Latest Crypto related questions

Score: 2
Carlos avatar
ECDSA-SHA256 HTTP Signature String Construction
zw flag

I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing

This is their x509 PKIX encoded signing key's public key: MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEflgGqpIAC9k65JicOPBgXZUExen4rWLq05KwYmZHphTU/fmi3Oe/ckyxo2w3Ayo/SCO/rU2NB90jtCJfz9i1ow==

I am following this specification to construct the signing string: https: ...

Score: 1
Proliferate309 avatar
Real-world instantiation of NIZK protocol from Fiat-Shamir
vi flag

So I understand how one can use Fiat-Shamir to turn a HVZK sigma protocol into a non-interactive zk protocol in the random oracle model. My problem though is I don't understand why is this useful.

If I wanted to use a NIZK in something and I choose a protocol based on Fiat-Shamir, this would mean I have to choose a hash function which surely invalidates the zk proof in the ROM. So do I know anyth ...

Score: 7
crypt avatar
How to generate random numbers within a range (0,n) from random bits?
cn flag

What is a good method to generate random numbers between 0 and n from random bits?

For example, I have a one million random bits generated according to NIST SP 800 90 publications. Now I need to generate random numbers between 0 and 100 (inclusive) using these random bits. Few possible methods i could think of are

Read 7 bits, convert these to a number (0 to 127), store the number if its <= 100,  ...

Score: 28
n-l-i avatar
Is there a hash function that's more expensive for an attacker than for the server?
cx flag

Say a server wants to hash a password $p$. It would use a secure hash function $H$ and a unique salt $s$ to hash the password as $H(p,s)$. If one has access to the salt, each password candidate requires one run of the hash function to be ruled out; the same amount of time it would take for the server to verify a password candidate.

If, on the other hand, the password was hashed as $H'(p,s+r)$, wh ...

Score: 2
Conceal time-based GUIDs with an affine-cipher?
in flag

I'd like to create a custom type of sortable GUID by concatenating an 8-byte nanosecond timestamp, 6 random bytes, a 1-byte node number, and a 1-byte counter. But, such a precise timestamp can be used to enact very effective side-channel attacks if it can be related to the execution time of other cryptographic operations being done on the same system. It'd be ideal to conceal them in some invertible way ...

Score: 3
Ember avatar
How to calculate probability of cracking a password from entropy?
pr flag

I am working on a project for my maths assessment where I research the effect of complexity and length on a given password. Currently, I am working on calculating the probability of guessing a password on the first try. I assumed that I had to start from entropy and go from there but I am kind of stuck on which formula to use in order to find the probability.

I considered 1 / (2^entropy) but I am not su ...

Score: 0
user997112 avatar
Implementing AES GCM but not getting correct output from cipher block
al flag

I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect).

When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the output of the cipher block (before we XOR).

https://csrc.nist.rip/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf

Inputs:

K       00000000000000000000000000000000
P       000000000000 ...
Score: 1
Carlos avatar
Verifying ECDSA-SHA256 HTTP Signature
zw flag

With PHP, I'm trying to setup a HTTP signature verification for webhook requests coming from BlockCypher: https://www.blockcypher.com/dev/bitcoin/?php#webhook-signing

This is their public key: MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEflgGqpIAC9k65JicOPBgXZUExen4rWLq05KwYmZHphTU/fmi3Oe/ckyxo2w3Ayo/SCO/rU2NB90jtCJfz9i1ow==

This is an HTTP request that I've collected using RequestCatcher:

POST / HTTP/1.1
Host: 2 ...
Score: 1
baro77 avatar
About SNARKs general recipes (regarding required assumptions)
gd flag

I'm following ZK MOOC: https://zk-learning.org/

After some previous readings about these topics, I was believing to have understood that, stated that non-interactivity isn't attainable in standard/plain model, there were to alternatives B-plans:

  • Fiat-Shamir heuristic for public coin IPs requiring the acceptance of ROM (Random Oracle Model)
  • or CRS (Common Reference/Random String) assuming a trusted setup ...
Score: 2
Mango avatar
Vulnerability due to same IV, same key, same plaintext at same position in OFB
ve flag

I am currently studying OFB mode, and one of the vulnerability mentioned for it is that if two different messages have a block at the same position in the ciphertext, and have same plaintext, the attacker can figure out the encryption function output for that particular block. This was brought up to highlight the danger of reusing IV, so this is assuming that same IV and key are used.

I understan ...

Score: 0
user997112 avatar
AES GCM Difference between the IV and the Secret Key?
al flag

Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.

The GCM specification examples state both an IV and a Secret Key as two inputs.

Can someone please explain where both are used?

Is the 96 bit IV expanded to 128 bits, incremented (most-significant byte?) and used to create the AES Key Expansion?

