All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Building an Adversary for a PRF game

Here is the game: How can I make an O(k^2)-time adversary making only one query to its Fn oracle and achieving advantage = 1 - 1/(p-1) Here is my idea so far: query 2^{-1}, which when it goes thorugh ...
1
vote
0answers
21 views

Which of the following is considered cryptographically hard/easy?

Which of the following are easy, if any? Which are hard? and why. Case 1) Given $x^3 \bmod N$, where $N$ is a composite number and we don't know any of the factors of $N$, find $x$. Case 2) Given $x^...
0
votes
0answers
9 views

Building an adversary for a OW-CCA game

Let K_rsa be a RSA genertor with associated security parameter k >= 1024. Let game OW-CCA_Krsa be as follows: How can I build a O(k^3)-time adversary A making at most 2 queries to Invert and ...
0
votes
0answers
15 views

How to create clone of solana bolckchain? [closed]

I want to create similar coin like solana. I have tried forking litecoin to know process, can you suggest me how can hard fork solana? share the link of article if any.
0
votes
0answers
14 views

How can we prove that the advantage for this hide game for any adversary is equal 0?

Here is the Scheme: Here is the HIDE game: Here is my idea but I am not quite sure. I would appreciate some input. We want to bring advantage = 0 for all adversaries. We can show that advantage = 0 ...
2
votes
2answers
165 views

Distinguishing the correct IV from incorrect IV in AES CBC when key is known

Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
1
vote
2answers
443 views

RSA: Is it a security risk if an attacker knows the length of the values of P and Q?

Is it a security risk - or perhaps, how big of a security risk is it - if an attacker knows the length of the values of P and Q used when deriving a value for the parameter N in the RSA encryption ...
1
vote
1answer
68 views

How can I understand the math behind crypto, especially that used in blockchains / distributed ledgers?

A bit of a background about me; Computer Engineer but during my studies I didn't dive too deep into the maths, especially the crypto maths that is used to make the blockchain and cryptography work. I'...
0
votes
0answers
21 views

INT-CTXT game adversary

I am trying to answer this question. But I think I got it wrong. I am not sure why and how I can improve it. This is the adversary I came up with. Is this correct? ...
4
votes
1answer
122 views

Is there a difference between the strength of Telgram's (MTproto) forward secrecy and Signal's?

If I understood correctly, the Signal protocol generates a new key after every message sent and forgets the previous one. Telegram, on the other hand, renews the key only after 100 messages or one ...
3
votes
0answers
32 views

What is the best way to use a keyed hash on IP addresses while retaining the ability to identify those that share a subnet?

Background: I'm developing an app that is based around registered users voting on stuff, and I want to create a heuristic that involves IP addresses as one way to flag accounts for further ...
1
vote
0answers
24 views

Showing that $F'(k, x) := F(F(k, 0^{n}), x)$ is a PRF [duplicate]

I wanted to do some practice on security reduction proofs, and I am stumped on this one from the Boneh-Shoup book. If $F(k, x)$ is a secure PRF, then show that $F'(k, x) := F(F(k, 0^{n}), x)$ is a ...
3
votes
1answer
123 views

Why are the parameters (such as modulus and dimension) of homomorphic encryption so large?

Compared with the common lattice-based PQC schemes, the modulus $q$ and dimension $n$ of homomorphic encryption are so large. For example, in Kyber, $n=256, n \times k = \{512,768,1024\}$, $q = 12289$...
0
votes
0answers
31 views

Is it possible to crack a Linear Congruential Generator if I only know the modulus of the output?

$x_{n+1} = (a \cdot x_{n} + b) \mod m$ In normal situation, $x_{n+1}$ and $x_n$ are known. But now I only know $x_n\mod 6$ and $x_{n+1}\mod 6$. I have searched many website on google but I only find ...
2
votes
1answer
37 views

LWE and pseudorandom functions

Consider the learning with errors problem. Assuming LWE (or a variant of LWE, like ring LWE) is hard for polynomial time algorithms, can we construct a family of pseudorandom functions from there?
1
vote
1answer
34 views

Current status of ring signatures/proof of set membership

I understand the original O(n) implementation of a ring signature, but I'm trying to figure out where the state of the art is on signing a message as an anonymous member of an ad hoc group without ...
2
votes
0answers
33 views

composing password hash functions

Firstly I know that what I'm asking about is not practical, so let's keep it theoretical. Let $B[H](x)$ be balloon hashing with $H$ as it's underlying hash. What happens if I do $B[H1](B[H2](x))$, ...
2
votes
0answers
41 views

For unequal set sizes in PSI: why should the party with fewer elements use cuckoo hash rather than simple hash?

