All Questions

Filter by
Sorted by
Tagged with
1 vote
0 answers
17 views

test data for AES based F8 encryption, F9 authentication

I am working on implementation of F8 confidentiality scheme for encryption/decryption and F9 based authentication scheme. These are specified by 3GPP standard, but the implementation in standard is ...
Ashish's user avatar
  • 11
0 votes
0 answers
30 views

Is there any notion of key-recovery attacks security (perhaphs using games) that is equivalent to IND-CPA?

I am talking about Symmetric Cryptography only in the following. We know that Semantic Security (in the presence of eavesdropper) implies security against message recovery (in the presence of ...
Alessio Proietti's user avatar
2 votes
0 answers
37 views

Producing existential forgery against CBC-MAC

Given the above MAC scheme, I want to ask how to form existential forgery of this scheme? I have looked through a couple explanations on existential forgery but still struggle understanding the ...
b1841837's user avatar
0 votes
0 answers
20 views

CryptoPals spoiler: Stuck on Set 1, Challenge 4 (in Rust)

I'm completely stuck on the named problem. (I am totally fresh to crypto code and not particularly familiar with particularly numerical code in general). My code looks like this: ...
phdavis1027's user avatar
0 votes
0 answers
44 views

In RSA, can having a part of e allow for solving it? [closed]

I encountered this problem,the core is as follows.I have n and c,but I only have part of e,The 200 bits of e are zeroed out. ...
Ink's user avatar
  • 1
0 votes
0 answers
27 views

Request for Assistance in Deciphering Encrypted Message [closed]

I would like to decipher this message: d%qgL[MuV$7HEb4pePO3t4?BhS`1R84cV,?<Lw9dE, and ChatGPT suggested that you might be able to help me. Please assist me with ...
Yanis's user avatar
  • 1
0 votes
1 answer
58 views

NTRU: Does the ```*``` indicates something more than a simple multiplication, so for that reason omitted from ```ph``` instead of ```p*h```?

I read the literature and more specific a book describing NTRU encryption. Somewhere (among other things) it describes the "encrpyption", etc... between Alice and Bob. The author writes: $e\...
someone's user avatar
  • 97
0 votes
0 answers
53 views

Password entropy, or at least establishing reasonable upper and lower bounds on it

I use, and have always used, cryptographically secure randomness as a source for my passwords. However, the final coding of that random stream into something a website will accept as a password has ...
Neil_UK's user avatar
  • 408
0 votes
0 answers
10 views

Merkle Proofs vs. Hash-Based Signatures in Byzantine Distributed Computing

I am working on Byzantine fault-tolerant distributed computing. Concretely, I am currently looking at an asynchronous multi-valued validated Byzantine agreement (MVBA). Two hash-only solutions to the ...
Jovan Komatovic's user avatar
2 votes
1 answer
87 views

Rationale for the choice and majority functions of SHA-2

I've been trying to learn why the different stages to the SHA-2 family of algorithms were added - SHA-256 in particular. Here's the pseudocode for the message schedule: ...
Jason Stackhouse's user avatar
2 votes
0 answers
32 views

Succinct proof of evaluation of known polynomial

Consider the zeroes polynomial $$ zeroes_n(X) = \prod_{0\leq i< n} (X-i) . $$ Fix a large prime $p$, and fix some $n$ that is less than $p$ but which may still be very large (e.g. $p\approx 2^{256}...
Jim's user avatar
  • 131
0 votes
0 answers
19 views

How to Securely Index Specific Elements from a Secret-Shared Vector Using a Binary Vector?

I am currently exploring a specific problem in secret sharing, which involves securely indexing elements specified by another binary secret-shared vector $\mathbf{s} \in \mathbb{R}^n$ from a secret-...
sillyg's user avatar
  • 1
0 votes
0 answers
37 views

I'm curious on what the downsides of the public-key encryption method from my research project could be

As part of my final BS degree research project, I had to work with an encryption method based on research done in my university. What surprised me, is that while the method is very simple, I can't ...
H-a-y-K's user avatar
  • 111
2 votes
2 answers
332 views

Simple CSRNG design based on hash function

I was researching designs for cryptographically secure random number generators based on hash function. I know that there is Hash_DRGB but I can not understand why such a complicated design is ...
loewexy's user avatar
  • 21
1 vote
1 answer
84 views

RFC6979: Can deterministic ecdsa signature diverge with same key and message?

As I understands, RFC6979 uses deterministic K which is generated by HMAC-SHA256(private_key, message). In this way, I guess if same key with same message, ecdsa signature generated would be always ...
Hyunhum's user avatar
  • 33
0 votes
0 answers
19 views

Substitution Permutation Network [closed]

Can someone solve this question because I'm brand new to SPN and self studying :)
Amr Ahmed's user avatar
0 votes
0 answers
18 views

Question about Environment Set in Universally Composable Security Proof

I have read into many papers and tutorials regarding "Universally Composable Security Proofs." I still have one confusion about the initial setup by the environment. On one hand, I got that ...
Novice User's user avatar
2 votes
1 answer
136 views

Shamir secret sharing beats XOR in theory or in practice too?

tldr Shamir secret sharing seems to beat XOR secret sharing when there’s more than 10 participants but practical use cases are usually less than 10 participants. Also XOR secret sharing is easier to ...
ghosts_in_the_code's user avatar
0 votes
0 answers
22 views

Should Homomorphic Encryption Keys Be Generated by a Key Generation Server or the Data Owner?

