# All Questions

19,832 questions
Filter by
Sorted by
Tagged with
11 views

### How to build a bloom filter based on p-stable locality sensitive hashing functions?

p-stable locality sensitive hashing function:$$h_{a,b}(v)=\lfloor{\frac{a\cdot v+b}{w}\rfloor}$$ a is a vector random choosed from normal distribution, a is uniformly choosed from $[0,w]$, v is a ...
10 views

### Find salt that produces hash(knownInput + salt) = knownOutput

Hope anyone can help! As title says, I need to find a unique salt that produces knownOutput, using knownInput, when calculated like this: ...
33 views

### Why can't AES-GCM be used in IKEv1 phase 1?

I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...
46 views

15 views

### Product of a negligible function with another negligible function is also a negligible function?

Intuitively I know the answer but can anyone help me to prove it?
35 views

### Why are PAKE protocols not widely used?

While there are plenty of PAKE protocols, especially those augmented ones which are practical in C/S model, actually they seem to be not widely used. Even TLS-Standardized SRP, the most popular one ...
18 views

### In DES : Matsui's notation(LC) vs Biham's notation(DC)

I'm doing linear attack for 8 rounds DES. And I just wondering about the difference between matsui's notation and Biham's notation. In Matsui's paper, numbers bits from 0 to 63 from right to left. In ...
43 views

### Why is “key-rotation” called key-rotation?

The word "rotate" in respect to "key-rotation" has connotations of looping/repeating variable values like a rotor, but as far as I can tell there isn't a single definition available for "key-rotation" ...
1k views

### How does IBM's 53-bit quantum computer compares to classical ones for cryptanalytic tasks?

IBM just announced "a new 53-qubit quantum computer". How does it compare to classical computers, performance-wise, for cryptanalytic tasks? E.g. finding a 48 or 64-bit value which SHA-256 has a ...
34 views

### Calculating Maximum Index of Coincidence

I'm trying to understand how the maximum Index of Coincidence (IC) is found. This is the only description I have for it: "For a given period $P$ you can divide a cipher into $P$ groups, calculate the ...
34 views

### How can I understand this notation of a hash function from Classic Mceliece

I have no idea what does it mean $H(1, v, C)$, where $v$ and $C$. I know and how I can implement it in Sage. It's from Classic McEliece. Can anyone help me? Some example to check
6 views

### can I generate a fixed encrypted message of 16 values in Python [migrated]

I am using Python to create an RSA encoding system but I have to follow some conditions: Both of private and public keys have to be encoded in 16 values. The keys has to be encoded in 64 bits. I ...
16 views

### Saving Thales keys to different location than KMDATA/local

I'm generating cryptographic keys using Thales HSMs. The encrypted keys are stored to /opt/nfast/kmdata/local. Since I may need to generate a very important number ...
23 views

### Definition of support in the context of an encryption scheme and usage of P = NP assumption in lemma 9.2 (Arora, Barak)

EDIT: I've migrated the question by deleting the same question I asked on mathematics stackexchange. 2 questions: (1) I am confused about the definition of support used in the proof given in the ...
35 views

### Preimage attack on cbc-mac with constant key

Is a hash function created by using CBC-MAC with one public key that does not change secure against preimage attacks? If not, how could you exploit this to find a single block message that hashes to a ...
63 views

### zk-SNARKs vs. Zk-STARKs vs. Bulletproofs: definitions

I have become quite familiar with Bulletproofs the last few months. Bulletproofs is the name given to a zero-knowledge proof system for arithmetic circuits, by Benedikt Bünz et al. It is a specific ...
44 views

I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0'...
36 views

### Compute ln function of a Paillier encrypted value

If I have an encrypted value $Enc(x)$ with Paillier cryptosystem, is it feasible to compute an encryption form of $\ln(x)$ or its approximation using homomorphic properties? The input $x$ is always ...
49 views

### Why BGW Multiplication Gate Works?

I am reading Pragmatic MPC (link) about the BGW protocol. I also cross-reference here (click on lecture link for slides) *The BGW Construction for the Information Theoretic Setting – Benny Pinkas I do ...
59 views

### HMAC for round-trip validation

I have a need to produce URLs to allow the downloading of a single file, without authentication. These links will be sent through email, and I understand and accept the risk of a given link being ...
3 views

### Can openssl's S/MIME handle RSASSA-PSS [migrated]

I need to sign emails with S/MIME and want to do this using openssl. The requested signature algorithm is RSASSA-PSS. I couldn't figure out how to specify the ...
60 views

### Post-Quantum security of Pseudo-Random Functions

I am wondering what is the exact post-quantum security of a PRF. I know that for most symmetric mechanisms, it is assumed it is sufficient to double the key size, but I am looking for a more precise ...
36 views

### how to deterministically generate a key from a passphrase [on hold]

I'm working with NodeJS v10.16.3 and the Crypto Module. I want to create a crypto wallet. Not for any actual crypto but rather a crypto of my own for educational purpose. My wallet should provide me ...
32 views

