New answers tagged


In “Alternating Product Ciphers: A Case for Provable Security Comparisons” by J. Pliam some representation theory is used. Here is a snippet of the Proof of Theorem 1


For example, if $F$ is the round function for AES-128 or DES, then does $\{f_k | k \in K \}$ generate the alternating group $A_X$? In the case of DES, then, yes it is known that the round function does generate the alternating group, as shown in this paper ("The One-Round Functions of the DES Generate the Alternating Group" by Ralph Wernsdorf). I ...


Let $\mathbb G$ with generator $g$, it's 256-bit prime order $q$, and the 128-bit prime $p$ be known and fixed. Assume we get an algorithm $\mathcal A$ which on input $(h_1,h_2)\in\mathbb G^2$, with $h_1=g^{a_1}$, $h_2=g^{a_2}$ for random $a_1,a_2\in\mathbb Z_q$, outputs $h_3=g^{a_1+a_2\bmod p}$ with non-vanishing probability, as in the question. Define ...


It seems that finding $g^x$ is nonsense, duo to there being $g^x=g^{a_1} * g^{a_2}\text{ mod }q$. However, we could not judge that whether $x=a_1+a_2 \text{ mod } p$. Another way, we can let the generator $g=r^{(q-1)/p}\text{ mod }q$, where $r\in(1,...,q-1)$ and $p$ is a large prime such that $q-1 \text{ mod } p = 0$. Now, according to the Fermat Therom, the ...

Top 50 recent answers are included