Most PSI papers usually use hash-to-bin to improve the number of comparsons. For unequal set sizes in 2PSI, I have read CCS17, which designs a PSI protocol for unequal size. The party with fewer ...
1
vote
1answer
52 views

reversing hash function makes possibilities increase exponentially, yet there is a finite number of inputs. How?

When trying to reverse a hash function, there is loss, e.g. a+b=c given c=5, try to go back to a,b (previous step) (a,b)=(5,0),(4,1),(3,2),(2,3),(1,4),(0,5) but, ...
1
vote
1answer
36 views

Can an adversary distinguish QROM from ROM with a single query?

I acknowledge that QROM differs from ROM (which can be considered as a specific QROM which performs a measurement to the input). For example, one can find a preimage for an arbitrary value with $O(N)$ ...
0
votes
0answers
15 views

what is difference between CKKS bootstrapping an TFHE bootstrapping? [closed]

Compare the libraries how they are different. all the libraries are implement using LWE hard problem. compare with HElib
3
votes
1answer
230 views

Is the security of a Schnorr signature dependent on the hash function that is used?

When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
1
vote
0answers
97 views

Do organizations like NSA use racial profiling in the screening process? [migrated]

some sources seem to indicate that they do: https://www.bloomberg.com/news/features/2019-12-10/the-u-s-government-s-mistrust-of-chinese-americans I realize this is a sensitive question. I'm a second-...
0
votes
1answer
44 views

Python code for 'Verifiable Canonical Generation of the Generator g', FIPS 186-4, returns False [closed]

Edit: if anyone, inexperienced like me, lands on this question, it has been answered at the stackoverflow. Why the Python code, see below, returns false? More context: I am going through the FIPS 186-...
0
votes
0answers
11 views

How to sign CAM/DENM messages using mbed LTS libray with ECDSA (EEE Std 1609.2)

I have read ETSI TS 103 097 and EEE Std 1609.2 which gives me the security data structure defined in ASN.1 notation. I want to use mbed LTS to calculate the ECDSA signature. I understand that I should ...
1
vote
1answer
45 views

Using one seed to create signing key pair and encryption key

I'm working on creating a secure digital vault. I'm using mnemonic to generate a seed. The seed is used to generate a signing key pair for identity verification. However I want to also encrypt the ...
2
votes
1answer
42 views

Is there an algorithm to compute the wNAF for an exponent faster than quadratic?

For doing exponentiation in a group for which inversion is trivially easy, such as elliptic curve groups, is there an algorithm for computing the $w$NAF ("$w$-ary non-adjacent form") array ...
-1
votes
1answer
66 views

truncated sha3-512

Let's say I need performance on 64-bit machine, then SHA3-512 is the way to go. SHA-512/256(x) is SHA-512(x) with output truncated to 256 bits, according to https://pycryptodome.readthedocs.io/en/...
0
votes
0answers
48 views

Collision finding method

The "birthday paradox" places an upper bound on collision resistance: if a hash function produces $N$ bits of output, an attacker who computes only $2^{N/2}$ (...) hash operations on random ...
2
votes
1answer
57 views

LWE - Encrypting/Decrypting messages bigger than 1 bit

I'd like to know if LWE (and its variants: RLWE and MLWE) can cipher messages bigger than 1 bit. Is it possible? I didn't find any reference yet. Could you explain it to me or give some good ...
1
vote
1answer
42 views

Decrypt AES-128-CBC encypted partial RSA Key

I am given a private RSA key, which header indicates that it is AES-128-CBC encypted. Note that the last ten lines of the key are missing. (This is part of an educational task.) ...
1
vote
0answers
53 views

How does the simulator generate a correct transcript under HVZK with the Fiat-Shamir heuristic?

Background I understand the interactive version of Schnorr's protocol and I understand how the simulator can generate an output that is i.i.d to the output of the prover-verifier: Question What I don'...
2
votes
1answer
318 views

How is MitM attack prevented when complete session is hijacked?

