All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?

HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function. The hash functions considered in that paper were ones based on the Merkle-...
0
votes
1answer
11 views

Why all multivariate schemes restrict themselves to polynomials of degree 2

If we note all multivariate schemes restrict themselves to polynomials of degree 2. I was wondering why they do it. After looking on the internet, I came to know that they do it for the efficiency. My ...
0
votes
1answer
37 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
0
votes
0answers
17 views

Parallel random-access machine resistance in memory-hard functions

I'm trying to add memory-hardness to a hash function. A link to the specific line where that part of the implementation starts can be seen here. The basic approach is this: (1) Concatenate a string of ...
0
votes
1answer
36 views

byte significance with hash functions

I am using the python hmac module to generate an authentication code. Given a key, message, and hash function (I am using md5), the library returns an authentication code as a python bytes object. I ...
0
votes
0answers
10 views

How to restore the original mnemonics from shares? [closed]

I just read that an original mnemonic can be split into parts, I am a little confused about how the system can restore the original mnemonic from these mnemonic pieces. example i have mnemonic ...
0
votes
1answer
24 views

Can a nonce be used to steganographically hide a message?

If a standard encryption scheme involves a nonce, as most do, can the nonce be used to hide another small message? That is, the nonce (rather than being randomly generated) is a hidden message XORed ...
0
votes
0answers
4 views

How to create certificate signed with RSAPSS using openssl command? [migrated]

I tried https://gist.github.com/superseb/788a234647324b49ee5a56e07e3a91ac for commands, but getting following error in first command itself: ...
0
votes
0answers
19 views

Homomorphic encryption watermarking identity

I've been doing some research on FHE and SWHE schemes, most specifically on watermarking. As far as I've understood, you take as the merchant, take the buyer information encrypted and his public key ...
1
vote
1answer
43 views

Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)

Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability? This is what I mean about doing MtEtM: ...
-1
votes
0answers
25 views

How does Merkle tree Bitcoin query works?

I am trying to understand the basics of Encryption and Decryption in the Bitcoin blockchain. However there is something which is scratching my head recently? I understand how The Merkle Tree hashes ...
1
vote
1answer
110 views

Tests to distinguish between PRNG and a CSPRNG

What are the tests which a regular PRNG would fail but a CSPRNG would succeed? Is it just the next-bit test or are there multiple other tests which a PRNG which is not a CSPRNG would fail? Would a ...
0
votes
2answers
20 views

$\mathrm{Hash}(A\|B)$ where $B$ is known, $A$ is unknown. Would knowing $\mathrm{Hash}(A\|C)$ as well as $C$, speed up a brute force search for $A$

Let's say $\mathrm{Hash}(A\|B)$ is a hash of two concatenated strings, $A$ and $B$. Suppose I am trying to figure out $A$ from $\mathrm{Hash}(A\|B)$, I know $B$ but not $A$, I want to brute force to ...
-1
votes
0answers
30 views

Understanding Blockchain technology especially Wallet related

Hey guys I'm trying to really understand how blockchain technology works. To understand it completely I am trying to code a new coin, not sure if I'm doing it right. I came across the concept of ...
1
vote
1answer
42 views

Perfect Secrecy and Message distribution

I have been trying to come up with a proof of the following statement, Suppose a cryptosystem achieves perfect secrecy for a particular plaintext probability distribution then Prove that perfect ...
0
votes
0answers
26 views

Right implementation of digital signature with timestamp

The goal is to sign a file along with a timestamp using ECDSA. The signature can be later used to prove the file existed at a particular time. Signing implementation. The timestamp is appended with ...
0
votes
3answers
51 views

Is there an accepted way to cryptographically enforce tracked changes on a document?

I'm working on a document-editor project, and I would like to add a feature to lock tracked changes, similar to Microsoft Office. The goal is to allow one user to lock tracked changes with a password,...
0
votes
1answer
54 views

How many public keys and private keys are needed for RSA?

I am just learning about RSA encrytion and I am somewhat confused. First two prime numbers $p$ and $q$ must be chosen and multiplied to get $n$. Then we compute Euler function $\varphi (n) = (p-1)(q-1)...
0
votes
2answers
51 views

Encrypt a big file in blocks with AES-GCM: how many nonce do we need?