I'm currently working on a project involving homomorphic encryption and I'm trying to determine the best practices for key generation. Specifically, I'm unsure whether the keys should be generated by ...
snow's user avatar
  • 1
3 votes
2 answers
119 views

Why is division in fully homomorphic encryption impossible?

I am trying to use division in PySyft or tenSeal or anything but the devs still haven't learned how to support division?!?!
David Bower's user avatar
2 votes
2 answers
125 views

Short software license keys with asymmetric verification

Would it be possible to implement a modern version of the old software license key scheme that uses an asymmetric signing approach, while keeping the length of the key short, say 40 chars of base64? ...
Larsp's user avatar
  • 23
1 vote
0 answers
32 views

crack AES CBC with chosen Ciphertext, IV and known plaintext [closed]

I am currently tackling a challenge involving AES CBC encryption where i have the ability to choose both the IV and the ciphertext, and then provide it to a service. The service decrypts with an ...
ucker's user avatar
  • 11
1 vote
1 answer
500 views

Key generation from partially random data

Suppose an embedded system without a true random number generator peripheral, but nevertheless it is necessary to generate a secret key. Suppose also that this embedded system has an analog-to-digital ...
swineone's user avatar
  • 870
0 votes
0 answers
39 views

Help required for analysis of my cryptograpgic algorithm [closed]

Can someone please help me to understand what steps must be taken to check how much a custom algorithm is vulnerable to know attacks
Relish's user avatar
  • 1
0 votes
0 answers
33 views

How some auxiliary information influence the CDH assumption?

I am proposing a multi-party group-key agreement protocol in my paper, which can be seen as an extension of the classic Diffie Hellman bipartite group key agreement. However, how to formalize the ...
glietwp's user avatar
1 vote
0 answers
21 views

Question about Security proof of Gentry's Anonymous IBE

In Gentry's paper 'Practical Identity-Based Encryption without Random Oracles', I have a little difficulties in understanding the security proof part. The paper claims that in Challenge phase, 'ID ...
jhf's user avatar
  • 11
0 votes
0 answers
51 views

A Diffie-Hellman related question [closed]

Given g^x,g^y,to compute g^xy is hard, but if g^x,g^y,g^x^2,g^y^2 are given, is it still a hard problem to compute g^xy? can someone give me some clues?thanks!this is not a homework problem.
glietwp's user avatar
0 votes
0 answers
26 views

CBC-MAC variant forgeable proof [closed]

\begin{align*} & \text{Consider the following variant of the CBC MAC that allows us to construct MAC}\\ & \text{of any message having length a multiple of } n. \text{The construction uses a ...
statsisfun_sid's user avatar
0 votes
1 answer
28 views

Is shared secret and SKEYID are same in the IPSec?

I want to know that, is shared secret and SKEYID are same in the IPSec? I knew that from SKEYID, three further keys are generated (derivative, authentication and encryption). But from where this ...
Tech Learner's user avatar
1 vote
1 answer
80 views

ADRS in WOTS+ signature scheme

I am trying to understand the sphincs+ from [1] and have a fair understanding of WOTS+ scheme from [2] However, in the OTS scheme defined in [1] , it seem to use ADRS for storing chain address, hash ...
Gappu's user avatar
  • 31
1 vote
1 answer
47 views

How can one model the behaviour of CKKS decryption noise?

I am trying to program a simulator for CKKS. It is a "simulator", in the sense that there is actually no encryption involved, but to a person seeing only the plaintexts (before encryption ...
Michael's user avatar
  • 31
0 votes
1 answer
33 views

Length of SK_ei and SK_er in IKEv2 when using AEAD

I'm currently using strongSwan as a peer for the IKEv2 protocol. I've configured it to use HMAC SHA-256 for its pseudorandom function, and AES-256-GCM-16 for its encryption and integrity algorithm. ...
skeguest's user avatar
0 votes
0 answers
17 views

Configure .Net AES to produce results of FIPS 197 [migrated]

For testing I want to configure any .Net AES algorithm to produce the results given in the FIPS 197 publication (Appendix B). I tried different parameters (block size = key size = feedback size = 128, ...
Torsten's user avatar
2 votes
1 answer
48 views

The explicit authentication in PQ3

I've found the main part of the PQ3 protocol used in iMessage introduced in Apple's blog https://security.apple.com/blog/imessage-pq3/ is like combining the Signal protocol with a post-quantum KEM ...
RIN's user avatar
  • 21
3 votes
0 answers
95 views
+50

