Questions tagged [cr.crypto-security]
Theoretical aspects of cryptography and information security.
248
questions
4
votes
2answers
161 views
If I know pretty well '(a,b)', I know pretty well 'a', or 'b', or 'a xor b'
I've a quite simple problem: let's imagine I have a couple of bits $(a,b) \in \{0,1\}^2$ sampled uniformly at random. Then, I give a function of these bits $f(a,b)$ (it can be any function, including ...
2
votes
1answer
129 views
Would an NP-complete public key cryptosystem imply NP=co-NP?
Would the existence of an NP-complete (or co-NP-complete) public key signature cryptosystem imply that NP = co-NP? My specialty is definitely not theoretical computer science, so this is somewhat of ...
1
vote
1answer
81 views
Cryptography protocols using graph problem instances
I personally am only aware of basic examples of public key cryptography and I haven't studied cryptography yet. I'm curious if there are circumstances in cryptography where using problem instances ...
8
votes
2answers
146 views
What is the state of the art in online voting?
Is there a cryptographic protocol which, at least in theory (and under standard cryptographic assumptions) enables people to securely vote from their homes? I could see how the various problems might ...
0
votes
0answers
28 views
GCM mode of operation with long-term keys
Cross post: https://crypto.stackexchange.com/q/61630/77
Regarding GCM, NIST specifies the following:
The total number of invocations of the authenticated encryption function shall not exceed $2^{...
16
votes
1answer
1k views
Password hashing using NP complete problems
Commonly used password hashing algorithms work like this today: Salt the password and feed it into a KDF. For example, using PBKDF2-HMAC-SHA1, the password hashing process is ...
1
vote
2answers
204 views
Which cryptographic protocols are secure against quantum computer attacks?
Are there any cryptosystems that we know that would be secure against an attack by a quantum computer?
Are there problems which are known or suspected to be hard for quantum computers, and can these ...
5
votes
0answers
138 views
How hard is it to generate a set of relatively prime numbers between two given bounds?
Informal Question
How hard is it to generate a set of relatively prime numbers between two given bounds?
Decision Problem
Given $a$, $b$, and $k \in \mathbb{N}$. Does there exist a set $S \...
17
votes
2answers
480 views
Is it possible to encrypt a CNF?
Is it possible to convert a CNF $\mathcal C$ into another CNF $\Psi(\mathcal C)$ such that
The function $\Psi$ can be computed in polynomial time from some secret random parameter $r$.
$\Psi(\mathcal ...
20
votes
2answers
1k views
Can any computational challenge be transformed to proof-of-work?
The seemingly pointlessness of cryptocurrency mining raised the question of useful alternatives, see these questions on Bitcoin, CST, MO.
I wonder whether there exists an algorithm that can convert ...
4
votes
1answer
71 views
Can entropicly secure encryption algorithms be used on low-entropy messages by adding noise
There exist information-theoretic notions of security like Shannon's "perfect security" that one-time pads exhibit. All methods which achieve perfect security will require long keys, however. If we ...
2
votes
1answer
156 views
Is there a fast algorithm to quickly evaluate $a^{b^c}$ mod $n$?
I need to quickly evaluate $a^{b^c} \mod n$ where $c$ is pretty big. Using the usual repeated squaring trick, this can be performed in $O(\log(b^c)) = O(c)$ time. In my problem, $c$ is huge, (say, $&...
6
votes
1answer
250 views
Why is the security of lattice cryptosystems not provable from $P \neq NP$?
My understanding is that the Shortest Vector Problem ($\text{SVP}$) is $\text{NP}$-hard. Therefore, $\text{LWE}$ is also $\text{NP}$-hard. But $\text{LWE}$ is hard on average if it is hard in the ...
0
votes
1answer
80 views
Problems equivalent to the existence of secure cryptosystems? [closed]
What are some necessary and sufficient conditions for the existence of following?
Symmetric encryption (defined here as satisfying $\text{IND-CPA}$ and $\text{INT_CTXT}$)
Asymmetric encryption
...
2
votes
1answer
78 views
“Security Against Covert Adversaries” question
I was reading the paper Security Against Covert Adversaries: Efficient Protocols for Realistic Adversaries by Aumann and Lindell, and had some questions with the protocol for covert OT given errorless ...
5
votes
0answers
74 views
Is [2-party d3-rolling with maximum probability 1/2] known to imply one-way functions?
Most things in complexity-based cryptography (for examples, see page 4) are known to imply
the existence of one-way functions, especially after this paper proved that implication for weak coin-...
