All Questions
29,831
questions
0
votes
1
answer
122
views
Safe primes subgroup in Diffie–Hellman key exchange
I'm trying to understand how the safe primes numbers are used in Diffie–Hellman key exchange. According to wiki:
The order of G should have a large prime factor to prevent use of the
Pohlig–Hellman ...
- 409
-1
votes
1
answer
159
views
Can the public key be derived from the private key? [closed]
The calculation/formula i use in deriving a public key from the private key without importing any module in python3 script involves the following steps:
Define the parameters of the secp256k1 ...
0
votes
0
answers
41
views
Could ECDH-OPRF-PSI support private information retrieval？
Alice：has $x=(x_1，x_2,...x_m)$
Bob: has $(y_1,m_1),...,(y_n,m_n)$
For this, Alice wants to get some message from Bob, but does not want bob to know which one she gets
Bob generate random $a \in Z_q$，$...
- 21
0
votes
0
answers
33
views
What is best $1$ out $2$ oblivious transfer?
There are a lot of oblivious transfer algorithm. What is the best? It would be good if it were malicious secure, but that is not necessary, if this make protocol very difficult/slow. This protocol ...
- 175
0
votes
0
answers
35
views
question for lemma 4 of the BGV paper
I would like to ask a question that arose when reading the proof of lemma 4 on page 10 of this BGV paper:
The assumption is:
And the inequality:
So it seems that
$$ \sum_{j=1}^{n} \parallel c'[j]-(p/...
- 327
0
votes
0
answers
48
views
Cryptanalyzing a hash compression function
I'm designing a hash function which uses a double-tree construction and a compression function $c(s,A,B,C,a)$ ($s$ and $a$ may be omitted when there's only one of them) where
$s$ is a set of three ...
- 221
1
vote
0
answers
88
views
Showing that $F(k,x) \oplus F(k,x \oplus 1^n)$ is not a secure PRF
Let $X = \{0, 1\}^n$. Given a PRF $F : X \times X \rightarrow X$, define
$$H(k, x) = F(k,x) \oplus F(k,x \oplus 1^n).$$
I think this is insecure, since $H(k, x) = H(k, \bar{x})$ for all $x \in X$, ...
- 111
3
votes
2
answers
231
views
Could a EC public key have zero coordinate?
Take secp256r1 as an example, the parameter of the curve is
...
- 133
4
votes
1
answer
116
views
How is the Full-State Keyed duplex useful?
In the Full-State Keyed duplex (sponge construction AEAD), plaintext is absorbed into the entire state of the sponge permutation but only a portion of the output can be used else the scheme breaks (...
- 169
0
votes
0
answers
65
views
Having trouble providing a distinguisher proving this hash function is not collision-resistant
As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
5
votes
1
answer
467
views
What is a non-OWF?
We know that A function $f:\Bbb Z_2^n \longrightarrow\Bbb Z_2^m$ is a (strong) one-way function (OWF), if:
$f$ can be computed by a PT algorithm. Equivalently, there exists a PPT algorithm that on ...
- 206
3
votes
1
answer
98
views
Key blinding security in Ascon
This article explains the role of key blinding in Ascon. Key blinding in Ascon involves XORing the key with the capacity part after the permutation in both the initialization and finalization stages.
...
- 2,074
0
votes
1
answer
160
views
Determining the coefficients of a binary LFSR
I am currently leaning about LFSRs.
I was told that a binary LFSR with length m has a form of $s_m=a_0s_0+a_1s_1+\ldots+a_{m-1}s_{m-1}$ are binary numbers.
$a_0\ldots a_{m-1}$ are hidden and we are ...
0
votes
0
answers
28
views
Signature algorithm/protocol with fillable gaps?
Consider how a cheque-book works: Alice goes to the Bank, and gets some incomplete messages, like ...
- 101
1
vote
0
answers
25
views
If a SoK satisfies simulatability and extractability, is this signature unforgeable and non-malleable?
This paper[1] defines the simulatability and extractability of the signature of knowledge (SoK).
As is widely known, a secure signature scheme should be both unforgeable and non-malleable. Can we ...
- 63
2
votes
1
answer
89
views
Properties of Sums of Legendre Symbols
Context
An unknown modulus N with 8 unknown prime factors $p_1, p_2, p_3, p_4, p_5, p_6, p_7, p_8$
a plaintext $m$ is encrypted with the formula $c = 2^m \mod N$
the only things the attacker know are ...
- 21
-2
votes
1
answer
139
views
Validating slope (s) in secp256k1 elliptic curve
knowing the coordinates of $R$ on secp256k1 and an integer $s$, how do we validate that $s$ is the slope at the point $Q$ on secp256k1 such that $R=2Q$ ?
