No, but Curve25519 was chosen so that even if an adversary supplies the x coordinate of a point P on the twist (i.e., a point not generated by the standard base point), and you reveal the Diffie–Hellman secret H(x([n]P)) where n is your secret scalar, it won't help them to find n.
I am looking for a cryptographic hash function optimized for speed on short inputs, in order to implement a pseudorandom generator with expansion factor 2 (e.g. takes 16 bytes of input and outputs 32 pseudorandom bytes).
Here are some natural candidates I tried:
SHA256: good baseline
Blake2: des...
@kelalaka I would really discourage you from making confusing claims like ‘128-bit tag size give 64-bit security with %50 by the birthday attack’ about AES-GCM. Birthday attacks are simply not relevant to the tag size. The birthday attack applies to using AES, or any random permutation rather than random function, to encrypt many blocks—and it's the same for AES-CBC, AES-CTR, AES-OCB, etc.
In a cryptographic application, two types of (pseudo)random bit streams are needed:
a stream $A= a_{1}a_{2}a_{3}\ldots$ in which $\Pr[a_{i}=0]=\Pr[a_{i}=1]= 1/2\ \forall i$ and
a stream $B= b_{1}b_{2}b_{3}\ldots$ in which $\Pr[b_{i}=0]=2/3; \Pr[b_{i}=1]=1/3\ \forall i$.
Propose the following co...
I like crypto, but I'm a bioanalytical chemistry person by trade. I like this algorithm and was wondering if I could use it to encrypt partitions like a MBR that prompts a passphrase, like BitLocker.
@SqueamishOssifrage I'm not discouraged as long as I learn something at the end. he danger of truncating tags because of the O(ℓ/2n) term in the forgery probability instead of O(1/2n) for n-bit tags on messages of length up to ℓ Like this one?
Saarinen in his work GCM, GHASH and Weak Keys says that;
This paper is not very clear and has led many people into regrettable confusion about universal hashing authenticators.
The paper—both the manuscript you cited and the conference paper at FSE 2012—contains misleading claims and misatt...
Oh, I see, you're just viewing Ed448-Goldilocks as the curve, which I guess was the nomenclature several years ago before everyone settled on edwards448 as the curve and Ed448 as the signature scheme.
@kelalaka Neither O(L/2^n) nor O(1/2^n) have anything to do with the birthday attacks. Birthday attacks essentially always involve a quadratic term like n^2 or q^2 in the number of messages or blocks. AES-GCM does have quadratic terms related to the block size because of birthday attacks on the underlying AES-CTR, but they have essentially no relation to the tag size.
The general limits from the NIST recommendation are as follows:
Maximum Encrypted Plaintext Size ≤ 239 - 256 bits;
Maximum Processed Additional Authenticated Data ≤ 264 - 1 bits;
This stack overflow answer (https://crypto.stackexchange.com/a/20340/44337) hints that the maximum invocati...
@fgrieu Deadline finished. I hope you will find another good one for you.
@fgrieu I think I'm missing the real 2^b−2 point if the block cipher is even. There are n!/2 even permutations, so how does that help to determine the last two?
@kelalaka simple example, for b=3. You found these 6 plaintext/ciphertext pairs: 0/1, 1/6, 2/5, 3/0, 4/2, 5/7. If the permutation is even, then that's enough to determine the last two pairs. For this, start from 01234567, and make an even number of permutations to get to 165027xy, and the desired plaintext/ciphertet pairs are 6/x and 7/y.
I do 01234567->10234567->16234507
then 16234507->16534207->16504237
then 16504237->16502437->16502734
thus if I did not goof, the missing plaintext/ciphertext pairs are 6/3 and 7/4
In a cryptographic application, two types of (pseudo)random bit streams are needed:
a stream $A= a_{1}a_{2}a_{3}\ldots$ in which $\Pr[a_{i}=0]=\Pr[a_{i}=1]= 1/2\ \forall i$ and
a stream $B= b_{1}b_{2}b_{3}\ldots$ in which $\Pr[b_{i}=0]=2/3; \Pr[b_{i}=1]=1/3\ \forall i$.
Propose the following co...
I like crypto, but I'm a bioanalytical chemistry person by trade. I like this algorithm and was wondering if I could use it to encrypt partitions like a MBR that prompts a passphrase, like BitLocker.
Saarinen in his work GCM, GHASH and Weak Keys says that;
This paper is not very clear and has led many people into regrettable confusion about universal hashing authenticators.
The paper—both the manuscript you cited and the conference paper at FSE 2012—contains misleading claims and misatt...
The general limits from the NIST recommendation are as follows:
Maximum Encrypted Plaintext Size ≤ 239 - 256 bits;
Maximum Processed Additional Authenticated Data ≤ 264 - 1 bits;
This stack overflow answer (https://crypto.stackexchange.com/a/20340/44337) hints that the maximum invocati...
