For many signature schemes, having two signatures using the same randomness for two different hash values allows recovery of the private key. This is used in many security proofs by showing that an ...

As you probably know $f(\lambda)=O(\lambda^4)$ means that $|f|$ asymptotically upper bounded by some constant times $\lambda^4$. The notation $f(\lambda)=\Omega(\lambda^4)$ corresponds to an ...

Your question first calls for a remark, the XOR itself already is an instance of taking a modulo. Namely, XOR is just another name for addition modulo 2. As a consequence, using modulo n can be seen ...

Since your problem seems to be with the principle of public key crypto rather than with the math itself, here is an analogy with a physical object that may help. Take a key lock padlock as below: To ...

A good block cipher should be indistinguishable from a random permutation (otherwise it is considered broken). A consequence of this is that two good block ciphers are indistinguishable from each ...

Here is a quick summary: First direction, from discrete logs modulo $N$ to factoring. Assume that there is a fixed basis $g$ for the method that computes logs. Choose a random $x$ modulo $2N$ and ...

The relationship between recovering the decryption exponent $d$ and factoring the RSA modulus $n=pq$ is a classical question in cryptography. There are three useful answers: The first answer deals ...

Let me try a simple explanation of NFS. I will necessarily skip lots of details, but I hope you will get the main ideas. The number field sieve algorithm (NFS) is a member of a large family: index ...

This call for a few different answers. First concerning any rainbow table or similar approach, nothing prevents you from defining $HH(x)=H(H(x))$ and then to apply the desired method to the composed ...

The exact information leaked depends on the mode of operation that is in use. The simplest case is ECB, where a duplicate ciphertext block means that the corresponding plaintext blocks are also equal. ...

This question can be answered in several way depending on the exact meaning you intend for more secure. First answer: No, it is not more secure in general. The most you can expect is "at least as ...

Without pairings, there is no known single round tripartite key-exchange algorithm. However, it is possible to do it in two-rounds. For example, refer to the Burmester-Desmedt conference key protocol (...

The computation of square roots modulo a composite $N$ is hard, because a method for computing square roots can be turned into a factoring method in the following way: Choose an element $a$ modulo $N$...

Nightcracker's method works fine. There also are deterministic solutions to select the correct ciphertext that require very few additional bits. One very useful ingredient is the use of the Jacobi ...

In fact, the basic idea of Shor's algorithm for the discrete logarithm problem is reasonably simple. Assume (as in Section 4 Discrete Log: the easy case of Shor's paper) that you have an efficient ...

Hard to answer impartially, expect opinion-colored answers here. The paper you are mentioning has essentially nothing to do with keysizes. Instead they show that bad use of randomness during RSA key ...

The simplest answer is probably to give an example of information leaked when using Shamir's secret sharing over the integers. Assume that we construct a low degree example, defining $q$ to be a ...

As explained in @fgrieu answer, you can always create such a function from a regular hash function by taking variations on the IVs or internal constant. However, if you ask for a clean standardized ...

A pairing is a non degenerate and bilinear map from $G_1\times G_2$ to $G_T$. This means that if $g_1$, $g_2$ are generators of $G_1$ and $G_2$ then: By non-degeneracy, $e(g_1,g_2)\neq 1$ and, in ...

Concerning question 3, here is an answer assuming that the coefficients of $r$ are known to Bob and the coefficients of $s$ hidden in an exponential representation. [This is unessential, it can be ...

[Partial answer] In Generic Groups, Collision Resistance, and ECDSA by D. Brown (see http://cacr.uwaterloo.ca/techreports/2002/corr2002-06.ps or http://eprint.iacr.org/2002/026) on page 17, you have ...

If I understand correctly is to hash your password $pw$ into a point using either $P=Pad(pw)\cdot P_0$ or $P=MD5(pw)\cdot P_0$ and then use $P$ for cryptographic purpose. The exact security of this ...

As D.W. said, your questions are not very clear. I interpret your first question as asking how the security of an $\epsilon$-PRP varies with $\epsilon$. The answer to this is quite clear from Tessaro'...

With your curve, you can use the Gallant-Lambert-Vanstone (GLV) method to answer your question. Indeed, the equation of your curve is: $$y^2=x^3+7.$$ Since $p$ is congruent to $1$ modulo $3$, there ...

The probability of recovering the string $R$ is the same with both of your scheme. The reason is that your second scheme can be separated into two independent parts. In the first part, you just ...

Obviously, PMAC needs a padding because you want to be able to compute MACs of messages which are not multiple of the block length. The padding is defined in the PMAC paper http://www.cs.ucdavis.edu/~...

The ideal cipher model is a way of modeling of block cipher (i.e. a keyed permutation family) which is very close to the modelization of a hash function by a random oracle. In fact, these two models ...

If I interpret your question correctly, your unchanging 4-character input is probably just a PIN code that unlocks the use of the device. In this case, the sequence of 6-character strings is a series ...

First of all, your linear recurrence relation is not exactly linear, it is affine. However, in general, it is not difficult to get rid of the constant term $d$. To do this, define $A(n)=a(n)+t$, and ...