This is another installment in a series of monthly recurring cryptography wishlist threads.

The purpose is to let people freely discuss what future developments they like to see in fields related to cryptography, including things like algorithms, cryptanalysis, software and hardware implementations, usable UX, protocols and more.

So start posting what you'd like to see below!

A quiet revolution in secure communication

In a digital world dominated by centralized services—where messages, metadata, and personal data often funnel through corporate servers—CommunisP emerges as a beacon of true privacy and user empowerment. We’re not just another “secure messenger”; we’re a movement dedicated to reshaping how communication works. By blending advanced cryptographic techniques with a decentralized, peer-to-peer (P2P) architecture, CommunisP.com offers unrivaled confidentiality, ensuring your conversations remain exclusively yours.

No Central Logs, No Big Data Harvest

Imagine someone demanding your chat histories... and you literally have nothing centralized to produce. Many “private” messengers still route every message through their own servers or store them in some buffer. CommunisP instead enables direct, encrypted P2P channels, leaving no archives or metadata in a big corporate database. Even under subpoena, there’s no lingering trove to expose.

• No Phone Numbers or Emails: A simple nickname + password is all you need.
• No Single Authority: Without a central server, no entity can be coerced into handing over your data.
• Minimal Metadata: “Ping” notifications remotely inform you that someone wants to connect or of messages received from your home browser—without revealing message content or personal info.
• Off-Limits: Because everything is handled in real time, ephemeral encryption means once a conversation ends, it truly ends.

The Problem with Centralized Communication

• Privacy Risks: Central servers are prime targets for data breaches.
• Censorship & Control: A single authority can monitor or suppress content.
• Data Commodification: Personal data is often mined for profit.
• Single Point of Failure: Server outages immediately paralyze entire userbases.

These inherent issues underscore the need for a platform that values user rights and freedoms over corporate convenience.

Our Philosophy: Decentralization & Empowerment

1. Users Own Their Data: You decide if ephemeral messages stay ephemeral or are saved to local logs. No one else sees them.
2. Privacy is Paramount: End-to-end encryption ensures only intended recipients see the conversation.
3. No Central Authority: CommunisP eliminates data silos and corporate middlemen.

Decentralization as a Core Principle

• Enhanced Security: Fewer infiltration points for attackers.
• Resilience: If some devices go offline, the rest keep the network alive.
• Democratized Access: Limited central power to manipulate or throttle communication.

The CommunisP Approach

1. Browser-as-Server / Always-On Presence

Rather than forcing you to install Docker containers or rent a VPS, your normal web browser (on a home PC) functions as a 24/7 node:

• No Extra Setup: Just open CommunisP.com, log in, and let the tab run.
• Offline Message Storage: If your phone is switched off, your desktop browser quietly receives (and optionally logs) new messages.
• Retrieval On Your Terms: When you reconnect from another device or location, you can seamlessly fetch logs or continue chats.

2. W Ratchet Encryption

CommunisP’s signature security layer merges time-based ephemeral key rotation with per-message ephemeral expansions:

• Session Key Rotations Every 60 Seconds: Ensuring even if a key is compromised, it’s worthless by the next minute.
• Unique Ephemeral Keys per Message: Each message is independently encrypted, insulating the rest if one key is somehow exposed.
• Forward Secrecy & Post-Compromise Security: Attackers can’t retroactively decrypt old messages or read future ones after a key leak—because ephemeral keys shift so frequently.

3. Ephemeral Local Logs (Optional)

• Local Only: If you enable “Local Message Logs,” ephemeral messages are stored solely on your home browser. No central copies exist.
• Nickname Authentication: Only a device logged in with your nickname can request or clear these logs, and this can also require an additional 'passphrase'.
• Truly Ephemeral: If you prefer no trace at all, keep logging disabled or send a “Clear*” ephemeral command to wipe everything.

