What are the optimal secure curves for ECC? I have been using Curve25519 because of https://safecurves.cr.yp.to/ and also want to implement Curve448.

BLS12_381 is another interesting one, especially for zkps.

From what I understand the size of a secp256k1 EC public key is 65 bytes (out of which one is a prefix byte so lets ignore that). The private key is any 256-bit number in [0, N] where N is the order of the curve. So if I have a random 64-byte stream, the probability of it being a valid EC public key on the curve is N / 2^512 = 2^256 / 2^512 = 2^{-256}. Does this sound right?

Also from some shallow reading you can compress the public key to half the size (32-bytes) by only using one of the (x, y) coordinates due to "special properties of the curve". So then how would I find the probabilty of a random 32-byte stream being a valid EC public key on the (secp256k1) curve? Does the probability remain the same?

Hi. As title goes, I’m getting into cryptography I’d like to know if there’s any online puzzles or beginner ciphers I can try to solve to start getting into this. Thanks

I was reading this paper that claims to "combine metaverse with blockchain", but I have a hard time understanding their use of primitives. On page 4 they first generate the key-pairs (not sure which scheme?):

https://preview.redd.it/zpkop4rklife1.png?width=672&format=png&auto=webp&s=8cef80acf6bafc73585f06bb71a8a565fea02afb

Then the patient uses his/her private key to sign the data, and then the hospital encrypts it (page 5):

https://preview.redd.it/cbur2iezlife1.png?width=691&format=png&auto=webp&s=ac36069b1d42256c93ab9d1d7aaa3e18fc195691

So I'm guessing (pk0, pk1) is probably from Ed25519 but (ak0, ak1) may be from X25519. The patient data is then encrypted using ak0, but isn't that something you aren't supposed to do? The paper doesn't mention the size constraints on patient data either.

It then says that:

The newly generated data has to be validated before they can be added to the blockchain. These data are validated by the admin (doctor, pathologists, radiologists) following the process depicted in figure 5 using the admin private key ak1.

But figure 5 doesn't mention ak1:

https://preview.redd.it/bn0ei7e8oife1.png?width=699&format=png&auto=webp&s=dfec3ff0b2a196be1bc860067ca2b41072b4e014

What was the point of ak* anyway given that the hospital is the one encrypting the data in the first place? Am I missing something?

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

Hi, please fill out Lattica's FHE survey https://forms.gle/UA4LrVKhkWgENeGS9. This survey gathers insights from industry experts about the current state and future development of Fully Homomorphic Encryption. Survey results will be widely available here and on social media. Thanks - your insights are super valuable!

https://preview.redd.it/i7dprkewabfe1.jpg?width=3158&format=pjpg&auto=webp&s=1c0a7213b21a4f7d84a7adfcfe9034dbd9635fe5

Why does the dCode.fr website for Caesar Cipher result in two or more answers for strings I want to decode? Shouldn't there be only one way to shift using key 3? I can't find the answer anywhere. Please help!

Greetings Crypto Sub!

I am dealing with a kind of cryptolocker situation... Not _that_ bad, but kinda bad.

Data that is encrypted out of my reach: ~8 years of Signal Desktop data (including family photos and much else).

How it went beyond reach: In late 2024, Signal Desktop started encrypting its data encryption key using DPAPI. Then, in early 2025, my laptop died. While I have a full file system backup (thank you backblaze!), the old SSD is damaged and dead (I currently have it in an M.2->USB enclosure, imaging apps like Macrium and Acronis fail to image it, repairs like fdisk are not able to fully repair the volume).

IOW: The old Windows OS is not bootable. (If it were, I would be able to use this tool to decrypt the Signal crypto key)

The crypto path is:

(a) Signal Data Encryption key -> (b) Itself encrypted via DPAPI under OldPC -> (c) WinUser1

The puzzle I am trying to solve is (b)

I have dug around the DPAPI world.. My specific context is: OldPC was Win11 but WinUser1 is an "old style" Windows user [e.g. not a microsoft.com account] _and_ I know the Windows Password for that user [as that user was yours truly].

Ideally, there would be an offline DPAPI tool or cracker. I can give it (b) and the Windows Password for (c). I can also provide the raw registry files or other files from the old Windows OS (or potentially extract values from those files).

