/r/crypto
Cryptography is the art of creating mathematical assurances for who can do what with data, including but not limited to encryption of messages such that only the key-holder can read it. Cryptography lives at an intersection of math and computer science.
This is a technical subreddit covering the theory and practice of modern and strong cryptography.
... is the art of creating mathematical / information theoretic assurances for who can do what with data, including but not limited to the classical example of encrypting messages so that only the key-holder can read it. Cryptography lives at an intersection of math and computer science.
This subreddit is intended for links and discussions surrounding the theory and practice of modern and strong cryptography.
Please note that this subreddit focused on the tech, not politics! The focus is on the algorithms and the security of the implementations.
Because this subreddit currently is in restricted mode, you will NOT be able to post or comment before your account has been approved. Send us a reason for why you want to join via mod mail, click here and tell us why you want to discuss cryptography;
https://www.reddit.com/message/compose/?to=/r/crypto
(along with normal reddiquette)
Don't forget to read our RULES PAGE! The rules listed there are also used as this sub's report reasons. The quick version;
Internal:
External:
Other subreddits that may be of interest:
Theory:
Practical:
Educational, hobbyist:
Political and in the news:
Software:
Related:
Memes and low effort submissions:
Feel free to message the moderators with suggestions for how to improve this subreddit, as well as for requesting adding links in the sidebar.
/r/crypto
This is another installment in a series of monthly recurring cryptography wishlist threads.
The purpose is to let people freely discuss what future developments they like to see in fields related to cryptography, including things like algorithms, cryptanalysis, software and hardware implementations, usable UX, protocols and more.
So start posting what you'd like to see below!
A quiet revolution in secure communication
In a digital world dominated by centralized services—where messages, metadata, and personal data often funnel through corporate servers—CommunisP emerges as a beacon of true privacy and user empowerment. We’re not just another “secure messenger”; we’re a movement dedicated to reshaping how communication works. By blending advanced cryptographic techniques with a decentralized, peer-to-peer (P2P) architecture, CommunisP.com offers unrivaled confidentiality, ensuring your conversations remain exclusively yours.
Imagine someone demanding your chat histories... and you literally have nothing centralized to produce. Many “private” messengers still route every message through their own servers or store them in some buffer. CommunisP instead enables direct, encrypted P2P channels, leaving no archives or metadata in a big corporate database. Even under subpoena, there’s no lingering trove to expose.
These inherent issues underscore the need for a platform that values user rights and freedoms over corporate convenience.
1. Browser-as-Server / Always-On Presence
Rather than forcing you to install Docker containers or rent a VPS, your normal web browser (on a home PC) functions as a 24/7 node:
2. W Ratchet Encryption
CommunisP’s signature security layer merges time-based ephemeral key rotation with per-message ephemeral expansions:
3. Ephemeral Local Logs (Optional)
CommunisP stands for a new age of private communication—where you alone decide what’s stored, who sees it, and how ephemeral it stays.
CommunisP is more than a messenger. It’s a quiet revolution in how we exchange data online. By seamlessly combining:
We deliver a system that’s off-grid, off-limits, and in your hands. No phone numbers, no corporate synergy—just encryption, ephemeral privacy, and your personal freedom.
If you’re ready to transcend old paradigms of data-harvesting and central surveillance, visit CommunisP.com, open a tab, pick a nickname, and step into the next frontier of user-driven, cryptographically robust communication.
I need to buy an HSM for a project (need it for compliance with government regulations) and I am kind of confused. Price range is really wide. I can see used THALES nCipher HSMs on eBay for as low as 300$ and as high as 10,000$, even though modules are similar according to Entrust (now THALES nCipher owner) website.
Anyway. Two questions:
I am planning to deploy EJBCA as the API/FrontEND of the HSM to integrate it with my platforms.
Hi, I'm a dual CS & math major. I've been accepted into a mentorship program of sorts and will have the opportunity to do (likely remote) research on a topic (if I find a PI)
I'm interested in crypto and have studied the standard intro class to cryptography (classical ciphers and public key) (my university doesn't offer it, so I studied by myself). I also have a project on implementing elliptic curve cryptographic systems and algorithms. And will take abstract algebra next semester (few weeks)
I'm wondering what the 'normal' knowledge gap should be and if I have enough prerequisites to start getting involved in cryptography research. Is there even a decent chance any PIs would consider me, considering my lack of background?
