All Questions
28,686
questions
0
votes
0
answers
4
views
FHE Relinearization
I don't understand why relinearization is so significant. I understand the equations in the paper (in this post I'll be using notation from BV but I would it applies to BGV+BFV) but if anything it ...
0
votes
1
answer
24
views
Fast and secure pseudo random generator with Linux tools
The conventional and simple wisdom is to combine head with /dev/urandom to create the amount of pseudo-random data that is ...
- 101
1
vote
0
answers
15
views
Definition of soundness for interactive proof systems
I am reading the Wikipedia page for Interactive proof systems and am having trouble understand the notation in the definition of soundness, many of which is left unspecified.
Given a formal language ...
- 11
3
votes
1
answer
28
views
zerocoin ZKSoK Pedersen commitment process
I am studying the zerocoin paper‡. More precisely I am stuck at page 6, on the Spend function (in paragraph "B. Our construction").
I am not understanding how the ZKSoK is computed.
Let's ...
- 33
1
vote
0
answers
33
views
Why was A doubled in size
Why was the dimension of A doubled in kyber?
LWE encryption uses a public matrix A of dimension K but kyber uses a double matrix A resulting in $A ^{ k * k * n }$
When deriving the results of the ...
- 165
0
votes
0
answers
29
views
Security assumption: Where is an assumption from (who provides and formalizes it)?
Is there a list of all the (most) assumptions (such as RSA and DDH assumptions) used in cryptography and the corresponding properties?
- 73
2
votes
1
answer
30
views
What are the RCons for mini-AES if you want to encrypt more than 2 rounds?
I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper.
I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions ...
- 189
1
vote
0
answers
24
views
Hashing a seed full of entropy with a cryptographic hash function and emiting a key with the same size as input: can a collision attack occurs?
I read this in the documentation of HighwayHash:
By contrast, 'strong' hashes such as SipHash or HighwayHash require
infeasible attacker effort to find a hash collision (an expected 2^32
guesses of m ...
- 107
1
vote
2
answers
21
views
What does it mean when they say IKEv1 does not support asymmetric authentication?
I read somewhere that ike1 does not support asymmetric authentication. Does that mean that it does nit support PKI authentication (digital certs)?
Thanks
Champ
- 11
3
votes
1
answer
250
views
One way function candidate based on the Collatz function
I am relatively new to cryptography and am curious what cryptographers would say about what I think is a beautiful one-way hash function described in a paper I found here https://arxiv.org/abs/1801....
- 163
2
votes
1
answer
35
views
What is the difference between those two KZG Polynomial Commitment Schemes?
In short what are the differences (pros & cons) between multiplying by powers of Tau
(from this lecture https://youtu.be/tAdLHQVW)
and raising to powers of Tau
(from this lecture https://youtu.be/...
- 126
0
votes
1
answer
26
views
How does the plausible deniability used by TrueCrypt work mathematically?
I have been unable to find any mathematical explanations on how TrueCrypt's plausible deniability encryption works, when using TC containers.
Would someone be able to provide a mathematical ...
- 129
1
vote
1
answer
39
views
Hash Flooding a Randomized Modular Hash Table
Assume we have a hash table using the function h(x) = x mod 32. h(x) = x mod 33. Also assume it dynamically resizes by doubling the amount of buckets and rehashing. If I was able to provide inputs for ...
- 111
0
votes
0
answers
24
views
Decode an encrypted text [closed]
I've been doing some reverse engineering challenges online (newbie). And i can't figure out this decryption process.
Your goal is to analyze the given file and help forgetful George to remember his ...
0
votes
1
answer
42
views
assumption needed to work in Generic Group Model
KZG poly-commitment & QAP linear PCP can be proved sound under Knowledge of Exponent assumption or Generic Group Model (I take it for granted from lecture 6 and 9 of ZK-MOOC https://zk-learning....
- 645
4
votes
1
answer
85
views
Cryptographically obfuscating IP addresses while preserving locality
In an online community, you sometimes have to ban certain IP addresses or even entire IP ranges due to abuse. You may hire moderators to help you with this, but you might not trust them enough to show ...
- 41
0
votes
1
answer
66
views
Checking encoded strings for a hash collision in Python [closed]
There is a common term used in cryptography called a hash collision. If I am reading the definition correctly on Wikipedia, this can occur if two different data values give rise to the same hash ...
