All Questions
29,857
questions
1
vote
1
answer
16
views
What is the standard security and leaky security, and the relation between the standard/leaky security and the leakage function?
Recently, I read some security proofs about the secure multi-party computation (MPC) protocol, which includes statements about information leakage, such as the security proof below from the paper CWL+...
- 150
0
votes
0
answers
33
views
Generating UUID from Keccak-256 hash
Is generating Keccak-256 hashes with timestamp + nonce (ensured to be unique for each run), and taking its most significant 16 bytes sufficient to generate random V4 UUIDs?
Obviously the 13th hex ...
- 101
0
votes
0
answers
23
views
Mysterious number series logic [closed]
(8,5,6)
(16,9,10,12,7)
(32,17,18,20,11,24,13,14)
(64,33,34,36,19,40,21,22,48,25,26,28,15)
Above four series are according to power of 2.
The first row is 2^3
second row is 2^4
third row is 2^5 and so ...
-1
votes
0
answers
16
views
How is sharegen computed without trusted third party in GHKL08 [closed]
https://eprint.iacr.org/2008/303
The protocol here relies on a subprotocol sharegen but i cannot understand how it is computed. Please explain.
0
votes
0
answers
39
views
Differential cryptanalysis of modes of operation
It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
- 223
0
votes
1
answer
86
views
Is a prime shifting method for RSA modulus generation safe?
I have a prime number, $p$, with $n$ bits. To generate a new prime number, $q$, I shift the bits of $p$ from left to right by a certain length. For example, if $p$ is represented as ...
- 497
-1
votes
0
answers
24
views
Is this forum ok to post a factoring problem and ask for help fixing it? [closed]
One of my factoring methods works correctly sometimes, but other times it misses the factors, or is off by a square number from the the target product (the product of output factors is off by a square ...
2
votes
1
answer
38
views
Rationale for BLAKE2 message schedule?
BLAKE2 uses a message schedule I did not see before. It uses permutations of pieces of the message block.
The BLAKE2 book did not state the rationale for such a choice and how it contrasts with the ...
- 189
1
vote
0
answers
55
views
Identified Performance Discrepancy in my AES addRoundKey: Slower than Expected
Problem
I'm working on an AES implementation in C++, and I have been testing the performance of my code, and its functions. I've noticed a significant performance slowdown in my 'addRoundKey' function....
- 101
2
votes
1
answer
63
views
1-out-of-2 Oblivious Transfer with RSA
I'm trying to implement a simple 1-out-of-2 Oblivious Transfer with RSA. I was checking the code and tried to work it step by step. The 2 messages by Alice, let's say, are $m_0 = 7$ and $m_1 = 9$. Bob'...
- 21
1
vote
1
answer
51
views
Difference between a a doubled point and a point from point addition
Are all doubled points on an elliptic curve even, meaning if you compress the point, it will have '02' plus the $x$ coordinate? If not, what distinguishes a doubled point from a point resulting from ...
- 11
0
votes
1
answer
21
views
How IKE authentication happens? what's the role of HASH_I & HASH_R, and how it gets verified by each parties? and where SKEYID_a gets engaged?
Dears,
In RFC 2409 "The Internet Key Exchange (IKE)", its mentioned there are four available authentication methods for IKE, there are different calculations for SKEYID for each method and ...
- 1
3
votes
2
answers
629
views
How much entropy is lost due to collision?
If entropy is hashed with SHA-256 for example, and the input has exactly 256 entropy bits, how much entropy is reduced after hashing due to collision? Is there any reference that explains how to ...
2
votes
0
answers
38
views
What's the lattice dimension of the uSVP for attacking CRYSTALS-Dilithium-128?
I am trying to understand the process of transitioning from a NIST standard to the attacks based on of the Unique Shortest Vector Problem (Unique-SVP). Specifically, I am working with Crystals ...
- 324
-1
votes
0
answers
34
views
Encrypted text question [closed]
I’m new here and I dont even know if I’m at the right place. I have a question about encrypted text. The thing I want to know is… let’s say someone sends me encrypted text
Example:
...
- 1
2
votes
1
answer
258
views
Choosing (key,plain) to produce zero state in middle rounds of AES encrypt
I was told in passing that (key, plain) pairs could be chosen to produce a zero state in AES encrypt in some middle round (say 5). [The application here being to side-channel leakage assessment.] ...