Hello, i'm sort of confused by a small point on Regev's pke.
Say that the the public parameters is (A, u) = (A, s^t A + e) with A matrix, s the secret key, e an error.
I see that in the original paper as well as in follow up papers, the encryption part of the system is of the form (A*r, u*r + m*q/2)
However in the following talk at the timestamp in chris peikert's talk, the encryption is of the form (A*r + e, r*u + m*q/2): https://youtu.be/K_fNK04yG4o?list=PLgKuh-lKre10rqiTYqJi6P4UlBRMQtPn0&t=2097
Looking more into it, i see another paper in which he defines an improved scheme supposed to generalize 3 former iterations of the scheme. All of the older schemes are of the first form, while the proposed scheme is of the 2nd. it's in chapter 3. https://eprint.iacr.org/2010/613.pdf
My question is: what gives? am i looking at papers that are out of date? when someone mentions regev without specifying, will they be thinking of an encryption of the first or second form? What does it change in fine? Is it just that adding an error with one error distribution is equivalent to adding none but selecting r with another distribution?
edit: I also noticed that in ringLWE and moduleLWE, the latter showed up, not the first form
Welcome to /r/crypto's weekly community thread!
This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.
Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!
So, what's on your mind? Comment below!
The MOV attack works by choosing an elliptic curve with a small embedding degree then using a Tate pairing to map from the curve to a finite field, where the discrete log is sub-exponential.
Can you go the other way? Choose an elliptic curve over a small (~ 2^24 ) finite field with a fairly large embedding degree (~ 125). Then present adversaries with a large (2^(24*125) ) finite field Diffie Hellman protocol, which you then map back to the small curve for which discrete log is easy?
Has this been tried and does it have a name?
The MOV attack works by choosing an elliptic curve with a small embedding degree then using a Tate pairing to map from the curve to a finite field, where the discrete log is sub-exponential.
Can you go the other way? Choose an elliptic curve over a small (~ 2^24 ) finite field with a fairly large embedding degree (~ 125). Then present adversaries with a large (2^(24*125) ) finite field Diffie Hellman protocol, which you then map back to the small curve for which discrete log is easy?
Has this been tried and does it have a name?
This is about the Bulletproofs zk Proof protocol - https://eprint.iacr.org/2017/1066.pdf
(I am going to use additive notation instead of the multiplicative notation used in the paper to describe my question)
Prover knows 2 vectors a & b such that their inner product is c.
She creates a binding (but not hiding) Pedersen commitment to the 2 vectors
P = aG + bH
(Here G & H are 2 vectors of generators - the relations between the different generators both inside each vector of generators & also between the 2 set of generators is not known).
assuming a = [a1, a2, a3] & G = [G1, G2, G3] etc, this commitment will look like
P = a1G1 + a2G2 + a3G3 + b1H1 + b2H2 + b3G3
which we write as
P = aG + bH
c = <a, b>
The Prover sends P & c to the verifier. The verifier samples a random x and sends it to the prover
There is another generator V (the relations between V & G & H is not known)
Verifier constructs another a new point
P' = P + cxV
Let xV = U
The prover proves
P' = aG + bH + <a,b>U
using the Bulletproofs Protocol
What I don't understand is how this one proof proves 2 things
How does proving the longer statement prove the 2 things?
I mean proving A + B = C + D doesn't prove A = C & B = D, so how does it work here?
I have my own explanation of why this works but I am not sure if it's correct
For e.g. in many zkProofs let's say we have to prove 3 polynomials to be zero polynomials using the Schwartz Zippel Lemma, we combine them using a linearly independent set.
i.e. if prover wants to prove 3 polynomials f1, f2 & f3 are zero, then instead of proving it using 3 separate Schwartz Zippel proofs, she can combine them into one polynomial.