Why CommunisP Is Different

• No Central Storage: End-to-end encryption prevents even CommunisP’s minimal servers from reading your messages. They only help peers find each other (signaling).
• Time + Message Ratchet: Beyond typical single-lane E2EE, we tie ephemeral expansions to both message-by-message and minute-by-minute intervals, shrinking the adversary’s window.
• Offline Resilience: Your home browser is your “personal server,” so friends can reach you anytime, even if your phone or other devices are offline.
• User-Level Control: You alone decide whether ephemeral messages persist or vanish, free from corporate retention policies.

Technical Underpinnings (Quick Highlights)

1. WebRTC
   • Circumvents NAT/firewalls via STUN on port 3478.
   • Provides real-time P2P data channels for messages/files.
   • Encrypted transport at the network layer.
2. ECDH + ECDSA
   • Derives shared secrets without exposing private keys.
   • Ensures authenticity of messages (ECDSA digital signatures).
3. AES-GCM
   • Authenticated, high-speed encryption.
   • Protects confidentiality and detects tampering.
4. W Ratchet
   • Time-driven session key resets every 60 seconds.
   • Per-message ephemeral expansions with HKDF or ephemeral ECDH.
   • Eliminates static or long-lived encryption contexts.
5. Offline/Async Support
   • A browser left open at home acts as a 24/7 relay, gathering ephemeral messages so that you can fetch them later from any device.

Typical Usage Scenarios

• Activists & Whistleblowers: Communicate off-grid, no centralized logs, no phone number requirement.
• Personal Chat & File-Sharing: Freed from phone-based constraints, you can share ephemeral files with advanced encryption.
• Work Collaboration: If compliance or security rules forbid storing data in corporate servers, CommunisP’s ephemeral approach is perfect—nothing official to subpoena.
• Everyday Privacy: Just want to keep a private chat private? No big deal—CommunisP is here.

Practical Workflow Example

1. Morning
   • Open your home browser, log in to CommunisP, keep that tab open.
2. You’re Away
   • Your phone is off or you’re not using it.
   • Friends or colleagues message your nickname; your home browser collects any new ephemeral messages.
3. Return & Retrieve
   • On your phone or another PC, log in with the same nickname.
   • If you want to see offline logs, send a special ephemeral passphrase. The home browser confirms your identity, encrypts the logs, and sends them to you P2P.
4. Continue Chat
   • Chat in real time using ephemeral keys that rotate every minute, ensuring fresh security.
5. Optionally Clear
   • If you want to maintain absolute ephemerality, send a “Clear*” ephemeral command, erasing any local logs on your home browser.

The Quiet Revolution

• Truly Off-Grid: Past a minimal handshake, your message content never returns to a central server—ever.
• Off-Limits: No corporate or third-party entity has any read or moderation ability over your conversation.
• User Empowerment: Zero overhead, zero forced phone IDs, zero illusions of “secure” while data is still being mined.

CommunisP stands for a new age of private communication—where you alone decide what’s stored, who sees it, and how ephemeral it stays.

CommunisP is more than a messenger. It’s a quiet revolution in how we exchange data online. By seamlessly combining:

• Browser-as-Server convenience,
• W Ratchet ephemeral encryption, and
• Full P2P architecture

We deliver a system that’s off-grid, off-limits, and in your hands. No phone numbers, no corporate synergy—just encryption, ephemeral privacy, and your personal freedom.

If you’re ready to transcend old paradigms of data-harvesting and central surveillance, visit CommunisP.com, open a tab, pick a nickname, and step into the next frontier of user-driven, cryptographically robust communication.

I need to buy an HSM for a project (need it for compliance with government regulations) and I am kind of confused. Price range is really wide. I can see used THALES nCipher HSMs on eBay for as low as 300$ and as high as 10,000$, even though modules are similar according to Entrust (now THALES nCipher owner) website.

Anyway. Two questions:

1. What should I take into consideration if I want to buy a used model?
2. What would be your general recommendation on the TOPIC?

I am planning to deploy EJBCA as the API/FrontEND of the HSM to integrate it with my platforms.