- 391
0
votes
1
answer
76
views
Hash Collision: Weak and Strong Resistance [closed]
On average, against a 128-bit-long key, how many more hash computations would an attacker need to perform to break weak collision resistance compared to breaking strong collision resistance? In other ...
- 11
1
vote
0
answers
29
views
Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing
I'm working on a project where we have three different software systems—let's call them A, B, and C.
Systems A and B handle user data identified by phone numbers and want to send user actions to ...
- 111
-1
votes
0
answers
36
views
Determining the vulnerability of BTC in the presence of output RSZ with the entropy of mutual relations [closed]
I found the program as I understood from the description of the search for mutual entropy of different groups of RSZ output signatures from one wallet to bitcoin. Who has heard anything about this ...
- 1
1
vote
0
answers
18
views
Search the LWE problem
When designing the search LWE problem, how do you set the dimensions of the A matrix? Or under what circumstances can I use very few matrix dimensions to achieve 128-bit security? Up to noise level? ...
- 11
0
votes
0
answers
28
views
Requesting some recommendations for research topics on Signal protocol [migrated]
I am a beginner in Signal protocol. In my opinion, Signal protocol is already a very mature protocol, so I would like to ask What are the other worthwhile problems about Signal protocol that can be ...
0
votes
0
answers
81
views
Rate the security of the following MAC
Ok we know when we add a random IV in our encrypted MAC became useless and the IV can be forgery, then our encryption scheme becomes vulnerable to chosen plaintext attacks.
According those proves :
...
- 1
2
votes
1
answer
48
views
Learning the LWE secret with advice
I am trying to argue about the hardness of LWE, but in a setting that is different from the standard one.
Consider the task of learning the LWE secret $s$ from noisy samples. The specifications of the ...
- 377
2
votes
0
answers
23
views
How to distribute share that sums to 0 without a dealer?
I am looking for a protocol where each party generates a share such that $\sum_{i\in [n]} s_i =0$ where the shares should remain secret. The adversary may corrupt n-2 parties, and the parties can be ...
- 99
3
votes
2
answers
486
views
RSA perfect square phi
So I've been learning about RSA for quite a while (mainly by playing around in CTF competitions) and I came across an interesting problem.
The other day I was looking to create a challenge in which I ...
- 63
0
votes
2
answers
64
views
Cannot get RSA encrypt and decrypt to work in hardware and online calculator
I am attempting to get a hardware implementation of RSA working but I am having trouble with encryption and decryption. First, I ran these commands to generate the keys:
openssl genrsa -out private-...
0
votes
0
answers
33
views
Encrypting a number with a key of smaller size [closed]
How do I encrypt a 12 bit number using a 4 digit code?
- 1
1
vote
0
answers
24
views
Bounding the commitment min-entropy of NTRU version of BLISS
I've read [DDLL13] paper and want to understand how the lemma 3.4 is changed for NTRU version of BLISS.
In the naive construction of BLISS, the commitment entropy is bounded in Lemma 3.4 as below:
$$ \...
- 11
2
votes
0
answers
55
views
Tor Key Exchange Client - Middle Node
I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
- 21
0
votes
1
answer
63
views
Z-coordinate in Jacobian coordinates
secp256k1 Generator:(G_X, G_Y, 0x1),
secp256k1 any public key using affine coordinates : B=(X, Y)
secp256k1 any Public key using jacobian coordinates:BB=(P_X, P_Y, P_Z)
(B's private key)==(BB's ...
- 13
1
vote
1
answer
130
views
Do we know that LWE is harder than Ring LWE?
The plain, normal-form, decisional LWE problem over $\mathbb{Z}/q\mathbb{Z}$ is: given a uniformly random $n\times n$ matrix $A$ and vector $b\in \mathbb{Z}/q\mathbb{Z}^n$, decide if $b=As+e$ for ...
- 1,105
0
votes
0
answers
24
views
Can't figure out the encryption [closed]
The ciphertext:
Fubswrulqwb lv wkh sudfwlf dqg vwxlv ri whvwlf ryhu wklv xvhvwlq ri dwhvhvhfuhv ejwhfq. Pruh jovqshq, fubswrulqwb lv deyqxbuwlqj dqg exsduqbg rqrq ykiwhk vdssrkwxmtqj dqg wkhslnkrdq ...
6
votes
2
answers
637
views
Kyber 512 Security Level Issue
So I read parts of the following article:
https://blog.cr.yp.to/20231003-countcorrectly.html
But I quite dont understand it. NIST assumes Kyber 512 is just as hard as AES128 nowadays, in presence of ...