The Verifier sends a random r. Prover creates a linearly independent set [r^0, r^1, r^2] & then creates a new polynomial
f = f1 + r.f2 + r^(2).f3
Now when f is evaluated at another random point send by the verif & the evaluation is zero, then that proves f1, f2 & f3 are all zero?
is something similar being done here - i.e. the 2 statements are being combined using [x^0 , x^(1)] & hence it proves both statements are true? I am not fully convinced because this isn't a polynomial & nor is Schwarz Zeppel being used here.
Greetings,
I drafted a paper over the holidays about a commitment scheme for ledgers and ledger-like data. My paper might not be much.. but the scheme itself, I think, is powerful. I've yapped about skip ledger on reddit before, but at the time, I didn't know some terms of art to describe it properly. Hope you give it a look and give me constructive feedback.
Welcome to /r/crypto's weekly community thread!
This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.
Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!
So, what's on your mind? Comment below!
Keccak and Poseidon are both sponge constructions. Keccak’s permutation function is uniquely invertible. This simplifies and strengthens security arguments. Keccak hides 256 bits of internal state when producing an output, so as long as the permutation is chaotic, Keccak is secure.
Is Poseidon’s permutation function uniquely invertible? Can you find two different internal state inputs that permute to produce the same internal state output?
Hi,
Given that essentially all production ECC systems are 256-bit, and that 256-bit is really 128-bit strong in the context of our best attacks Pollards/BSGS.
Do we consider 128-bit enough for the medium term (5-10years).
It's starting to feel too small.
I understand that authenticated encryption provides immallability, that an attacker could not mess with the ciphertext and still have it "decrypted", but if there truly are an infinity number of possible decryption keys, wouldn't this simply gives a tolerance of the messing? Just like how hash is collisible by pigeonhole
I’ve written my own TLS 1.3 implementation (for fun). I would like to keep this up to date when post quantum algorithms come around. I’m guessing a supported_groups extension will be added for one of the algorithms, maybe Kyber.
I understand how NTRU works but haven’t looked into Kyber or other solutions.
What might I benefit from being aware of? Have any proposals been made? Will hybrid implementations be considered? Is there a timeline for this?
For elliptic curves, Montgomery modular multiplication is a somewhat essential optimisation. What similar optimisations are needed when going from pedagogical to performant Kyber implementations?
As part of the venture startup, 'coco-space', under Statecraft Laboratories (unregistered startup), I am trying to explore sustainable tokenomics models to create an economy for a certain COCO Protocol where authenticators, users, and verifiers thrive while maintaining robust privacy guarantees.
💡 If you wish to volunteers/co-author, if interested in collaboratively researching and shaping this tokenomics framework, please do connect!
💡 Also, I would love your suggestions on how to approach it. If you’re passionate about cryptography, distributed systems, or blockchain-based incentives, I’d love to connect too!
Our 'coco-space' is based on COCO Authentication Protocol, a privacy-preserving, decentralized authentication system that decouples digital identity from real-world identifiers. I did already share a post about COCO Protocol earlier on the group, but for the sake of clarity I'll be sharing it here once again:
🔗 Learn more about COCO Protocol: COCO Protocol Overview
🔗 Check out the open-source code: COCO GitHub Repository
Let’s push the boundaries of decentralized authentication together.
Comment below or DM me or connect with me on my email reiki.yamya14@gmail.com if you’re interested in contributing! 🙌
Welcome to /r/crypto's weekly community thread!
This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.
Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!
So, what's on your mind? Comment below!
What's a good paper on CA root attacks? You know, if the signing chain was compromised; what is there in place to mitigate that?
Hi,
I am working on a decentralized digital identity management system, and I would like to ask for a wider community feedback.
In my opinion one of the biggest issues with decentralized identity management systems is the problem of the long lived private key loss or compromise.
I am designing a system based on an assumption that an average person is totally capable of memorizing a 128-bit cryptographic key. I made a mnemonic system for this exact purpose: https://github.com/dmaevsky/brainvault
If this really works as well as I feel it would, it might open doors to some interesting cryptographic schemes for efficient long term identify management.
