All Questions

2,263 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
57 views

Does the bias in RC4 drop asymptotically further in the keystream?

It's well-known that the RC4 keystream has significant biases that become less prominent later in the keystream. The most severe bias is in the second byte, which has a 128-1 bias towards zero. Other ...
4
votes
0answers
50 views

Transferable zero-knowledge proofs

Many interactive ZK-proofs satisfy non-transferability; that is, the prover performs a series of actions to convince the verifier of a certain fact, and this verifier can't use this proof to convince ...
4
votes
0answers
92 views

Aside from Keccak, are there any keyed/unkeyed permutations where the choice of all rotation constants is not based on heuristic methods?

I am interested to see examples of cryptographic algorithms (namely, keyed or unkeyed permutations that transform an $n$-bit input to an $n$-bit output) where the choice of all rotation values is not ...
4
votes
0answers
190 views

How does post quantum key exchange in OpenSSH 8 work?

OpenSSH 8 supports a post quantum KEX, namely sntrup4591761x25519-sha512@tinyssh.org It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how ...
4
votes
0answers
67 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
4
votes
0answers
80 views

About Cocks IBE

Why doesn't Cocks IBE use the hash function H from ID space to quadratic residue set $\mathbb{QR}_N$ in $\mathbb{Z}/N\mathbb{Z}$ to reduce the ciphertext expansion by half? I think it is also IND-ID-...
4
votes
0answers
110 views

How sensitive is Tiny Encryption Algorithm (TEA) to the magic numbers?

If I needed to implement an encryption algorithm from memory, chances are I would try to implement: TEA https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm How sensitive is it to the magic ...
4
votes
0answers
56 views

Effect of block size on diffusion rate

I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The ...
4
votes
0answers
81 views

Which organization is responsible for certifying a TSA?

I see there a number of free TSA services according to this page (not all are still in service). In other sources I see references to the requirement of audits for the TSA to be 'rfc3161 compliant'. ...
4
votes
0answers
97 views

Can “OPAQUE-over-TLS” authentication be optimized?

So while discussing the issues of password-hashing off-loading in our chat I noticed that it's easy to extend OPAQUE (CFRG draft) to essentially be a better standard password based authentication when ...
4
votes
0answers
76 views

Upgrading key derivation by adding a XOR with a known value

In general keys for password based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
4
votes
0answers
141 views

Why is this Trivium implementation working bytewise instead of bitwise?

I am currently looking into a Trivium implementation available in the FELICS framework. Parameters of the Trivium stream cipher: Key size: 80 bit IV size: 80 bit State size: 288 bit The Trivium ...
4
votes
0answers
90 views

Use of randomness in an Elgamal like encryption

Suppose I have the following encryption scheme: for a message $m\in\mathbb{F}_p^*$, I generate the ciphertext = $(g^r,f^mh^r)$ where $g$ is the generator of a cyclic group $G$ of unknown order $n$ and ...
4
votes
0answers
127 views

Why are matrices so common in symmetric encryption?

Matrices have been used in symmetric ciphers since the Hill Cipher (before?) all the way up to modern ciphers such as Twofish and AES. I understand matrices can be invertible, therefore making them ...
4
votes
1answer
152 views

Is there any way to check hash of homomorphic encrypted data?

I need some algorithm that satisfies: H - hash function Enc - encryption function (using public key) M - secret data $Enc(H(M)) = H(Enc(M))$ Let this system exist: the First person has a secret ...
4
votes
0answers
464 views

Argon2 - memory setting - lower bound?

(I realise this is yet another Argon2 "how do I configure" question, but the existing questions I've found don't really help. If I've missed one, happy to have this closed). Deploying Argon2 (with ...
4
votes
0answers
53 views

Threshold homomorphic

Quite a specific question, but are there any threshold signatures that are also homomorphic? Preferably ones that work in the discrete log setting and don't require any pairings.
4
votes
0answers
137 views

Indistinguishability vs fixed bit-length

Suppose there is a cyclic group $\mathbb{G}$ of prime order $q$ of elements in $Z^{∗}_p$ with a generator $g$ and values $a,b,c,d \in Z_q$. There is also an equation $g^{ab} = g^{cd}$, where $a,b,c$ ...
4
votes
0answers
223 views

Where do the PKs come from in Bluetooth device?