-3
votes
1answer
178 views
The factoring problem reduces to order finding or is it the other way around? [closed]
initially i was not at all equipped in theoretical computer science and knew only basics of number of theory.
I started working from scratch on the age old problem of primality testing which led me to ...
3
votes
4answers
224 views
Is a theoretically secure key exchange possible?
During a discussion I was wondering if it would be possible to design a theoretically secure key exchange.
In other words: If it is possible to design a key exchange (like Diffie–Hellman) where the ...
9
votes
1answer
254 views
Can a random oracle change which TFNP problems are strongly hard-on-average?
I've been thinking about the following question at
various times
since I saw this question on Cryptography.
Question
Let $R$ be a TFNP relation. Can a random oracle help P/poly
to break $R$ ...
2
votes
1answer
100 views
Is a “complete” cipher possible?
Is a "complete" symmetric cipher possible? By this I mean a symmetric cipher that is provably secure under the assumption that a secure symmetric cipher exists.
4
votes
1answer
69 views
Is it possible to MAC a quantum state with a classical key under reasonable assumption?
Assume that classical one-way functions secure against quantum adversaries exist. Is it possible, given a quantum state $Q$ and classical secret key $k$, produce a quantum state $AuthQ$ such that:
...
2
votes
1answer
93 views
Is it possible to encrypt quantum states under reasonable assumptions?
Is it possible to encrypt a quantum state, such that a $BQP$ attacker who does not know the secret key cannot obtain any information about the original state, but a $BQP$ decryptor with the key can ...
16
votes
0answers
283 views
Does Factoring have a Statistical Zero Knowledge Proof?
The title should be pretty self-explanatory, but to be more precise, consider the decision version of factoring, which is given input $(x,k)$, where $x$ and $k$ are binary encodings of integers, to ...
1
vote
0answers
112 views
Quantum algorithms for generalizations of determinants
There are a wide variety of determent-like constructions. Some like the permanent or immanents are variations on the ordinary determinant for matrices over fields or commutative rings. Some like ...
6
votes
2answers
250 views
How to find a non-zero point of a non-zero polynomial of low degree?
Given a circuit that computes a polynomial $P(x_1 \dots x_n)$ of low formal degree over some large field $\mathbb{F}$. Moreover, given a point $X \in \mathbb{F}^n$, such that $P(X) \neq 0$. Can one ...
7
votes
1answer
252 views
Quantum Hardness of Approximating Lattice Problems
A common claim in lattice-based cryptography is that cryptosystems based on the Learning with Errors ($\mathsf{LWE}$) problem are hard to break (for a per-system definition of "break") for quantum ...
17
votes
0answers
413 views
Quantum Hardness of Finding Nash Equilibria
This question is inspired by the recent, beautiful work On the Cryptographic Hardness of Finding a Nash Equilibrium by Bitansky, Paneth, and Rosen.
Their main result is that the existence of ...
5
votes
2answers
489 views
Alternatives to Diffie Hellman
Assume that Discrete logarithms can be solved in linear time over any group (hence factorization is also trivial by a result of Eric Bach), is there any other candidate public key exchange problem ...
16
votes
1answer
400 views
Complexity classes for proofs of knowledge
Prompted by a question Greg Kuperberg asked me, I'm wondering if there are any papers that define and study complexity classes of languages admitting various kinds of proofs of knowledge. Classes ...
23
votes
2answers
2k views
Knot Recognition as a Proof of Work
Currently bitcoin has a proof of work (PoW) system using SHA256. Other hash functions use a proof of work system use graphs, partial hash function inversion.
Is it possible to use a Decision problem ...
1
vote
0answers
103 views
Extractor with somewhat corrupted seeds
In conditional min-entropy extractor, there is a joint distribution $(X,Y)$ such that if the average min-entropy (for some appropriate notion of it) ${\rm H}_\infty(X|Y)$ is large, then ${\rm Ext}(X, ...
2
votes
2answers
133 views
Factoring semiprimes whose factors very close to a power of two
Are there any factorization algorithms that run well on numbers $N = pq$ where $p,q$ are prime and $p = 2^b - k_p, q = 2^b - k_q$ for very small $k_p,k_q$? What about $p = 2^b + k_p, q = 2^b + k_q$ ...