- 29
0
votes
1
answer
66
views
Can a Sigma protocol be transformed into a signature of knowledge through Fiat-Shamir transform？
As is well known, a sigma protocol can be transformed into a NIZK protocol through a Fiat-Shamir transform.
But can the Sigma protocol be transformed into a signature of knowledge in a similar manner?
...
- 63
1
vote
0
answers
51
views
Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?
I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works.
First of all, ...
1
vote
0
answers
58
views
Proving 2-way nesting security
I recently came across the theorem about $n$-way nesting. It states that if $\mathcal{E}=(E, D)$ is semantically secure, then $\mathcal{E}$ is secure for $n$-way nesting. I'm trying to prove the ...
- 11
2
votes
1
answer
209
views
Why doesn't ChaCha use a 512bit key and xor parameters into it?
ChaCha has clear delineations between key, nonce, counter and constants.
What is the reason for not using a XEX-like ($k=0$) approach such that the ChaCha key is 512 bits and all the other things are ...
1
vote
2
answers
3k
views
How weak is using AES with a 128 bit key but 64 bits of the secret key are public constants?
Respected community,
I was wondering how weak would AES-128 be, if we provide only a 64 bit key with the other remaining 64 bits either zero bits or public constants, known to the attacker.
Is it easy ...
- 1,000
0
votes
0
answers
106
views
Proving that a PRG is insecure
I'm trying to show that the PRG $G$ defined as below is insecure for any binary matrix $A$.
\begin{align}
A&: m\times n& (n < m)\\
s&: n\times 1\\
G&: \{0, 1\}^n\rightarrow\{0, 1\}^{...
- 11
1
vote
0
answers
18
views
Curious behavior of EVP_DigestSign for DKIM
Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
- 111
4
votes
2
answers
333
views
Key commitment in GCM (or AEAD in general)
Many of the presentations at The Third NIST Workshop on Block Cipher Modes of Operation 2023 complain about the lack of key commitment in AES-GCM.
But isn't that one application of "associated ...
- 367
2
votes
0
answers
76
views
A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3
The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
- 1,327
0
votes
1
answer
189
views
How to calculate key length in bits?
On a technical forum discussion, an example key of 16 hexadecimal numbers was said to be 2048 bits in length. I do not understand this as each number would be 4 bytes - 32 bits - therefore to me 16 ...
- 21
2
votes
0
answers
42
views
Speedups for non-constant time modular arithmetic?
I am interested in modular arithmetic with respect to the prime $p = 2^{64}-2^{32}+1$.
Thomas Pornin has some work on constant time implementation of arithmetic in $\mathsf{GF}(p)$ for this prime (the ...
- 11.6k
0
votes
1
answer
68
views
On the construction and notation of a certain OWF
I am studying a little bit about one-way functions from Dr Goyal's notes.
He constructs the following OWF:
Let $D=\Bbb Z_2^{n^3}$ and $R=\Bbb Z_2^{2 n}$. Given $x \in D$, $f$ interprets $x$ as a set $...
- 206
2
votes
1
answer
67
views
In NIZK, what is the difference between "transparent“ and “without trusted setup”?
When I study a zk-SNARK scheme, the scheme claims to be transparent. Does this mean that this scheme does not require a trusted setup? Furthermore, if a NIZK scheme includes a Common Reference String (...
- 63
2
votes
1
answer
181
views
Point halving formula for Koblitz curve over prime field
Consider a Koblitz elliptic curve over a prime field $\mathbb F_p$, with equation $y^2=x^3+b$, prime order $n$ close to (but different from) $p$. This includes secp256k1, secp224k1, secp192k1, ...
- 21
1
vote
1
answer
86
views
Solving equation of xor and mod operation
How do I solve equations like this
$$(aX \oplus X+b) \bmod M = c$$
If a,b and c are known?
and if i have system of of equation with different b values, is it solvable? I am particularly interested in ...
- 11
8
votes
2
answers
2k
views
Is lattice encryption susceptible to Grover's algorithm?
So Grover's algorithm, also known as the quantum search algorithm, can find an entry, with a high probability, in an unstructured database.
Well can't we consider the basis of a lattice problem an ...
- 355
3
votes
0
answers
74
views
Real-world protocols based on pairings such that the number of additions in $\mathbb{G}_1$ is equal to the number of additions in $\mathbb{G}_2$
Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \...
- 395
1
vote
1
answer
109
views
TLS 1.3: How is Finished message useful when authenticating via certificates?