Is there a possible path forward?

No way they can be, right? (Edit: see comments, problem was between chair and keyboard. Thanks!)

I'm currently writing yet another AES implementation. My goal is to have a bitslice implementation, similar to BearSSL, but with a nicer API. Anyway, right now I'm making a simple, slow, unsafe (variable time) reference implementation, to better understand AES before I do the actual bitslice. So far AES ECB encryption seems to be working, at least according to this nice online tool.

It was time for a more serious test suite, so I searched for official test vectors. I landed on this page, and eventually downloaded these response files. In those I extracted the ECBMCT128.rsp, wrote a parser, and ran my implementation against it.

It does not work.

Specifically, the very first test got me this:

KEY       : 139a35422f1d61de3c91787fe0507afd
PLAINTEXT : b9145a768b7dc489a096b546f43b231f
CIPHERTEXT: d7c3ffac9031238650901e157364c386
RESULT    : 0da1b56ba11c1a5500e95583c0eac913

The first 3 lines come from the response file, and the RESULT is what my implementation outputs — it's supposed to match the CIPHERTEXT. They're clearly different, so I guess I botched it. No problem, let's try the online tool I was using before, see what their result is:

0da1b56b a11c1a55 00e95583 c0eac913

Okay now I'm confused. The online tool agrees with me. The official test vectors do not. What the hell is going on? Was the stuff I downloaded not official? Did I use the wrong file? Does AES ECB involve more than just using the raw output of the block cipher? Are the test vectors made for a row-major implementation of AES instead of column major like the specs say?

Where does the difference come from? And also, where can I find a reputable source of test vectors?

I am working on a security-critical tool that uses ECDH to establish shared session keys. I want to reinforce this process by using a PQ-KEM algorithm like Kyber. Right now, I am thinking of achieving this by having two independent key exchanges (one with ECDH keys and one using the PQ-KEM) and then deriving the shared key by passing the two derived secrets through an HKDF. Is this a good approach or am I missing something critical?

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

Hello,

I am wondering for any information on the security of SHA3 and its sponge function versus older hash functions like MD5, SHA1, SHA2.

What makes it more secure? How heavily studied has it been. The sponge function is still newer than the other constructions but its internal state is quite large.

I am looking for hash functions with good security margins.

BLAKE2 and SHA3 are so far the best looking but is there any reason I should look at SHA2 again because it’s well studied.

I would like to engage in a thorough discussion comparing these hash functions.

This is another installment in a series of monthly recurring cryptography wishlist threads.

The purpose is to let people freely discuss what future developments they like to see in fields related to cryptography, including things like algorithms, cryptanalysis, software and hardware implementations, usable UX, protocols and more.

So start posting what you'd like to see below!

A quiet revolution in secure communication

In a digital world dominated by centralized services—where messages, metadata, and personal data often funnel through corporate servers—CommunisP emerges as a beacon of true privacy and user empowerment. We’re not just another “secure messenger”; we’re a movement dedicated to reshaping how communication works. By blending advanced cryptographic techniques with a decentralized, peer-to-peer (P2P) architecture, CommunisP.com offers unrivaled confidentiality, ensuring your conversations remain exclusively yours.

No Central Logs, No Big Data Harvest

Imagine someone demanding your chat histories... and you literally have nothing centralized to produce. Many “private” messengers still route every message through their own servers or store them in some buffer. CommunisP instead enables direct, encrypted P2P channels, leaving no archives or metadata in a big corporate database. Even under subpoena, there’s no lingering trove to expose.

• No Phone Numbers or Emails: A simple nickname + password is all you need.
• No Single Authority: Without a central server, no entity can be coerced into handing over your data.
• Minimal Metadata: “Ping” notifications remotely inform you that someone wants to connect or of messages received from your home browser—without revealing message content or personal info.
• Off-Limits: Because everything is handled in real time, ephemeral encryption means once a conversation ends, it truly ends.

The Problem with Centralized Communication

• Privacy Risks: Central servers are prime targets for data breaches.
• Censorship & Control: A single authority can monitor or suppress content.
• Data Commodification: Personal data is often mined for profit.
• Single Point of Failure: Server outages immediately paralyze entire userbases.

