All Questions
29,517
questions
1
vote
1
answer
58
views
Newbie question about AES-GCM and IV
Imagine a channel where the initial secret for deriving of the actual key is established with ECDH.
First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
- 113
1
vote
1
answer
55
views
Where & how is the 2nd group used in the KZG Commitment Scheme in case the 2 groups are not the same?
This is about the KZG Polynomial Commitment Scheme
In Section 2, it's written
We use the notation $e : \mathbb G \times \mathbb G \mapsto \mathbb G_T$ to denote a symmetric (type 1) bilinear pairing....
- 2,167
2
votes
1
answer
252
views
Does RFC 6979 unconditionally prevent nonce-reuse attacks?
Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
- 3,605
1
vote
1
answer
127
views
How strong should my password manager's master password be?
I use an offline password manager, I want to use a future proof very strong master password and I'm going to choose one of these options from the EFF's large wordlist, a randomly chosen 8 word ...
- 11
1
vote
1
answer
67
views
Alternative definition of secret sharing using entropy
I ame reading the paper "Secret-Sharing schemes: A survey" by Amos Beimel. Here there are two definitions of secret sharing.
The first one states:\
A distribution scheme $\langle \Pi,\mu \...
- 73
0
votes
1
answer
56
views
On a problem assuming Diffie-Hellman oracle
If we have a Diffie-Hellman oracle then given $g^x$ and $g^y$ we can construct $g^{xy}$.
Can we construct $g^{x^{-1}}$ given $g^x$?
- 908
0
votes
0
answers
33
views
RSA with p and q being generated by pow expression of weak random seed
n, e and modulus of RSA are given and n is very large. p and q are primes generated by pow(7, random_seed, modulus), and the seed that p and q used is very close. ...
- 1
0
votes
1
answer
64
views
How to get the rest of 10 bytes (from total 32 bytes plaintext) of plaintext from a 48 byte ciphertext using AES-128 when knowing 22B of plaintext?
I have a challenge in which I need to decrypt 32(?) bytes of plaintext, which by encryption resulted in 48 (this for sure) bytes of data.
It's a black box challenge, but managed to figure out the ...
- 173
0
votes
1
answer
42
views
Key expansion in AES CTR mode
While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption).
Does AES CTR mode also requires such a step ? Or can the 256 ...
- 103
0
votes
0
answers
21
views
Transfering PIR to Symmetric PIR
Common PIR schemes only protect the client's privacy, not the server's, while Symmetric PIR(SPIR) can do both.
In many papers, it is mentioned that we can use the Naor and Pinkas method (https://dl....
- 97
0
votes
1
answer
58
views
Finding out corrupted S Box value in DES implementation?
I am using DES encryption when writing a file in an embedded device. When I decrypt the file. I get a partially corrupted file. Kind of randomly some 8-byte blocks are corrupted. Some are not. When I ...
2
votes
1
answer
45
views
NIST random number tests report
I am using the NIST test suite to test random binary numbers. when I tried it for data.pi, the generated report has some items that can not be interpreted.
for example, the coeffecients named C0~C10. ...
- 55
2
votes
2
answers
95
views
NIST random number generators ASCII input file format problem
I have temporal data from experiment and by setting a threshold, I convert them to zeros and ones. I saved these binary bits to txt file (normal txt file from MATLAB) with each line has 32 bits (total ...
- 55
0
votes
1
answer
58
views
Some questions about AES-128 key wrapping using RFC3394
It's that time of the year - I'm trying to learn how AES-128-CBC encryption works. My key is (since it's AES-128) is 16 bytes, my IV is 16 bytes as well. My implementation of key wrapping does ...
- 173
0
votes
1
answer
66
views
Safe implicit value validation: $H_k(k \oplus m) \sim H_k(m)$?
$H_k$ is a cryptographic hash function that's keyed using a section of key material $k$ (for whatever definition of "keyed" that's appropriate for the given hash function $H$).
Are the ...
- 703
1
vote
0
answers
30
views
How to uncover keys from using double encryption schemes such as Hill and Vernam Cipher
I have a quick question. How would you decrypt an encryption scheme, involving both Hill and Vernam Cipher. The order of encryption is Hill Cipher then Vernam Cipher. Problem is that only final cipher ...
- 11
0
votes
2
answers
92
views
Query about arithmetic finite fields
I was working on implementing shamir secret sharing in GF(2^256), According to my knowledge multiplication in a finite field is defined as mul(a,b) = (a*b)%mod, where mod is the irreducible polynomial....
- 33
1
vote
1
answer
91
views
PLONK's computation of the first Lagrange polynomial at $\zeta$
From the PLONK paper.