And the Secret Key is passed (with the Key Expansion) to E_k for encry ...

Score: 0
xin yao avatar
finding the Key if hmac output, and input are known
mk flag

Assume we have message M, key K, and MAC = hmac-256SHA(M, K).

I wonder if an attacker can figure out the Key K if the attacker knows the Message M and MAC

Score: 3
fgrieu avatar
Bilinear pairing for compact BLS signature
ng flag

What family of bilinear pairing is recommendable for BLS signature when the overriding criteria is compactness of the signature, as desirable for something to be keyed-in from printout, or embedded in a small QR-code?

Is there something giving signature size lower than ≈384 bit for 128-bit conjectured security, as in this draft RFC, which is no more compact than a more conservative and faster s ...

Score: 2
empty_stack avatar
Importance of non-degeneracy property of bilinear map for cryptography
sk flag

I'm currently looking into pairing-based cryptography and I stumbled upon the definition of the properties bilinearity, computability and non-degeneracy.

Now I have a problem with understanding the non-degeneracy and how it is important to the security of elliptic curve cryptography. I have not found a paper that goes into detail about it, only from a mathematical standpoint which is a little to  ...

Score: 1
Anlo avatar
Remembering user credentials by double-hashing
tt flag

I'm developing a desktop application where the users will login with username and password, which is then verified against a database. After the initial login, the current user should be automatically logged in each time the application is started (until the user logs out or 1 month has passed).

I could encrypt and store the last successful username and password on the computer, but the decryptio ...

Score: 0
trieulieuf9 avatar
How can I decode the salt of this argon2i passwordhash?
mm flag

I have this password hash: $argon2i$v=19$m=128,t=2411,p=2$hmJvvpH3BZlvb2V1vLm/yf3zANU4qNpKuw5TBnGzo2I$<censored>.

I know the password, and I want to verify if this password will produce the same hash the the above. Using an online argon2 hashing site: https://antelle.net/argon2-browser/

My problem is I don't know how to convert the salt into the right format for hashing.

Score: 0
Nathan Aw avatar
Mitigating side-channel attacks: which is better? Masked cryptography or differential power analysis-resistant cryptography?
eg flag

As part of mitigating side-channel attacks, which is the most efficient? Masked cryptography or differential power analysis-resistant cryptography? Or are they both similar?

Score: 1
user212942 avatar
Please review proxy re-signature on Elliptic Curve
tn flag

I want to implement proxy re-signature on elliptic curve.

I've been thinking about ideas like the one below, but are there any problems?

Key Generate:

  • $a = $ alice's secret key
  • $aG$ = alice's public key
  • $b = $ bob's secret key
  • $bG = $bob's secret key
  • $rk_{ab} = aP * b^{-1} = a/bG$

First Sign:

  • $Pm$ is hashed point
  • $k = $ random
  • $r = ka^{-1}$
  • $z = e(G, G)$
  • $s = z^kPm$

Resign:

  • $r' = rk_{ab} * r ...
Score: 2
Anna Johnston avatar
WRT Shor resistant crypto: which is more likely
cr flag

In NIST’s ‘competition’ to obtain new public key crypto which resists Shor’s algorithm (aka ‘post quantum cryptography’), two algorithms to make it into the third and fourth rounds have been catastrophically broken (Rainbow over a weekend on a laptop and SIDH/SIKE in an hour on a single core), while others have been shown to have less security than required by NIST (https://zenodo.org/record/ ...

Score: 2
Cisco Saeed avatar
Can one affine point on an elliptic curve have two Jacobians coordinates?
pl flag

I have theses output on curve for jacobian coordinates which I made doubling for (3,10,1) to get (17,21,20) then I made addition for all points to get this results:

     1     3    10     1
     2    17    21    20
     3    11    13     7
     4    20    21    14
     5     2     6     6
     6     9     1     8
     7    14    18     8
     8     6    13     2
     9     0    20    11
    10     3    ...
Score: 2
velis avatar
Does partial public key pre-sharing and partial public key exchange improve security vs one-sided public key sharing
km flag

I have a small ARM M0 SoC and a smartphone as actors. Encryption keys used are Elliptic curve.

My current security is implemented such that:

  1. the SoC has 128 bit hashes of phone public keys (vs 512 bit - due to storage space constraints)
  2. the phone has the SoC's public key
  3. the phone sends its own public key during negotiation
  4. step 3 establishes grounds for ECDH on both sides. From here encrypted co ...
Score: 1
NB_1907 avatar
Authenticated Encryption with Length Expansion for Storage Devices
us flag

Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general.

I know that AES-XTS is preferable from many aspects for disk encryption as long as authentication is not requested. You don't need to store additional data for an authentication tag or IV and it is more resistant ag ...

