133956.3134104) and Limbo (https://eprint.iacr.org/2021/215.pdf) use a somewhat unique MPC model for their zk-PCP where not all parties communicate with each ...
- 982
10
votes
2
answers
4k
views
If I have enough examples of a private key's signature, can I discern it?
I understand that you can't discern a private key from a public key, but what if you have thousands of examples of the private key signatures, and you know what the message/cypher is?
Basically, you ...
0
votes
1
answer
36
views
Transforming a encryption of binary representation of a number to an encryption of vector representation
Suppose Alice chooses a number $n\in Z_q$ and decompose it to its binary representation $b_0,b_1,...,b_d$. Then Alice encrypts these bits (can be any encryption scheme). Is it possible for Bob (who ...
- 31
0
votes
0
answers
29
views
Encrypt user AES keys with AWS KMS RSA key
I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
- 1
1
vote
0
answers
58
views
Is there any structure similar to GGM but more efficient?
Although Goldreich-Godlwasser-Micali (GGM) construction of a pseudo-random function (PRF) from a pseudo-random number generator (PRNG) is widely in many cryptographic applications, it needs to consume ...
- 23
1
vote
0
answers
25
views
Can the proof only be the stateful?
Let SE be stateful encryption.
Then, it is well known that the oracle for the security proof becomes stateful too. (We only consider the IND-CPA security game.)
On the other hand, assume that E is ...
- 11
1
vote
2
answers
97
views
LWE with a binary matrix A
In LWE, we know that given reasonable public parameter $A\in \mathbb{Z}_q^{n\times \lambda}$, secret $s\in \mathbb{Z}_q^{\lambda}$ and noise $e\in \mathcal{X}^{n}$, random $r\in \mathbb{Z}_q^{n}$, $(A,...
- 23
1
vote
0
answers
30
views
How does Diogenes prove equivalence of discreet logs despite the candidates not being composed of safe primes
In the paper describing a protocol for distributed RSA modulus generation, Diogenes, "[they] employ a special-purpose $\Sigma$-protocol based on [Sho00] for proving correctness of exponentiations ...
- 488
0
votes
0
answers
4
views
how to sign a payload with existing private key [migrated]
I have an existing private key like "4FcPXsrv3cr2rD5PULq3LYBnjYHXqvdvnCrJje1A2kMoVyFZgK5RTSM8msmQNeirvDSaR9LhPeZVyaV69oLx1WLz" (changed for obvious reason). I want to use this to sign a ...
1
vote
1
answer
25
views
HMAC-based one-time password, norm for how many counter events to check forwards in time (to see if user skipped a few)?
My bank seems to use something like HMAC-based one-time password, and it generates a new code every time I open it, and I could in theory skip a thousand codes (not use them to log in), and then the ...
- 11
1
vote
0
answers
31
views
What issues does the following Distributed Shamir Secret Sharing scheme have?
What (obvious) security issues does the following "onion" Distributed Shamir Secret Sharing scheme on a blockchain for the purpose of e-voting have?
The blockchain in this context, is an ...
- 71
0
votes
1
answer
47
views
Encrypting content with assymetric key pairs as a form of signing
The use-case is as follows:
There is a signer, call it $S_A$ that have a claim or document $D_j$.
$S_A$ wants any client $C_k, \forall k$ to be able to verify that it has not been tampered with.
I ...
1
vote
1
answer
47
views
OTP like Identity
I am a developer with very little experience on the crypto part,
and I'm looking for a secure solution (OTP Like) for identifying between client (browser) and server.
this is what i need:
Web Page at ...
4
votes
0
answers
52
views
How to get started with Simulation and UC proofs?
I've been in my PhD program for a few months, and every time I try to understand the simulation and UC proof-paradigms I get so confused.
I feel like what I really need is an easy set of (guided) ...
- 41
-2
votes
1
answer
113
views
Why does the comb of Natasha Otomoski have 21 teeth? [closed]
What is the signature size of Natasha Otomoski haircomb? What is the number of invocations of the underlying one way hash function for key generation, signature, and verification?
How does it compare ...
0
votes
0
answers
54
views
What is the best choice of the base g in El-Gamal PKC
I have just read in a book that in El-Gamal PKC, the best choice of a base g is a number whose order in the field ($\mathbb{F}_p$) is a large prime, and added: "approximately = $\frac{p}{2}$"...
0
votes
2
answers
94
views
bitcoin public address cryptography
I was learning about bitcoin cryptography and seen some strange bitcoin public addresses like this
1Lets1xxxx1use1xxxxxxxxxxxy2EaMkJ
1fuLL1xxxx1power1xxxxxxxxxxzatvCK
...
3
votes
1
answer
73
views
Information Theoretic Security for Public Key Encryption
Do there exist information theoretic secure public key crypto-systems? Are they useful in any way, or are they just mathematical curiosities?
- 133
0
votes
0
answers
19
views
Mersenne Twister - Get all outputs from several outputs
First of all, I'm not a programmer nor a cyrptography expert.
