All Questions

Filter by
Sorted by
Tagged with
2 votes
1 answer
64 views

Is AES-CTR mode with predictable IV vulnerable to CPA attacks?

I'm just confused about this topic problem. I know that the CBC mode will be vulnerable to CPA attacks if the IV is predictable, but what about the CTR mode?
zephyr Victor's user avatar
0 votes
0 answers
87 views

rsa special private key attack

This is a level 3 challenge in Mystery Twister. https://mysterytwister.org/media/challenges/add/mtc3-kitrub-04-speciald-paramter.txt https://mysterytwister.org/media/challenges/pdf/mtc3-kitrub-04-...
Leo's user avatar
  • 1
1 vote
0 answers
47 views

Are saltless PoW's ok?

So, I'm building a system loosely based on the S/Kademlia principles and I have a question. I generate IDs from hashing a public key such that $ID = H(PK)$. Further, I say that for an ID to be valid ...
Lullen's user avatar
  • 11
3 votes
1 answer
137 views

Hybrid argument for repeated but alternating sequence

In the usual hybrid argument, it is shown that if two efficiently samplable distributions, $X$ and $Y$, are indistinguishable given a single sample, then they remain indistinguishable with any ...
manta's user avatar
  • 87
-1 votes
1 answer
117 views

RSA small private key attack: the private key is slightly larger than the bound given by Boneh and Durfee

$N$ = ...
Lee's user avatar
  • 1
4 votes
0 answers
95 views

Maximum-period rotate-add RNG

I've experimentally verified that the following (incredibly simple) PRNG can have period $2^w - 1$ for $w = 8$ and $w = 16$, for appropriate choices of $r, c$, where $0 < r < w$: $$x \leftarrow ...
orlp's user avatar
  • 4,310
0 votes
0 answers
33 views

Do 512 bit hash functions meant for post quantum world? [duplicate]

for instance SHA2-512, İs it overkill to use currently?
xdd's user avatar
  • 1
0 votes
1 answer
83 views

Question about error-Correction Code on Paper titled 'A New Public-Key Cryptosystem via Mersenne Number"

I've been implementing a cryptosystem outlined here, which relies on Mersenne Numbers, as part of my coursework in a Cryptography class. In this cryptosystem, both encryption and decryption require ...
Nuno Marques's user avatar
0 votes
2 answers
62 views

Not able to find any references for opening of BBS+ signature

I've reviewed the BBS signature scheme and the constant size k-TAA, known as BBS+. However, I couldn't find any specific mechanism for opening in BBS+. In the constant size k-TAA, if a user attempts ...
Reisha Ali's user avatar
0 votes
0 answers
39 views

X25519Kyber768Draft00 Key Exchange still in use, even after GPO/Registry to disable

I am trying to find out if there is another place to disable the Post-Quantum key exchange options other than what has been published Chrome/MS for browsers. The X25519Kyber768Draft00 Key Exchange ...
Chris S's user avatar
2 votes
1 answer
100 views

Does the actual length of a password or salt provide any additional entropy to that contained within them?

I refer to the following wiki description of the Argon2 key derivation function:- ...
Paul Uszak's user avatar
  • 15.6k
1 vote
1 answer
143 views

What makes so difficult to calculate the needed vector in NTRU's CVP and SVP problems?

I am reading literature related to NTRU cryptosystem. I have readen many questions in the current Cryptography stackexchange site, But, I still search for some answers: What makes so difficult to ...
someone's user avatar
  • 51
0 votes
1 answer
36 views

Digest Signing for GPG Packages

We're currently using file type-specific signing tools (textsign, helmsign, rpmsign) for GPG packages, creating network strain by transmitting entire packages to a signing server. To optimize this, we'...
undefined's user avatar
  • 103
0 votes
1 answer
136 views

Kyber and Classic McEliece as Public Key Encryption algorithms

Can Crystal Kyber and Classic McEliece be used as public key encryption (PKE) algorithms?. Is there any problem with using these KEM algorithms as PKE for some reason, e.g., doing some holomorphic ...
Anas Ahmad's user avatar
1 vote
0 answers
44 views

Unable to find any references for opening of BBS+ signature [duplicate]

I've reviewed the BBS signature scheme and the constant size k-TAA, known as BBS+. However, I couldn't find any specific mechanism for opening in BBS+. In the constant size k-TAA, if a user attempts ...
Reisha Ali's user avatar
0 votes
1 answer
139 views

Finding good shift operators for XorShift

I'm not certain this is the right place to ask but I'll ask anyway. I've been messing around with XorShift random number generators, I've only implemented a simple one copied almost verbatim from the ...
Nico Elbers's user avatar
0 votes
1 answer
48 views

Zero knowlede proof of linear relations

Suppose a prover publishes two perfectly hiding commitments for $s_1,s_2$, i.e. two Pedersen commitments $C_1=g^{s_1}h^{r_1}$ and $C_2=g^{s_2}h^{r_2}$ such that $s_1,s_2,r_1,r_2$ are secret field ...
Itamar Lishansky's user avatar
0 votes
0 answers
44 views

