# All Questions

28,686 questions
Filter by
Sorted by
Tagged with
4 views

### FHE Relinearization

I don't understand why relinearization is so significant. I understand the equations in the paper (in this post I'll be using notation from BV but I would it applies to BGV+BFV) but if anything it ...
24 views

### Fast and secure pseudo random generator with Linux tools

The conventional and simple wisdom is to combine head with /dev/urandom to create the amount of pseudo-random data that is ...
• 101
1 vote
15 views

### Definition of soundness for interactive proof systems

I am reading the Wikipedia page for Interactive proof systems and am having trouble understand the notation in the definition of soundness, many of which is left unspecified. Given a formal language ...
28 views

### zerocoin ZKSoK Pedersen commitment process

I am studying the zerocoin paper‡. More precisely I am stuck at page 6, on the Spend function (in paragraph "B. Our construction"). I am not understanding how the ZKSoK is computed. Let's ...
• 33
1 vote
33 views

### Why was A doubled in size

Why was the dimension of A doubled in kyber? LWE encryption uses a public matrix A of dimension K but kyber uses a double matrix A resulting in $A ^{ k * k * n }$ When deriving the results of the ...
29 views

### Security assumption: Where is an assumption from (who provides and formalizes it)?

Is there a list of all the (most) assumptions (such as RSA and DDH assumptions) used in cryptography and the corresponding properties?
• 73
30 views

### What are the RCons for mini-AES if you want to encrypt more than 2 rounds?

I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper. I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions ...
• 189
1 vote
24 views

### Hashing a seed full of entropy with a cryptographic hash function and emiting a key with the same size as input: can a collision attack occurs?

I read this in the documentation of HighwayHash: By contrast, 'strong' hashes such as SipHash or HighwayHash require infeasible attacker effort to find a hash collision (an expected 2^32 guesses of m ...
• 107
1 vote
21 views

### What does it mean when they say IKEv1 does not support asymmetric authentication?

I read somewhere that ike1 does not support asymmetric authentication. Does that mean that it does nit support PKI authentication (digital certs)? Thanks Champ
• 11
250 views

### One way function candidate based on the Collatz function

I am relatively new to cryptography and am curious what cryptographers would say about what I think is a beautiful one-way hash function described in a paper I found here https://arxiv.org/abs/1801....
35 views

### What is the difference between those two KZG Polynomial Commitment Schemes?

In short what are the differences (pros & cons) between multiplying by powers of Tau (from this lecture https://youtu.be/tAdLHQVW) and raising to powers of Tau (from this lecture https://youtu.be/...
• 126
26 views

### How does the plausible deniability used by TrueCrypt work mathematically?

I have been unable to find any mathematical explanations on how TrueCrypt's plausible deniability encryption works, when using TC containers. Would someone be able to provide a mathematical ...
1 vote
39 views

### Hash Flooding a Randomized Modular Hash Table

Assume we have a hash table using the function h(x) = x mod 32. h(x) = x mod 33. Also assume it dynamically resizes by doubling the amount of buckets and rehashing. If I was able to provide inputs for ...
• 111
24 views

### Decode an encrypted text [closed]

I've been doing some reverse engineering challenges online (newbie). And i can't figure out this decryption process. Your goal is to analyze the given file and help forgetful George to remember his ...
42 views

### assumption needed to work in Generic Group Model

KZG poly-commitment & QAP linear PCP can be proved sound under Knowledge of Exponent assumption or Generic Group Model (I take it for granted from lecture 6 and 9 of ZK-MOOC https://zk-learning....
• 645
85 views

### Cryptographically obfuscating IP addresses while preserving locality

In an online community, you sometimes have to ban certain IP addresses or even entire IP ranges due to abuse. You may hire moderators to help you with this, but you might not trust them enough to show ...
• 41
66 views

### Checking encoded strings for a hash collision in Python [closed]

There is a common term used in cryptography called a hash collision. If I am reading the definition correctly on Wikipedia, this can occur if two different data values give rise to the same hash ...
• 111
130 views

