35

I've simplified the Alice random bytes to ARB and Bob random bytes to BRB. Then the protocol follows as; Alice knows $key$ and $ARB$ and sends $$C_1 = key \oplus ARB$$ Bob knows $C_1$ and $BRB$ and sends $$C_2 = C_1 \oplus BRB = key \oplus ARB \oplus BRB$$ Alice calculates $C_2 \oplus key \oplus ARB = key \oplus key \oplus ARB \oplus BRB = BRB$ Alice knows $...


12

Can I modify encrypted data without accessing it? if there is an example appreciate it If access means altering the data without decryption as an attacker then the answer is yes for messages without integrity. Take OTP, execute bit flipping attack, done. Take CTR mode, execute bit flipping attack, done. Take CBC, execute bit flipping attack, done. ...


10

If (and ONLY if) it was encrypted with a special "homomorphic" encryption scheme, then you can do the operations allowed by that scheme. Those are almost never used in practice currently (they're very slow, and an area of active research). This demo is quite good. More commonly data is encrypted using an "Authenticated Encryption with ...


7

Secure embedded TRNGs are difficult In an embedded system where the adversary is assumed to control the environment of the Target of Evaluation¹, like a Smart Card, making a TRNG is notoriously tricky. It's hard to ensure the output is truly unpredicatable. When there is a hardware source, one line of attack freezes it, either literally (thru evaporation of ...


4

No. For example, these pairing-based protocols don't require trusted setup: BLS signatures; tripartite Diffie-Hellman, as mentioned in Elias' answer; some identity-based encryption schemes (when users are their own PKGs, e.g. when using IBE for forward-secure encryption); the Bünz–Maller–Mishra–Vesely polynomial commitment scheme. (This could in principle ...


4

The first thing to clarify is the definition of “EdDSA”. EdDSA was introduced in Bernstein et al.'s High-speed high-security signatures in 2011. Various parameters it implicitly assumed were declared more generally in the 2015 paper Bernstein et al., EdDSA for more curves. This culminated in an RFC Edwards-Curve Digital Signature Algorithm (EdDSA), RFC 8032 ...


4

That is not practical since either you keep a sequence of the bits of the $\pi$ or regenerate them every time. You may need to store 64GB sequence if you want to encrypt such files. Then you need to multiply it with the 128-bit number. That is not practical, consider multiplication of 64GB number with a random 128-bit number. OTP needs true random bit ...


4

Maybe I miss something, but after some quick thoughts about that algorithm, I think it is not secure. Therefore it may not be used and be more like an example for teaching (with no name). The problem with the algorithm is that you can derive the secret key q from the public key. When you have two integers a and b, where both are a multiple of q (like all q*...


4

Are there any cryptographic algorithms like that? Yes, those algorithms are known are "homomorphic encryption algorithms"; they are public key encryption algorithms (that is, they have a public key and the private key; with the public key, you can encrypt data; to decrypt data, you need the private key). In addition to the normal public key ...


3

The classic Gaussian Elimination algorithm is $O(n^3)$ runtime regardless of specific field and the Matrix, so in this case a finite field $F_q$ of order $q$ doesn't play a role in the complexity. This runtime is due to the fact that you are zeroing out entries in columns column-by-column to get into row reduced echelon form. For matrices in $GL(n, q)$, the ...


3

In the first part of this answer, I restrict to reading requirement 2 as "if one pair $(m,r)$ is known…", and assume that $k$ is chosen at random. I entirely disregard security when an adversary knows two distinct pairs $(m,r)$, or when related keys $k$ are used. The following construction uses the Galois Field $(\mathbb F_{2^{64}},\oplus,\otimes)$,...


3

There is no security improvement for using an algorithm with ciphertext expansion. In fact, it's really only an unavoidable side-effect of certain public key operations. It's not something that's desired. Anyway, time for the obligatory don't roll your own. No matter how secure you think it is, it isn't. If you want to learn about cipher design, read about ...


3

I'm going to treat this question as a strict one time pad one. With a key k of sufficient length, say 128 bits, is it possible to use kth multiple of π as a one-time pad? That's 107 characters of description plus 128 bits of secrecy (plus $\pi$ which is a known constant). Your Kolmogorov complexity cannot exceed 200 characters if you consider that:- $$\pi =...


3

Generally speaking, more than 128 bit security is not required - except maybe for protection against multi-target attacks where large amounts of ciphertext become available to the adversary. The reason for this is that no system will be able to perform $2^{128}$ operations. So if there is an analysis that threatens the structure or number of rounds used, ...


3

Bug 1: You're not substituting the letters, frequency analysis breaks it horribly. Bug 2: You're noting down the coordinates, it's not clear whether it's supposed to be used as the key or ciphertext. Bug 3: Your scheme has no key, which is a violation of Kerckhoffs's principle. That's it if you want to learn some basics about cryptography. There's plenty of ...


