You can print the data with (change PEM to DER if required): openssl rsa -in Alice.key -text -inform PEM -noout The following data is stored: Modulus ($n = pq$) Public exponent ($e$) Private ...

Most cryptosystems based on elliptic curves can be broken if you can solve the discrete logarithm problem, that is, given the point $P$ and $rP$, find the integer $r$. The MOV attack uses a bilinear ...

Let hash be the raw hash function, as you're referring to. You mentioned that the attacker knows hash(message || length), but to be more precise, they know hash(message || padding || length). Let ...

With Grover's algorithm, quantum computers can brute-force a block cipher with $n$-bit keys using $2^{n/2}$ steps, which is much smaller than the regular effort ($2^n$). This means, for example, that ...

The paper Enabling Standardized Cryptography on Ultra-Constrained 4-bit Microcontrollers (page 255) describes such an implementation.

The xor of two random strings is a random string, so you're basically generating a 128-bit random string from a 256-bit random string. Yes, it reduces security compared to a pure 256-bit random ...

It's the probability that an ECDSA signature (over the Bitcoin curve, secp256k1) will have the corresponding size. In other words, 25% of the secp256k1 ECDSA signatures have 73 bytes, 50% of them have ...

Just use SecureRandom and let the OS take care of it.

The leading 04 byte is specified by the SEC standard (which is based on the ANSI X9.62 standard). It indicates that the public key point is not compressed. If the key is compressed, it uses 02 or 03 ...

If you could use the same IV, then yes, you would need to rewrite everything after the modified block. But you shouldn't do that; every time the contents change, you should generate a new IV, which ...

The entire AES algorithm uses column-major order. So the first four elements are actually the first column, and not the first row.

Your N value, 209, has 8 bits. In practice, RSA uses N values larger than 2048 bits, which can't be factorized in reasonable time in a math software or any other software.

CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero ...

Antoine Joux announced the computation of discrete logarithm over $\mathbb{F}_{2^{257 \times 24}}$, which is now pretty close to what was being used in pairing-based cryptography. According to Joux, "...

That paper is misleading in several ways: The DSA vs BB comparison: it is unfair because it compares DSA with the "full" BB scheme, which does not produce shorter signatures. The same BB ...

Regarding the [B] and [C] parts of the question per the comments: I'm not sure how exactly did Mike Hamburg find the curve, but from what I know it's usually easier to find the order of the matching ...

That's insecure. In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because: $e(T, ... View answer 6 votes The Ed25519 prime has$p \equiv 1 \pmod 4$, while Ed448 has$p \equiv 3 \pmod 4$. This influences the square root algorithm. The$a$elliptic curve parameter is$-1$in Ed25519, and$1$in Ed448. This ... View answer 6 votes You can, with the right parameter sizes (384-bit prime instead of the older 256-bit). Pairings can be attacked in two fronts: the elliptic curve or the extension finite field. The security of the ... View answer Accepted answer 6 votes Maxwell's vanity public key is a result of how the generator of the secp256k1 was chosen; as explained by Maxwell himself. For some reason, the generator$G$is the double of the point: x = ... View answer 6 votes GHASH operates on polynomials with coefficients in the two-element finite field$\operatorname{GF}(2)$(which you can interpret as numbers modulo 2). Each coefficient is represented as a bit. To add ... View answer 6 votes Each 56-bit key has a unique 8-bit parity value. For this reason there are only$2^{56}$keys. View answer 6 votes ECIES may seem complex, but if you try another approach, you would end up with something very much like it. If you only encrypt with AES, then you are not authenticating, which is most cases you also ... View answer 6 votes From these three, ECDSA is faster - it does arithmetic with smaller numbers, and is thus faster. (RSA verification is faster than ECDSA, even though it uses larger numbers, because it computes a ... View answer Accepted answer 5 votes A group is a set of elements and some operation that satisfy some requirements. This operation is usually called "addition" or "multiplication", depending on the group, even though ... View answer Accepted answer 5 votes Why do we choose the value of e such that e is relatively prime to the totient (as opposed to just being relatively prime to n?) The final goal of RSA encryption is to have$m = c^d \bmod n$, which ... View answer Accepted answer 5 votes It's the size of the prime number of the underlying field in G1, G2 and GT. In BN256, G1 is$E(\mathrm{GF}(p))$, G2 is a subgroup of$E(\mathrm{GF}(p^{12}))$(or$E'(\mathrm{GF}(p^{2}))$when using a ... View answer Accepted answer 5 votes Most pairing-based cryptography (PBC) schemes are based in elliptic curve cryptography (ECC). The main function in PBC is the pairing, which is a function$e$with two parameters, e.g.$r = e(P, Q)$. ... View answer 5 votes It's the prime of the prime field. (Note that, if you're also using the curve for pairings, you'll need arithmetic over both$\mathbb{F}_p$and$\mathbb{F}_{p^{12}}\$. The first can be viewed as ...