Latest Crypto related questions

As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10):

In Phase 1, they create a (commitment, decommitment) pair using a commitment scheme. Earlier in the paper, they mention that “in practice one can use any secure hash function H and define the commitment to x ...

I want to find an encryption algorithm which provides the functionality described below.

Given a key (a vector Vkey) and a data (an image), use this key to encrypt the image; the encrypted image can not be identified afer encryption.

When decrypt, if:

1. use a key = Vkey to decrypt, the decoded image is the same as original one without error.
2. use a key = Vkey_1, and diff(Vkey, Vkey_1) < threshold, ...

Lets say Alice has a list of values, and Bob sends Alice a Merkle root that he claims is for this list of values. The Merkle tree construction algorithm is mutually known of course.

Alice can then pick arbitrary values from the list and ask Bob for their Merkle proof.

Lets say Alice wants to avoid constructing the whole tree to verify Bob's Merkle root. How sure can she be that Bob's Merkle root is  ...

I am currently implementing some QKD protocols using Qiskit and I came up with the following question: After the protocol is finished, a true random password is generated using 0s and 1s, however, and here my question, do these passwords need to be converted to another base? Maybe hexadecimal? Or are they used as they are?

When I mean by used is to using them, for instance, as a key for the one t ...

I have been reading some papers to find a 'faster' way to compare two integers without revealing their real values. But I think I'm a bit lost in those papers due to my limited knowledge in cryptography. There are some papers comparing the efficiency of HE based/ GC based/ OT based protocols, for example https://eprint.iacr.org/2016/544.pdf by Geoffroy Couteau(still a bit hard for me to understand th ...

Assume there is an RSA public key $(e,n)$ such that factarization of $n$ is unknown to both prover and verifier parties. We also have a prime order group $G$ and a generator $g$ for the group. For $m\in QR_n$, is there a zero-knowledge proof protocol to prove that $C_1=m^e$ and $C_2=g^m$, for public values $(C_1, C_2, e, n, g)$?

In practical applications, elliptic curves over $F_p$ seem to be more popular than those over $F_{2^n}$. Is it because operations over prime fields are faster than those over $F_{2^n}$ for the same security level?

Maybe it is my imagination. I just see many more open projects using elliptic curves over $F_p$ but not as many over $F_{2^n}$.

While reading the paper

• 2020 - Non-Malleable Codes for Bounded Polynomial Depth Tampering by Dana Dachman-Soled and Ilan Komargodski and Rafael Pass

I stumbled upon the case in which it was necessary to state whether the authors were assuming uniform or non-uniform attackers. For what I know, non uniform PPT are basically a sequence of PPTs, so $\mathcal{A}=\{\mathcal{A}_1,\mathcal{A}_2,\dots,\math ...

Question

I seek a quantitatively better proof of theorem 13.11 in Katz and Lindell's Introduction to Modern Cryptography (3^rd edition) (or nearly equivalently, theorem 19.1 in Dan Boneh and Victor Shoup's freely available A Graduate Course in Applied Cryptography). The proof is about the Schnorr identification scheme for a generic group $\mathcal G$ of prime order $q=\lvert\mathcal G\rvert$ and genera ...

While reading about mining in crypto currency, I found that it requires some leading bits of a hash function output to be 0. This boils down to preimage resistance of the hash function, hence done with exhaustive search.

My question, say I have an ideal hash function that gives 128 bit output and I want leading 4 bits be 0. What is the expected number of time I have to run it (with randomly chose ...

Let $n, q, \sigma$ be the polynomial degree($x^n+1$), coefficient modulo, and the standard derivation, respectively. I often see some parameters such as

For RLWE, we can use the CRT to decompose the $\text{RLWE}_{q}$ to some $\text{RLWE}_{q_i}$ for $1\leq i\leq l$, where $q = q_1 q_2\cdots q_l$, then when we consider the security of RLWE, we should take $\log q$ or $\log q_i$ to be considered?

I am attempting to manually encrypt a plaintext message (message = MI) using RSA.

I receive an answer of: 33,264 and 21,164.

When I enter the same plaintext into CrypTool to confirm that my calculations were correct, I receive a different answer:

What am I doing incorrect? How can I obtain the same result as CrypTool?

I am trying to figure out how to complete RSA manually. I am trying to encode a simple block message (Mi). I used CrypTool to determine the encryption. When I "manually" computed the plaintext, I obtained a different number than what CrypTool provided. Can someone guide me? Am I doing the manual encryption for RSA correct?

I am creating a simple Sign up and Sign in form using PHP. At the sign up, I create hash using password_hash() function and then store it in the DB. At the time of Sign in, initially what I did was created a new hash using password_hash() function again and then compared it with the stored Password hash.

This failed all the time because as I understand now, a new salt is used every time you creat ...