Hi, I'm a dual CS & math major. I've been accepted into a mentorship program of sorts and will have the opportunity to do (likely remote) research on a topic (if I find a PI)

I'm interested in crypto and have studied the standard intro class to cryptography (classical ciphers and public key) (my university doesn't offer it, so I studied by myself). I also have a project on implementing elliptic curve cryptographic systems and algorithms. And will take abstract algebra next semester (few weeks)

I'm wondering what the 'normal' knowledge gap should be and if I have enough prerequisites to start getting involved in cryptography research. Is there even a decent chance any PIs would consider me, considering my lack of background?

Hello, i'm sort of confused by a small point on Regev's pke.

Say that the the public parameters is (A, u) = (A, s^t A + e) with A matrix, s the secret key, e an error.

I see that in the original paper as well as in follow up papers, the encryption part of the system is of the form (A*r, u*r + m*q/2)

However in the following talk at the timestamp in chris peikert's talk, the encryption is of the form (A*r + e, r*u + m*q/2): https://youtu.be/K_fNK04yG4o?list=PLgKuh-lKre10rqiTYqJi6P4UlBRMQtPn0&t=2097

Looking more into it, i see another paper in which he defines an improved scheme supposed to generalize 3 former iterations of the scheme. All of the older schemes are of the first form, while the proposed scheme is of the 2nd. it's in chapter 3. https://eprint.iacr.org/2010/613.pdf

My question is: what gives? am i looking at papers that are out of date? when someone mentions regev without specifying, will they be thinking of an encryption of the first or second form? What does it change in fine? Is it just that adding an error with one error distribution is equivalent to adding none but selecting r with another distribution?

edit: I also noticed that in ringLWE and moduleLWE, the latter showed up, not the first form

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

The MOV attack works by choosing an elliptic curve with a small embedding degree then using a Tate pairing to map from the curve to a finite field, where the discrete log is sub-exponential.

Can you go the other way? Choose an elliptic curve over a small (~ 2^24 ) finite field with a fairly large embedding degree (~ 125). Then present adversaries with a large (2^(24*125) ) finite field Diffie Hellman protocol, which you then map back to the small curve for which discrete log is easy?

Has this been tried and does it have a name?

The MOV attack works by choosing an elliptic curve with a small embedding degree then using a Tate pairing to map from the curve to a finite field, where the discrete log is sub-exponential.

Can you go the other way? Choose an elliptic curve over a small (~ 2^24 ) finite field with a fairly large embedding degree (~ 125). Then present adversaries with a large (2^(24*125) ) finite field Diffie Hellman protocol, which you then map back to the small curve for which discrete log is easy?

Has this been tried and does it have a name?

This is about the Bulletproofs zk Proof protocol - https://eprint.iacr.org/2017/1066.pdf

(I am going to use additive notation instead of the multiplicative notation used in the paper to describe my question)

Prover knows 2 vectors a & b such that their inner product is c.

She creates a binding (but not hiding) Pedersen commitment to the 2 vectors

P = aG + bH

(Here G & H are 2 vectors of generators - the relations between the different generators both inside each vector of generators & also between the 2 set of generators is not known).

assuming a = [a1, a2, a3] & G = [G1, G2, G3] etc, this commitment will look like

P = a1G1 + a2G2 + a3G3 + b1H1 + b2H2 + b3G3

which we write as

P = aG + bH

c = <a, b>

The Prover sends P & c to the verifier. The verifier samples a random x and sends it to the prover

There is another generator V (the relations between V & G & H is not known)

Verifier constructs another a new point

P' = P + cxV

Let xV = U

The prover proves

P' = aG + bH + <a,b>U

using the Bulletproofs Protocol

• I understand the protocol.
• I also understand why the random x is required - i.e. how the prover can prove a wrong c' in place of c if the proof had just proved P' = aG + bH + <a,b>V instead of P' = aG + bH + <a,b>U

What I don't understand is how this one proof proves 2 things

• Proof of knowledge of 2 vectors
• Proof that c is the inner product of the 2 vectors

How does proving the longer statement prove the 2 things?

I mean proving A + B = C + D doesn't prove A = C & B = D, so how does it work here?

I have my own explanation of why this works but I am not sure if it's correct

For e.g. in many zkProofs let's say we have to prove 3 polynomials to be zero polynomials using the Schwartz Zippel Lemma, we combine them using a linearly independent set.

i.e. if prover wants to prove 3 polynomials f1, f2 & f3 are zero, then instead of proving it using 3 separate Schwartz Zippel proofs, she can combine them into one polynomial.