I need to encrypt big files using AES-GCM, potentially 10 GB or more. For memory (RAM) reasons, I need to processs them by blocks (let's say 16 MB), rather than doing ...
0
votes
0answers
38 views

Vulnerability in the Digital Signature Algorithm. Can I calculate k and x?

I feel DSA is vulnerable if k is randomly selected over a small set, example, {1,2,...,2^16 -1}. I am trying to come up with a program where I assume I have the public parameters (p,q,g) , public key :...
0
votes
0answers
31 views

CCA secure vs AE scheme

We already know that every authenticated encryption scheme is CCA secure, I was wondering about the converse. I believe it is not true, and I am finding trouble to construct a scheme which is only CCA ...
2
votes
1answer
34 views

Industry standard recommendations for memory usage defaults for a password hashing function?

I've been looking around for any studies done on this topic with respect to memory-hard password hashing. I'm inclined to simply impose no extra overhead by default, to be honest, but I'd really like ...
2
votes
2answers
57 views

How the coin flipping protocol prevent Alice from generating $ n $ from many primes?

This is a question from reading the paper 'Coin Flipping by Telephone - a protocol for solving impossible problems'. The fact that the coin is unbiased is based on the fact that if n is a product of ...
1
vote
1answer
46 views

Are MAC algorithms and digital signatures secure from quantum computers? If not, why?

I understand that asymmetric encryption is fundamentally deemed useless under Shor's Algorithm, and understand that symmetric encryption is somewhat quantum-resistant as long as the key-length is ...
0
votes
0answers
45 views

Encrypting a ciphertext with another cipher

Are there any disadvantages, other than performance, of using ChaCha20-Poly1305 with key K1 to encrypt a ciphertext generated by using AES-GCM with key K2? Would the answer change for combinations of ...
0
votes
1answer
33 views

Protecting the merkle tree from 2nd preimage attack

A 2nd preimage attack is possible on the standard Merkle tree as pictured below. I'm aware that we can add identifiers (to differentiate nodes) to the input of each hash as discussed in the link. ...
0
votes
0answers
20 views

Multiple Decryption Keys Where Decrypted Result Reveals Which Key Was Used

Is there an encryption scheme such that you can encrypt some data (such as an image) once, generate multiple decryption keys that can decrypt the ciphertext (so far this is just shamir's secret ...
1
vote
1answer
33 views

PRFs / hash functions with a parameter amount of 'hot' bits?

Does there exist a cryptographically secure hash function (or keyed PRF) that can take, as a parameter, the number of 'hot bits' in the output? And if so, what is the name? The goal here is to produce ...
0
votes
1answer
26 views

What is the adversary advantage for soundness of a sigma protocol?

Does a sigma protocol have an adversary advantage of zero for soundness? Or is this affected by the probability distribution of the indistinguishability of the simulator? Will in that case using the ...
-3
votes
0answers
14 views

How can we trust that cryptographers act in the public best interest [migrated]

There is a major body of evidence of moderators hiding uncomfortable truths from the public view. How can we trust that a state level actor is not behind this. How can one be sure that there is ...
-1
votes
0answers
18 views

How to generate the binary file for nist statistical test?

I Have to test the result of my newly created hash function using NIST. I downloaded the NIST and I can run the NIST on the example files given in that NIST implementation. But I don't have any idea ...
7
votes
1answer
184 views

Introduction to LLL algorithm applied to linear modular inequalities

What is the Lenstra–Lenstra–LovΓ‘sz lattice basis reduction algorithm about? How is it applied to solve for $x\pmod m$ a system of modular inequalities $(u_i\,x+v_i\bmod m)<w$ for $0\le i<n$? I'm ...
1
vote
0answers
16 views

Technological based solution needed for a real world problem of transferring a physical object between two untrusted parties [closed]

Suppose I have a physical object A. Another person also has some rights over the object A. After some litigations, a schedule has been made under which object A will be passed for some time to the ...
0
votes
1answer
62 views

Why in RSA do we use mod n rather than mod phi(pβ‹…q)?