On Page 31, Point 6
Compute the Lagrange Polynomial Evaluation $L_1(\zeta) = \frac{\omega(\zeta^n - 1)} {n(\zeta- \omega)}$
I don't think this formula is correct.
We have $n$ ...
- 2,167
0
votes
1
answer
142
views
Kleopatra: What is the strongest and most popular cryptography standard for PGP
While setting up PGP for the first time, I am presented with various encryption standards I can use being:
RSA (2048, 3072, 4096 bits) with an option for + RSA (2048, 3072, 4096 bits)
DSA (2048 bits) ...
- 1
0
votes
1
answer
81
views
AES-GCM vulnerabilities
Does AES-GCM take replay attacks into consideration?
If an attacker intercepts the AES-GCM secured message and gains access to the initialization vector (IV), can they inject falsely fabricated data (...
- 1
1
vote
2
answers
66
views
Orthogonal Lock
Is there a cryptographic function that employs two locks: first 'Lock A', and then on top of that 'Lock B' but it permits unlocking 'Lock A' before 'Lock B' to read the message?
- 11
2
votes
2
answers
460
views
What is the difference between a seeded RNG and an XOF hash?
Suppose I have some ZK proofs that were turned non-interactive using Fiat-Shamir heuristic. So I need to generate the challenge value deterministically using some data shared between the prover and ...
- 289
2
votes
0
answers
35
views
Which one is more general, attribute based encryption or inner product predicate encryption?
If we have a scheme for inner product predicate encryption (IPPE), then can we claim that we already have designed an attribute based encryption (ABE) scheme; So we do not need to design an ABE again. ...
- 347
1
vote
0
answers
33
views
TLS 1.3 key_share capture without certificate exchange
I am working on an investigation on TLS 1.3.
I've came across an article of qacafe where they shared a TLS 1.3 handshake sequence. Wireshark capture. In this capture you see that in the Client Hello a ...
0
votes
0
answers
19
views
Finding key using Mutual Index of coincidence / Mg from vigenere ciphertext [duplicate]
I'm new to cryptography and I was trying to find key to an intercepted vigenere ciphertext using ciphertext-only attack, I'm following book "cryptography and network security" by Forouzan.
...
- 1
1
vote
1
answer
58
views
Fast Algorithms for generalized Discrete Logarithm?
I know the standard algorithms for D-log. Pollard-rho, Baby-step-big-step, Pollig-Hellman, index calculus, etc.
I'm looking for fast algorithms to find a relation for the generalized discrete ...
- 135
1
vote
2
answers
38
views
Let $X$ be the set of 256-bit strings and $x \rightarrow H(x)$ a map on this set, where $H$ is SHA-256. How often is $H^-1(y)$ empty?
It cannot be "frequent" because that implies $H$ is not really 256-bit. Are there statistical or mathematical bounds on this? Finding the inverse is computationally difficult, but what ...
- 111
0
votes
0
answers
19
views
What is the running time of precomputation for the PLONK zk-SNARK?
I have been looking for benchmarks on the precomputation phase of PLONK (https://eprint.iacr.org/2019/953.pdf), but found none. Is there a resource where one can get a feel for this? Either in terms ...
- 243
0
votes
1
answer
42
views
How to maximise compatibility of Shamir's Secret Sharing
I want to create a shared secret from a short string (e.g. a password) which should be easy to decrypt also in the long term. Unfortunately, I have quite a hard time to make the different tools work ...
- 101
0
votes
0
answers
49
views
Authenticate the users (in telegram bot) without storing user ids
Might be a bit weird but interesting scenario: I have a telegram bot and I need to authenticate users but I don't want to store any user data(at least openly).
So here's a breakdown:
I need to prove ...
3
votes
1
answer
533
views
How brittle is the current public key encryption infrastructure
Edit: One half of the answer to this question also applies to a recently asked and now deleted question regarding the impact of an algorithm which breaks DLP over integers but has no impact on ...
- 21k
1
vote
1
answer
51
views
If meet in the middle is a known plaintext attack, and i already have both plaintext and ciphertext, why would i need to find the key?
since I already have plaintext and ciphertext why would I need the key for? what purpose would that serve?
user110859
0
votes
1
answer
76
views
How does the Key Expansion Step Work for AES-192
I now understand the initial key from all the round keys will be the original 4x4 block for 128-bit keys, but I do not know how it would work for something else, like AES-256 or 192. Would it be that ...
1
vote
1
answer
128
views
Many-out-of-many proofs
I need to prove that given vector of commitments of length N contains N-1 commitments to zero (and one to an arbitrary number).