The Verifier sends a random r. Prover creates a linearly independent set [r^0, r^1, r^2] & then creates a new polynomial

f = f1 + r.f2 + r^(2).f3

Now when f is evaluated at another random point send by the verif & the evaluation is zero, then that proves f1, f2 & f3 are all zero?

is something similar being done here - i.e. the 2 statements are being combined using [x^0 , x^(1)] & hence it proves both statements are true? I am not fully convinced because this isn't a polynomial & nor is Schwarz Zeppel being used here.

Greetings,

I drafted a paper over the holidays about a commitment scheme for ledgers and ledger-like data. My paper might not be much.. but the scheme itself, I think, is powerful. I've yapped about skip ledger on reddit before, but at the time, I didn't know some terms of art to describe it properly. Hope you give it a look and give me constructive feedback.

https://crums-io.github.io/skipledger/paper.html

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

Keccak and Poseidon are both sponge constructions. Keccak’s permutation function is uniquely invertible. This simplifies and strengthens security arguments. Keccak hides 256 bits of internal state when producing an output, so as long as the permutation is chaotic, Keccak is secure.

Is Poseidon’s permutation function uniquely invertible? Can you find two different internal state inputs that permute to produce the same internal state output?

Hi,

Given that essentially all production ECC systems are 256-bit, and that 256-bit is really 128-bit strong in the context of our best attacks Pollards/BSGS.

Do we consider 128-bit enough for the medium term (5-10years).

It's starting to feel too small.

I understand that authenticated encryption provides immallability, that an attacker could not mess with the ciphertext and still have it "decrypted", but if there truly are an infinity number of possible decryption keys, wouldn't this simply gives a tolerance of the messing? Just like how hash is collisible by pigeonhole

I’ve written my own TLS 1.3 implementation (for fun). I would like to keep this up to date when post quantum algorithms come around. I’m guessing a supported_groups extension will be added for one of the algorithms, maybe Kyber.

I understand how NTRU works but haven’t looked into Kyber or other solutions.

What might I benefit from being aware of? Have any proposals been made? Will hybrid implementations be considered? Is there a timeline for this?

For elliptic curves, Montgomery modular multiplication is a somewhat essential optimisation. What similar optimisations are needed when going from pedagogical to performant Kyber implementations?

As part of the venture startup, 'coco-space', under Statecraft Laboratories (unregistered startup), I am trying to explore sustainable tokenomics models to create an economy for a certain COCO Protocol where authenticators, users, and verifiers thrive while maintaining robust privacy guarantees.

💡 If you wish to volunteers/co-author, if interested in collaboratively researching and shaping this tokenomics framework, please do connect!
💡 Also, I would love your suggestions on how to approach it. If you’re passionate about cryptography, distributed systems, or blockchain-based incentives, I’d love to connect too!

Our 'coco-space' is based on COCO Authentication Protocol, a privacy-preserving, decentralized authentication system that decouples digital identity from real-world identifiers. I did already share a post about COCO Protocol earlier on the group, but for the sake of clarity I'll be sharing it here once again:

🔗 Learn more about COCO Protocol: COCO Protocol Overview
🔗 Check out the open-source code: COCO GitHub Repository

Let’s push the boundaries of decentralized authentication together.

Comment below or DM me or connect with me on my email reiki.yamya14@gmail.com if you’re interested in contributing! 🙌

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

What's a good paper on CA root attacks? You know, if the signing chain was compromised; what is there in place to mitigate that?

Hi,

I am working on a decentralized digital identity management system, and I would like to ask for a wider community feedback.

In my opinion one of the biggest issues with decentralized identity management systems is the problem of the long lived private key loss or compromise.

I am designing a system based on an assumption that an average person is totally capable of memorizing a 128-bit cryptographic key. I made a mnemonic system for this exact purpose: https://github.com/dmaevsky/brainvault

If this really works as well as I feel it would, it might open doors to some interesting cryptographic schemes for efficient long term identify management.

