All Questions
29,797
questions
0
votes
0
answers
31
views
Reorderable encryptions [duplicate]
Are there any two encryption function(s) where encryptB(encryptA(data, keyA), keyB) == encryptA(encryptB(data, keyB), keyA).
The two functions may be related or ...
- 897
1
vote
1
answer
68
views
Equality between encrypted hash of data and hash of encrypted data?
Are there any cryptographically strong hash function and encryption function(s) where hash(encryptA(data)) == encryptB(hash(data)). The functions ...
- 897
2
votes
1
answer
79
views
in NTRU, can g be recovered given f and h?
The NTRU key generation involves polynomials and their arithmetic in polynomial rings, which is a bit different from arithmetic in modular integers.
In the NTRU cryptosystem, the public key $h$ is ...
- 23
0
votes
0
answers
64
views
Can you have a public password file that is still secure?
So I’ve been reading about different ways to store passwords on servers (plain text, encrypted, hashed, hashed + salt, slow hash + salt) and I wanted to find a way where a leak of the stored passwords ...
0
votes
0
answers
53
views
Security of the trivium stream cipher
So I've been trying to implement a Non-Deterministic RBG based on randomness polling from non-hardware sources (nothing novel, just a side-project). Since collecting entropy and further conditioning ...
0
votes
0
answers
33
views
Required Block Size for XTS Using MSFT CNG
I am struggling with using Microsoft's BCrypt library in AES-XTS mode.
I've confirmed that the Cipher Block Size is 16 bytes (by getting the BCRYPT_BLOCK_LENGTH property). I'm setting the Data Unit ...
- 1
4
votes
1
answer
288
views
How does the Legendre symbol reveal if $g^a$ is odd or even for Finite Field Diffie-Hellman
According to wikipedia(markdown is striped below) for Decisional Diffie–Hellman assumption:
the DDH assumption does not hold in the multiplicative group $Z(p)$,
where $p$ is prime. This is because if ...
- 409
2
votes
1
answer
119
views
Operands size in RSA Cryptography (C language)
I am trying to implement the RSA cryptography algorithm using C language. I am not sure of the size that each operand should have. Let me explain:
RSA requires to generate two huge prime numbers p and ...
- 123
0
votes
0
answers
30
views
Is the NIZK constructed based on Pedersen commitment transparent?
It is well-known that, in the setup phase of Pedersen commitment, it is necessary to generate $g,h\in G$. Then a user can compute $c = g^vh^r$ to commit the value $v$.
Is a trusted center needed to ...
- 63
1
vote
0
answers
120
views
Can a Full-State Keyed Sponge be used as AEAD by using XEX?
Full-State Keyed Sponge (aka Donkey Sponge) is when a message is absorbed into the full state of the sponge.
Such an approach to MAC construction is considered secure. 1
However for an AEAD or a ...
- 169
1
vote
1
answer
83
views
Is it possible to use two different engine to encrypt/decrypt data with AES GCM?
I'm confused about something that makes AES GCM great.
It uses MAC to sign data it encrypts. I also uses nonce.
But lets say I encrypt data in software A. Software A produces a ciphertext and a tag as ...
- 11
3
votes
2
answers
288
views
Are sponges inherently inefficient when compared to other constructions?
A sponge has by definition 'wasted' operations (the part of the state which always remains private but goes through all the ops of the permutation).
In return for that waste you get a MAC at the end - ...
- 169
0
votes
1
answer
56
views
Nonce reuse in GMAC without ciphertext (only AAD)
As we all know, nonce reuse in AES/GCM can easily be catastrophic.
However, I'm wondering if the same risks are present if an adversary has access to:
Ciphertext and corresponding MAC of one message
...
- 101
0
votes
1
answer
120
views
Safe primes subgroup in Diffie–Hellman key exchange
I'm trying to understand how the safe primes numbers are used in Diffie–Hellman key exchange. According to wiki:
The order of G should have a large prime factor to prevent use of the
Pohlig–Hellman ...
- 409
-1
votes
1
answer
155
views
Can the public key be derived from the private key? [closed]
The calculation/formula i use in deriving a public key from the private key without importing any module in python3 script involves the following steps:
Define the parameters of the secp256k1 ...
0
votes
0
answers
41
views
Could ECDH-OPRF-PSI support private information retrieval？
Alice：has $x=(x_1，x_2,...x_m)$
Bob: has $(y_1,m_1),...,(y_n,m_n)$
For this, Alice wants to get some message from Bob, but does not want bob to know which one she gets
Bob generate random $a \in Z_q$，$...
