Latest Crypto related questions

Are there any methods to prevent version rollback attack while using TLS 1.2 (apart from disabling lower versions)? I've read about how TLS 1.3 provides a downgrade protection mechanism which is embedded in the server’s random nonce. Is there any such mechanism in TLS 1.2?

I'm currently trying to get an overview of post-quantum cryptography. Now I'm struggling with correlations and adjustments of the PQ-world and the Modern-world of cryptography.

My Questions:

1. Can you give me a brief overview of new important assumptions in the PQ-world (e.g. something similar to the factorization or discrete logarithm assumption)?

2. Can you give me an overview about new models / adj ...

My understanding of digital signatures is as follows: Alice hashes a message with a one-way cryptographic hash function, the output of which is called the message digest. She then encrypts the digest with her private key and then sends both the original unhashed/unencrypted message along with the encrypted hashed version (i.e. the digital signature) to Bob. Bob uses the same hash function on the message ...

I read through related questions on this SE, but I still do not understand why we can use the rewinding argument. Specifically, rewinding seems like a really strong superpower to me, and I don't understand why such strong assumption does not undermine the strength of the conclusion. Sure, the adversarial verifier learns nothing from a simulator that can manipulate time, but if some entity is so strong t ...

Since it is preferred to sign-then-encrypt I was wondering how can another party validate that the message is valid?

The use case I had was the following...

1. Client authenticates and gets the access token, the access token is a signed JWT from authorization server
2. Client verifies that the JWT is signed by a key that the client recognizes
3. Client sends requests with the JWT passed on the header as Bear ...

Tor vanilla bridges look like this:

Bridge x.x.x.x:1234 9DD03662B50FEDBF6F8D5630CB86D7E8CE4F4432

It's only the IP/Port and a hash of the key.

Can Bob and Alice do an authenticated Diffie–Hellman key exchange if Bob just knows the hashsum of Alice's key?

Thinking by myself is possible, Bob receives Alice's key and verify the integrity, if a there is a different hash of the key, Bob end the connect ...

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022?

In our threat model, if we ignore the risks linked to quantum computing, is this secure?

Here is an example working Python implementation:

import Crypto.Random, Crypto.Protocol.KDF, Crypto.Cipher.AES
plaintext = b"hello world hello world hello world hello world hello world"
password = b"correct horse battery st ...

What is meant by meta reduction? What does it achieve and how is it different from the normal reduction technique?

How does oblivious commitment remove the active security? How is it useful over a normal commitment scheme.

I am going through the Lamport Diffie One-time signature. I am having a hard time understanding

1. How can long messages (greater than 100 bits) can be mapped into short messages (100 bits) by a one way function and only the short message signed? Can someone explain this with an example?(Refer page no.13 in attached document.)

2. "the message can be encrypted with a newly generated random key by the sig ...

Consider the Ring-SIS problem for $R_q=\mathbb{Z}_q[x]/(x^n+1)$ when $n$ is power of $2$ and $q=1 \mod 2n$. Does the modulus $q$ need to be prime? if yes, it seems that it is mainly because of the way that we prove the hardness of Ring-SIS by reducing it to a lattice-problem. This means that it might be possible to choose $q$ non-prime, is there any attack to the case that $q$ is not prime.?

Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(\mathbb{F}_{\!q})$ be prime and hence the group is generated by $P$. For the sake of security, in numerous protocols of elliptic cryptography (e.g., in a safe version of Dual_EC_DRBG) we need to generate  ...

Let's suppose that Bob has only Alice's IP and no more information about Alice's key, nor the digest of Alice's key.

They exchange keys and need proof that the received keys are the same keys that were sent.

How Bob and Alice can know that the key received is the right key?

Also, I read about Sigma protocol:

The general idea is that Alice and Bob do an unauthenticated Diffie-Hellman (D-H) key exc ...