New answers tagged

1

Regarding crypto working now (or soon) I guess three candidates for that state of the art are Lelantus Spark from Firo (formerly Zcoin), Triptych and Seraphis (from Monero entourage): Triptych was the earlier, but it seemed to have problems with multisig so the other two have been developed: Sorry, I haven't had time yet to go deeper about them, but here it ...


0

If you absolutely needed to advertise one public key that could be used both for public-key authenticated encryption ("crypto_box") and also for signing ("crypto_sign"), that would be a reason to map key pairs between the Twisted Edwards Ed25519 curve (which is preferred for signing operations) and the Montgomery curve Curve25519 (which ...


0

Little bit late. sEUF-CMA is stronger, because an adversary has more freedom. It can try to find a new hash to messages it already has queried before. If an adversary has no luck in sEUF-CMA, it has no luck in EUF-CMA either. Here the adversary makes no use of its advantage. sEUF-CMA security implies EUF-CMA security, and if we are talking about an ...


1

The size of $p$ only affects the cost of the group operations (which is small even for 1024-bit number). Many known attacks against Dlog such as baby-step-giant-step are in $\mathcal{O}(\sqrt{o(g)})$ group operations, with $o(g)$, the order of $g$. That's why it's important that $g$ has the same order of $\mathbb{Z}^{*}_p$ (then it should be a generator). ...


0

I'm new to cryptography too, but recently I'm working on an SSL project. Here are more details in the instruction about an SSL handshake process(TLS 1.2 and TLS 1.3) What the SSL handshake process does is generate a symmetry-key by using asymmetric encryption. Before the key exchange step, the client or server(or both) will check the other's identity, which ...


4

As Mark has said, it's, in theory, a solvable problem (we know how to do it; the known methods are not simple). However, by tweaking things around a bit, we can make this problem easy. My solution is based on Pedersen commitments; those are based on a large prime-sized group (where the discrete log problem is difficult) and two group members $g$ and $h$ (...


1

You are looking for the notion of a additively-homomorphic signature. In general, a homomorphism is a function which "respects an operation", meaning: $$f : A\to B,\qquad f(a_0+a_1) = f(a_0)\oplus f(a_1)$$ here, I use $+, \oplus$ to write two (potentially different) "addition operations". So an additive homomorphism behaves well with ...


2

TLS (the proper name for what you're calling SSL) does provide end-to-end integrity guarantees; that is, the receiver can know that what they got is exactly what the sender sent. However, it is a point-to-point protocol; any message (recorder) is from a specific sender and to a specific receiver. One way to look at it is like it's a secure 'pipe'; one side ...


2

Yes. An SSL connection provides confidentiality and integrity of the transmission: an adversary (someone who is neither of the two communicating parties) cannot find or check what data was transmitted, and cannot modify the transmitted data. The adversary cannot replay data either. With respect to confidentiality, note that an adversary can observe which ...


1

Yes, TLS can provide end-to-end encryption, integrity and authenticity of messages for transport - it's not called Transport Layer Security without a reason. You need to establish trust both parties though: if you cannot identify the clients then the adversary can masquerade as one and will probably receive the message as well. Generally with PKIX you need ...


4

You need some kind of authentication of the source. One solution can be to use pre-shared secret. To exchange the secret you need some reliable channel. Only you know if you have such a channel or not. Another approach can be to use TESLA. A brief explanation see here. Also other approaches can be used.


Top 50 recent answers are included