- 61
0
votes
0
answers
63
views
Random Bit Generation [closed]
I am new to cryptography , and I am trying to recreate the RSA 1024 bit encryption algorithm from scratch.I was wondering how I could make a CSPRNG from scratch to generate 512 bit primes for RSA. ...
- 1
1
vote
2
answers
740
views
In RFC 2313 (PKCS1/RSA) said you could recreate the Private key from 'n' and 'd', which later versions removed. Why?
RFC 2313 has this specific callout:
...
- 113
3
votes
0
answers
79
views
Impossibility of uniform generation in random world
I was reading Limits on the provable consequences of one way permutations by Impagliazzo and Rudich when I got stuck on a sentence.
First of all, they define a polynomial relation that is any relation ...
- 48
0
votes
0
answers
50
views
How to prove that signature hash is wrong without reveal message
Let's say we have Bob, Alice and third party.
Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice
Alice receive message and decrypt ...
- 3
0
votes
0
answers
27
views
How to anonymously poll for information in a small group of people?
A company wants to poll employees about their view of the company (by using a web system, say). They would like to do it anonymously, but they don't want people filling out forms more than once. An ...
- 133
1
vote
1
answer
77
views
Probability when representing message as a point on elliptic curve
There is a very popular method to represent a message $m$ (number) as a point on elliptic curve over a finite field:
Set $i = 0$
Check whether $m'=m\cdot K+i$ is on elliptic curve. If not, try again ...
- 13
0
votes
1
answer
45
views
How do bad actors manipulate game results in real time within 'provably fair' gaming systems?
Ive been assigned research involving online gaming companies and their use of cryptographic algorithms to produce 'provably fair' results. The largest player in the industry uses a method involving a ...
1
vote
1
answer
200
views
Recursive NTT for Kyber
since the NTT is a variant of the DFT respectively FFT, it seems possible to implement a recursive algorithm for the NTT of Kyber with a divide-and-conquer concept. This is the reason for my question ...
- 45
1
vote
1
answer
76
views
Point doubling for a point on Elliptic Curve (15,13) + (15,13) = (2,)
Consider the elliptic curve E1:y2=x3+7 over F17 with the base point G=(15,13)
I am trying to compute point double of (15,13) i.e (15,13)+ (15,13)
Expected point is (2,10) , however I am not able to ...
- 13
0
votes
1
answer
106
views
Possible to encrypt message without knowing recipient public key?
Assume Bob is sender and Alice is future recipient.
In ideal situation Bob know Alice public key, and encrypt message with it.
But what if Bob don't know Alice public key (he only will know Alice ...
- 3
0
votes
1
answer
80
views
Prove that if $e.d \equiv 1 \text{ mod } pq$ then it's impossible to have $e.d \equiv 1 \text{ mod } (p-1)(q-1)$
I am studying RSA cryptosystem and here is the question that came to my mind. Let's pick $p, q$ to be two primes and $n = p * q$. From that we calculate Euler's totient function:
$$
\phi(n) = (p - 1)(...
0
votes
0
answers
41
views
Achieving sub-block non-malleability
I have a noisy one-way communication channel where data is sent as a series of words of width n bits.
Assume n is a constant roughly in the range of 16...48.
I don't want bit errors in one word to ...
- 101
0
votes
0
answers
39
views
which DH protocol is safer in communication with given condition?
I am trying to understand some concepts such as DH problem and its variants. I have the following question from the book I read. (note that I translated the question from my language to english)
...
user112930
4
votes
1
answer
175
views
Integrating Elligator mapping with libsodium Curve25519 implementation
I'm currently working on a project where I want to map Curve25519 public keys to uniformly random noise. The main idea is that when these transformed public keys are sent over a network, an outsider ...
- 43
0
votes
0
answers
27
views
Short-input (<= 128 bit), short-output (<= 10 bit) MAC
I am faced with a problem of selecting an appropriate message authentication code (MAC) for a particular application. These are the constraints:
I have two 64-bit integers $r_a$ and $r_s$ as input, ...
- 11
1
vote
0
answers
27
views
Dealing with MITM attack in e-voting systems
I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers.
-Does anyone knows ...
- 152
1
vote
2
answers
133
views
What scheme is the best for combining two shared secrets?
I'm developing a program that uses a hybrid Key Encapsulation Mechanism (KEM) scheme, employing Kyber and X25519, with each producing a 32-byte shared secret. What would be the best scheme to combine ...
- 47