All Questions

Filter by
Sorted by
Tagged with
1 vote
1 answer
58 views

Newbie question about AES-GCM and IV

Imagine a channel where the initial secret for deriving of the actual key is established with ECDH. First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
Kote Isaev's user avatar
1 vote
1 answer
55 views

Where & how is the 2nd group used in the KZG Commitment Scheme in case the 2 groups are not the same?

This is about the KZG Polynomial Commitment Scheme In Section 2, it's written We use the notation $e : \mathbb G \times \mathbb G \mapsto \mathbb G_T$ to denote a symmetric (type 1) bilinear pairing....
user93353's user avatar
  • 2,167
2 votes
1 answer
252 views

Does RFC 6979 unconditionally prevent nonce-reuse attacks?

Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
Melab's user avatar
  • 3,605
1 vote
1 answer
127 views

How strong should my password manager's master password be?

I use an offline password manager, I want to use a future proof very strong master password and I'm going to choose one of these options from the EFF's large wordlist, a randomly chosen 8 word ...
Echo's user avatar
  • 11
1 vote
1 answer
67 views

Alternative definition of secret sharing using entropy

I ame reading the paper "Secret-Sharing schemes: A survey" by Amos Beimel. Here there are two definitions of secret sharing. The first one states:\ A distribution scheme $\langle \Pi,\mu \...
Cristie's user avatar
  • 73
0 votes
1 answer
56 views

On a problem assuming Diffie-Hellman oracle

If we have a Diffie-Hellman oracle then given $g^x$ and $g^y$ we can construct $g^{xy}$. Can we construct $g^{x^{-1}}$ given $g^x$?
Turbo's user avatar
  • 908
0 votes
0 answers
33 views

RSA with p and q being generated by pow expression of weak random seed

n, e and modulus of RSA are given and n is very large. p and q are primes generated by pow(7, random_seed, modulus), and the seed that p and q used is very close. ...
Imanity's user avatar
0 votes
1 answer
64 views

How to get the rest of 10 bytes (from total 32 bytes plaintext) of plaintext from a 48 byte ciphertext using AES-128 when knowing 22B of plaintext?

I have a challenge in which I need to decrypt 32(?) bytes of plaintext, which by encryption resulted in 48 (this for sure) bytes of data. It's a black box challenge, but managed to figure out the ...
Sir Muffington's user avatar
0 votes
1 answer
42 views

Key expansion in AES CTR mode

While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption). Does AES CTR mode also requires such a step ? Or can the 256 ...
shaiko's user avatar
  • 103
0 votes
0 answers
21 views

Transfering PIR to Symmetric PIR

Common PIR schemes only protect the client's privacy, not the server's, while Symmetric PIR(SPIR) can do both. In many papers, it is mentioned that we can use the Naor and Pinkas method (https://dl....
vince.h's user avatar
  • 97
0 votes
1 answer
58 views

Finding out corrupted S Box value in DES implementation?

I am using DES encryption when writing a file in an embedded device. When I decrypt the file. I get a partially corrupted file. Kind of randomly some 8-byte blocks are corrupted. Some are not. When I ...
Monem Ahmed's user avatar
2 votes
1 answer
45 views

NIST random number tests report

I am using the NIST test suite to test random binary numbers. when I tried it for data.pi, the generated report has some items that can not be interpreted. for example, the coeffecients named C0~C10. ...
O. Nawwar's user avatar
2 votes
2 answers
95 views

NIST random number generators ASCII input file format problem

I have temporal data from experiment and by setting a threshold, I convert them to zeros and ones. I saved these binary bits to txt file (normal txt file from MATLAB) with each line has 32 bits (total ...
O. Nawwar's user avatar
0 votes
1 answer
58 views

Some questions about AES-128 key wrapping using RFC3394

It's that time of the year - I'm trying to learn how AES-128-CBC encryption works. My key is (since it's AES-128) is 16 bytes, my IV is 16 bytes as well. My implementation of key wrapping does ...
Sir Muffington's user avatar
0 votes
1 answer
66 views

Safe implicit value validation: $H_k(k \oplus m) \sim H_k(m)$?

$H_k$ is a cryptographic hash function that's keyed using a section of key material $k$ (for whatever definition of "keyed" that's appropriate for the given hash function $H$). Are the ...
aiootp's user avatar
  • 703
1 vote
0 answers
30 views

How to uncover keys from using double encryption schemes such as Hill and Vernam Cipher

I have a quick question. How would you decrypt an encryption scheme, involving both Hill and Vernam Cipher. The order of encryption is Hill Cipher then Vernam Cipher. Problem is that only final cipher ...
Kelvin Li's user avatar
0 votes
2 answers
92 views

Query about arithmetic finite fields

I was working on implementing shamir secret sharing in GF(2^256), According to my knowledge multiplication in a finite field is defined as mul(a,b) = (a*b)%mod, where mod is the irreducible polynomial....
CipherNewbie's user avatar
1 vote
1 answer
91 views