One way function bulit by singular matrices

Our one-way function $F:\mathbb{F}_q^{n\times n}\times \mathbb{F}_q^{n\times n}\to\mathbb{F}_q^{n\times n}$ differs from traditional OWFs, which focus on being hard to invert. Instead, ours aims to be ...
X.H. Yue's user avatar
  • 392
1 vote
1 answer
61 views

Showing special soundness for Dilithiums underlying $\Sigma$-protocol

I'm trying to prove the security of Dilithiums underlying $\Sigma$-protocol using the following theorem. Let $\Sigma=\left(\mathcal{P},\mathcal{V}\right)$ be a $\Sigma$-protocol on an effective ...
limeeattack's user avatar
2 votes
2 answers
111 views

Efficient commutative one-way encryption or hashing

Spent two days researching the subject, but so far I haven't come up with a satisfying answer as to whether there is a feasible solution to the following problem: A has a secret $m$ whereby $0 \leq m \...
Andreas P.'s user avatar
1 vote
0 answers
61 views

Security of modified CBC$ mode encryption

I am trying to understand the (IND-CPA or lack thereof) security of a modified CBC mode. Instead of choosing the IV completely at random per plaintext, the adversary provides a "pre-IV" ...
puppet puppet's user avatar
0 votes
0 answers
64 views

Is the PLONK paper incorrect? [duplicate]

I'm having some confuses while implementing the PLONK by following the instruction in the Plonk paper. Could someone please help me with it? In step 6th of the "Verifier preprocessed input" ...
Steve Nguyen's user avatar
1 vote
0 answers
46 views

Simulating physical envelops: Will commitments work in this case?

I want to simulate following physical activity in cryptography. Person X has written integers 1, 2, ..., 10 in seperate paper slips. He needs to distribute these slips to 10 people without knowing ...
user60588's user avatar
  • 307
3 votes
1 answer
156 views

Understanding CBC-MAC Algorithm and Nested Encryption

In the CBC-MAC algorithm as given in the image below, I have two questions: It is said that the CBC-MAC is simply the last block of ciphertext if the message is encrypted using CBC block cipher mode, ...
revision's user avatar
0 votes
1 answer
90 views

Asymmetric encryption of the AES key made available along with the ciphertext

I know there are much more sophisticated encryption schemes than this one that achieve the same goal but I would like to understand any weaknesses in this basic, and probably typical, process: ...
blockmined's user avatar
1 vote
0 answers
38 views

Is there any possible way to make each party obtain the output in a MPC protocol?

I konw a fact that it is impossible to achieve complete fairness in 2-party protocol from Cleve's paper.But i wonder if it is possible to achieve fairness in multi-party setting when the number of ...
Rui T.'s user avatar
  • 41
4 votes
2 answers
114 views

How do I solve a discrete log using pen paper for exam without bruteforcing it?

I have my Network Security finals. In elgamal cryptosystem, I am often encountering these equations like this 3 = (10^XA) mod 19 now everywhere I am finding only ...
Pragyan's user avatar
  • 141
0 votes
1 answer
186 views

Finite Fields and security level in HECC (Hyper Elliptic Curve Cryptography)

How to calculate the security level for HECC (Hyper Elliptic Curve Cryptography) genus = 2, 3, for a Finite Field of 128-bits or 256-bits or 512-bits, by following the below rationale of the ECC here: ...
someone's user avatar
  • 51
0 votes
0 answers
22 views

Master Key/Certificate for encyption tenant kek/dek keys

I'm building multi-tenant solution (not in cloud) where we need to store sensitive data which should be encrypted. Some of our clients want to bring own keys (BYOK). Each tenant has own instance of ...
dariol's user avatar
  • 101
4 votes
1 answer
93 views

Security impact of weakened collision resistance for 128-bit Fiat-Shamir challenges

As I understand, to achieve a security level of $\lambda$, a hash function's output should be at least $2\lambda$ in length, since the search space is halved for collision resistance. However, I am ...
Taka's user avatar
  • 43
11 votes
1 answer
5k views

Is it possible to establish a shared secret over an untrusted unidirectional channel?