- 21
0
votes
0
answers
33
views
What is best $1$ out $2$ oblivious transfer?
There are a lot of oblivious transfer algorithm. What is the best? It would be good if it were malicious secure, but that is not necessary, if this make protocol very difficult/slow. This protocol ...
- 175
0
votes
0
answers
35
views
question for lemma 4 of the BGV paper
I would like to ask a question that arose when reading the proof of lemma 4 on page 10 of this BGV paper:
The assumption is:
And the inequality:
So it seems that
$$ \sum_{j=1}^{n} \parallel c'[j]-(p/...
- 327
0
votes
0
answers
48
views
Cryptanalyzing a hash compression function
I'm designing a hash function which uses a double-tree construction and a compression function $c(s,A,B,C,a)$ ($s$ and $a$ may be omitted when there's only one of them) where
$s$ is a set of three ...
- 221
1
vote
0
answers
86
views
Showing that $F(k,x) \oplus F(k,x \oplus 1^n)$ is not a secure PRF
Let $X = \{0, 1\}^n$. Given a PRF $F : X \times X \rightarrow X$, define
$$H(k, x) = F(k,x) \oplus F(k,x \oplus 1^n).$$
I think this is insecure, since $H(k, x) = H(k, \bar{x})$ for all $x \in X$, ...
- 111
3
votes
2
answers
226
views
Could a EC public key have zero coordinate?
Take secp256r1 as an example, the parameter of the curve is
...
- 133
4
votes
1
answer
115
views
How is the Full-State Keyed duplex useful?
In the Full-State Keyed duplex (sponge construction AEAD), plaintext is absorbed into the entire state of the sponge permutation but only a portion of the output can be used else the scheme breaks (...
- 169
0
votes
0
answers
64
views
Having trouble providing a distinguisher proving this hash function is not collision-resistant
As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
5
votes
1
answer
466
views
What is a non-OWF?
We know that A function $f:\Bbb Z_2^n \longrightarrow\Bbb Z_2^m$ is a (strong) one-way function (OWF), if:
$f$ can be computed by a PT algorithm. Equivalently, there exists a PPT algorithm that on ...
- 206
3
votes
1
answer
98
views
Key blinding security in Ascon
This article explains the role of key blinding in Ascon. Key blinding in Ascon involves XORing the key with the capacity part after the permutation in both the initialization and finalization stages.
...
- 2,074
0
votes
1
answer
155
views
Determining the coefficients of a binary LFSR
I am currently leaning about LFSRs.
I was told that a binary LFSR with length m has a form of $s_m=a_0s_0+a_1s_1+\ldots+a_{m-1}s_{m-1}$ are binary numbers.
$a_0\ldots a_{m-1}$ are hidden and we are ...
0
votes
0
answers
28
views
Signature algorithm/protocol with fillable gaps?
Consider how a cheque-book works: Alice goes to the Bank, and gets some incomplete messages, like ...
- 101
1
vote
0
answers
25
views
If a SoK satisfies simulatability and extractability, is this signature unforgeable and non-malleable?
This paper[1] defines the simulatability and extractability of the signature of knowledge (SoK).
As is widely known, a secure signature scheme should be both unforgeable and non-malleable. Can we ...
- 63
2
votes
1
answer
89
views
Properties of Sums of Legendre Symbols
Context
An unknown modulus N with 8 unknown prime factors $p_1, p_2, p_3, p_4, p_5, p_6, p_7, p_8$
a plaintext $m$ is encrypted with the formula $c = 2^m \mod N$
the only things the attacker know are ...
- 21
-2
votes
1
answer
135
views
Validating slope (s) in secp256k1 elliptic curve
knowing the coordinates of $R$ on secp256k1 and an integer $s$, how do we validate that $s$ is the slope at the point $Q$ on secp256k1 such that $R=2Q$ ?
- 29
0
votes
1
answer
65
views
Can a Sigma protocol be transformed into a signature of knowledge through Fiat-Shamir transform？
As is well known, a sigma protocol can be transformed into a NIZK protocol through a Fiat-Shamir transform.
But can the Sigma protocol be transformed into a signature of knowledge in a similar manner?
...
- 63
1
vote
0
answers
49
views
Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?
I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works.
First of all, ...
1
vote
0
answers
56
views
Proving 2-way nesting security
I recently came across the theorem about $n$-way nesting. It states that if $\mathcal{E}=(E, D)$ is semantically secure, then $\mathcal{E}$ is secure for $n$-way nesting. I'm trying to prove the ...
