7
votes
Accepted
One-way permutation over a small interval?
How about this. Find an elliptic curve mod $p$, say $E:y^2=x^3+ax+b$ for some 256-bit prime $p$ such that the curve $E$ and its twist $E':dy^2=x^3+ax+b$ with $(\frac dp)_L=-1$ are both of prime order. ...
- 25.1k
3
votes
Accepted
What is the inverse of this variant of the Gimli SP-box?
First, note that (z << 1) ^ ((x ^ (y | ~z)) << 1) can be simplified to the shorter ~(x ^ (y & z)) << 1.
...
- 12.8k
2
votes
Accepted
Why doesn't ChaCha use a 512bit key and xor parameters into it?
The obvious downside is there would be $2^{256}$ weak inputs (key-nonce-counter) due to ChaCha requiring constants to break symmetry (see this paper at 3.1 about NORX permutation based on ChaCha) and ...
- 1,682
2
votes
Accepted
Worst-case one-way permutations under P different from NP
The following paper shows that worst-case one-way permutations exist if and only if $\textsf{P} \ne \textsf{UP} \cap \textsf{coUP}$. A problem is in $\textsf{UP}$ if all yes-instances have exactly one ...
- 14.1k
1
vote
Accepted
Per-XOR computation
Here is another way to understand the transform (and it may be an easier way):
For all the locations where N has a 1 bit, take the corresponding bit in M, and place them together to form A (so that ...
- 150k
1
vote
Rationale for BLAKE2 message schedule?
The permutation used in BLAKE2 is identical to the one used in BLAKE itself, so we can look at the BLAKE specification submitted as part of the SHA-3 competition:
The permutations $ σ_{0}, . . . , σ_{...
- 3,516
Only top scored, non community-wiki answers of a minimum length are eligible