It there any way to, given a unidirectional channel, say a UDP messaging protocol, to derive a secret key and transmit information securely without prior knowledge of the other party? It sounds ...
Wesley Jones's user avatar
0 votes
2 answers
81 views

Qbits vs RSA vs Time

So I'm writing a section for my Rats of NIMH fanfiction where the Rat Republic using Quantum computers to wreck havoc on the US economy for the war effort. Well, the issue is that I like to pretend to ...
qwerty keyboard's user avatar
2 votes
0 answers
68 views

Inequalities in collision search on the separation between the classical and quantum random oracle (ROM vs QROM)

I'm trying to read the separation between the classical and quantum random oracle through a paper "Random Oracles in a Quantum World" by Dan Boneh, Ozgur Dagdelen, Marc Fischlin, Anja ...
Dai Chi DO's user avatar
1 vote
1 answer
82 views

Shannon's Perfect Security for Asymmetric Encryption

I have the following definition of Shannon's Perfect Security. Assuming messages and keys are drawn randomly from some distribution then: The probability of guessing plaintext m is not enhanced by ...
revision's user avatar
2 votes
0 answers
40 views

Merkle-Damgård construction without MD compliant padding

Is there an easy example of a Merkle-Damgård constructed hash that does not have Merkle-Damgård compliant padding and is collision resistant? Is there an example that does not have MD-compliant ...
revision's user avatar
1 vote
0 answers
47 views

Suffix-free padding scheme for hash function

I would like an easy to read proof that shows that it is sufficient for a padding scheme to be suffix-free for it to be collision resistant. Whenever I have come across such a proof it always seems to ...
revision's user avatar
0 votes
1 answer
56 views

Does truncating a CBC ciphertext result in a truncated plaintext?

I want to know why in the CBC cipher, if we truncate the first block in the ciphertext then the corresponding plaintext block is truncated in the same way. I have an equation for the plaintext $m_i$ ...
revision's user avatar
0 votes
0 answers
31 views

Assessing the security of the V2Ray ecosystem and its protocols

I recently came across tools like v2rayNG, described as "A V2Ray client for Android, supporting Xray core and V2Fly core," which function as VPN or proxy clients. These seem to utilize ...
Programmer.zip's user avatar
3 votes
0 answers
63 views

improved impossible differential crpytanalysis of 6-round rijndael

I'm studying the paper: "Improved Impossible Differential Cryptanalysis of Rijndael and Crypton". I've got two questions: Please explain the calculation performed for step 5? Step 4 ...
can balıkçı's user avatar
0 votes
1 answer
70 views

What is the reason to use blocks in the first place? [closed]

I am not sure this question is really for this forum. But to be honest, I could not think of a better one. This question is about blockchains in general. As far as I know, there is no site for general ...
unsafe_where_true's user avatar
0 votes
1 answer
54 views

Beaver Multiplication Triples in Dynamic Indexing

Suppose that we have a series of operations, including matrix multiplication $(A × B)$ where $A$ and $B$ are matrices (will be result of other computations) inside our unsupervised machine learning ...
ShokofehVS's user avatar
1 vote
1 answer
32 views

ECIES encryption time linearity with plaintext size using the same key lenght

Do you know if ECIES encryption time is linear with the plaintext size, using the same key length?
Nuno Lopes's user avatar
3 votes
1 answer
121 views

Do you need assembler to enhance the performance of your algorithm?

for an IT-Project in school I'm developing a sponge constrction (doesn't have to be secure but it has to mix well) and I'm done implementing it in Python,however it is extremely slow and I don't ...
RA35's user avatar
  • 43
3 votes
1 answer
113 views

Is using KDF more insecure that generating key directly? (AES 256 CBC)

I am writing a PHP application that requires files to encrypted using AES-256-CBC. I have two options: Option #1 Generate a totally random AES key => User Key Generate another totally random AES ...
Mathew Paret's user avatar
2 votes
1 answer
76 views

How to design a reversible shifted XOR with an S-box?

According to this post, S-boxes are invertible. Inverting S-boxes can be very easy: you simply create a lookup table that reverse all the possible substitutions of the S-box. E.g. if the S-box maps ...
nalzok's user avatar
  • 123
6 votes
3 answers
4k views

Why does it take longer to generate suitably large primes for Diffie-Hellman key exchange as opposed to for RSA encryption / decryption?

For RSA, we need two primes p and q to define N = pq. We will only look how long it takes to generate a prime for p because the process is similar for q. From my lecture slides, my professor states ...
nasiedlak's user avatar
1 vote
1 answer
42 views

Can proxy re-encrypted cyphertext be identical to encrypted text by the target?

I have the following basic set-up for my question, I am getting to learn about proxy re-encryption and so far what I have looked at in more detail is this re-encryption algorithm from IronCore Labs ...
Robert Lica's user avatar
1 vote
1 answer
91 views

Decrypting the sum of votes but not the single vote

For educational reasons I am implementing an e-voting platform. The idea is that the voter generates the ballot on client side, the ballot is verified using a zero-knowledge proof protocol. Also, the ...
g3k0's user avatar
  • 13
0 votes
1 answer
106 views

Unknown NamedGroup in key_share from Google Chrome

My server has got key_share externsions while TLC 1.3 handshaking: 1 19018 = 0x4a4a = GREASE ...
LUN's user avatar
  • 119
0 votes
2 answers
92 views

About IND-CPA security of Homomorphic Encryption

I am trying to understand IND-CPA security in (Partially) Homomorphic Encryption schemes. However, the result of the proofs is usually something stating that a ciphertext does not expose anything ...
Daniel Morales's user avatar

15 30 50 per page
1
5 6
7
8 9
616