### Definition of diffusion matrix

I've been studying this article and since I'm not studying cryptography in English and it is not my native language, I don't understand some of the terminology. More precisely: what are diffusion ...
46 views

### RSA-CRT exponent reduction

In the implementation of RSA-CRT, the exponent d is reduced mod p-1 ($d_p = d \bmod {(p-1)}$). The only proof I've found for that, is the following (considering $d = k\varphi(p) + d \bmod {\varphi(p)}$...
28 views

### EC threshold private key's multiplicative inverse and derived-key sharing

I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
57 views

### Why do we need HMAC?

AFAIK, HMAC solves the collision problem of hash algorithms by mixing in a pre shared secret. Can't we just use the pre shared secret to symmetrically encrypt data and leave out the hashing?
19 views

### Again on discrete gaussians over lattices

Define $$\rho_{s,c}(x) = exp(-\pi \cdot \frac{\|x - c\|^2}{s^2})$$ and $$\rho_{s,c}(L) = \sum_{x \in L} \rho_{s,c}(x)$$ Then Discrete Gaussian over $L$ with center $c$ and standard deviation $s$ is ...
59 views

### ECDSA signature verification checks

From Wikipedia: Check that $Q_a$ is not equal to the identity element $O$, and its coordinates are otherwise valid. Check that $Q_a$ lies on the curve. Check that $n*Q_a = O$ Verify that $r$ and $s$ ...
115 views

### Understanding LFSR stream ciphers and the content scrambling system

I'm a little confused over how exactly Linear Feedback Shift Registers (LFSR) work, I kind of get it, but not really, can someone help me understand it? I know it XORs bits in a loop against some mask,...
40 views

### blake2b length extension attack approach

I understand that a completion flag parameter with Boolean value of 1 is used by Blake2 when it’s compressing the final block of the digested message. This ensures that one cannot load the state of a ...
944 views

### Which block cipher parameters should be kept secret?

Which of the parameters of a block cipher (e.g., algorithm name, mode of operation, IV (if any), key length) are essential to keep secret?
58 views

### (Whitebox Crypto) Using ChaCha20, is it safe to reduce the nonce length in a single block cipher?

I am willing to write a Whitebox Crypto unit using ChaCha20 algorithm (Bernstein, D. 2008) for an input consisting of a single block. The fact it is going to be a single block cipher is of special ...
37 views

### Difference in elliptic curve order and finite field size [duplicate]

Must the prime finite field, Fp, an elliptic curve is defined over always have a greater number of elements than the cardinality of an elliptic curve. For example, If I have ...
73 views

### Hybrid cryptosystem

I'm using RSA (4096) and AES GCM (256) to exchange messages between A and B. A random key for AES is generated, the plain message is encrypted with AES, and the random AES key is encrypted with Bs ...
11 views

### PHP encrypt string using blowfish [migrated]

I have an application running on php 7.2 and I need to encrypt a string using the following criteria: Cipher: NCFB Output encoding: Base64 Initialization Vector (IV) = 8 I already know the output I ...
38 views

### BGV for three multiplication level/depth

Can BGV homomorphic encryption scheme support three multiplication level/depth with the help of key switching and modulus switching? If Yes, how does one set up the parameter to achieve that?
37 views

### Is it possible to encrypt a message stream with the same IV each time and for it to be secure?

I know we should ideally never reuse the IV (Depending upon the mode of encryption used), but is it possible to have a protocol which uses the same IV for the message stream and is as safe as one ...
86 views

### Is AES in XTS mode insecure for data stream encryption?

Can anybody explain to me why AES in XTS mode is supposedly insecure for data stream encryption? I have been unable to find a clear explanation for this.
36 views

### A5/1 Formula Question's

So before I start I'm learning how this algorithm still works so my first question is for the x,y, and z steps (of getting the keystream I believe). The formula is t = y 20 XOR y 21 for y. There is ...
31 views

### Keyspace of monoalphabetic substitution cipher

Assume that the length of the key is known. What is the smallest value this can take and still have the number of possible keys exceed the keyspace of a monoalphabetic substitution cipher?
41 views

### what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?

I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is ...
35 views

### Is it possible to find what is the random generated key if I know the plaintext and ciphertext? [on hold]

Is it possible to find what is the key with only plaintext and ciphertext? For example, My plaintext is: hi My ciphertext is: 0x1db5
54 views

### Which is the best AES mode of operation? [on hold]

Is there any reason to choose, say ECB over CBC? Or GCM over AEX? Or CTR over CFB? Is there a best AES mode of operation? And, when required, which is the best padding to use?
29 views

### Finding repeated groups of letters in the Kasiski examination

While doing the Kasiski examination I came to a problem. If there is the following group of letters in the cipher: AA and later on a group AAA is found. Does it count as two repeats or just one? And ...
### Why is $S(y) = y^{2^8-2} = y^{254}$ a one-to-one function and a permutation on $GF(2^8)$
I'm taking a course on cryptography and I have some confusions concerning the materials in our notes. Say we have the field $GF(2^8)$, we create a substitution algorithm (the S Box in AES) so we need ...