Questions tagged [standards]
Questions about official cryptographic standards and their implementation.
136 questions
2
votes
2
answers
151
views
Rationale for SP 800-56Cr2 ordering of shared secrets in hybrid schemes
In TLS, mlkem768x25519 derives a master shared secret from a concatenation of the x25519 shared secret and the ML-KEM shared secret. The FIPS-approved hybrid PQC key agreement algorithm, ...
- 16.2k
1
vote
2
answers
360
views
Why clamp Poly1305?
Introduction
In 2005, Daniel J. Bernstein proposed a simple polynomial over $2^{130} - 5$
for fast universal hashing with applications to authenticated encryption [1].
Over the years, Poly1305 gained ...
- 95
6
votes
1
answer
162
views
Impossible optimization in IKE Intermediate RFC?
RFC 9242 - Intermediate Exchange in the Internet Key Exchange Protocol Version 2 (IKEv2) describes a new IKEv2 exchange type called "IKE_INTERMEDIATE". The purpose of this type is to allow ...
- 2,807
0
votes
0
answers
28
views
CNSA 2.0, code signing, and stateful hash-based signatures [duplicate]
Per this blog post and this press release, stateless hash-based digital signature schemes seem to not be approved by CNSA 2.0 for software signing. What's the rationale for this? This strikes me as ...
- 4,338
4
votes
2
answers
1k
views
Is there still an active cryptographic standard in some developing country that allows the DLP in the multiplicative group of finite fields?
Is there still an active cryptographic standard in some developing country that admits the use of the multiplicative group of a sufficiently large finite field $\mathbb{F}_{\!q}$ (usually, $q$ is ...
- 495
0
votes
1
answer
167
views
Why is ElGamal threshold encryption not being standardized by NIST?
I’ve been reviewing the NIST Multi-Party Threshold Cryptography project, and I noticed that several primitives are being standardized, including RSA encryption and decryption. However, I don't see the ...
1
vote
0
answers
118
views
CRYSTALS-Kyber Central Binomial Distribution reference inplementation in c
In lines 8 to 10, why it does not get input bytes as it is (i.e., line 8)? It first does some changes (line 9 and 10).
Do authors do this changes as we cannot work with binary form of a variable ...
- 733
4
votes
0
answers
95
views
Why is the standardized ECDSA conversion function projection instead of a hash function?
DSA/ECDSA has not been shown to be provably secure when H alone is modeled as an RO (Random Oracle). However, Brickell showed as far back as 1996 ([2], I couldn't actually find his Brickell96 citation)...
2
votes
1
answer
115
views
Is it possible to generate an elliptic curve (with the hard discrete logarithm problem) by iterating only a finite field, but not its $j$-invariant?
Let me ask one question. Maybe, you know an answer. Thanks in advance for any response.
Let's fix an elliptic curve $E$ over the field $\mathbb{Q}$ of rationals without complex multiplication, i.e., ...
- 495
0
votes
0
answers
66
views
Crypto standards
According to answer and status of PGP on RFC search, OpenPGP RFCs can be used as "technical reference for the applicable internet standard". The quote mentioned in previous sentence is a ...
- 23
2
votes
1
answer
1k
views
BN254 specification?
Sorry for asking another question but is BN254 specification standardized? I am using two different implementations one python another solidity and the prime field $F_p,F_{p^2}$ and the the group ...
- 671
3
votes
1
answer
852
views
Current Digital Signature Standards as of late 2023
Is my summary understanding of current (classical) Digital signature standards essentially correct? I may be totally wrong.
DSA is no longer to be used for new signature generation just for checking ...
- 25.9k
1
vote
0
answers
50
views
Is PKCS#12 structure without integrity protection against the specification?
PKCS#12 contains 2 integrity protection modes: password-based and public-key based. The way this is done in the standard is that data layout wise it appears to be fine to skip integrity protection ...
- 211
0
votes
1
answer
3k
views
Kleopatra: What is the strongest and most popular cryptography standard for PGP
While setting up PGP for the first time, I am presented with various encryption standards I can use being:
RSA (2048, 3072, 4096 bits) with an option for + RSA (2048, 3072, 4096 bits)
DSA (2048 bits) ...
- 1
4
votes
2
answers
228
views
Is there a standard for LFSRs to test against for use in a stream cipher?
I am trying to implement a stream cipher that uses an LFSR PRNG. I have found resources online that give good primitive polynomials, but I am struggling to find resources with the initial states as ...
- 111