### CRYSTALS-Dilithium - How do the supporting algorithms work?

I am studying the Dilithium signature from Ducas et al's CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme. Wanting to understand how the supporting algorithms work together, I am trying ...
• 117
27 views

### Encoding scheme to encode all 195 printable character into english letters A to Z [closed]

Please suggest me an already available encoding scheme for encoding strings comprising of 195 printable characters into strings comprising of ONLY English characters FROM CAPITAL A to Z. I am open to ...
31 views

### RSA decryption given C (Cipher Text), e, and d [duplicate]

I am given C, e, and d to decode an RSA ciphertext (or would it be SRA given this information?), and I am thoroughly confused. I have tried working backward to n by reversing modulo operators and then ...
22 views

### What could these blocks of numbers represent? [closed]

The other half of the puzzle is here: in kinds trees of with forests thickest and the forest overgrown of allnone see to have me have few some wished once never and twiceunexpected your my ...
1 vote
21 views

### Hardness of LWE with Uniform Secrets and Error Distributions

I have seen various papers discussing the security of the Learning with Errors problem with very small uniform secrets and errors but I have not found any papers on the general LWE problem with ...
• 11
1 vote
35 views

### Recovering the curve-point R from a signature ECDSA

When recovering the public key from ECDSA signature (r, s), the first step is recovering the point R. You do this by plugging in (r + xn) into the curve equation where n is the order of the basepoint ...
• 11
1 vote
37 views

### Issue with understanding Side Channel Attacks

I am currently working on Side Channel Attacks (SCA) on Kyber and Dilithium. I have found myself quite confused with side channel, because so much is mentionned all the time. For instance, I don't ...
19 views

### Why zero sharings are used to mask secret value to the masked value appears to be a random value?

Some interpretations say "By masking a secret value with a uniformly random zero sharing, the masked value appears to be a random value drawn from a uniform distribution. This randomness helps ...
• 21
23 views

### Computations over encrypted data [closed]

I want to encrypt some medical data using Fully Homomorphic Encryption (FHE) and compute some statistics on them. Which tool is mature enough to perform this experiment? Is there a tutorial?
33 views

### How to verify that a JWT was in fact generated by the claimed issuer (iss)?

JSON Web Tokens (JWTs) (RFC, introduction) are digitally signed using a secret key (which can be symmetric, but for distributed use cases will typically be asymmetric). The signature forms the third ...
27 views

### Security implications of leaking d, e, and a ciphertext in an RSA calculation? [duplicate]

I'm learning about RSA, and one of the textbooks I'm studying from talks about the security implications of various parts of an RSA key pair being leaked. It talks about what happens when an attacker ...
89 views

### Recover partially known ECC parameters from a single known point [closed]

Is it possible to recover the $a$ and $b$ parameters of an elliptic curve of the form $x^2 = y^3 + a \cdot x + b \mod p$ from a single known point $A = (X_a, Y_a)$ on the curve and partial knowledge ...
1 vote
21 views

### Can BGV scheme work with congruent values

Since all evaluation in BGV scheme is on polynomials it seems that it does not really matter if the coefficients of the polynomials are within $q$ range or not. All must be okay for the congruent ...
• 11
1 vote
39 views

### In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?

Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation. Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
• 107
1 vote
238 views

### In Learning with errors, what is the relation between the size(or standard deviation) of errors and security?

I want to understand how the hardness of Learning With Errors problem varies as size of the error term changes. For example, assuming that the other parameters are the same, LWE with errors sampled ...
• 171
43 views

### Rainbow What happened to signatures in the NIST standardization process?

The rainbow signature was not seen in round 4 of the NIST PQC standardization process. Was Rainbow not shortlisted?
• 117
1 vote
32 views

### Which cryptographic attack here is feasible on RSA? [duplicate]

I'm new to cryptography, so please don't bash me. I'm trying to learn to recover a RSA private key. As you can see from my profile I'm a cybersecurity professional, which is only now trying to learn ...
272 views

