# Tag Info

0

Similarly, just send the identity element $\mathcal{O}$ as the public key. Alice must be a fool to not validate the public key to fall into this trap. The first rule is to check that $P \neq \mathcal{O}$

2

Yes! Good observation! Although note that the original Helios paper by Ben Adida does not mention such implementation details, i.e., on which curve to instantiate the ElGamal encryption scheme. Your observation basically stems from the fact that the decisonal Diffie-Hellman (DDH) assumption does not hold on pairing-friendly curves. On the other hand, one ...

1

The multiplicative group $\mathbb{Z_{67}}^*$ has 66 elements. By Lagrange theorem, we can say that the order of any subgroup $G$ of $\mathbb{Z_{67}}^*$ must divide the order of the group, 66. The inverse of the theorem doesn't need to be held, therefore one must check that there are subgroups of order 2,3, and 11, and their products. With the below SageMath ...

3

The problem with "why" "Why" is generally an unfortunate question. It is often very hard or impossible to answer. The reasoning goes like this: if you ask "why" a (reasonably complex) thing is like it is, any meaningful answer usually breaks the issue down into subcomponents. Then, you can and need to ask "why" for ...

2

Maybe I can give another answer from the perspective of Multiparty Computation (MPC), which studies the problem of enabling multiple parties to securely compute a function on sensitive data while revealing only the outputs. A very important tool for solving the problem stated above is secret-sharing, which enables distribution of a secret $s$ into $n$ shares ...

3

I think you got it backwards: Algebraic structures like rings and groups and fields are the underlying concept of all commonly used types of numbers like the integers, rationals, reals and complex numbers. In algebra it is quite common to do theorems and proofs in the structure with the minimum requirements - so they are valid in a wide range of structures, ...

6

Groups have properties which are useful for many cryptographic operations When you multiply 2 numbers in a cryptographic operation you want the result of the multiplication also to be in the same set. For e.g. if you are multiplying something which fits in a byte (or n bytes) by something similar, you also want the result also to fit in a byte (or n bytes). ...

15

Kindly, let me know what was the actual problem which leads us to use groups in cyptogrpahy? Well, we use groups and other similar mathematical constructs because: We found there are problems that appeared to be difficult to solve with those groups We found ways to translate the difficulty of solving those problems into the cryptographical strength of ...

1

The procedure that Mike Kaye suggested works; the other method would be to select a random value, and then use a Hash-to-Curve method to translate that random value to a point; they have been designed so that the order of that generated point is unknown.

1

Pick a random $x$ value. Calculate $y^2 = x^3+ax+b \bmod p$. Then try to form $y$ by taking the square root $\bmod p$. If the square root fails then no $(x,y)$ pair exists on the curve. If the square root works, flip a coin; if tails form $y = p-y \bmod p$. This is how public key compression works. Only the low bit of y is saved. Form $y^2$, take the square ...

2

If you are on linux/mac you can also use bc: echo "(5^7347)%10007" | bc

3

On a calculator this gives overflow error, how am I supposed to calculate the public key when a private key is a large number? A standard calculator cannot handle that, and we don't expect it. If you have a programmable one you can use square-and-multiply as in levgeni's answer. This, however, will fail when the calculator cannot handle integers (the ...

1

5^{7347} is a huge integer (with thousands bits), if you are using standard integer encoding, you can only use few hundreds bits ($128$, in general). But, if you are looking the fact that you don't need to compute entirely this integer, you can use the square-and-multiply algorithm smartly : pow (a,b) : if b is odd then return (a* (pow (a, b-1)) mod 10007) ...

1

As stated the problem is insoluble as zero-knowledge of $k$ is provided (unless we know something about $m$). To see this, let $x$ be any integer $0\le x\le p-1$ and let $m':= m\cdot v^{-x}$ then we see that $c=m'\cdot g^{(k+x)a}$ and we see that $k+x\pmod p$ is an equally valid output unless we have some reason to choose $m$ over $m'$.

2

Yes -- which is the same as RSA, because there the server proves it was able to decrypt the premaster secret (with the private key) only by getting the correct master secret, and working keys, and thus Finished. (All of these are the same for 1.1 and 1.0, and SSL3.)

1

In this case, you have two different threat models and two different types of attacks that both need to be considered. The solution that a typical TLS connection (HTTPS or WSS connection) provides is an encrypted connection between a server, which is authenticated, and a client, who typically is not (but may be). This means that data between the client and ...

1

The NIST special publication 800-90B is probably your go to here. It is the approach used to meet the FIPS 140-3 requirements which are accepted by as good assurance by a large population. Different approaches are taken for TRNGs that are believed to produce independent, identically distributed outputs and others. One of the key measurements is the minimum ...

Top 50 recent answers are included