# All Questions

3,026 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
163 views

### GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
261 views

### Share Conversion between Different Finite Fields

Let us have any linear secret sharing scheme (LSSS) that works on some field $Z_{p}$, where p is some prime or a power of a prime e.g., Shamir Secret Sharing, Additive secret Sharing. The problem at ...
151 views

### Replacing signer with simulator

Assume we can prove security of digital signature scheme against key-only (no message) attacks. Now we want to prove security against adaptive chosen message attack. We use random oracle model. The ...
324 views

### Security proof in (Ciphertext-Policy) Attribute-Based Encryption

I am having hard time understanding the security proof in Attribute-Based Encryption, especially in Ciphertext-Policy Attribute-Based Encryption. To do reduction in CP-ABE scheme, how do I check that ...
143 views

68 views

### Is it possible to derive a homomorphic signature from homomorphic encryption

At the moment I am trying to find a practical way to implement a linearly homomorphic signature. Background: "In a homomorphic signature scheme, a user Alice signs some large dataset x using her ...
131 views

### Which is the smallest safe elliptic curve (bit-length)?

At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security tests. The smallest bit-length of a safe curve listed there is 221 bits. At wiki page discrete logarithm ...
88 views

### FPE current state of art for “small” domains

Is there any survey with the state of art treatment of format-preserving encryption for small domains (i.e. 2^20 for example)? I believe that Stalling's and Rogaway's surveys are out of date due to ...
555 views

### Signal Protocol - Better way to generate one time pre keys (OTPK)

The following explains a different way (then one-time pre keys) for Bob to securely generate ephemeral keys asynchronously without a limit while still being able to delete the private key immediately ...
98 views

### What is the “brand X” cipher mentioned in the Usenet thread about RC4?

In the original Usenet thread about RC4 when it was finally reverse engineered, a user by the name of Michael Johnson mentioned that the RC4 algorithm looked surprisingly like another proprietary ...
94 views

### Why did Rabin use $x(x + b)$ instead of just $x^2$ in the original paper?

Encryption in the original Rabin scheme took a message $x$ and computed $x(x + b) \bmod n$, where $0 \le b \lt n$ and $n$ is the product of two secret primes $p$ and $q$. The private key is defined as ...
314 views

### What's the difference among Vector Commitment, Zero-knowledge Set, Zero-knowledge Accumulator, and Zero-knowledge Elementary Database?

Vector commitment allows to commit to an ordered sequence of $q$ value ($m_1,\cdots,m_q$) in such a way that one can later open the commitment at specific positions(e.g., prove that $m_i$ is the $i$-...
75 views

### Is there a standard definition of non-malleability for the encryption schemes?

I find some different definitions of non-malleability for the encryption schemes. They may be equivalent, but I am not sure which one is better or if there is a standard definition. I give two ...
161 views

### Does there exist trapdoor permutation from lattices?

It seems that the lattice functions are either surjective (SIS) or injective (LWE), due to the error that is basically intended to destroy the structure and provide security. I was wondering whether ...
90 views

### Parity of the order of a element

Given an element $g$ in a cyclic group $G$ of known order $m$ its easy to test if $m$ has even or odd order. In other words $\textrm{ord}(g) \pmod 2$ can be computed easily. In some cases where the ...
82 views

### Distributed generation of random integers with prescribed sum

While reading this document I came across the following problem. Assume you have $n$ clients. The clients need to generate random integers in $\mathbb{Z}_p$, say $T_i$ for $i \in \{1, \ldots, n\}$, ...
904 views

### Argon2 - memory setting - lower bound?

(I realise this is yet another Argon2 "how do I configure" question, but the existing questions I've found don't really help. If I've missed one, happy to have this closed). Deploying Argon2 (with ...
151 views

### Why is recipient hashed in this Sign/Encrypt/Sign proposal?

Own research In my journey into trying to understand PGP, and public key signing and encryption as a whole, I came across this answer on CE. It is an answer to a question with the title: Should we ...
202 views

### Cryptographically Secure Elliptic Curve

What are the properties a cryptographically secure Elliptic Curve must have? I have started to create a list and wanted to know if I forgot some important points, and if it is correct so far: A curve ...
288 views

### Relation between Claw-free permutation and Trapdoor

Can someone explain the two definitions in relation to each other? Is a claw-free permutation a permutation without a trapdoor? For your convenience, here's the definition of a "claw-free ...
214 views

### How did the cryptographers of Bletchley Park figured out the chi stream of the Lorenz cipher?

How did the Bletchy Park code breakers figured out the chi stream of the Lorenz cipher, that was obscured in the cipher text, which Britain code breakers eventually decoded. It's written in The ...
331 views

### Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
172 views

### What are the theoretical memory requirements for these factoring algotihms?

Given an $n$ bit integer quadratic sieve takes $L(\frac12,1+o(1))$ time and number field sieve takes $L(\frac13,1.922)$ time where $L$ notation is given in https://en.wikipedia.org/wiki/L-notation. ...
256 views

87 views

### Which organization is responsible for certifying a TSA?

I see there a number of free TSA services according to this page (not all are still in service). In other sources I see references to the requirement of audits for the TSA to be 'rfc3161 compliant'. ...
103 views

### IND-CCA2 post-quantum key exchange

QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems. I am looking for a post-quantum key exchange algorithm with the following ...
61 views

### Threshold homomorphic

Quite a specific question, but are there any threshold signatures that are also homomorphic? Preferably ones that work in the discrete log setting and don't require any pairings.
124 views

### Multilinear trapdoor commitments secure against concurrent man-in-the-middle attacks

I am trying to understand how to apply a multi-trapdoor commitment described by Gennaro and what makes them secure against a concurrent MiM attack. There are two ways to construct a multi-trapdoor ...
176 views

### aside from DES has the NSA ever strengthened algorithms?

When DES was originally developed, the NSA changed the s-boxes. For decades people thought that their changes introduced a backdoor but then it was discovered that their changes actually strengthened ...
69 views

I don't understand how the AddRoundKey function works, because the following example is from the cipher authors. I`m trying to add 76 and 7d, and my result is f3. Could someone explain this? 8F 20 3E ...