### Deriving secret keys vs generating and encrypting them

Suppose one has a password manager, based on symmetric cryptography, that requires a master passphrase to be unlocked. Argon2 is used for deriving a secret key from the master passphrase. I need ...
• 123
163 views

### Crack RSA with $e$ and $d$?

Is it possible to decipher a ciphertext, in RSA with small primes (two 128-bit factors) when we only have ciphertext $c$, private exponent $d$ and public exponent $e=65537$ to crack it? I try hard on ...
• 121
25 views

### Is there a Block cipher (mode) with a not symmetric variable which if it is altered always produced a different cipher?

The BC should look like this $$BC(m,k,n) = (c,n')$$ $$BC^{-1}(c,k,n') = (m,n)$$ with the additional variable $n$ not symmetric, so in almost all cases: $$n \not= n'$$ $m$... plaintext $c$... ...
• 505
55 views

### Is my domain separation in stream cipher and MAC accepted?

I would like to implement domain separation in encryption/decryption along with MAC. The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
• 115
178 views

### Secure channel: Is there a assumption in an MPC protocol that the communication between different parties is secure?

If we should consider that in an MPC protocol, the confidential messages communicated between two parties can be eavesdropped on by adversaries? If so, should we build a secure channel for that?
• 73
1 vote
443 views

### Stuck on a cryptanalytical research project [closed]

This is not a technical question, but rather it seeks advice on what to do if cryptanalytical research goes wrong. I've discovered a new attack that works great in theory, but in practice, it fails. I ...
• 11
43 views

### Pedersen commitments equivalence

Is there a zero-knowledge proof that proves that two Pedersen commitments commit the same value?
• 557
16 views

### In Python RSA broadcast attack, why am I using bit length in this binary search for the cube root? [migrated]

https://stackoverflow.com/a/23622115/9481613 Shows this function: ...
• 101
1 vote
19 views

### Is it secure to do subfield VOLE over a Ring $Z_{2^k}$?

In the paper "Efficient Pseudorandom Correlation Generators: Silent OT Extension and More (https://doi.org/10.1007/978-3-030-26954-8)" Boyle et. al. proposed subfield vole. For standard VOLE ...
11 views

### Session Key reaching protocol for group communication [closed]

I'm trying to read about Diffie Hellman (One to One) kind of protocols for group communication. Like, Is symmetric encryption used for group chat in Telegram or Signal kind of chat applications ? I ...
• 53
1 vote
38 views

### Is it safe or reasonable to use the key parameter in a cryptographic hash function as a counter?

Not all the cryptographic hash functions have the counter parameter for making messages be different for each counter value. But many accept a key parameter. Is reasonable to use the key parameter as ...
• 107
1 vote
127 views

### Does an increase of message size increase the number of guesses to find a collision?

If I hash a 256-bit message and generate an output digest of the same size with a cryptographic hash function then the number of guesses to find a collision is expected to be 2^128. Does increasing ...
• 107
1 vote
37 views

### How to estimate the collision resistance of a hash function if a secondary key is used (keyed hash function)?

According to the documentation of HighwayHash, for finding a collision are expected $m \over 2$ guesses, being $m$ the message. By contrast, 'strong' hashes such as SipHash or HighwayHash require ...
• 107
28 views

### A tensor-based Diffie-Hellman exchange

Below is a description of a "cube" Diffie-Hellman, based on commuting matrix actions on tensor products. Some questions: References for something similar? Obvious flaws, is this a terrible ...
• 215
37 views

### For what 'rounding constant' exists in Round5?(NIST PQC Round 2 Algorithm)

I am reading a paper Round5. This public key encryption scheme is based on Ring-LWR but I found it is a little bit different from typical LWR-based PKE scheme. In the key generation algorithm of ...
• 171
1 vote
Is it possible to solve this: If you have the following information about an RSA ecrypted plaintext $m$: $e = 65537$ $d$, $c$ some very large numbers $p$ and $q$ are both random 128-bit long prime ...