More formally, given vector:
$$\textbf{a} = \begin{bmatrix}
C(0, r_1)...
- 33
1
vote
0
answers
49
views
name/acronym/abbreviation explanation for hashes
(Cryptographically and hash/checksum wise consider me a rookie, as I'm rather just using algorithms.) While there are many names, not all of them are explained - I tried searching for the meaning of a ...
- 111
0
votes
1
answer
42
views
Is there a way to short circuit (speed up) hashing a large but sparse array?
Imagine a large array (Megabytes) that is virtually empty, i.e. contains 0 in almost all locations. But also imagine there's 1000 pseudo random locations that contain a pseudo random byte. There is ...
- 15k
3
votes
1
answer
140
views
Kyber-CCA-KEM - Deterministic implicit rejection
In Kyber-CCA-KEM, there's a step in the Fujisaki-Okamoto transformation, where decryption failure results in a random shared secret returned from the decapsulation call.
I have a C language project ...
- 8,648
1
vote
1
answer
80
views
Safe to use a BCrypt hash directly as a key to HMAC-SHA256?
Is it safe (or optimal) to use a BCrypt hash directly as the key to an HMAC-SHA256? I ask because all the BCrypt hashes I will use contain the same salt, version, and cost, so the first 29 characters ...
0
votes
1
answer
82
views
Elliptic curve signature scheme without a nonce
ECDSA and EdDSA both require the generation of a single-use value. Are there any elliptic curve signature schemes in existence which don't require nonce and maintain the usual security strength equal ...
- 3,605
2
votes
1
answer
104
views
Can I predict CryptGenRandom on my own device?
I have a Windows 10 laptop with an algorithm that creates a random number using the PRNG CryptGenRandom. According to Wikipedia:
Because CryptGenRandom is the de facto standard CSPRNG in Win32 ...
- 173
6
votes
2
answers
335
views
Efficient multiplication modulo a square
Can anyone point me to techniques for efficient computation of modular multiplication/exponentiation modulo a square, as comes up, e.g., in the context of Paillier encryption? The standard references ...
- 270
1
vote
2
answers
255
views
Encrypting random IV in CTR mode (no nonce!)
Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
- 323
2
votes
0
answers
58
views
Fischlin vs. Fiat-Shamir Performance
Using Fiat-Shamir, an interactive 3-round sigma protocol can be compiled into a non-interactive zero-knowledge proof in the random oracle model.
A NIZK through Fiat-Shamir is not UC-Secure due to ...
- 143
1
vote
1
answer
27
views
Is it possible to forge valid proofs in this Schnorr signature-based ZKP system for proving knowledge about discrete logarithms?
I am currently reading the paper "A 2-round anonymous veto protocol" and have run into some trouble verifying the claims made about the zero knowledge proofs presented within. My knowledge ...
- 13
1
vote
1
answer
45
views
Ensuring Data Security During Decryption and Re-encryption Process
Scenario:
Consider a scenario where Server 1 stores a 600-800 KB ebook encrypted with a certain private key. Server 2, a computation-purpose server, holds this private decryption key and get access to ...
- 51
2
votes
1
answer
52
views
Which reordering should I use for an 8-bit S-box?
I'm designing a cipher which has key-dependent S-boxes. The procedure is like this:
Transform the key (a string of bytes) into 96 16-bit words (the high bits are ignored, but make a difference when ...
- 221
1
vote
1
answer
101
views
finding r-th root in $\mathbb{Z}/n\mathbb{Z}$
I was reading the paper One-way Accumulators: A Decentralized Alternative to Digital Signatures by Benaloh and de Mare [link], and in section 4.2, they say that given $z\in (\mathbb{Z}/n\mathbb{Z})^*$ ...
- 445
2
votes
1
answer
75
views
Is it possible to reverse engineer an encryption algorithm derived from AES-128 given these conditions?
Given the following conditions:
The encryption program, which uses some algorithm resembling AES-128 but with unknown modifications to real AES-128.
It uses a fixed key and IV.
It is written in Rust ...
- 173
2
votes
1
answer
58
views
Is it possible to perform an unlimited amount of multiplications on the same ciphertext in fully homomorphic encryption?
I am currently playing around with some of the Python FHE libraries and found out that, e.g. TenSeal (SEAL) is able to perform "only" 8 ciphertext-ciphertext multiplications on the same ...
- 23
2
votes
1
answer
85
views
Is hash function cryptanalysis the same or more difficult for iterated hashing, as H(H(H(H(H))))?
The effectiveness of hash function attacks is typically measured in $x$ broken rounds of $N$ total designed rounds. And some constructs containing iterated hash functions include proof of work schemes,...
- 15k