# Tag Info

Accepted

### One-way permutation over a small interval?

How about this. Find an elliptic curve mod $p$, say $E:y^2=x^3+ax+b$ for some 256-bit prime $p$ such that the curve $E$ and its twist $E':dy^2=x^3+ax+b$ with $(\frac dp)_L=-1$ are both of prime order. ...
• 25.1k
Accepted

### What is the inverse of this variant of the Gimli SP-box?

First, note that (z << 1) ^ ((x ^ (y | ~z)) << 1) can be simplified to the shorter ~(x ^ (y & z)) << 1. ...
• 12.8k
Accepted

### Why doesn't ChaCha use a 512bit key and xor parameters into it?

The obvious downside is there would be $2^{256}$ weak inputs (key-nonce-counter) due to ChaCha requiring constants to break symmetry (see this paper at 3.1 about NORX permutation based on ChaCha) and ...
• 1,682
Accepted

### Worst-case one-way permutations under P different from NP

The following paper shows that worst-case one-way permutations exist if and only if $\textsf{P} \ne \textsf{UP} \cap \textsf{coUP}$. A problem is in $\textsf{UP}$ if all yes-instances have exactly one ...
• 14.1k
1 vote
Accepted

### Per-‌XOR computation

Here is another way to understand the transform (and it may be an easier way): For all the locations where N has a 1 bit, take the corresponding bit in M, and place them together to form A (so that ...
• 150k
1 vote

### Rationale for BLAKE2 message schedule?

The permutation used in BLAKE2 is identical to the one used in BLAKE itself, so we can look at the BLAKE specification submitted as part of the SHA-3 competition: The permutations \$ σ_{0}, . . . , σ_{...
• 3,516

Only top scored, non community-wiki answers of a minimum length are eligible