These inherent issues underscore the need for a platform that values user rights and freedoms over corporate convenience.

Our Philosophy: Decentralization & Empowerment

1. Users Own Their Data: You decide if ephemeral messages stay ephemeral or are saved to local logs. No one else sees them.
2. Privacy is Paramount: End-to-end encryption ensures only intended recipients see the conversation.
3. No Central Authority: CommunisP eliminates data silos and corporate middlemen.

Decentralization as a Core Principle

• Enhanced Security: Fewer infiltration points for attackers.
• Resilience: If some devices go offline, the rest keep the network alive.
• Democratized Access: Limited central power to manipulate or throttle communication.

The CommunisP Approach

1. Browser-as-Server / Always-On Presence

Rather than forcing you to install Docker containers or rent a VPS, your normal web browser (on a home PC) functions as a 24/7 node:

• No Extra Setup: Just open CommunisP.com, log in, and let the tab run.
• Offline Message Storage: If your phone is switched off, your desktop browser quietly receives (and optionally logs) new messages.
• Retrieval On Your Terms: When you reconnect from another device or location, you can seamlessly fetch logs or continue chats.

2. W Ratchet Encryption

CommunisP’s signature security layer merges time-based ephemeral key rotation with per-message ephemeral expansions:

• Session Key Rotations Every 60 Seconds: Ensuring even if a key is compromised, it’s worthless by the next minute.
• Unique Ephemeral Keys per Message: Each message is independently encrypted, insulating the rest if one key is somehow exposed.
• Forward Secrecy & Post-Compromise Security: Attackers can’t retroactively decrypt old messages or read future ones after a key leak—because ephemeral keys shift so frequently.

3. Ephemeral Local Logs (Optional)

• Local Only: If you enable “Local Message Logs,” ephemeral messages are stored solely on your home browser. No central copies exist.
• Nickname Authentication: Only a device logged in with your nickname can request or clear these logs, and this can also require an additional 'passphrase'.
• Truly Ephemeral: If you prefer no trace at all, keep logging disabled or send a “Clear*” ephemeral command to wipe everything.

Why CommunisP Is Different

• No Central Storage: End-to-end encryption prevents even CommunisP’s minimal servers from reading your messages. They only help peers find each other (signaling).
• Time + Message Ratchet: Beyond typical single-lane E2EE, we tie ephemeral expansions to both message-by-message and minute-by-minute intervals, shrinking the adversary’s window.
• Offline Resilience: Your home browser is your “personal server,” so friends can reach you anytime, even if your phone or other devices are offline.
• User-Level Control: You alone decide whether ephemeral messages persist or vanish, free from corporate retention policies.

Technical Underpinnings (Quick Highlights)

1. WebRTC
   • Circumvents NAT/firewalls via STUN on port 3478.
   • Provides real-time P2P data channels for messages/files.
   • Encrypted transport at the network layer.
2. ECDH + ECDSA
   • Derives shared secrets without exposing private keys.
   • Ensures authenticity of messages (ECDSA digital signatures).
3. AES-GCM
   • Authenticated, high-speed encryption.
   • Protects confidentiality and detects tampering.
4. W Ratchet
   • Time-driven session key resets every 60 seconds.
   • Per-message ephemeral expansions with HKDF or ephemeral ECDH.
   • Eliminates static or long-lived encryption contexts.
5. Offline/Async Support
   • A browser left open at home acts as a 24/7 relay, gathering ephemeral messages so that you can fetch them later from any device.

Typical Usage Scenarios

• Activists & Whistleblowers: Communicate off-grid, no centralized logs, no phone number requirement.
• Personal Chat & File-Sharing: Freed from phone-based constraints, you can share ephemeral files with advanced encryption.
• Work Collaboration: If compliance or security rules forbid storing data in corporate servers, CommunisP’s ephemeral approach is perfect—nothing official to subpoena.
• Everyday Privacy: Just want to keep a private chat private? No big deal—CommunisP is here.