I am studying the Elliptic Curve Diffie-Hellman (ECDH) on Bluetooth 4.2. There are some questions about the PK.. Where do these public and private keys come from? Who defines them? and Will it ...
4
votes
0answers
201 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
4
votes
0answers
142 views

computational indistinguishable/distinguishable?

Let $a,b,c,d$ be selected at random from $Z_q$. Consider the following two distributions $X_1$ and $Y_1$: $X_1={(r_1\cdot a, r_2\cdot b, r_3\cdot c, (r_1+r_2-r_3)\cdot d)}$ where $r_1,r_2,r_3$ ...
4
votes
0answers
234 views

Encrypt using ECDH with two different EC public keys, minimizing payload size

Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob. Bob now wants to ...
4
votes
0answers
222 views

Is the matrix step of GNFS still the hardest part?

When the factorization of RSA-768 was announced in December 2009: the sieving took about 24 months and the matrix step took 119 days (4 months). So sieving took about 6 times as long. This is despite ...
4
votes
0answers
189 views

What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
4
votes
0answers
309 views

Alternative way to provision secret in Intel SGX enclave

I have a case where I have multiple clients(non sgx, assumeed safe) and server(sgx based), talking over a network. I wanted to provision shared (per client) key which is used to encrypt and decrypt ...
4
votes
1answer
485 views

In zkSNARKS, does R1CS require every step of the calculation, or just statements which confirm the calculation was performed correctly?

I was attempting to figure out a way to implement the modulo operation as a set of gates in an Rank-1 Constraint System, detailed by Vitalik Buterin here However, it occurred to me that maybe we don'...
4
votes
0answers
44 views

Relation between k-th shortest vector of a lattice and (n-k+1)-th shortest of its dual

Let $\Lambda$ be an $n$-dimensional lattice and $\Lambda^*$ be its dual lattice. For any $k \in \{1, 2, ..., n\}$, let $\lambda_k(\Lambda)$ be the $k$-th successive minima of $\Lambda$ (analogously ...
4
votes
0answers
155 views

How many reversible gates would DES require?

How many reversible gates (said counting Toffoli and Controlled NOT, with free NOT) would be required to reversibly implement $(K,P)\mapsto(G,C)$ for the block cipher DES? $P$ is the plaintext, $C$ ...
4
votes
0answers
78 views

Is it safe to extend the length of Blake2b’s keyed hash key?

Blake2b keyed hash variation specifies a maximum key length equal to the digest size. It implements this feature simply concatenating the zero-padded key to a boundary of the block size with the ...
4
votes
1answer
258 views

Formal Verification of DHKE protocol using ProVerif

I am new to ProVerif and trying to verify a simple DHKE protocol. The attacker is assumed as passive. The specifications are: The attacker cannot obtains the mutual key. Both participants obtain the ...
4
votes
0answers
143 views

AES-256 9 round related key attack - getting possible state differences

I'm trying to implement related key attack on 9 round AES256, described here: Biryukov, Dunkelman, Keller, Khovratovich, Shamir, but I am stuck at the very beginning with Observation A, used to ...
4
votes
0answers
84 views

Implications of TLS-SRP client with improper N validation?

During development of a client side application of TLS-SRP, i noticed a bug that allows an attacker spoofing as the server to send custom, but non-arbitrary $N$ values, with the client accepting them. ...
4
votes
0answers
100 views

Is there a cryptographic solution to provide a “proof of exclusion”?

I would like a proof that accomplishes the following: $N$ strings are part of a set $S$. There is a do_proof function on set $S$ that produces a succinct witness ...
4
votes
0answers
69 views

Сryptanalysis of Hill's method

The brutal ciphertext is given. The text volume is more than 6000 characters. It is known that the text is encrypted with a 7x7 matrix. Unknown key and plaintext. Is it possible to crack this code? ...
4
votes
1answer
241 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
4
votes
0answers
100 views

Multi-party computation with untrusted nodes?

