Search Results

Fix a 256-bit key $k$. What ciphertext you get if you try to encrypt the plaintext $\mathrm{AES}256_k(0)$ with AES-256 in CTR mode with a zero nonce? When you have found the answer, what is your gut …

If you already have an Ed25519 private key, then you can't generate a BIP39 mnemonic from it because BIP39 is a system for generating keys by way of generating mnemonics from which the keys are derived …

One way to address this question is not to ‘store’ secrets in the sense that they can be retrieved, but to create a circuit that only computes a pseudorandom function $f_k(c)$ of a challenge $c$ with …

That said, the Salsa20 family technically supports 80-bit keys too—which are zero-padded up to 128 bits and then repeated as if with 128-bit keys, but with, again, a different constant. … (I've never heard of anyone using this; 80-bit keys are ridiculous!) Neither of these decisions—repeating vs. zero-padding the key—appears to be discussed in any of the design documents. …

To an adversary who doesn't have access to the system, the keys have 256 bits of entropy. But to you, each key has at most 64 bits of entropy. … knowledge, the legitimate user's key has to have a distribution of possible values with a nonnegligible min-entropy, which is formally defined as $-\max_k \log p(k)$ where $k$ ranges over all possible keys …

Compute $v^e \equiv a^m b^s c \pmod n$. Output $(e,s,v)$. This should perhaps read: Solve $v^e \equiv a^m b^s c \pmod n$ for $v$. Output $(e,s,v)$. If you can solve $v^e \equiv u \pmod …

The cost of computing $x^e \bmod n$, which is the bottleneck in any RSA-based cryptosystem, is $\lfloor\log_2 e\rfloor$ squarings and $H(e) - 1$ multiplications modulo $n$, where $H$ is Hamming weight …

$\newcommand{\concat}{\mathbin\Vert}$Use a key derivation function, such as HKDF, to expand a master password-derived key into subkeys for each cipher. Compute $k = \operatorname{scrypt}(\mathit{pas …

in the foot; there's much more to encryption and much more to signature, and beyond the use of exponentiation they bear very little resemblance—and if you naively try to combine the two with the same keys …

exercising human rights, they can't use what's on it to decrypt all the past conversations you had over the internet while they were eavesdropping—then you need to rotate the IKM and erase the old one and all keys … Another way to thwart the batch advantage is to use 256 bits of min-entropy instead, and 256-bit keys everywhere. …

, the adversary could compute the one-time pad $s$ used to conceal the hash $\operatorname{Poly1305}_r(m)$ by $s = a - \operatorname{Poly1305}_r(m)$, and then—with full knowledge of the authenticator keys …

That makes a trillion possible keys, $10^{12} \approx 2^{40}$—and to write down your cryptosystem, you must literally fill a library. …

From the defender's perspective, we accept a cipher as secure if the best known adversary at a game called IND-CCA2 has negligible probability of success even if the adversary can choose what structur …

What if you re-encrypt the same messages with fresh independent keys? Same deal. … Rotating keys doesn't prevent an adversary from using old keys to decrypt old ciphertexts. It only prevents them from using old keys to decrypt new ciphertexts or vice versa. …

Generally, the security contract for a cipher involving an IV or nonce does not require the IV/nonce to be secret, for the cipher to provide any security. Not only is there no need to keep the IV/non …