PLONK's computation of the first Lagrange polynomial at $\zeta$

From the PLONK paper. On Page 31, Point 6 Compute the Lagrange Polynomial Evaluation $L_1(\zeta) = \frac{\omega(\zeta^n - 1)} {n(\zeta- \omega)}$ I don't think this formula is correct. We have $n$ ...
user93353's user avatar
  • 2,167
0 votes
1 answer
142 views

Kleopatra: What is the strongest and most popular cryptography standard for PGP

While setting up PGP for the first time, I am presented with various encryption standards I can use being: RSA (2048, 3072, 4096 bits) with an option for + RSA (2048, 3072, 4096 bits) DSA (2048 bits) ...
Bill Joe's user avatar
0 votes
1 answer
81 views

AES-GCM vulnerabilities

Does AES-GCM take replay attacks into consideration? If an attacker intercepts the AES-GCM secured message and gains access to the initialization vector (IV), can they inject falsely fabricated data (...
udit's user avatar
  • 1
1 vote
2 answers
66 views

Orthogonal Lock

Is there a cryptographic function that employs two locks: first 'Lock A', and then on top of that 'Lock B' but it permits unlocking 'Lock A' before 'Lock B' to read the message?
Arik Malachi's user avatar
2 votes
2 answers
460 views

What is the difference between a seeded RNG and an XOF hash?

Suppose I have some ZK proofs that were turned non-interactive using Fiat-Shamir heuristic. So I need to generate the challenge value deterministically using some data shared between the prover and ...
fjarri's user avatar
  • 289
2 votes
0 answers
35 views

Which one is more general, attribute based encryption or inner product predicate encryption?

If we have a scheme for inner product predicate encryption (IPPE), then can we claim that we already have designed an attribute based encryption (ABE) scheme; So we do not need to design an ABE again. ...
user1035648's user avatar
1 vote
0 answers
33 views

TLS 1.3 key_share capture without certificate exchange

I am working on an investigation on TLS 1.3. I've came across an article of qacafe where they shared a TLS 1.3 handshake sequence. Wireshark capture. In this capture you see that in the Client Hello a ...
Arthur Timmermans's user avatar
0 votes
0 answers
19 views

Finding key using Mutual Index of coincidence / Mg from vigenere ciphertext [duplicate]

I'm new to cryptography and I was trying to find key to an intercepted vigenere ciphertext using ciphertext-only attack, I'm following book "cryptography and network security" by Forouzan. ...
Eternity's user avatar
1 vote
1 answer
58 views

Fast Algorithms for generalized Discrete Logarithm?

I know the standard algorithms for D-log. Pollard-rho, Baby-step-big-step, Pollig-Hellman, index calculus, etc. I'm looking for fast algorithms to find a relation for the generalized discrete ...
mtheorylord's user avatar
1 vote
2 answers
38 views

Let $X$ be the set of 256-bit strings and $x \rightarrow H(x)$ a map on this set, where $H$ is SHA-256. How often is $H^-1(y)$ empty?

It cannot be "frequent" because that implies $H$ is not really 256-bit. Are there statistical or mathematical bounds on this? Finding the inverse is computationally difficult, but what ...
Warren MacEvoy's user avatar
0 votes
0 answers
19 views

What is the running time of precomputation for the PLONK zk-SNARK?

I have been looking for benchmarks on the precomputation phase of PLONK (https://eprint.iacr.org/2019/953.pdf), but found none. Is there a resource where one can get a feel for this? Either in terms ...
joakimb's user avatar
  • 243
0 votes
1 answer
42 views

How to maximise compatibility of Shamir's Secret Sharing

I want to create a shared secret from a short string (e.g. a password) which should be easy to decrypt also in the long term. Unfortunately, I have quite a hard time to make the different tools work ...
Wulle's user avatar
  • 101
0 votes
0 answers
49 views

Authenticate the users (in telegram bot) without storing user ids

Might be a bit weird but interesting scenario: I have a telegram bot and I need to authenticate users but I don't want to store any user data(at least openly). So here's a breakdown: I need to prove ...
Jordan Walker's user avatar
3 votes
1 answer
533 views

How brittle is the current public key encryption infrastructure

Edit: One half of the answer to this question also applies to a recently asked and now deleted question regarding the impact of an algorithm which breaks DLP over integers but has no impact on ...
kodlu's user avatar
  • 21k
1 vote
1 answer
51 views

If meet in the middle is a known plaintext attack, and i already have both plaintext and ciphertext, why would i need to find the key?

since I already have plaintext and ciphertext why would I need the key for? what purpose would that serve?
user avatar
0 votes
1 answer
76 views

How does the Key Expansion Step Work for AES-192

I now understand the initial key from all the round keys will be the original 4x4 block for 128-bit keys, but I do not know how it would work for something else, like AES-256 or 192. Would it be that ...
Epicko Corporation's user avatar
1 vote
1 answer
128 views

Many-out-of-many proofs

I need to prove that given vector of commitments of length N contains N-1 commitments to zero (and one to an arbitrary number). More formally, given vector: $$\textbf{a} = \begin{bmatrix} C(0, r_1)...
Seed Barret's user avatar
1 vote
0 answers
49 views

name/acronym/abbreviation explanation for hashes

(Cryptographically and hash/checksum wise consider me a rookie, as I'm rather just using algorithms.) While there are many names, not all of them are explained - I tried searching for the meaning of a ...
AmigoJack's user avatar
  • 111
0 votes
1 answer
42 views

Is there a way to short circuit (speed up) hashing a large but sparse array?