- 111
3
votes
1
answer
130
views
CRYSTALS-Dilithium - How do the supporting algorithms work?
I am studying the Dilithium signature from Ducas et al's CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme.
Wanting to understand how the supporting algorithms work together, I am trying ...
- 117
0
votes
0
answers
27
views
Encoding scheme to encode all 195 printable character into english letters A to Z [closed]
Please suggest me an already available encoding scheme for encoding strings comprising of 195 printable characters into strings comprising of ONLY English characters FROM CAPITAL A to Z.
I am open to ...
0
votes
0
answers
31
views
RSA decryption given C (Cipher Text), e, and d [duplicate]
I am given C, e, and d to decode an RSA ciphertext (or would it be SRA given this information?), and I am thoroughly confused. I have tried working backward to n by reversing modulo operators and then ...
0
votes
0
answers
22
views
What could these blocks of numbers represent? [closed]
The other half of the puzzle is here:
in kinds trees of with forests thickest and the forest overgrown of allnone see to have me have few some wished once never and twiceunexpected your my ...
1
vote
0
answers
21
views
Hardness of LWE with Uniform Secrets and Error Distributions
I have seen various papers discussing the security of the Learning with Errors problem with very small uniform secrets and errors but I have not found any papers on the general LWE problem with ...
- 11
1
vote
1
answer
35
views
Recovering the curve-point R from a signature ECDSA
When recovering the public key from ECDSA signature (r, s), the first step is recovering the point R.
You do this by plugging in (r + xn) into the curve equation where n is the order of the basepoint ...
- 11
1
vote
0
answers
37
views
Issue with understanding Side Channel Attacks
I am currently working on Side Channel Attacks (SCA) on Kyber and Dilithium. I have found myself quite confused with side channel, because so much is mentionned all the time.
For instance, I don't ...
- 21
2
votes
0
answers
19
views
Why zero sharings are used to mask secret value to the masked value appears to be a random value?
Some interpretations say "By masking a secret value with a uniformly random zero sharing, the masked value appears to be a random value drawn from a uniform distribution. This randomness helps ...
- 21
0
votes
0
answers
23
views
Computations over encrypted data [closed]
I want to encrypt some medical data using Fully Homomorphic Encryption (FHE) and compute some statistics on them. Which tool is mature enough to perform this experiment?
Is there a tutorial?
- 93
0
votes
1
answer
33
views
How to verify that a JWT was in fact generated by the claimed issuer (iss)?
JSON Web Tokens (JWTs) (RFC, introduction) are digitally signed using a secret key (which can be symmetric, but for distributed use cases will typically be asymmetric). The signature forms the third ...
0
votes
0
answers
27
views
Security implications of leaking d, e, and a ciphertext in an RSA calculation? [duplicate]
I'm learning about RSA, and one of the textbooks I'm studying from talks about the security implications of various parts of an RSA key pair being leaked. It talks about what happens when an attacker ...
0
votes
0
answers
89
views
Recover partially known ECC parameters from a single known point [closed]
Is it possible to recover the $a$ and $b$ parameters of an elliptic curve of the form $x^2 = y^3 + a \cdot x + b \mod p$ from a single known point $A = (X_a, Y_a)$ on the curve and partial knowledge ...
1
vote
0
answers
21
views
Can BGV scheme work with congruent values
Since all evaluation in BGV scheme is on polynomials it seems that it does not really matter if the coefficients of the polynomials are within $q$ range or not. All must be okay for the congruent ...
- 11
1
vote
1
answer
39
views
In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?
Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation.
Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
- 107
1
vote
2
answers
238
views
In Learning with errors, what is the relation between the size(or standard deviation) of errors and security?
I want to understand how the hardness of Learning With Errors problem varies as size of the error term changes.
For example, assuming that the other parameters are the same,
LWE with errors sampled ...
- 171
0
votes
1
answer
43
views
Rainbow What happened to signatures in the NIST standardization process?
The rainbow signature was not seen in round 4 of the NIST PQC standardization process. Was Rainbow not shortlisted?
- 117
1
vote
0
answers
32
views
Which cryptographic attack here is feasible on RSA? [duplicate]
I'm new to cryptography, so please don't bash me.
I'm trying to learn to recover a RSA private key. As you can see from my profile I'm a cybersecurity professional, which is only now trying to learn ...