Score: 1
user997112 avatar
What is Inverse equivalent (decrypt) in the AES specification examples?
al flag

Referring to the AES specification:

https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.197.pdf

Printed pages 35-37...

The first detailed walkthrough is encryption, the second is decryption.... I don't understand what is the third, "equivalent inverse cipher (decrypt)"?

How can there be two decryption techniques?

Score: 2
Ss1996 avatar
AES key encryption on one time pad
ve flag

I need to use the following scenario: There are 2 keys: AES-key and OTP-key (one-time pad). I encrypt the AES-key (as if it were plaintext) with an OTP key. Then I send the encrypted AES-key to another person who has the same OTP-key on which the AES-key was encrypted. This person decrypts the AES-key. Is it safe for him to use this AES-key to encrypt plaintext on it in CBC mode? And the second question ...

Score: 1
Abol_Fa avatar
Can proofs be generated from Merkle Patricia Tries in the same way as merkle trees?
pe flag

I'm kind of confused about this, I have read that nodes in Merkle Patricia tries are key-value pairs, can someone provide a proof of membership for a data in a Merkle Patricia Trie just as he would with a Merkle tree? That is, providing hash of some nodes and allowing the other party to calculate the rest?

Score: 0
Cerina avatar
Does Index calculus work on secp256k1?
hr flag

Does Index calculus work on secp256k1?

I did a search but couldn't find answers, Can I use Index calculus to find private key of the elliptic curve secp256k1?

Score: 3
vinod avatar
The successive minima of a lattice
vu flag

I am new to lattice theory. I hope(will be grateful) that one could explain to me this claim 7 in REGEV course(this claim appears in this file page 6 : https://cims.nyu.edu/~regev/teaching/lattices_fall_2004/ln/introduction.pdf) which states that : The successive minima of a lattice are achieved i.e., for every 1 ≤ i ≤ n, there exists a vector vi ∈ Λ with ‖v_{i}‖ = λi(Λ).

Thank you,

 ...
Score: 3
Dontmilkme avatar
Arithmetic Circuit to Square Arithmetic Program (SAP)
tl flag

I'm trying to figure out how to convert a circuit into a Square Arithmetic Program (SAP). This is to eventually use it for zk-SNARKs such as Groth16. I do however understand how to convert arithmetic circuits into Quadratic Arithmetic Programs (QAP). As an example if we have the following circuit $c_1 \cdot c_2 = c_3$. Here we would define the following three polynomials: $L_1 = R_2 = O_3 = x$ (where  ...

Score: 2
user212942 avatar
Elliptic Curve digital signature algorithm without "hashing to point"?
tn flag

Through " Why do we need to convert hashes to points on an elliptic curve? ", I found out why Hashing to Point is necessary.

However, using the algorithm below can sign and verify without Hasing to Point?

  • $a$ is secret key
  • $H$ is scalar hash function

Sign:

  • $k = random (mod\ r)$
  • $r = kG_2$
  • $s = a (H(m||r) + k)$ : If don't know k, won't know a. Also hashing both m and r to prevent tamper.

Verify:

Score: 6
Mathijs avatar
How can 4 users generate a provable fair random number?
mo flag

The past few weeks I have been trying to solve a difficult problem. I have asked some cryptography experts but unfortunately they had no clue on how to solve the problem.

The situation is as follows, an online casino wants to host an online bet, each bet can have a variable amount of players. For this example we will use four players. Each player wants to be sure that the outcome of the bet is ra ...

The Stunning Power of Questions

Much of an executive’s workday is spent asking others for information—requesting status updates from a team leader, for example, or questioning a counterpart in a tense negotiation. Yet unlike professionals such as litigators, journalists, and doctors, who are taught how to ask questions as an essential part of their training, few executives think of questioning as a skill that can be honed—or consider how their own answers to questions could make conversations more productive.

That’s a missed opportunity. Questioning is a uniquely powerful tool for unlocking value in organizations: It spurs learning and the exchange of ideas, it fuels innovation and performance improvement, it builds rapport and trust among team members. And it can mitigate business risk by uncovering unforeseen pitfalls and hazards.

For some people, questioning comes easily. Their natural inquisitiveness, emotional intelligence, and ability to read people put the ideal question on the tip of their tongue. But most of us don’t ask enough questions, nor do we pose our inquiries in an optimal way.

The good news is that by asking questions, we naturally improve our emotional intelligence, which in turn makes us better questioners—a virtuous cycle. In this article, we draw on insights from behavioral science research to explore how the way we frame questions and choose to answer our counterparts can influence the outcome of conversations. We offer guidance for choosing the best type, tone, sequence, and framing of questions and for deciding what and how much information to share to reap the most benefit from our interactions, not just for ourselves but for our organizations.