Latest Crypto related questions

Score: 1
haoyu avatar
How "unorthogonal" can a LLL-reduced basis be?
va flag

I have been recently studying LLL-reduction. I get from the size condition and Lovasz condition that the basis are guaranteed to be somewhat orthogonal. But I couldn't figure out how orthogonal the LLL-reduced basis has to be in the geometric or intuitionistic sense. For example,

  1. How small can an angle be between two LLL-reduced basis?
  2. How long can the "diagonal" of the fundamental parallelepiped of t ...
Score: 1
librehash avatar
Discrepancy in secp256k1 signature generation
us flag

I'll get straight to the point here.

There are two different programs I'm looking at. They both use secp256k1 to deterministically sign data (RFC6979) & provide the results online in-browser. However, both programs produce different DER-encoded signatures and I'm honestly baffled at this point as to why.

Program #1: https://paulmillr.com/noble/

Program #2: https://asecuritysite.com/encryption/sigs2 ...

Score: 0
NB_1907 avatar
Disk encryption and advanced format
us flag

As far as I understand, the biggest problem of requesting authentication in disk encryption is that the plaintext and ciphertext are not having the same size -because of tag-. The XTS mode is already designed with this issue in mind (length preserved). However, as far as I know, it is not possible to preserve the size with authentication. Is it possible to solve this problem with disk type? Advan ...

Score: 1
nitchan avatar
What is the most secure hybrid cipher suite(Library) possible today?
gr flag

What combination of public key cryptography (DH) and symmetric key cryptography is currently available that is (subjectively) as secure as possible over other ciphers (AES,curve448) when security is prioritized over efficiency?

translator user

Score: 1
Ironic avatar
ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses
bq flag

Edited: changing the notation according request by fgrieu.

I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.

properties of secp256k1:

p = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141   # order of curve

It is according to: ecdsa-revealing-the-private-key-from-four-signed-message-two-keys-and-shared-nonces- link here: https://billatnapier.medium.com/ecdsa ...

Score: 2
Maarten Bodewes avatar
Iteration count for (enhanced) Miller-Rabin
in flag

In FIPS 186-5 (Digital Signature Standard or DSS) there is a Table B.1 which specifies the minimum number of rounds of Miller-Rabin testing for 1024, 1536 and 2048 bit keys, used for digital signatures. That's already an update to FIPS 186-4 which specified these numbers up to 1536 bits. However there doesn't seem to be a table for any other values over 2048 bit keys.

Table B.1. Minimum number of rounds ...

Score: 1
objecttothis avatar
How do I properly generate pkcs#12 keystore?
tc flag

I have an application that needs to communicate with the bank for online transactions. I am using OpenSSL 3.0.8.7 in Windows 11. I generated a private key using:

openssl genrsa -out rsa_key.pem 2048

Then a Certifate Signing Request using:

openssl req -new -key rsa_key.pem -out csr.pem -subj "[REDACTED]"

I sent the CSR to the bank and received back a signed certificate (signed_cert.pem) and the bank  ...

Score: 2
Carlos avatar
ECDSA-SHA256 HTTP Signature String Construction
zw flag

I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing

This is their x509 PKIX encoded signing key's public key: MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEflgGqpIAC9k65JicOPBgXZUExen4rWLq05KwYmZHphTU/fmi3Oe/ckyxo2w3Ayo/SCO/rU2NB90jtCJfz9i1ow==

I am following this specification to construct the signing string: https: ...

Score: 1
Proliferate309 avatar
Real-world instantiation of NIZK protocol from Fiat-Shamir
vi flag

So I understand how one can use Fiat-Shamir to turn a HVZK sigma protocol into a non-interactive zk protocol in the random oracle model. My problem though is I don't understand why is this useful.

If I wanted to use a NIZK in something and I choose a protocol based on Fiat-Shamir, this would mean I have to choose a hash function which surely invalidates the zk proof in the ROM. So do I know anyth ...

Score: 7
crypt avatar
How to generate random numbers within a range (0,n) from random bits?
cn flag

What is a good method to generate random numbers between 0 and n from random bits?

For example, I have a one million random bits generated according to NIST SP 800 90 publications. Now I need to generate random numbers between 0 and 100 (inclusive) using these random bits. Few possible methods i could think of are

Read 7 bits, convert these to a number (0 to 127), store the number if its <= 100,  ...

Score: 28
n-l-i avatar
Is there a hash function that's more expensive for an attacker than for the server?
cx flag

Say a server wants to hash a password $p$. It would use a secure hash function $H$ and a unique salt $s$ to hash the password as $H(p,s)$. If one has access to the salt, each password candidate requires one run of the hash function to be ruled out; the same amount of time it would take for the server to verify a password candidate.

