# All Questions

20,122 questions
Filter by
Sorted by
Tagged with
14 views

### Why is this functionality chosen for UC-NIZK?

A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness. And, let's say P is a party ...
21 views

### Signing files with some kind of “inheritance”

I'd like to design a system where the following situation happens: Person 1: I've got some secret key I hand out another secret key to a developer (Person 2) That dev signs several files with his ...
29 views

### Authenticated Encryption mode & AEAD

I'm studying Authenticated encryption with Associated Data (AEAD). My questions are About AE - I heard that when it comes to Encrypt-then-MAC, if an attacker forges the ciphertext then he gets the ...
14 views

### message authentication [on hold]

Consider a new security definition (in analogy to CCA security), in which the adversary is provided oracle access to a verification algorithm as well. Then: (a) How to define this security ...
18 views

### security of composed scheme [on hold]

This question explores scenarios where one has several available schemes but dubious security guarantees. (i) Let Γ1 = (MAC1, Vrfy1) and be two Γ1 = (MAC1, Vrfy1) message authentication (MAC) schemes....
21 views

### incremental CBC [on hold]

If we consider an another variant of CBC encryption called incremental CBC, where the encryption algorithm stores an IV , and increments it every time an encryption is performed (is also stateful like ...
13 views

### Is ECB CPA Secure? [duplicate]

I am trying to prove on how ECB may not be CPA secure, i tried to google and also looked at similar links on stack exchange but couldn't find any
18 views

### Seeking security feedback for new secure social media tool (open source and federated) [on hold]

I’m writing a pathologically secure social media tool, a federated system where the servers never see any private information of the users, and can only infer a minimum of metadata (such as who knows ...
19 views

### RSA modulo 26 in ‘ECB mode’ [on hold]

I have successfully implemented RSA without ECB or padding. I have been told by @SqueamishOssifrage that it is possible to do RSA modulo 26 in ECB mode I would like to continue this conversation in ...
30 views

### No freshness protection for single messages, but for the overall protocol

I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for ...
28 views

### How to find the KEY knowing the Ciphertext and IV of Encryption type aes-128-cbc [on hold]

I know the following information: Time Stamp "2018-04-17 23:08:49" (within a 2-hour window of generating the encrytption) Encryption type aes-128-cbc Plaintext: 255044462d312e350a25d0d4c5d80a34 ...
49 views

### RSA wont decrypt ciphertext to plaintext [on hold]

Here is my CSharp code for a basic RSA cipher, when the plaintext is encrypted to the ciphertext and the ciphertext decrypted to the plaintext the plaintext does not match the input. I would like to ...
30 views

### Problem with Hash-DRBG's seedlen values (and others)

In NIST-SP-800-90Ar1, the Hash-DRBG is instantiated with hash functions using strange values for seed length (seedlen) such as 440, 888. How are these values derived? How to derive values for other ...
30 views

### RSA given p,q,n,c1,c2,e1,e2 [on hold]

I am given the p,q,n,c1,c2,e1,e2 values for an RSA key, along with an encrypted message. Here are those values: ...
45 views

### Why do we hash the random challenge in Fiat-Shamir heuristic? [duplicate]

I had a quick question for all. Why do we hash the random challenge in Fiat-Shamir heuristic? If we hash the public key of Prover it should be enough for the verifier to prove non-repudiation? What ...
39 views

### How do I generate the multiplication table for GF(3^2)?

I understood, how this works for arbitrary n and p = 2, but I am struggling with higher prime numbers as a base. In the following, I wanted to use the irreducible polynomial ...
29 views

### One time OTP- hashing [on hold]

I have question hashing the user credentials to prevent the system from unauthorised access. I’m working on internet banking . I have to develop attacks. One attack is that, if attacker get to know ...
21 views

### AES-MixColumn layer in the last round

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about AES algorithm the authors say that in the last round of the encryption algorithm the MixColumn ...
32 views

### AES - Non-linearity hinders differential cryptoanalysis

Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?
18 views

### Computationally indistinguishably vs Perfect Indistinguishably [duplicate]

I know that perfect security means absolutely no information about the plaintext is leaked to the adversary while computational secrecy is okay with a tiny amount of leak. But, what is the difference ...
20 views

### show how bob can use only one permutation to reverse the process [on hold]

Alice use three consecutive permutations [1 3 2] ,[3 2 1] , [2 1 3] show how bob can use only one permutation to reverse the process use the table below can anyone explain to me
77 views

### TLS 1.2 handshake ECDH premaster/master secret generation with C OpenSSL API [on hold]

I am doing a study on the TLS protocol as my degree thesis, but being completely inexperienced on this subject, I have many questions. I have to write C code and program a client that partecipates ...
26 views

### Encryption data [migrated]

I have encrypted data. the MBR partition shows but I can't decrypt the data. What's the likelihood that the USB NAND flash experienced bit rot in the sector that stores the hash but still kept the MBR ...
34 views

### For CBC, if the initialization vector is corrupted, can we still decrypt the message?

Actually, I think IV (initialization vector) is random number which is same size as the other block of plaintext. But if the IV is corrupted, message cannot be decrypted because original IV used to ...
35 views

