Latest Crypto related questions

Two lattices are defined as following: \begin{align} \Lambda_q^{\bot}{(A)} & = \{\mathbf{x} \in \mathbb{Z}^m: A\mathbf{x} = \mathbf{0}\text{ mod }q\} \\ \Lambda_q{(A)} & = \{\mathbf{x} \in \mathbb{Z}^m: \mathbf{x} = A^T\mathbf{s} \text{ mod }q \text{ for some } \mathbf{s} \in \mathbb{Z}^n_q\}. \end{align} T.S.T.

1. $\Lambda_q{(A)} = q \cdot \Lambda_q^{\bot}{(A)}^*$, where $\Lambda_q^{\bot}{(A ...

In Dual Watermarking in Tele-radiology using DWT for Data Authentication and Security, the authors wrote:

The encryption process uses the Feistel structure consisting multiple rounds for processing the plaintext to obtain the cipher text and each round consisting of a “substitution” followed by a permutation step. In this paper dual watermarking algorithm for patient detail encryption is use ...

This may not be a good question, but I am just start to learn cryptography. I would like to ask why a fix permutation is not one way.

An adversary is given y=f(x) and try to invert y, x and y are n bits

In my opinion, an efficient adversary could only make polynomials query to the permutation. And it could only succeed if it made a query of x to f().

So the probability of the adversary to success is on ...

Can someone help tell how to generate a 3-CNF verifier for SHA-256 that:

1. outputs 1 if message/input's calculated SHA-256 value matches the pre-provided hash
2. Otherwise outputs 0.

Given that the message can be arbitrarily long we can assume it to have a finite length (say 2 MB) to make our task simpler.

I'm working on a anonymization project and I got interested in linking attacks. For simplicity I only look at data in table format, such as xlxx or csv data. To anonymise such data the most common technique is generalization. There are others like synthetic data, changing data, deleting data, etc.. To evaluate the results one can use definitions like k-anonymity, l-diversity or t-closeness.

So fa ...

How can we determine if a private key associated with a point, on an EC, is less than or greater than 1/2 $n$, where $n$ is the order?

In ECC, specifically over finite fields, in my mind there must be other points that exist that still yield $y^2 \bmod p=x^3 + ax + b \bmod p$ to be true but are never used because the Generator Point (or base point) never "lands" on that point before reaching the order and effectively starting over. How can we calculate if a point is actually part of the order (not sure if thats the correct term)  ...

I want to ask if there is any way to store a Schnorr signature key in PEM format, or any other standardized format.

And, if possible, I would like to know if that's possible to be done in C language; here's my code so far:

EC_KEY *key = EC_KEY_new();
EC_KEY_set_group(*key, group);
EC_KEY_set_private_key(*key, *a);
EC_KEY_set_public_key(*key, *Q);
...
FILE* fout2 = fopen("pub.key", "wb");
PEM_write_EC_ ...

Given a 2048-bit RSA public key physically burned into hardware, is it feasible to find a keypair where the public key could be "overlaid"? To detail, each bit in the hardware key is write-once; zeroes can be set to ones, but the write is permanent. The existing RSA public key is 2048-bit and its corresponding private key is unknown; my hunch is that this would take around 2¹⁰²⁴ guesses since on averag ...

I have been reading about chaos-based cryptosystems. Every designer claims that his design is a secure system without much cryptographic analysis; however, it turns out that this is a false claim in many cases. I do not know if all these systems are weak or inefficient. I do not have the time to perform cryptanalysis on them all.

For the examples of the chaos-based cipher, almost every designer h ...

I tried to learn the algorithmic process behind ECDSA and it's pretty challenging. I'm wondering what motivation or thought process might have led to the discovery in the first place. What properties do elliptic curves possess that make them resilient to attack?

Predecessor RSA seems somewhat more intuitive and reasonable to discover.

In the sense of security level (as defined, for example, by Ferguson and Schneier in the book Practical Cryptography), does it make sense to use SHA384 with HMAC-SHA256 in the general settings. By birthday paradox, HMAC-SHA256 will give a security level of 128 bits, and SHA384 will give 192 bits. To my understanding, the overall security level will be limited to 128 bits and SHA384 is just faking around ...

Is chaos-based encryption a rigorous discipline? And why there are objections to it within the cryptography community? And why are many of its cryptosystems weak? And does it has a promising future? And is there any example of secure cryptographic systems based on chaos?

Also, some people differentiate between the legitimacy of analog vs digital chaos-based cryptography, is this right?

The most impo ...

I think I have successfully reverse engineered a Samsung RSA public key here. However, the public key mainly seems to consist of the modulus, but it also contains a 32 bit integer -1 / n[0] mod 2^32, i.e. the inverse of the first 32-bit word of the modulus as well as R^2 (possibly mod n?).

Can anybody explain why these values are included with the RSA public key? What could these values do? I first thoug ...

I am trying to understand Bulletproofs and it uses the following assumption (Section 2.1): Note: $\mathbb{G}$ is of prime order $p$.

My question is about the last sentence in the image -- I cannot prove it. Specifically, I want to prove that $(*)$ if Discrete Log Relation is "broken", then the "plain" Discrete Log is also broken. Intuitively this makes sense, but I must be careful since I am just beg ...