Practical Workflow Example

1. Morning
   • Open your home browser, log in to CommunisP, keep that tab open.
2. You’re Away
   • Your phone is off or you’re not using it.
   • Friends or colleagues message your nickname; your home browser collects any new ephemeral messages.
3. Return & Retrieve
   • On your phone or another PC, log in with the same nickname.
   • If you want to see offline logs, send a special ephemeral passphrase. The home browser confirms your identity, encrypts the logs, and sends them to you P2P.
4. Continue Chat
   • Chat in real time using ephemeral keys that rotate every minute, ensuring fresh security.
5. Optionally Clear
   • If you want to maintain absolute ephemerality, send a “Clear*” ephemeral command, erasing any local logs on your home browser.

The Quiet Revolution

• Truly Off-Grid: Past a minimal handshake, your message content never returns to a central server—ever.
• Off-Limits: No corporate or third-party entity has any read or moderation ability over your conversation.
• User Empowerment: Zero overhead, zero forced phone IDs, zero illusions of “secure” while data is still being mined.

CommunisP stands for a new age of private communication—where you alone decide what’s stored, who sees it, and how ephemeral it stays.

CommunisP is more than a messenger. It’s a quiet revolution in how we exchange data online. By seamlessly combining:

• Browser-as-Server convenience,
• W Ratchet ephemeral encryption, and
• Full P2P architecture

We deliver a system that’s off-grid, off-limits, and in your hands. No phone numbers, no corporate synergy—just encryption, ephemeral privacy, and your personal freedom.

If you’re ready to transcend old paradigms of data-harvesting and central surveillance, visit CommunisP.com, open a tab, pick a nickname, and step into the next frontier of user-driven, cryptographically robust communication.

I need to buy an HSM for a project (need it for compliance with government regulations) and I am kind of confused. Price range is really wide. I can see used THALES nCipher HSMs on eBay for as low as 300$ and as high as 10,000$, even though modules are similar according to Entrust (now THALES nCipher owner) website.

Anyway. Two questions:

1. What should I take into consideration if I want to buy a used model?
2. What would be your general recommendation on the TOPIC?

I am planning to deploy EJBCA as the API/FrontEND of the HSM to integrate it with my platforms.

Hi, I'm a dual CS & math major. I've been accepted into a mentorship program of sorts and will have the opportunity to do (likely remote) research on a topic (if I find a PI)

I'm interested in crypto and have studied the standard intro class to cryptography (classical ciphers and public key) (my university doesn't offer it, so I studied by myself). I also have a project on implementing elliptic curve cryptographic systems and algorithms. And will take abstract algebra next semester (few weeks)

I'm wondering what the 'normal' knowledge gap should be and if I have enough prerequisites to start getting involved in cryptography research. Is there even a decent chance any PIs would consider me, considering my lack of background?

Hello, i'm sort of confused by a small point on Regev's pke.

Say that the the public parameters is (A, u) = (A, s^t A + e) with A matrix, s the secret key, e an error.

I see that in the original paper as well as in follow up papers, the encryption part of the system is of the form (A*r, u*r + m*q/2)

However in the following talk at the timestamp in chris peikert's talk, the encryption is of the form (A*r + e, r*u + m*q/2): https://youtu.be/K_fNK04yG4o?list=PLgKuh-lKre10rqiTYqJi6P4UlBRMQtPn0&t=2097

Looking more into it, i see another paper in which he defines an improved scheme supposed to generalize 3 former iterations of the scheme. All of the older schemes are of the first form, while the proposed scheme is of the 2nd. it's in chapter 3. https://eprint.iacr.org/2010/613.pdf

My question is: what gives? am i looking at papers that are out of date? when someone mentions regev without specifying, will they be thinking of an encryption of the first or second form? What does it change in fine? Is it just that adding an error with one error distribution is equivalent to adding none but selecting r with another distribution?

edit: I also noticed that in ringLWE and moduleLWE, the latter showed up, not the first form

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

The MOV attack works by choosing an elliptic curve with a small embedding degree then using a Tate pairing to map from the curve to a finite field, where the discrete log is sub-exponential.

Can you go the other way? Choose an elliptic curve over a small (~ 2^24 ) finite field with a fairly large embedding degree (~ 125). Then present adversaries with a large (2^(24*125) ) finite field Diffie Hellman protocol, which you then map back to the small curve for which discrete log is easy?

Has this been tried and does it have a name?