34 votes

Digital signature that is only verifiable by one specific person

What you seem to be looking for is deniable authentication. This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
Ilmari Karonen's user avatar
33 votes
Accepted

Examples of modern, widely used ciphers that suddenly fell?

This question is quite broad by specifying a sudden fall to cryptanalysis and therefore my answer might not be as complete as you wish it to be. If by "become practically attackable, or close enough ...
Biv's user avatar
  • 9,979
26 votes

Is secp256r1 more secure than secp256k1?

The curves secp256r1 and secp256k1 have comparable security. If we consider only the best known attacks today, they have very close security. Both curves are defined over prime fields and have no ...
Ruggero's user avatar
  • 7,014
26 votes
Accepted

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private ...
poncho's user avatar
  • 146k
22 votes
Accepted

Does AES-NI offer better side-channel protection compared to AES in software?

Yes, AES-NI was specifically designed to be constant-time and thus offers better side-channel protection than (some) software implementations. Note however that these day there exist quite fast side-...
SEJPM's user avatar
  • 45.9k
17 votes
Accepted

Is Bruce Schneier Applied Cryptography, Second ed. up to date?

The Applied Cryptography Second Edition goes back to 1996. Although there is a 20th-anniversary edition, 2015, it is not updated as one thought. If you look for Schneier's style, you may look at the ...
kelalaka's user avatar
  • 48.3k
16 votes
Accepted

Is every point on an elliptic curve of a prime order group a generator?

This is true of any group of prime order, over elliptic curves or not. This is due to Lagrange's Theorem which states that the order of a subgroup $H$ of group $G$ divides the order of $G$. Since ...
diagprov's user avatar
  • 721
16 votes

Does AES-NI offer better side-channel protection compared to AES in software?

With regards to timing-based side channels (those that can potentially be exploited remotely, as opposed to, say, power analysis), the AES-NI opcodes are constant-time. See for instance Intel ...
Thomas Pornin's user avatar
15 votes
Accepted

Why cannot I assume that cryptography published in venues/journals handled by the same publishers as prestigious journals is serious?

In addition to the (good) response of kodlu, let me clarify a point which, I think, is the source of the confusion. Springer, IEEE, Elsevier, etc, are publishers. What this means is that they are ...
Geoffroy Couteau's user avatar
14 votes

Digital signature that is only verifiable by one specific person

Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else. A MAC is a good way of doing ...
JvH's user avatar
  • 162
13 votes
Accepted

Where can I find a description of the SHA-0 hash algorithm?

The reference on SHA(-0) is FIPS 180 (archived scan) of 1993 May 11. The standard itself is referenced on the NIST website, but that links to another scan lacking page 1 and the one before, thus ...
fgrieu's user avatar
  • 140k
13 votes
Accepted

Who is the inventor of the OFB block cipher mode of operation?

It's difficult to be sure of the attribution here, but my best guess would be Carl M. Campbell Jr., from the (later renamed to Mastercard) Interbank Card Association. Soon after the DES was ...
Samuel Neves's user avatar
  • 12.4k
11 votes

Is there a string that's hash is equal to itself?

Yes, you can create many such functions. For instance, lets build such a function based on SHA512. Generate some random value $m_0$ and generate a hash of it. It is important, because there is no ...
mentallurg's user avatar
  • 2,601
11 votes
Accepted

Opinion from "military institution" about the academic work

Here is a blog where Scott Aaronson wrote about this, including a link to the NSA document. That link is however now broken, but the blog contains all of the needed text. An alternative copy of the ...
Yehuda Lindell's user avatar
11 votes
Accepted

Clarification of the provable cryptography controversies

In general, that article seems to be referring to the "Another Look At..." line of work. Many of the papers are collated on this website. There are a number of "controversies" you ...
Mark's user avatar
  • 12.4k
10 votes
Accepted

Which cryptography technique does not increase the size of the plain data?

The standard answer to this question is format-preserving encryption (FPE). FPE is a class of techniques that allow you to encrypt data while preserving some of its format (which can include its ...
pg1989's user avatar
  • 4,636
10 votes
Accepted

Efficiency of oblivious algorithms vs non-oblivious algorithms?