Shortest Vector Problem as Dihedral Hidden Subgroup Problem

I’m a mathematician trying to get into cryptography. I have a somewhat silly question, but I can’t seem to find a proper answer anywhere. I am interested in whether or not there is a way to directly ...
Joe's user avatar
  • 81
0 votes
0 answers
73 views

DSA Randomness attack on signatures [closed]

I am working on a CTF where i am given the exponent = p-1/q * input that is going to be used to calculate r. What value can i use for "input" in order to cause randomness attack so that i ...
endi__edi's user avatar
0 votes
2 answers
87 views

Adding 2 hash values

hash(a) + hash(b) = hash(c) When adding 2 hashes values can it be equal to another hash value? Is it unlikely for this to happen? If so why?
randomdude's user avatar
0 votes
0 answers
21 views

Queries about RNCryptor libraries [closed]

https://github.com/RNCryptor/RNCryptor I notice this one of the applications in IOS is developed with this library. The password for AES decryption is stored in plain text. A hooking library like ...
Alvin567's user avatar
  • 101
2 votes
1 answer
171 views

Discrete log of Goldilocks, Babybear, and Mersenne31 fields

Does anyone know if the discrete log problem of these small prime fields: Goldilocks, Babybear, Mersenne31, has been solved? If not, is there a small prime field in which the discrete log of any ...
Jason's user avatar
  • 21
2 votes
1 answer
119 views

Is the D = D1 + D2 of HECC the equivalent of the P + Q tangent-and-chord method as occurs in ECC?

I am reading about Hyper Elliptic Curve Cryptography here: https://en.wikipedia.org/wiki/Imaginary_hyperelliptic_curve#The_divisor_and_the_Jacobian In Elliptic Curve Cryptography we have the tangent-...
someone's user avatar
  • 97
0 votes
0 answers
9 views

Using an application specific entity id in X.509 certificates [migrated]

I'm generating self-signed X.509 certificates so I can use TLS in peer-to-peer applications. My problem is that the identifier of each peer is an arbitrary string of bytes derived from the public key, ...
Felipe Rossi's user avatar
0 votes
2 answers
61 views

Using random samples from indistinguishable ensembles to create new empirical ensembles

Suppose I have two computationally indistinguishable ensembles of random variables $\{X_i\}_i$ and $\{Y_i\}_i$ ($i$ is the usual security parameter). The random variables are both uniformly ...
JasperT's user avatar
1 vote
1 answer
49 views

Valid use of extendable output functions?

I'm paranoid about new storage devices, since it's a common scam to reprogram a device to lie and report a much larger capacity than it actually has. I know that there are testing programs ...
kwan3217's user avatar
  • 111
0 votes
0 answers
24 views

How to use a private key to invert a trapdoor claw-free function?

I'm trying to find a high-level description of how the following claim from this paper works. The original paper describing this protocol is by Mahadev. Is there a beginner-friendly description of ...
user1936752's user avatar
0 votes
1 answer
41 views

What is the best way to use a string with characters other than numbers as a random seed?

Is this done using cryptographic hashing, or just with a sum of the ASCII codes? A possible use case would be on a video game with random procedural generation, where the game allows users to enter a ...
user56510's user avatar
1 vote
1 answer
61 views

Necessity of all three MD-Compliant padding conditions

For Merkle-Damgård hashing, MD-compliant padding is defined as any padding scheme satisfying: $M$ is a prefix of $\text{Pad}(M)$ $|M_1|=|M_2|\Rightarrow |\text{Pad}(M_1)|=|\text{Pad}(M_2)|$ $|M_1|\...
hegash's user avatar
  • 113
1 vote
0 answers
61 views

New Impossible Differential Attacks on AES reduce time complexity

I am interested in the following snippet from the paper New Impossible Differential Attacks on AES. Analysis of Steps 3–4 of the 7-Round Attack in the 8-Round Attack The most time consuming steps of ...
can balıkçı's user avatar
0 votes
0 answers
11 views

How many extra bits of security can I get from an intermediate finalisation of SipHash-2-4?

I'm currently using SipHash-2-4 to hash 4096-byte blocks into 64-bit hashes. The key is secret, as that is required by SipHash. I have 128 bits of space available for hashes, but I don't want to use ...
fadedbee's user avatar
  • 928
0 votes
0 answers
39 views

Can the ability to sign arbitrary messages expose the private key?

Consider a system that consists of a black box (some abstraction layer with perfect sandboxing). The black box contains a private key that cannot be extracted by request, but the black box exposes an ...
The Quantum Physicist's user avatar
2 votes
1 answer
45 views

Is AES-CTR mode with predictable IV vulnerable to CPA attacks?

I'm just confused about this topic problem. I know that the CBC mode will be vulnerable to CPA attacks if the IV is predictable, but what about the CTR mode?
zephyr Victor's user avatar

15 30 50 per page
1
2 3 4 5
612