If, on the other hand, the password was hashed as $H'(p,s+r)$, wh ...

Score: 2
Conceal time-based GUIDs with an affine-cipher?
in flag

I'd like to create a custom type of sortable GUID by concatenating an 8-byte nanosecond timestamp, 6 random bytes, a 1-byte node number, and a 1-byte counter. But, such a precise timestamp can be used to enact very effective side-channel attacks if it can be related to the execution time of other cryptographic operations being done on the same system. It'd be ideal to conceal them in some invertible way ...

Score: 3
Ember avatar
How to calculate probability of cracking a password from entropy?
pr flag

I am working on a project for my maths assessment where I research the effect of complexity and length on a given password. Currently, I am working on calculating the probability of guessing a password on the first try. I assumed that I had to start from entropy and go from there but I am kind of stuck on which formula to use in order to find the probability.

I considered 1 / (2^entropy) but I am not su ...

Score: 0
user997112 avatar
Implementing AES GCM but not getting correct output from cipher block
al flag

I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect).

When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the output of the cipher block (before we XOR).

https://csrc.nist.rip/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf

Inputs:

K       00000000000000000000000000000000
P       000000000000 ...
Score: 1
Carlos avatar
Verifying ECDSA-SHA256 HTTP Signature
zw flag

With PHP, I'm trying to setup a HTTP signature verification for webhook requests coming from BlockCypher: https://www.blockcypher.com/dev/bitcoin/?php#webhook-signing

This is their public key: MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEflgGqpIAC9k65JicOPBgXZUExen4rWLq05KwYmZHphTU/fmi3Oe/ckyxo2w3Ayo/SCO/rU2NB90jtCJfz9i1ow==

This is an HTTP request that I've collected using RequestCatcher:

POST / HTTP/1.1
Host: 2 ...
Score: 1
baro77 avatar
About SNARKs general recipes (regarding required assumptions)
gd flag

I'm following ZK MOOC: https://zk-learning.org/

After some previous readings about these topics, I was believing to have understood that, stated that non-interactivity isn't attainable in standard/plain model, there were to alternatives B-plans:

  • Fiat-Shamir heuristic for public coin IPs requiring the acceptance of ROM (Random Oracle Model)
  • or CRS (Common Reference/Random String) assuming a trusted setup ...
Score: 2
Mango avatar
Vulnerability due to same IV, same key, same plaintext at same position in OFB
ve flag

I am currently studying OFB mode, and one of the vulnerability mentioned for it is that if two different messages have a block at the same position in the ciphertext, and have same plaintext, the attacker can figure out the encryption function output for that particular block. This was brought up to highlight the danger of reusing IV, so this is assuming that same IV and key are used.

I understan ...

Score: 0
user997112 avatar
AES GCM Difference between the IV and the Secret Key?
al flag

Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.

The GCM specification examples state both an IV and a Secret Key as two inputs.

Can someone please explain where both are used?

Is the 96 bit IV expanded to 128 bits, incremented (most-significant byte?) and used to create the AES Key Expansion?

And the Secret Key is passed (with the Key Expansion) to E_k for encry ...

Score: 0
xin yao avatar
finding the Key if hmac output, and input are known
mk flag

Assume we have message M, key K, and MAC = hmac-256SHA(M, K).

I wonder if an attacker can figure out the Key K if the attacker knows the Message M and MAC

Score: 3
fgrieu avatar
Bilinear pairing for compact BLS signature
ng flag

What family of bilinear pairing is recommendable for BLS signature when the overriding criteria is compactness of the signature, as desirable for something to be keyed-in from printout, or embedded in a small QR-code?

Is there something giving signature size lower than ≈384 bit for 128-bit conjectured security, as in this draft RFC, which is no more compact than a more conservative and faster s ...

Score: 2
empty_stack avatar
Importance of non-degeneracy property of bilinear map for cryptography
sk flag

I'm currently looking into pairing-based cryptography and I stumbled upon the definition of the properties bilinearity, computability and non-degeneracy.

Now I have a problem with understanding the non-degeneracy and how it is important to the security of elliptic curve cryptography. I have not found a paper that goes into detail about it, only from a mathematical standpoint which is a little to  ...

Score: 1
Anlo avatar
Remembering user credentials by double-hashing
tt flag

I'm developing a desktop application where the users will login with username and password, which is then verified against a database. After the initial login, the current user should be automatically logged in each time the application is started (until the user logs out or 1 month has passed).

I could encrypt and store the last successful username and password on the computer, but the decryptio ...

Score: 0
trieulieuf9 avatar
How can I decode the salt of this argon2i passwordhash?
mm flag

I have this password hash: $argon2i$v=19$m=128,t=2411,p=2$hmJvvpH3BZlvb2V1vLm/yf3zANU4qNpKuw5TBnGzo2I$<censored>.