### Is it possible to narrow down the possible keys used for AES CBC encryption, knowing a given plaintext and its ciphertext, where IV=0? [duplicate]

I'm brute forcing a ciphertext with a given dictionary to figure out which key was used. However, it's been hinted at that there is a way to narrow down the dictionary to a smaller subset of ...
19 views

### X509_verify() with ECDSA public key failure [on hold]

I am developing an ECDSA signed certificate and embedded application using Openssl 1.0.2. The X509_verify(cert, pubkey) is failing with an 'other' error and after some debugging the solution ...
21 views

### Possible to convert PGP ed25519 signature into signify-compatible format?

Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
93 views

### Fiat-Shamir transform: reliance on hash input by interactive proof

Peggy would like to prove to Victor that she knows the discrete logarithm of $y$ based $g$; that is, she knows $x$ such that $y = g^x \bmod p$. One round of the interactive proof protocol consists of ...
29 views

### Dedekind sum is a product of sawtooth function [on hold]

"The Dedekind sum is a product of a sawtooth function." This sentence does not make sense to me. A sawtooth is a kind of wave for sound generation. But in the realms of cryptography, the Dedekind sum ...
24 views

### What to learn in order to understand Weil Divisors

My current role as a software developer is leading into areas of research in elliptic-curve-cryptography that keeps bringing me back to bilinear pairings. This includes BLS Signatures, CL Signatures ...
47 views

### Split hash for 2 keys

These are the steps: Hash ECDH shared secret with SHA3-512 Concatenate odd bytes and rehash with SHA3-512 for AES-256 key Concatenate even bytes and rehash with SHA3-512 for KMAC key Is this key ...
12 views

### Is 2FA secure, and can it ever be broken? [migrated]

Having weak passwords are so easily cracked by hackers and quantum computers that people introduced an extra layer of security, called Two Factor Authentication. How it works is it sends a message to ...
88 views

### Is SSH over TLS 1.2/1.3 overkill?

I am designing a protocol that will have security in mind as one of its key goals. Currently I have selected SSH with TLS as the underlying transport. I selected SSH because it had a variety of ...
52 views

### Would adding more rounds to AES increase security?

As the title states, would increasing the rounds by doubling them to Bruce Schneiers recommendation of 16, 20, and 28 increase security? And how much? As a bit more, would increasing rounds, keys, ...
47 views

### Using (EC)DH to generate a signature

Say I have access to a system that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key can e.g. be used to generate a MAC. Is it possible to generate a ...
18 views

### Choices of $q$ and $f$ for RLWE-based constructions

I understand that RLWE was introduced to avoid the quadratic overhead in the matrices that appear in plain LWE. However, I have a series of questions about this setting. First, Ring-LWE-based ...
52 views

### If multiple hashing algorithms are chained together, is the compound hash function more collision resistant?

The DASH cryptocurrency uses X11, which is a Proof of Work hashing algorithm composed of 11 separate hash functions which are run as a sequence. Example: $Digest = H_{11}...(H_3(H_2(H_1(Input))))$ ...
51 views

### Weakness in double encryption [duplicate]

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about DES algorithm the authors say that: "If double encryption is equivalent to single encryption,...
29 views

### Performance of Counter mode (CTR) with Ciphertext Errors

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that: "As a result, its performance is identical to OFB's ...
62 views

### Generating a MAC on a Polynomial

In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below ...
25 views

### Do I need verifiable shares?

I'm using Shamir's secret sharing in a 2:3 system. Thus a secret Key is split in 3 subkeys (KeyS:KeyC:KeyT) I've 3 entities at ...
46 views

### OFB mode vs LFSR

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about OFB (Output Feedback) mode the authors say that: The OFB mode produces a bit stream and it ...
6 views

### Have someone replaced Curve25519 in NaCL library? [migrated]

I am using NaCL library and I like it but I wonder if it is possible to replace Curve25519 with different stronger Curve if stronger encryption is needed. I do understand that new library would be ...
45 views

### Why are inputs to boolean functions usually modelled as random variables? [on hold]

I ask this because it might one of those things that "everybody knows/does", but never gets written or explained anywhere... Is it just a matter of aesthetics (in the mathematical sense of the word), ...
210 views

### Academic breach revealed too late

Do you know if is has already happened (since 1980), that someone (academic or not) has "broken" (even in a weak sense) some cryptographic assumption, but has chosen to not first publish and directly ...
41 views

### Hashing high entropy key into AES format

If I have a high entropy key (ECDHE shared secret), what type of hash should I use to format this into an AES-256 key? Is Sha256 or Sha3_256 sufficient to maintain entropy or do I need to use a KDF (...
24 views

### XORing a nonce with a ciphertext vs XORing a nonce with plain text and then encrypt

Consider a situation where a symmetric key encryption (such as AES) is used to encrypt the plain text. Moreover, a nonce is used to ensure that old communication cannot be used to perform a replay ...
30 views

### What Chaining Mode to use with RSA? (CNG's BCrypt)

I'm trying to make my first RSA encryption/decryption using CNG. In 1 part of the example they add pick a chaining mode, I don't know if this is mandatory and when I tried to google about it I found ...