While it's perhaps more about linguistics and neurobiology than cryptography, I would really appreciate your feedback on this bit before I start building a cryptographic system around it.
Best year end holidays to everyone )
Since we're sharing our pre-prints, this is my latest research. The use case is low communication overhead digital signatures, good for constrained network environments. I was researching novel lattice constructions and one idea simply led to the next.
Everyone forgot non-commutative cryptography was a thing after braid groups, but the field is still viable. I'd like to polish this paper up and submit it to the CIC journal next month, so I'm looking for co-conspirators to help. Let me know if you have questions, on reddit or signal.
Hi everyone,
I want to use libsodium in PHP in a little code signing/verifying library I'm writing. I had a working implementation in OpenSSL, but that extension isn't always installed on hosts, where it seems that libsodium mostly is.
The API seems pretty straightforward, with one exception - how does one safely store the private key on disk? With Openssl, I was using a user entered passphrase to encrypt the private key. That meant if the key was stolen from the disk, it would be useless without the passphrase. When using the key to sign ZIP files, the user was also prompted to enter the key to get access to the private key. I felt pretty safe that way, given how insecure some shared hosting providers are.
I don't seem a simple way to do the same thing with sodium. You can create a private/public key, but at that point you can't easily encrypt it , not without OpenSSL I don't think. The same seems to be with saving it to disk - it seems I can save it was binary data, but not in any portable key format. Can anyone recommend a portable way to do this safely? Thanks.
Hi guys, in few words: my head wraps around visual representations way way way easier than math math models and watching visual presentations (better if they are interactive) makes my knowledge more flexible.
I'm aware of the representation of the curve on the Real filed, it is very clear of course, the geometric pointadd and pointdouble is so easy to visualize.
I'm aware of the classical grid representation on the finite field as well, not very useful to be honest.
I'm aware of the torus representation, very cool, I should look more into it (is it on the finite field by the way?)
I saw a youtube short that was showing with a terrible video resolution how the curve on the Real field was "wrapped" and "cut" to make it fit in the finite field grid, however the video had no information about that at all and everything was about the torus representation (which if I'm not wrong is just the finite field grid bended to shape a donut(?)), I would like to know more about this "cut" representation.
I heard about some polar-coordinate representation(?), what is that and how can I find something about it? (searching for polar representation of jacobian coordinates doesn't show me any visual representation).
I will work on a simple visual 3d representation that highlights how the different triplets of point are one the double of the other, the other the half of the one, etc.
Are you guys aware of some other interesting visual representation that are worth it?
Thanks
🌟 Dear Scientists, Researchers, Scholars, and Enthusiasts, 🌟
I am thrilled to announce the pre-print of my latest research paper, now available on the International Association for Cryptologic Research (IACR) ePrint archive. 📚✨
Goal: To authenticate accurately and securely without revealing both virtual public identifiers (e.g., usernames, user IDs) and real-world identifiers (e.g., passwords, biometrics, or other secrets).
💡 Introducing COCO:
A full-consensus, zero-knowledge authentication protocol designed with:
COCO is built on Coconut credentials—a selective disclosure, re-randomizable credential scheme—and Oblivious Pseudorandom Functions (OPRF) to ensure both privacy and scalability in distributed frameworks.
🎯 This research is part of a larger project under Statecraft Laboratories to create a privacy-first virtual space.
🛠️ Explore the Codebase:
Check it out on GitHub.
📩 Let’s Collaborate!
Your expertise and feedback—whether on theoretical foundations, practical implementations, or potential optimizations—are invaluable.
Feel free to reach out via:
Looking forward to insightful discussions and collaborations! 🤝
Warm regards,
Yamya Reiki 🌿
I'm looking for prior art in encrypted object formats intended for encryption at rest (or store and forward messaging) for objects in the kilobytes to gigabytes range. Most probably involve marshalling together some symmetrically encrypted data along with a metadata block that includes details on key management and transports the data encryption key wrapped with recipient key(s).
Would love any well-designed examples I can look at for ideas, or problems you've encountered with such designs and implementations.
Currently I have:
But I'm sure this wheel must have been reinvented many times.