3

Take the output $H$ of $\operatorname{SHA-256(M)}$ or any other hash of $b$ bits. Count the number $u$ of bits set in $H$ and output $u\bmod3$. This is optimally close to unbiased in $\{0,1,2\}$, for an ideal hash and the requirement to deterministically output a value for any $M$. Counting the number of bits set can be fast. Sometimes there's even an ...


3

You are describing what you might call an "exact GCD" scheme. It is insecure (as discussed in the comments), and I believe the suggested modification to make it secure (add a single error $e$ to all samples) is insecure as well (take 4 coordinates, subtract pairs of them to get $q(a_0-a_1)$, $q(a_2-a_3)$, and then take GCDs. It seems quite likely ...


3

I encode [a secret $x$] with a key k and it becomes xxxxxx. The user can apply operations to xxxxxx without knowing k, like $+5$ and $\times2$. After those operations, the encoded value becomes yyyyyy. If I decode [yyyyyy] with the key k, it should be [ $(x+5)\times2$ ], as if I applied $+5$ and $\times2$ on the original data [ $x$ ]. The Pailler ...


2

First, I understand your question and the frustration that comes along with it, and it is not uncommon. I will warn you that from my perspective, there isn't really an easy answer that provides quick satisfaction. But let me try to point you in the right direction. For a simple beginning path, I will point you to Jean-Philippe Aumasson's book, "Serious ...


2

The issue is, the message length is now longer than the modulus $p$ and $q$ That's not true. In the $p$ track, you are raising $M \bmod p$ to the power $d \bmod p-1$; we have $M \bmod p < p$; that is, the value we are exponentiating is less that $p$, as results by Montomery multiplication. In the same way, the $q$ track also satisfies the requirements ...


2

good_RNG could be described as: an implementation of an unbiasing (or randomness extraction, or post-processing) algorithm performing the eXclusive-OR of 200 consecutive outputs of bad_RNG, using a loop unrolled by a factor of two, likely with an accidental data-dependent timing dependency beyond that in bad_RNG. This is because when $\mathtt{foo}\in\{0,1\}$...


2

The algorithm described is an unbiasing algorithm, which is a type of randomness extraction algorithm. Another method is von Neumann unbiasing where you can take 2 bits $(X_n,X_{n+1})$ and output $Z=0$ if $(X_n,X_{n+1})=(0,1),$ output $Z=1,$ if $(X_n,X_{n+1})=(1,0),$ and discard the two bits otherwise. This gives exactly uniform output bits, if the sequence $...


2

Name for crypto algorithm that preserves visual pattern I'm not sure exactly what you're looking for, but one interpretation of your question is that you're looking for a way to 'hide' a message within a picture in a way that the picture isn't obviously changed. The general technique to do this is known as "steganography"; that has the goal of ...


2

Does the use of repeated squaring rather than some arbitrary exponent have any cryptographic significance? Is it just simpler? Mostly, it makes the description simpler. The prover and the verifier jointly compute $g^{2^t} \bmod G$; however they don't don't do it in a balanced way. The prover does the vast bulk of the work, computing all but a factor of $\...


2

Suppose I had an enormous exponent $B$. To compute $g^B\mod G$ (I'll omit "mod $ G$" from now on), I would use a square-and-multiply method: I would compute $g$, $g^2$, $g^4$,\dots, $g^{2^t}$, where $t$ is the bit-length of $B$, then multiply all $g^{2^i}$ for $i=1$ in the binary representation of $B$. Note that this involves, at most, $t$ ...


2

Rounds in block ciphers, and in the inner compression or sponge function of a hash, are run sequentially for a security reason: it increases diffusion, which is necessary for security. Examples include the 10, 12 or 14 rounds of AES-128, -192 or -256; and the 64 or 80 rounds of SHA-2. We just do not know how to make a secure cryptographic primitive operating ...


2

This can be done in $O(n2^n)$, where $n$ is the number of variables (naive expansion would take $O(2^{2n})$ in the worst case). This is a standard technique called "sum over subsets/supersets/submasks/supermasks". A usual example is the ANF computation, which does it in $GF(2)$ so it uses the XOR operation. Here it is basically the same but since ...


2

There is demonstrably no general solution to this class of problems. Argument: we can construct the output as a Message Authentication Code (e.g. HMAC) of the other inputs, with a random secret fixed key; and what's asked is breaking the MAC. This class of problems is not modern academic cryptography, which assumes the algorithms are known, only the keys are ...


2

The constants in cryptography that can be chosen arbitrarily are typically not likely to be good candidates for backdooring. The constants in cryptography that can be backdoored usually have requirements that make it impractical to generate them randomly in the first place. But with enough degrees of freedom, it is clear that nothing-up-my-sleeve numbers ...


2

A (probably weak) reason not to use a standard is that some nothing-up-my-sleeve numbers may serve some sort of purpose. As an example, you cannot change Salsa20's constants to anything, it must be sufficiently asymmetric. It's feasible to presume that another cipher may have a different set of requirements As per this answer: Salsa20 has strong ...


Only top voted, non community-wiki answers of a minimum length are eligible