When we pick $e$: $$e \in \{1,2,3,4,...,\phi(p\cdot q)-1\}$$ where $\gcd(e,\phi(p\cdot q))=1$. Similarly when computing $d$ which is the modular inverse of $e$ (the private key) we use the extended ...
1
vote
1answer
45 views

Self-correcting encryption. What are the essential elements?

Optical discs are prone to damage, and for this reason, they usually store data encoded with an error correcting code. While day-to-day use for optical storage media has diminished in recent years, ...
3
votes
1answer
59 views

IND-CCA secure symmetric encryption

Although this question maybe looks silly, I have searched similar questions in this forum and googled it but got no desired answers. IND-CCA security has already been deeply studied in public ...
0
votes
0answers
17 views

R, S, and Z values in a transaction using the Transaction ID

How can i get the R, S, and Z values and the Public Key using a transaction IDE i have? I knew of a website called 2coin.org which provided these values but now the website is no more active and it ...
0
votes
0answers
34 views

Securely transmit signed token (e.g., JWT) over insecure channel

Apologies if this is already answered somewhere, but I could not find it. I have a setup where a client has a JWT (RSA- or ECDSA-signed), and needs to prove that fact to the peer which issued the ...
1
vote
0answers
24 views

HQC Duplicated Reed-Muller Codes

I'm having trouble with a definition in the HQC Specification. From page 25f., in section 2.5.5.: What does it mean to duplicate a code? Is it repeating each bit, similar to a repetition code? ...
1
vote
0answers
23 views

How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?

I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them. For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG ...
1
vote
1answer
42 views

Breaking the 40 bit DVD CSS stream cipher

This is from the transcript of Dan Boneh's Coursera Crypto course https://www.coursera.org/learn/crypto/lecture/mQAkP/real-world-stream-ciphers So it turns out this is easy to break in time roughly ...
0
votes
2answers
55 views

Does the Blake3 hash have identities, due to its merkle tree structure?

I've read that the Blake3 hash uses a Merkle Tree. Does it follow that there are identities such as: ...
3
votes
2answers
83 views

Probability of false positive key matching two plaintext/ciphertext pairs

Given a keyspace of $ 2^{80} $ and plaintext space of $2^{64}$. And two plaintext and ciphertext pairs $(x_1, y_1)$ , $(x_2, y_2)$. Now we have $2^{80}/2^{64} = 2^{16}$ keys that encrypt $x_1$ to $y_1$...
0
votes
0answers
31 views

Brute force attack on a block cipher with length n [duplicate]

Consider a block cipher whose block length is 𝑛. 𝑁 = 2𝑛 is number of possibilities. Imagine we have 𝑑 plain text-cipher text pairs { 𝑃𝑖, 𝐢𝑖 = 𝐸𝐾(𝑃𝑖) } , where the key 𝐾 selects one of ...
0
votes
0answers
31 views

How can JWE support an integrity check given that it uses a public key to encrypt the message?

As far as I know JWE (JSON Web Encryption) supports both integrity and confidentiality. I agree about the confedintiality because only the recepient with a private key can decrypt a message. What ...
0
votes
2answers
35 views

The Generator point and Mod P in ECDSA

I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
-1
votes
0answers
27 views

permutation,how that more than 60% of possible mappings will have at least one fixed point [closed]

Let $\pi(.)$ be a permutation over the integers $\{0,1,2,…,(2^𝑛 βˆ’ 1)\}$. Fixing the key, DES is such a permutation for $n=64$. We say $\pi$ has a fixed point if $\pi(π‘š) = π‘š$ for some $m$. As you ...
0
votes
0answers
17 views

Formal Verification using ProVerif

I want to implement a table with variable values in Proverif but I have no pattern. Can you help me? Also how do I model attacks on tables?
2
votes
0answers
37 views

How to measure information loss after adding noise to a signal

We can measure the information content of a collection of discrete numerical values, in bits, in the column by summing $P_i \cdot \log_2(P_i)$ for all $i$ distinct values and $P$ is the probability. ...
1
vote
1answer
27 views

Encrypting data with HMAC-SHA1 challenge response as the key

I came across a piece of software that uses the following algorithm to generate a symmetric encryption key to encrypt data. Generate a non-secret 64 byte random string $M$ (fixed challenge) Generate ...

15 30 50 per page
1
2 3 4 5
…
466