64
votes
Accepted
Why do 5G, 4G, etc., use non-conventional algorithms?
These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is ...
- 4,948
26
votes
Accepted
What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?
When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n
Actually, MD-n was not NIST's naming conventions; it was RSA Security's (a private ...
- 151k
25
votes
Accepted
Why did TLS 1.3 prohibit PGP authentication?
It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place):
...
- 94.5k
22
votes
Accepted
Finding flaw in cryptographic protocol
If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.
How about Finding a flaw in cryptographic protocol?!
A protocol ...
- 19.9k
21
votes
Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?
Is there any functional difference on how this process is conducted?
One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and ...
- 151k
17
votes
Accepted
What the X stands for in the front of Elliptic curve names like X25519
It is an open standard by IETF.org
We can find the details in the mail archive of IETF, D. J. Bernstein's response;
It has become increasingly common for "Curve25519" to refer to an
...
- 49.5k
17
votes
Accepted
How are curve names constructed?
The prefix sec stands for "Standards for Efficient Cryptography" (per the eponymous group, in the sense of assembly of experts). Brainpool stands for the name of another assembly of experts.
...
- 146k
16
votes
Accepted
How did || come to be used in crypto texts to represent concatenation?
The origin is set theory and not programming languages. In the context of cryptography, I could describe a set that is
$$x_1 \parallel x_2 \parallel \dots \parallel x_n$$
as a concatenation of the ...
- 4,948
16
votes
Is there a contingency plan in the event of a catastrophic attack on AES?
I'm not aware of any official NIST policy on the matter, so I can only make educated guesses.
I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For ...
- 94.5k
16
votes
Accepted
What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)
If you are seeking a government contract with China, you might be required to use Chinese government standards for cryptography, just like if you are seeking a government contract with the United ...
- 49.5k
15
votes
Accepted
Which cipher is used in the new 5G network?
Ericson's white paper lists them as
The strong and well-proven security algorithms from the 4G system are reused. These are encryption algorithms based on SNOW 3G, AES-CTR, and ZUC; and integrity ...
- 49.5k
14
votes
EC Schnorr signature: multiple standard?
Adding to other answers, I note that both schemes are related to (but clearly different from) those standardized in ISO/IEC 14888-3:2016 (non-functional preview):
The BSI's EC-Schnorr original ...
- 146k
10
votes
Why did NIST select Kyber and Dilithium?
NIST did consider the MATZOV attacks. If we read their Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process, we see in section 4.1.1 on page 29:
During the ...
- 26.4k
9
votes
How did || come to be used in crypto texts to represent concatenation?
Some languages like PL/I and Oracle Database SQL indeed use || for string concatenation.
One reason is maybe that + might be ...
- 6,511
9
votes
Notable Non-Western Cryptosystems that have been widely deployed?
Are there cryptosystems that have not been widely adopted in the West, that have been standardized by other major countries?
Camellia is a block cipher similar in performance and security to AES. It ...
- 15.5k
8
votes
EC Schnorr signature: multiple standard?
The $(r,s)$ version in theory is more secure than $(h,s)$. Bellare, Namprempre, Neven 2004 paper "Security Proofs for IBI and Signature Schemes" showed that Schnorr signature in the form of $(r,s)$ (...
- 91
7
votes
Accepted
Is there a standardized tree hash?
With SHA-3 Derived Functions (SP 800-185, pdf) there is now a standardized parallel hash based on SHA-3, called ParallelHash, appropriately.
However, it is not a tree hash, but more of a hash-list-...
- 32.4k
7
votes
"official" guidelines about the minimum length of a truncated hash
minimum reasonable length for a truncated hash (specifically, a truncated SHA256 hash) to ensure preimage resistance.
To answer this one might consider the attacks.
Brute-force preimage algorithm: ...
- 49.5k
7
votes
Accepted
How is EdDSA different from ECDSA with a custom curve?
EdDSA is not ECDSA over a different curve. Rather, it is a type of Schnorr signature. Indeed the name is very confusing, and I'm pretty sure that it was chosen in order to give this impression, since ...
- 28.2k
6
votes
Accepted
Standard parameters for Boneh–Lynn–Shacham signature?
Well, the Boneh-Lynn-Shacham "BLS" signature scheme is currently in the process of being standardized through an Internet Draft named "draft-irtf-cfrg-bls-signature-00" (a working ...
- 7,789
6
votes
Is there a standardized tree hash?
The BLAKE3 hash function was just announced today. Internally, it's a Merkle tree.
- 637
6
votes
Accepted
Formal description of KDF1 and KDF2
FCD 18033-2
Encryption algorithms — Part 2:
Asymmetric ciphers - the final committee draft (FCD) of ISO/IEC 18033 - by Victor Shoup is publicly available from his website and specifies (in section 6.2)...
- 328
6
votes
Accepted
FIPS 140-2 compliance and RSA encryption
There's a difference between FIPS approved and FIPS allowed algorithms. RSA is an allowed algorithm for doing key wrap and key transport, however it's not FIPS approved for that purpose. It's only ...
- 2,118
6
votes
Notable Non-Western Cryptosystems that have been widely deployed?
Chinese Standards:
Identity Based Encryption:
SM9 is a Chinese national cryptography standard for Identity Based Cryptography issued by the Chinese State Cryptographic Authority in March 2016 ...
- 23.7k
6
votes
Lack of response to CAESAR competition
The current accepted answer is out of date and somewhat misleading. Disclaimer: I'm an author on the AEGIS Internet-Draft I'm about to talk about.
AEGIS (technically AEGIS-128L and AEGIS-256) has an ...
- 2,120
6
votes
Post quantum hybrid model and its security
If I understand correctly, in hybrid schemes the input date is first encrypted/signed by classical section's algorithm and then the output of classical section is encrypted/signed by the post-quantum ...
- 151k
6
votes
Accepted
What is the significance of the results of the NIST PQC competition?
I guess one can make educated guesses by looking at what happened to DES, AES and SHA-3, all of which were the result of NIST competitions. Barring unexpected developments, it's quite likely that, at ...
- 880
6
votes
Accepted
Current Digital Signature Standards as of late 2023
A short answer on NIST;
With the NIST.FIPS.186-5
Published: February 3, 2023
Effective: February 3, 2023
Prior versions of this standard specified the DSA. This standard no longer approves the DSA ...
- 49.5k
5
votes
Accepted
BER or DER X9.62 for ECDSA signature
Annex E of X9.62-2005 says:
Annex E provides the syntax for elliptic curve cryptography, including domain parameters, keys and signatures, according to Abstract Syntax Notation One (ASN.1). Although ...
- 87.8k
5
votes
EC Schnorr signature: multiple standard?
Probably the most widely deployed Schnorr-type signature scheme over elliptic curve groups today is EdDSA, in its instantiation Ed25519 over Curve25519 with SHA-512. A public key is the encoding of a ...
- 49.5k
Only top scored, non community-wiki answers of a minimum length are eligible