2
votes
0answers
93 views
Claw finding using quantum walk: superposition for Szegedy's framework
Within Claw Finding Algorithms Using Quantum Walk there is the subroutine $claw_{detect}$ described. As in above paper:
Let $J_f(N, l)$ and $J_G(M, m)$ be Johnson graphs. Let $F$ and $G$ be vertices ...
1
vote
2answers
203 views
Information-theoretic Diffie-Hellman
The following non-standard description of Diffie-Hellman is entirely my own, by which I mean that I came up with it having not read about it anywhere else beforehand.
In Diffie-Hellman Alice and Bob ...
10
votes
1answer
266 views
Can we construct a k-wise independent permutation on [n] using only constant time and space?
Let $k>0$ be a fixed constant.
Given an integer $n$, we want to construct a permutation $\sigma \in S_n$ such that:
The construction uses constant time and space (i.e. preprocessing takes ...
5
votes
1answer
184 views
Simple candidates for pseudorandom permutations?
Even though it is not known whether one-way functions exist, there are several candidate functions used in practice for cryptographic applications that are efficiently computable but are conjectured ...
0
votes
1answer
76 views
Question on cryptographic advantage
In Provably Secure Steganography by Hopper, et al, we have the following definition
Cryptographic notions
Let $F:\{0,1\}^k \times \{0,1\}^L \rightarrow \{0,1\}^l$ denote a family of functions. Let $...
4
votes
1answer
320 views
Introductions to steganography from an information-theoretic standpoint
Can I get some introductory references for steganography from an information-theoretic standpoint? I recently listened to a talk on it, and the speaker said that he knew of no good introductions to ...
2
votes
1answer
153 views
Cryptography with very small keys
Is anything known about doing cryptography with very small keys? In particular, is there any theory involving cryptosystems (based on whatever assumption you want) that can encrypt messages of length ...
3
votes
0answers
73 views
One kind of dependence relation between a pair of random variables
I have been working on privacy and come across a neat problem.
Suppose two random variables $X$ and $Y$, over finite alphabets $\mathcal{X}$ and $\mathcal{Y}$, are given with joint distribution $P_{...
4
votes
1answer
188 views
Cryptographic systems that don't leak linear combinations of encrypted bits
Various encryption schemes would be considered broken if an adversary could have a non-negligible edge in predicting the first (or any) bit of an encrypted message. I am looking for a slightly ...
2
votes
2answers
183 views
Reference on cryptography methods
I'm looking for a good reference, possibly a survey, on the different types of cryptography methods. As far as I understand, the security of a cryptographic method depends on some hardness assumptions,...
1
vote
1answer
132 views
Is it possible to encrypt something in such a way that it can be decrypted by two different keys?
I'm a lowly web dev / programmer of 10 years who's never tried to wrap his brain around the high concept stuff, so apologies is this is a stupid question (or if it belongs in programmers.stackexchange....
13
votes
0answers
228 views
Is it possible to make trapdoor board games?
Motivated partly by this MO question, I am wondering if it's possible to design a board game where there is a simple winning strategy but it's hard to find. For example, the game of picking a random ...
9
votes
2answers
616 views
Why does most cryptography depend on large prime number pairs, as opposed to other problems?
Most current cryptography methods depend on the difficulty of factoring numbers that are the product of two large prime numbers. As I understand it, that is difficult only as long as the method used ...
5
votes
0answers
71 views
Understanding the weak-OWF exists -> OWF exists proof
This is a proof that I've gone back to many times over the last few years and while I can read it and easily verify the steps, it seems like it's a proof, where I will always essentially forget the ...
3
votes
1answer
175 views
Efficient Shamir secret sharing reconstruction
Shamir's secret sharing scheme is a well known way to convert a secret into a polynomial and distribute points in this polynomial. Some of these points can then be regrouped to reconstruct the ...
7
votes
3answers
493 views
Candidates for One-Way Function
Why are the candidates for one-way functions so few?
Today, almost all candidates are based on elementary mathematics, except Goldreich's candidate 2000 and ... (?!).
Why one can not generate ...
5
votes
1answer
109 views
Commitment schemes with verification in NC0
Is there any secure cryptographic commitment scheme, where the verification routine can be implemented in $NC^0$? If so, what is the minimum possible depth of the circuit for verification?
Applebaum ...
2
votes
1answer
81 views
Sufficient Statistics of $X$ from $Y$
I am reading the paper New Monotone and Lower Bounds in Unconditional Two Party Computation by Wolf and Wullschleger.
In Definition 2 on the third page, they define $f(x):=P_{Y|X}(\cdot|x)$ and they ...