Imagine a large array (Megabytes) that is virtually empty, i.e. contains 0 in almost all locations. But also imagine there's 1000 pseudo random locations that contain a pseudo random byte. There is ...
Paul Uszak's user avatar
3 votes
1 answer
140 views

Kyber-CCA-KEM - Deterministic implicit rejection

In Kyber-CCA-KEM, there's a step in the Fujisaki-Okamoto transformation, where decryption failure results in a random shared secret returned from the decapsulation call. I have a C language project ...
DannyNiu's user avatar
  • 8,648
1 vote
1 answer
80 views

Safe to use a BCrypt hash directly as a key to HMAC-SHA256?

Is it safe (or optimal) to use a BCrypt hash directly as the key to an HMAC-SHA256? I ask because all the BCrypt hashes I will use contain the same salt, version, and cost, so the first 29 characters ...
Starscream512's user avatar
0 votes
1 answer
82 views

Elliptic curve signature scheme without a nonce

ECDSA and EdDSA both require the generation of a single-use value. Are there any elliptic curve signature schemes in existence which don't require nonce and maintain the usual security strength equal ...
Melab's user avatar
  • 3,605
2 votes
1 answer
104 views

Can I predict CryptGenRandom on my own device?

I have a Windows 10 laptop with an algorithm that creates a random number using the PRNG CryptGenRandom. According to Wikipedia: Because CryptGenRandom is the de facto standard CSPRNG in Win32 ...
Riemann's user avatar
  • 173
6 votes
2 answers
335 views

Efficient multiplication modulo a square

Can anyone point me to techniques for efficient computation of modular multiplication/exponentiation modulo a square, as comes up, e.g., in the context of Paillier encryption? The standard references ...
user432944's user avatar
1 vote
2 answers
255 views

Encrypting random IV in CTR mode (no nonce!)

Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
ManRow's user avatar
  • 323
2 votes
0 answers
58 views

Fischlin vs. Fiat-Shamir Performance

Using Fiat-Shamir, an interactive 3-round sigma protocol can be compiled into a non-interactive zero-knowledge proof in the random oracle model. A NIZK through Fiat-Shamir is not UC-Secure due to ...
Atonal's user avatar
  • 143
1 vote
1 answer
27 views

Is it possible to forge valid proofs in this Schnorr signature-based ZKP system for proving knowledge about discrete logarithms?

I am currently reading the paper "A 2-round anonymous veto protocol" and have run into some trouble verifying the claims made about the zero knowledge proofs presented within. My knowledge ...
user7308228's user avatar
1 vote
1 answer
45 views

Ensuring Data Security During Decryption and Re-encryption Process

Scenario: Consider a scenario where Server 1 stores a 600-800 KB ebook encrypted with a certain private key. Server 2, a computation-purpose server, holds this private decryption key and get access to ...
JeremyDEX's user avatar
2 votes
1 answer
52 views

Which reordering should I use for an 8-bit S-box?

I'm designing a cipher which has key-dependent S-boxes. The procedure is like this: Transform the key (a string of bytes) into 96 16-bit words (the high bits are ignored, but make a difference when ...
Pierre Abbat's user avatar
1 vote
1 answer
101 views

finding r-th root in $\mathbb{Z}/n\mathbb{Z}$

I was reading the paper One-way Accumulators: A Decentralized Alternative to Digital Signatures by Benaloh and de Mare [link], and in section 4.2, they say that given $z\in (\mathbb{Z}/n\mathbb{Z})^*$ ...
vxek's user avatar
  • 445
2 votes
1 answer
75 views

Is it possible to reverse engineer an encryption algorithm derived from AES-128 given these conditions?

Given the following conditions: The encryption program, which uses some algorithm resembling AES-128 but with unknown modifications to real AES-128. It uses a fixed key and IV. It is written in Rust ...
Sir Muffington's user avatar
2 votes
1 answer
58 views

Is it possible to perform an unlimited amount of multiplications on the same ciphertext in fully homomorphic encryption?

I am currently playing around with some of the Python FHE libraries and found out that, e.g. TenSeal (SEAL) is able to perform "only" 8 ciphertext-ciphertext multiplications on the same ...
Freak14's user avatar
  • 23
2 votes
1 answer
85 views

Is hash function cryptanalysis the same or more difficult for iterated hashing, as H(H(H(H(H))))?

The effectiveness of hash function attacks is typically measured in $x$ broken rounds of $N$ total designed rounds. And some constructs containing iterated hash functions include proof of work schemes,...
Paul Uszak's user avatar

15 30 50 per page
1
3 4
5
6 7
591