I was doing some reading at StackExchange on mathematics subjects, and came across Mersenne Twister. And after some readings, many said ...
- 1
1
vote
1
answer
82
views
What do you think of my plan to secure on-chain sensitive data using asymetric encryption?
I’m new to development using web3 technologies and I have a use case where I want to store private data about the user in the public blockchain Polygon.
This data should be recorded to be tamper proof ...
- 11
3
votes
2
answers
828
views
Is the Euler totient shared in the RSA algorithm?
For what I know from the RSA algorithm, the receiver of an encrpyted message needs the Euler totient to generate its private decryption key. If the sender has chosen two primes p and q, then the Euler ...
- 139
2
votes
1
answer
32
views
How does the blinding become perfect in Ferguson's Randomized Blind Signature Scheme
Trying to figure out how the scheme works I came across the last paragraph of the page. As stated, for any possible additional factor we multiply by the specified power v of the element g. How did ...
- 23
3
votes
1
answer
78
views
AES-GCM with different IVs but close enough for counter to cause duplicates
I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
- 33
3
votes
1
answer
129
views
Alter SPHINCS+ to have collision probability=0 and remove entropy source when signing
If you alter the SPHINCS+ signature scheme such that the number of signatures it can sign is the same as the number of hashes the hashing algorithm can output such that for example if you have a 2^256 ...
- 31
0
votes
1
answer
36
views
IPS systems and AES Encrypted data [closed]
I was wondering how "IPS" systems process and react to the AES encrypted data than the DES
0
votes
0
answers
23
views
Understanding LSB extraction
I am not able to understand LSB extraction as explained in protocol 3.4 of this paper
Improved Primitives for Secure Multiparty Integer Computation
Specifically, the protocol samples random number $r'...
- 229
0
votes
0
answers
18
views
secure 2pc bit extraction?
I want to solve following problem
Give secret shared [x] I want to extract MSB of x, in other words I want to get sign(x).
Just to ensure I do not want to sure Yao Garbled circuit. I found one ...
- 229
0
votes
1
answer
45
views
Can the indistinguishability obfuscator leak the password when obfuscating the password checking function?
Suppose I have a dumb password checking function:
def dumb_checker(password):
return password == "my_secret_key_that_should_not_be_revealed"
One can ...
- 257
1
vote
1
answer
434
views
Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?
Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes,
And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
- 281
0
votes
0
answers
32
views
High leakage in Dual Execution
In all the papers I saw which mention garbled circuits Dual Execution (each party garbles and evaluates the same circuit and then an equality test is run), the ...
- 60
0
votes
1
answer
41
views
Millionaire problem where one entry is public?
I want to evaluation following functionality:
Parties have secret shares of private input [a] and public input b, they want to measure if
a>b, additionally only one party should learn the output
...
- 229
1
vote
0
answers
58
views
On a public e-voting, how do I keep the votes from being disclosed prematurely without a trustee?
I am trying1 to build a Proof Of Concept of a e-voting scheme on a blockchain. Before the elaboration, the question:
On a public e-voting, how do I keep the votes from being disclosed prematurely ...
- 71
0
votes
1
answer
286
views
Why are quantum-proof cryptography algorithms being developed?
I noticed some new quantum cryptography algorithms are being developed.
I know very little about quantum computing but my understanding is that it will just be a much more powerful computer and ...
- 163
1
vote
1
answer
69
views
Why does the random oracle H contain the index?
I'm reading the paper Extending OT. In the extending OT protocol, the sender using $H(j, \textbf{q}_j)$ as the mask, why not use $H(\textbf{q}_j)$ directly?
- 409
1
vote
0
answers
47
views
Montgomery algorithms for Lattice based schemes [closed]
Why most of Lattice based scheme use Montgomery Multiplication algorithm?
- 159
0
votes
4
answers
140
views
Is 32 bytes enough for a hash and would anything else be 'overengineering'?
For data integrity, specifically for small blocks of data, rather than using a SHA-256 hash, or simply truncating a SHA-512 hash, I am playing with the following idea:
...
- 281
1
vote
1
answer
43
views
How to interpret algorithm diagrams
It's been a while since I know about cryptography, and always end up seing diagrams like this.
However I have never been able to understang their meaning. I hope someone can explain in detail. Thank ...
1
vote
1
answer
61
views
Do snapshots of Encrypted Disk Images weaken security?
I have read/write disk images encrypted with 128 AES using Mac's disk utility. If I snapshot the encrypted disk images daily (sometimes with changes other times without), and an attacker has access to ...
0
votes
1
answer
67
views
Is a static IV really less secure than an IV generated from a master key?
As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication.
...
- 281
0
votes
1
answer
26
views
When would we need a bigger IV than 2 bytes when the IV is derived of a master key?
As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText to offer both authentication and prevent identical cipherTexts.
...
- 281
0
votes
1
answer
54
views
Determine if an elliptic point is negative
How to determine if an elliptic point $kG$ is negative? Is $k<0?$
By example, for $k=1234$, the coordinate of the point $1234G$ using secp256k1 =
$X= ...