I know the password, and I want to verify if this password will produce the same hash the the above. Using an online argon2 hashing site: https://antelle.net/argon2-browser/

My problem is I don't know how to convert the salt into the right format for hashing.

Score: 0
Nathan Aw avatar
Mitigating side-channel attacks: which is better? Masked cryptography or differential power analysis-resistant cryptography?
eg flag

As part of mitigating side-channel attacks, which is the most efficient? Masked cryptography or differential power analysis-resistant cryptography? Or are they both similar?

Score: 1
user212942 avatar
Please review proxy re-signature on Elliptic Curve
tn flag

I want to implement proxy re-signature on elliptic curve.

I've been thinking about ideas like the one below, but are there any problems?

Key Generate:

  • $a = $ alice's secret key
  • $aG$ = alice's public key
  • $b = $ bob's secret key
  • $bG = $bob's secret key
  • $rk_{ab} = aP * b^{-1} = a/bG$

First Sign:

  • $Pm$ is hashed point
  • $k = $ random
  • $r = ka^{-1}$
  • $z = e(G, G)$
  • $s = z^kPm$

Resign:

  • $r' = rk_{ab} * r ...
Score: 2
Anna Johnston avatar
WRT Shor resistant crypto: which is more likely
cr flag

In NIST’s ‘competition’ to obtain new public key crypto which resists Shor’s algorithm (aka ‘post quantum cryptography’), two algorithms to make it into the third and fourth rounds have been catastrophically broken (Rainbow over a weekend on a laptop and SIDH/SIKE in an hour on a single core), while others have been shown to have less security than required by NIST (https://zenodo.org/record/ ...

Score: 2
Cisco Saeed avatar
Can one affine point on an elliptic curve have two Jacobians coordinates?
pl flag

I have theses output on curve for jacobian coordinates which I made doubling for (3,10,1) to get (17,21,20) then I made addition for all points to get this results:

     1     3    10     1
     2    17    21    20
     3    11    13     7
     4    20    21    14
     5     2     6     6
     6     9     1     8
     7    14    18     8
     8     6    13     2
     9     0    20    11
    10     3    ...
Score: 2
velis avatar
Does partial public key pre-sharing and partial public key exchange improve security vs one-sided public key sharing
km flag

I have a small ARM M0 SoC and a smartphone as actors. Encryption keys used are Elliptic curve.

My current security is implemented such that:

  1. the SoC has 128 bit hashes of phone public keys (vs 512 bit - due to storage space constraints)
  2. the phone has the SoC's public key
  3. the phone sends its own public key during negotiation
  4. step 3 establishes grounds for ECDH on both sides. From here encrypted co ...
Score: 1
NB_1907 avatar
Authenticated Encryption with Length Expansion for Storage Devices
us flag

Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general.

I know that AES-XTS is preferable from many aspects for disk encryption as long as authentication is not requested. You don't need to store additional data for an authentication tag or IV and it is more resistant ag ...

Score: 1
user997112 avatar
What is Inverse equivalent (decrypt) in the AES specification examples?
al flag

Referring to the AES specification:

https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.197.pdf

Printed pages 35-37...

The first detailed walkthrough is encryption, the second is decryption.... I don't understand what is the third, "equivalent inverse cipher (decrypt)"?

How can there be two decryption techniques?

The Stunning Power of Questions

Much of an executive’s workday is spent asking others for information—requesting status updates from a team leader, for example, or questioning a counterpart in a tense negotiation. Yet unlike professionals such as litigators, journalists, and doctors, who are taught how to ask questions as an essential part of their training, few executives think of questioning as a skill that can be honed—or consider how their own answers to questions could make conversations more productive.

That’s a missed opportunity. Questioning is a uniquely powerful tool for unlocking value in organizations: It spurs learning and the exchange of ideas, it fuels innovation and performance improvement, it builds rapport and trust among team members. And it can mitigate business risk by uncovering unforeseen pitfalls and hazards.

For some people, questioning comes easily. Their natural inquisitiveness, emotional intelligence, and ability to read people put the ideal question on the tip of their tongue. But most of us don’t ask enough questions, nor do we pose our inquiries in an optimal way.

The good news is that by asking questions, we naturally improve our emotional intelligence, which in turn makes us better questioners—a virtuous cycle. In this article, we draw on insights from behavioral science research to explore how the way we frame questions and choose to answer our counterparts can influence the outcome of conversations. We offer guidance for choosing the best type, tone, sequence, and framing of questions and for deciding what and how much information to share to reap the most benefit from our interactions, not just for ourselves but for our organizations.