- 11
2
votes
1
answer
206
views
Why doesn't ChaCha use a 512bit key and xor parameters into it?
ChaCha has clear delineations between key, nonce, counter and constants.
What is the reason for not using a XEX-like ($k=0$) approach such that the ChaCha key is 512 bits and all the other things are ...
1
vote
2
answers
3k
views
How weak is using AES with a 128 bit key but 64 bits of the secret key are public constants?
Respected community,
I was wondering how weak would AES-128 be, if we provide only a 64 bit key with the other remaining 64 bits either zero bits or public constants, known to the attacker.
Is it easy ...
- 1,000
0
votes
0
answers
104
views
Proving that a PRG is insecure
I'm trying to show that the PRG $G$ defined as below is insecure for any binary matrix $A$.
\begin{align}
A&: m\times n& (n < m)\\
s&: n\times 1\\
G&: \{0, 1\}^n\rightarrow\{0, 1\}^{...
- 11
1
vote
0
answers
18
views
Curious behavior of EVP_DigestSign for DKIM
Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
- 111
4
votes
2
answers
332
views
Key commitment in GCM (or AEAD in general)
Many of the presentations at The Third NIST Workshop on Block Cipher Modes of Operation 2023 complain about the lack of key commitment in AES-GCM.
But isn't that one application of "associated ...
- 367
2
votes
0
answers
74
views
A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3
The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
- 1,327
0
votes
1
answer
174
views
How to calculate key length in bits?
On a technical forum discussion, an example key of 16 hexadecimal numbers was said to be 2048 bits in length. I do not understand this as each number would be 4 bytes - 32 bits - therefore to me 16 ...
- 21
2
votes
0
answers
42
views
Speedups for non-constant time modular arithmetic?
I am interested in modular arithmetic with respect to the prime $p = 2^{64}-2^{32}+1$.
Thomas Pornin has some work on constant time implementation of arithmetic in $\mathsf{GF}(p)$ for this prime (the ...
- 11.6k
0
votes
1
answer
68
views
On the construction and notation of a certain OWF
I am studying a little bit about one-way functions from Dr Goyal's notes.
He constructs the following OWF:
Let $D=\Bbb Z_2^{n^3}$ and $R=\Bbb Z_2^{2 n}$. Given $x \in D$, $f$ interprets $x$ as a set $...
- 206
2
votes
1
answer
64
views
In NIZK, what is the difference between "transparent“ and “without trusted setup”?
When I study a zk-SNARK scheme, the scheme claims to be transparent. Does this mean that this scheme does not require a trusted setup? Furthermore, if a NIZK scheme includes a Common Reference String (...
- 63
2
votes
1
answer
177
views
Point halving formula for Koblitz curve over prime field
Consider a Koblitz elliptic curve over a prime field $\mathbb F_p$, with equation $y^2=x^3+b$, prime order $n$ close to (but different from) $p$. This includes secp256k1, secp224k1, secp192k1, ...
- 21
1
vote
1
answer
85
views
Solving equation of xor and mod operation
How do I solve equations like this
$$(aX \oplus X+b) \bmod M = c$$
If a,b and c are known?
and if i have system of of equation with different b values, is it solvable? I am particularly interested in ...
- 11
8
votes
2
answers
2k
views
Is lattice encryption susceptible to Grover's algorithm?
So Grover's algorithm, also known as the quantum search algorithm, can find an entry, with a high probability, in an unstructured database.
Well can't we consider the basis of a lattice problem an ...
- 345
3
votes
0
answers
74
views
Real-world protocols based on pairings such that the number of additions in $\mathbb{G}_1$ is equal to the number of additions in $\mathbb{G}_2$
Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \...
- 395
1
vote
1
answer
109
views
TLS 1.3: How is Finished message useful when authenticating via certificates?
I cannot quite understand, if Finished message serves any particular purpose when the server is being authenticated via certificates, or if it there just for "consistency" or "extra ...
- 111
2
votes
1
answer
117
views
IND-CPA/CCA security of AEAD schemes
I was reading the Hybrid Public Key Encryption (HPKE) RFC and I came across this sentence in section 9.4 "All AEADs MUST be IND-CCA2-secure, as is currently true for all AEADs listed in Section 7....
- 382
1
vote
1
answer
55
views
What happens when a Merkle Tree OTS scheme runs out of keys
A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key
When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
- 13