I cannot quite understand, if Finished message serves any particular purpose when the server is being authenticated via certificates, or if it there just for "consistency" or "extra ...
- 111
2
votes
1
answer
119
views
IND-CPA/CCA security of AEAD schemes
I was reading the Hybrid Public Key Encryption (HPKE) RFC and I came across this sentence in section 9.4 "All AEADs MUST be IND-CCA2-secure, as is currently true for all AEADs listed in Section 7....
- 392
1
vote
1
answer
55
views
What happens when a Merkle Tree OTS scheme runs out of keys
A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key
When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
- 13
0
votes
0
answers
38
views
What are the implications for the proof when we substitute matrix multiplication with a bitwise XOR operation in Definition 5.1 (LWE degree-k PRF)?
In the paper located at https://eprint.iacr.org/2011/401.pdf, suppose we replace matrix multiplication with bitwise XOR operations in Definition 5.1 to create an LWE degree-k PRF. I'm seeking ...
- 63
1
vote
1
answer
94
views
Worst-case one-way permutations under P different from NP
This is probably obvious, but I cannot find it anywhere, since all textbooks define OWFs for average-case hardness.
Do we known if worst-case one-way permutations exist assuming $\mathbf{P} \neq \...
- 113
1
vote
0
answers
141
views
If G is a PRG, is G' necessarily a PRG?
Given:
A function $$G: \{0,1\}^{3n} \to \{0,1\}^{6n}$$ which is known to be a secure Pseudorandom Generator (PRG).
A derived function $$G'(x_1 \| x_2) = G_b(x_1\|0^n\|x_2), \text{ where } x_1, x_2 \...
- 11
2
votes
1
answer
138
views
AES GCM iv/nonce length under 12 bytes in java [duplicate]
I'm developping an Swift app that communicate with a Java legacy backend using AES GCM, my biggest problem is that Java let you use a 8 bytes iv/nonce (and the legacy code is written with 8 bytes ...
1
vote
1
answer
88
views
Finding two inputs [i, j] of a custom Hash function where their Hashes are [H(i), H(j)] = [H(i), H(i)^2] [closed]
I came upon the following hash function (pseudo-code):
...
- 33
9
votes
1
answer
2k
views
is TLS compression used in modern browsers?
In 2012 CRIME attack effectively killed TLS compression. Has anything changed since 2012 regarding compression in TLS or have modern browsers sacrificed security over performance?
If browsers now use ...
- 409
0
votes
0
answers
69
views
Benaloh cryptosystem
I was reading this article on Wikipedia, but I don't seem to understand how this holds: $u^\phi \equiv u^0 \mod n$. Can someone explain it to me? Thank you.
Key Generation
Given block size $r$, a ...
- 33
-1
votes
1
answer
273
views
How to convert (Rx1 and Ry1) to (Rx2 and Ry2)
I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve.
If a point is given $Q_x$ and $Q_y$
...
- 29
0
votes
1
answer
178
views
RSA - Twin Primes across two messages
This was a CTF challenge I was unable to solve, but I thought I may had come close.
We were given two $N$'s $N_1$ and $N_2$ each calculated with $P_1 \times Q_1$ and $P_2 \times Q_2$; however, $P_1 = ...
- 1
0
votes
0
answers
34
views
Is there any publicly available/self-hosted OPRF service/implementation?
I've recently implemented & hosted an Oblivious Pseudo-Random Function (OPRF) based on multiparty/oprf i.e. Burns et. al. EC-OPRF as an AWS Lambda function / API, that can be recurrently used ...
- 23
1
vote
1
answer
155
views
What is the inverse of this generalised automaton (based on bitwise XOR and modular addition)?
Section 4.1 of the paper “Nonlinear Diffusion Layers” [Y. Liu, V. Rijmen, G. Leander] defines the nonlinear function $\rho$ over $\mathbb{F}_{2^m}$ as follows: $$\rho : \mathbb{F}_{2^m}^4 \to \mathbb{...
- 1,327
0
votes
0
answers
50
views
BouncyCastle -- Sending ECDH Derivation and Encoding Vectors in the Clear
So Alice is sending a one-way message to Bob. Alice and Bob both, of course, have their own ECDH private keys, as well as each other's public keys.
I am using BouncyCastle 2.2.1 (BC) in this code. It ...
- 101
0
votes
1
answer
208
views
Why hash algorithms have many different digest size variants?
1- Why SHA2 has SHA224, SHA256, SHA384 and SHA512 variants?
2- Can we say SHA512 more secure than SHA256?
3- Symmetric ciphers use at most 2^256 security level and I saw on the internet people saying ...
user111059