Lets say there is mutual authentication between a client which connects to a server on an otherwise unsecured TCP channel. Both parties create a random challenge and the other side answers with a keyd-...
-1
votes
0answers
28 views

Strategic alternatives to passwords in the information systems

All the modern informational systems are based on a password concept. The password idea is the cornerstone of contemporary cryptography as well. Assume that quantum computers can and will succeed in ...
1
vote
0answers
24 views

Indistinguishability versus Indifferentiability

What is the Indifferentiability of Feistel Network? Why is the concept of Indifferentiability useful and how it is applicable in the real world? How is Indifferentiability compared to ...
2
votes
3answers
608 views

Composition of cryptographic hash functions

I've stumbled upon many opinions, so I ask about them myself. Let $H(x)$ and $F(x)$ be hash functions. is $H(F(x))$ or $F(H(x))$ safer than $H(x)$ or $F(x)$ is $H(F(x))$ or $F(H(x))$ safe when $H(x)$ ...
0
votes
0answers
28 views

properties of hash functions [closed]

Let safer mean harder to collide, invert or break. Let H[N](x) be a hash function with output size of N bits. (sha2, blake2...) Are the following true: H[512](x) is safer than H[256](x) H[256](H[512](...
0
votes
2answers
75 views

The number of odd integers we have to test until to find one that is a prime for any arbitrary RSA modulus size

Popular RSA modulus sizes are $1024$, $2048$, $3072$ and $4092$ bit. How many random odd integers do we have to test on average until we expect to find one that is a prime? I know roughly every $\ln p$...
1
vote
0answers
18 views

Is it possible to construct a 1-out-of-N OT with communication complexity smaller than the sender's whole input?

The constructions of 1-out-of-$n$ OT for $l$-bit strings I've seen had communication complexity proportional to $nl$. I wonder, is it possible to do OT with active security and transfer less than $O(...
0
votes
0answers
53 views

Bug Bounty for a reversed Hash

this is just a general question, Is there is a bug bounty from the NSA or anyone else for reversing a SHA HASH, specifically SHA-256?
2
votes
1answer
58 views

Prove: If there exist strong OWFs then there exist weak OWFs that aren't strong

Please help me to understand the proof of the following claim: Assume there exist strong OWFs, then there exist functions that are weak $\frac{2}{3}$-one-way functions, but not strong one-way ones ...
0
votes
2answers
58 views

hiding bits inside random bits, is this some sort of encryption?

Let's say that I uniformly sample a 1000 bits randomly. Then, I hide a secret of 10 bits on those 1000 bits, randomly. That is, I pick each of the 10 bits and randomly replace them inside the 1000 ...
0
votes
1answer
44 views

Where can I find good practice questions for proofs by reduction?

I already have the Katz-Lindell textbook, but I also want some additional practice problems for security reductions for stuff like PRFs, MACs, digital signatures, private and public key schemes, and ...
2
votes
1answer
56 views

Is SHA1 break significant for an algorithm intended to be Proof-Of-Work?

Let's say I'm modifying the Scrypt hash function (https://github.com/Tarsnap/scrypt/blob/master/lib/crypto/crypto_scrypt-ref.c) and that all I want to do is replace SHA256 with SHA1 in the code to ...
3
votes
0answers
56 views

Is it possible to have a shared secret without any party knowing all the parts?

I believe with Shamir’s Secret Sharing Scheme, I can create an n-part secret and distribute each of those parts to n parties. ...
1
vote
2answers
121 views

Can you identify these cryptographic algorithmic symbols?

I am mostly self taught and have limited knowledge of the symbology in the image below. It is a diagram of a sub block the RIPEMD-160 algorithm: Are such symbols standardized? Is there a good ...
1
vote
0answers
45 views

Is this kind of mutual Authentication safe?

The following is a real-world problem. In a standardized protocol clients can connect to a server using mutual 4-pass authentication on an otherwise unsecured TCP channel: pass-1: Client send random ...
2
votes
1answer
68 views

How to have a hash function that maps any binary string of size n to binary string of size n?

I am implementing certificateless cryptography from this research paper in python language. Essentially, I want to have the following hash function mapping. This hash function is mentioned in the ...
0
votes
0answers
73 views

Unable to factorise the modulus from public key to extract a private key

I have a public key but struggling to get the modulus from it ...
2
votes
1answer
59 views

Should I use HMAC to create a multiple part HASH token

I have a web API with a custom API authentication system that users each have a SecretKey and a public ApiKey. Using these two keys client(or user) can generate a token for the authentication on the ...

15 30 50 per page
1
2 3 4 5
518