Let $L = [b_1, \dots, b_k]$ be a list of blocks of a file. I want to compute the function $f = h(g(b_1), \dots, g(b_k))$ on $N$ untrusted nodes such that: Anyone can be reasonable convinced (with ...
4
votes
0answers
162 views

Using cryptography: How to handle this real life situation?

For my class in applied information security I'm asked to find a cryptographic solution to the following problem: The government of country X wants to simplify the process of issuing driving ...
4
votes
0answers
260 views

Is CMAC vulnerable to length extension attacks?

Given $m_1, m_2$ such that $MAC_k(m_1) = MAC_k(m_2)$ is it possible to construct more collisions with pairs of the form $m_1|x, m_2|x$? Here is the CMAC picture from Wikipedia where it is only part ...
4
votes
0answers
295 views

Why is this scheme not IND-CCA2 secure

I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead. However, it seems that (when used as a KEM) that any $\text{IND-...
4
votes
0answers
187 views

is a MAC defined by a pseudo random generator secure?

Let $ G:\{0,1\}^*\rightarrow\{0,1\}^*$ be a length doubling PRG, and let $ \Pi=(Gen,Mac,Vrfy)$ be the following MAC scheme: $ Gen $ on input $ 1^n$ uniformly samples and outputs $ k\leftarrow \{0,1\...
4
votes
0answers
113 views

Privacy of Multiplication of Shamir Shared Secrets with an Active Adversary Where Final Result is Revealed to a Third Party Over a Secure Channel

I have the following question related to the privacy of multiplication of Shamir Shared Secrets: Suppose we have two secrets, a and b, shared by a Shamir Secret Sharing Scheme in a (k,n) ...
4
votes
0answers
92 views

Which compression functions are MACs?

The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed). How does this relate to common assumptions for ...
4
votes
0answers
178 views

Differential Path Search of a Block Cipher

Camellia Design and Analysis document refers to a paper: [24] M. Matsui, "Differential Path Search of the Block Cipher E2," (in Japanese), Technical report of IE- ICE, ISEC99-19, pp.57-64, The ...
4
votes
0answers
55 views

Performing DFS search with garbled boolean circuit

Given $G=(V,E)$ How can i implement a DFS search in the Boolean circuit? ( The output should be to assign each node it's DFS value from a root node) I assume the complexity should be exponential, ...
4
votes
0answers
99 views

What are some of the current relevant fully homomorphic schemes?

As of February 2017, I have the feeling that all information on FHE is currently a bit scattered and finding a good summary/ timeline on the topic is really hard. I'm currently looking into FHE over ...
4
votes
0answers
70 views

Can a PGP subordinate key be used as a web of trust signing key?

I already understand the desire to segregate a PGP master key from subkeys, allowing me to keep the master key in some off-site non-networked location while making use of the subkeys to do things like ...
4
votes
0answers
134 views

Explanation of the term “view” for algorithm or adversary

What is the view of an algorithm/adversary? Is view just a term used to describe the output over a set of inputs for a probabilistic algorithm? For example: Consider experiment Mac-forgeA,Π (n). ...
4
votes
1answer
128 views

Noise of ciphertexts in LWE/RLWE based FHE

Often times $[\langle \textbf{c}, \textbf{s} \rangle]_q$ is referred to as the noise associated to the ciphertext $\textbf{c}$, and that decryption is correct when the norm of the noise is $< q/2$. ...
4
votes
0answers
899 views

How babai nearest plane algorithm solves approximate CVP

Babai's nearest plane algorithm solves approximate-CVP (Closest Vector Problem) where the approximation factor is $2(\frac{2}{\sqrt{3}})^n$. Let $b_1,...,b_n$ be a basis and $t$ be the target. This ...
4
votes
0answers
162 views

Sextic twist over BN elliptic curves

I am struggling to understand how to perform a sextic twist over a BN elliptic curve. This is what I understood so far: Let's consider a BN elliptic curve: $$ E: y^2=x^3+b $$ And let's consider a ...

15 30 50 per page