- 123
2
votes
1
answer
272
views
Deriving secret keys vs generating and encrypting them
Suppose one has a password manager, based on symmetric cryptography, that requires a master passphrase to be unlocked. Argon2 is used for deriving a secret key from the master passphrase.
I need ...
- 123
2
votes
1
answer
163
views
Crack RSA with $e$ and $d$?
Is it possible to decipher a ciphertext, in RSA with small primes (two 128-bit factors) when we only have ciphertext $c$, private exponent $d$ and public exponent $e=65537$ to crack it? I try hard on ...
- 121
0
votes
0
answers
25
views
Is there a Block cipher (mode) with a not symmetric variable which if it is altered always produced a different cipher?
The BC should look like this
$$BC(m,k,n) = (c,n')$$
$$BC^{-1}(c,k,n') = (m,n)$$
with the additional variable $n$ not symmetric, so in almost all cases:
$$n \not= n'$$
$m$... plaintext
$c$... ...
- 505
0
votes
0
answers
55
views
Is my domain separation in stream cipher and MAC accepted?
I would like to implement domain separation in encryption/decryption along with MAC.
The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
- 115
4
votes
1
answer
178
views
Secure channel: Is there a assumption in an MPC protocol that the communication between different parties is secure?
If we should consider that in an MPC protocol, the confidential messages communicated between two parties can be eavesdropped on by adversaries? If so, should we build a secure channel for that?
- 73
1
vote
2
answers
443
views
Stuck on a cryptanalytical research project [closed]
This is not a technical question, but rather it seeks advice on what to do if cryptanalytical research goes wrong.
I've discovered a new attack that works great in theory, but in practice, it fails.
I ...
- 11
2
votes
1
answer
43
views
Pedersen commitments equivalence
Is there a zero-knowledge proof that proves that two Pedersen commitments commit the same value?
- 557
0
votes
0
answers
16
views
In Python RSA broadcast attack, why am I using bit length in this binary search for the cube root? [migrated]
https://stackoverflow.com/a/23622115/9481613
Shows this function:
...
- 101
1
vote
0
answers
19
views
Is it secure to do subfield VOLE over a Ring $Z_{2^k}$?
In the paper "Efficient Pseudorandom Correlation Generators: Silent OT Extension and More (https://doi.org/10.1007/978-3-030-26954-8)" Boyle et. al. proposed subfield vole.
For standard VOLE ...
- 11
0
votes
0
answers
11
views
Session Key reaching protocol for group communication [closed]
I'm trying to read about Diffie Hellman (One to One) kind of protocols for group communication. Like, Is symmetric encryption used for group chat in Telegram or Signal kind of chat applications ? I ...
- 53
1
vote
1
answer
38
views
Is it safe or reasonable to use the key parameter in a cryptographic hash function as a counter?
Not all the cryptographic hash functions have the counter parameter for making messages be different for each counter value. But many accept a key parameter.
Is reasonable to use the key parameter as ...
- 107
1
vote
1
answer
127
views
Does an increase of message size increase the number of guesses to find a collision?
If I hash a 256-bit message and generate an output digest of the same size with a cryptographic hash function then the number of guesses to find a collision is expected to be 2^128.
Does increasing ...
- 107
1
vote
0
answers
37
views
How to estimate the collision resistance of a hash function if a secondary key is used (keyed hash function)?
According to the documentation of HighwayHash, for finding a collision are expected $m \over 2$ guesses, being $m$ the message.
By contrast, 'strong' hashes such as SipHash or HighwayHash require ...
- 107
2
votes
0
answers
28
views
A tensor-based Diffie-Hellman exchange
Below is a description of a "cube" Diffie-Hellman, based on commuting matrix actions on tensor products. Some questions:
References for something similar?
Obvious flaws, is this a terrible ...
- 215
2
votes
1
answer
37
views
For what 'rounding constant' exists in Round5?(NIST PQC Round 2 Algorithm)
I am reading a paper Round5.
This public key encryption scheme is based on Ring-LWR but I found it is a little bit different from typical LWR-based PKE scheme.
In the key generation algorithm of ...
- 171
1
vote
0
answers
37
views
RSA: decipher c when everything except N is known [duplicate]
Is it possible to solve this:
If you have the following information about an RSA ecrypted plaintext $m$:
$e = 65537$
$d$, $c$ some very large numbers
$p$ and $q$ are both random 128-bit long prime ...
- 111