New answers tagged public-key
1
Threshold signatures do not enforce accountability meaning a t-out-of-n threshold signature does not tell the verifier which $t$ of the $n$ signers created the signature. Multisignatures enforce accountability as the verifier learns which t signers created the signature. There does not need to be a threshold for multi-signatures.
But n-out-of-n threshold ...
-1
Key exchange: I'll use ECC as an example. Alice and Bob generate ephemeral key pairs and sign their ephemeral public key with their static private key, and then send their signed ephemeral public key to each other.
Both parties receive the others signed ephemeral public key and verify it using the others static public key, stored by a CA or in a PKI. Now ...
1
If you are going to public the same message with a signature multiple times, it is vulnerable to a replay attack. This is where another party basically copies your message and signature and can re-publish it at any time, implying that they own the key. To counter this, add a small piece of information to the message before signing, say a counter or random ...
3
What do I need to look for in a crypto library to achieve this?
There are multiple options for this (from most to least desirable):
You want any public-key encryption scheme and any MAC algorithm and distribute as your public key, the encryption scheme's public key and the MAC key. Then you enforce that every message either has the MAC applied on the ...
2
You are asking about a cryptosystem that is similar to a public key encryption system, except that the "private key" (or decryption key) cannot be used to encrypt.
One way to get this sort of functionality is using a conventional public key encryption and signatures. That is, Alice would get an encryption public key and a signature private key; while Bob ...
10
As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers):
$2^{61} ≈$ SHA-1 chosen-prefix collision (i.e. definitively practical) from the recent SHA-mbles attack.
$2^{63} ≈$ the initial SHA-1 collision from SHAttered attack (which ran over multiple months). (i.e. ...
2
Should I always call the key used for verification "public key" even on those settings?
Usually it is a public key, or at least it is called that in the key pair generation procedure of the cryptosystem that is used. Public key is in that case a more generic term - it may not be decided for what the key will be used after all. Similarly, cryptographic API'...
8
The current recommendations of the BSI recommend 120 bit of security beyond 2022. And AES 128 is still in their recommendations.
If the current estimate of AES128 is about 126.1 bits of security, that's still above the threshold. And AES has been subject to a lot of cryptanalysis for many years, so that estimate seems quite strong.
For crypto with keys, ...
24
I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over 34 million years of the entire bitcoin mining power to carry out a computation of $2^{128}$. This is far from broken. If quantum computers ever happen at scale, ...
1
I think Crypto++ will help you. This is a cryptography library implemented in C++. Its homepage: Crypto++ Library.
2
Libsodium is written/implementable in C++, C and Python. It implements lots of crypto systems, such as public key cryptography. Here is the intro in the docs: https://libsodium.gitbook.io/doc/
3
I am writing an application that involves checking to see if data has been created by me.
That's known as verifying data that was signed. It is good practice.
I do this by encrypting the data with the private key on my server, and then decrypting it using the public key on the client.
That's where it gets wrong. The server must sign with the private key,...
4
As long as you are not wedded to RSA, here's a way that completely solves the problem (and scales to more than two targets).
The general idea is that we do EC-ElGamal in a pairing friendly curve (that is, an elliptic curve that has a computable function $e(X, Y)$ that satisfies the identity $e(aG, bG) = e(G, G)^{ab}$, for any integers $a, b$ (and $G$ is the ...
-1
It depends on the what are you protecting from. If the scenario is that each party does not trust to other one, then there is no solution.
Alice can be in agreement with Bob against Oliver.
Scenario 1: Alice can send message X1 to Oliver and message X2 to Bob, and the message X2 means "pretend you received message X1". If Oliver wants to verify what Bob ...
2
Yes. You can see Micciancio's annotated bibliography for some relevant papers (including generic transformations from CPA security to CCA security in the random oracle model). If you want to see "actual" schemes which are CCA1 secure, Kyber is a CCA2-secure KEM with security based on a variant of LWE over "Module Lattices", which can be viewed as a slight ...
0
Your design is exploitable to MITM (man-in-the-middle) attack, an attacker can intercept your message and deliver "personal tampered message" encrypted with receiver's public key.
-1
primitive methods defined here
curve domain parameters available here
check whether public_key_xy = scalar_mult(private_key,curve.g) matches expected target
Top 50 recent answers are included