Yes. There is an $\Omega(\log n)$ lower bound on ORAM. Therefore directly using ORAM to transform a non-oblivious algorithm to oblivious algorithm would incur a logN overhead. It is an open problem to ...
redplum's user avatar
  • 376
9 votes
Accepted

Discrete logarithm problem is easy in a cyclic group of order a power of two

You may find it useful to play around with a toy example, such as the integers modulo a Fermat prime, like $p = 257$. Since $g$ is a generator of the Group, $h \equiv g^x$ for some unknown exponent $...
J.D.'s user avatar
  • 4,415
9 votes
Accepted

Where in the FIPS documents is it stated that SHA-1 is not secure?

Much of what NIST publishes about cryptographic algorithms is in Special Publications. In this case it is SP 800-131 (pdf) where they describe transitioning away from old algorithms and key sizes. ...
otus's user avatar
  • 32.1k
8 votes
Accepted

Homomorphic OR operations

For any $x,y$ represented by $\{0, 1\}$, $x \lor y = 1 - (1-x)(1-y)$. It follows, any one-multiplication homomorphic scheme would do. It also follows, just additively homomorphic scheme would be not ...
Vadym Fedyukovych's user avatar
8 votes

Does AES-NI offer better side-channel protection compared to AES in software?

In addition to the good answers by Thomas Pornin and SEJPM, I will also add a hypothetical downside related to side-channel attacks and AES-NI: nearly undetectable targeted hardware attacks. It's ...
orlp's user avatar
  • 4,230
8 votes

How to thwart a cleartext message's size?

This is a complex question. There exists no formal treatment of this question and the parameters you choose will depend on your application. A method that is typically used is, like you said, to ...
dionyziz's user avatar
  • 573
8 votes
Accepted

Why is this function bijective?

It is simply a typo in the paper I believe. It should say: $$F(x_1, x_2, \ldots, x_n) = (f(x_1, \ldots, x_k), f(x_2, \ldots, x_{k+1}), \ldots, f(x_n, x_1, \ldots, x_{k-1})).$$ (Note the $x_n$ instead ...
meshcollider's user avatar
  • 1,573
7 votes

Is knowing the private key of RSA equivalent to the factorization of $N$?

As S.Neves pointed out, Miller proved that if you know a multiple of $\phi(N)$ then you can factor $N$ in time $O((\log_2{N})^4),$ but he assumed the Extended Riemann Hypothesis. Using, his ideas of ...
111's user avatar
  • 796
7 votes
Accepted

Is there a standardized tree hash?

With SHA-3 Derived Functions (SP 800-185, pdf) there is now a standardized parallel hash based on SHA-3, called ParallelHash, appropriately. However, it is not a tree hash, but more of a hash-list-...
otus's user avatar
  • 32.1k
7 votes
Accepted

Are there any long term RC4 bias based exploits?

I'm happy to have a crack at this one, providing I've understood your question correctly. Firstly I wouldn't say the cipher possibly exhibits low level bias at any point. It experiences plenty of ...
Iam Nick's user avatar
  • 540
7 votes
Accepted

How to generate fingerprint for PGP public key

Your fingerprint is for OpenPGP V4 compatible as it uses SHA-1. The fingerprint is 20 bytes instead of 16 for MD5 used in the older package format. For V4 it is required to extract the public key ...
Maarten Bodewes's user avatar
  • 92.3k
7 votes
Accepted

What are fixed points and length extension attack in hash functions?

If $H(x) = x$, $x$ is a fixed point. If for a value the output of the function is the same as the input, it is called a fixed point. A length extension attack is unrelated to the concept of fixed ...
Ella Rose's user avatar
  • 19.6k
7 votes
Accepted

How does mutlivariate crypto schemes work?

UOV The first thing you need to know about UOV is that the input variables are partitioned into vinegar variables $x_1, \ldots, x_v$ and oil variables $x_{v+1}, \ldots, x_{v+o}$. The number of ...
Alan's user avatar
  • 1,450
7 votes
Accepted

When is an RNG a CSPRNG, a CSRNG, or a TRNG?

There seems to be a lot of confusing terminology here. Let me define everything to the best of my knowledge. RNG: Some mechanism that produces random numbers. CSRNG: An RNG that is safe for ...
Daffy's user avatar
  • 2,379

Only top scored, non community-wiki answers of a minimum length are eligible