While it's perhaps more about linguistics and neurobiology than cryptography, I would really appreciate your feedback on this bit before I start building a cryptographic system around it.

Best year end holidays to everyone )

Since we're sharing our pre-prints, this is my latest research. The use case is low communication overhead digital signatures, good for constrained network environments. I was researching novel lattice constructions and one idea simply led to the next.

Everyone forgot non-commutative cryptography was a thing after braid groups, but the field is still viable. I'd like to polish this paper up and submit it to the CIC journal next month, so I'm looking for co-conspirators to help. Let me know if you have questions, on reddit or signal.

https://eprint.iacr.org/2024/2074

Hi everyone,

I want to use libsodium in PHP in a little code signing/verifying library I'm writing. I had a working implementation in OpenSSL, but that extension isn't always installed on hosts, where it seems that libsodium mostly is.

The API seems pretty straightforward, with one exception - how does one safely store the private key on disk? With Openssl, I was using a user entered passphrase to encrypt the private key. That meant if the key was stolen from the disk, it would be useless without the passphrase. When using the key to sign ZIP files, the user was also prompted to enter the key to get access to the private key. I felt pretty safe that way, given how insecure some shared hosting providers are.

I don't seem a simple way to do the same thing with sodium. You can create a private/public key, but at that point you can't easily encrypt it , not without OpenSSL I don't think. The same seems to be with saving it to disk - it seems I can save it was binary data, but not in any portable key format. Can anyone recommend a portable way to do this safely? Thanks.

Hi guys, in few words: my head wraps around visual representations way way way easier than math math models and watching visual presentations (better if they are interactive) makes my knowledge more flexible.

I'm aware of the representation of the curve on the Real filed, it is very clear of course, the geometric pointadd and pointdouble is so easy to visualize.

I'm aware of the classical grid representation on the finite field as well, not very useful to be honest.

I'm aware of the torus representation, very cool, I should look more into it (is it on the finite field by the way?)

I saw a youtube short that was showing with a terrible video resolution how the curve on the Real field was "wrapped" and "cut" to make it fit in the finite field grid, however the video had no information about that at all and everything was about the torus representation (which if I'm not wrong is just the finite field grid bended to shape a donut(?)), I would like to know more about this "cut" representation.

I heard about some polar-coordinate representation(?), what is that and how can I find something about it? (searching for polar representation of jacobian coordinates doesn't show me any visual representation).

I will work on a simple visual 3d representation that highlights how the different triplets of point are one the double of the other, the other the half of the one, etc.

Are you guys aware of some other interesting visual representation that are worth it?

Thanks

🌟 Dear Scientists, Researchers, Scholars, and Enthusiasts, 🌟

I am thrilled to announce the pre-print of my latest research paper, now available on the International Association for Cryptologic Research (IACR) ePrint archive. 📚✨

Goal: To authenticate accurately and securely without revealing both virtual public identifiers (e.g., usernames, user IDs) and real-world identifiers (e.g., passwords, biometrics, or other secrets).

💡 Introducing COCO:
A full-consensus, zero-knowledge authentication protocol designed with:

• 🔒 Efficiency
• 🕵️‍♂️ Unlinkability
• ⏳ Asynchrony
• 🌐 Liveness

COCO is built on Coconut credentials—a selective disclosure, re-randomizable credential scheme—and Oblivious Pseudorandom Functions (OPRF) to ensure both privacy and scalability in distributed frameworks.

🎯 This research is part of a larger project under Statecraft Laboratories to create a privacy-first virtual space.

🛠️ Explore the Codebase:
Check it out on GitHub.

📩 Let’s Collaborate!
Your expertise and feedback—whether on theoretical foundations, practical implementations, or potential optimizations—are invaluable.
Feel free to reach out via:

• Email: reiki.yamya14@gmail.com
• Or connect on Reddit itself!

Looking forward to insightful discussions and collaborations! 🤝

Warm regards,
Yamya Reiki 🌿

I'm looking for prior art in encrypted object formats intended for encryption at rest (or store and forward messaging) for objects in the kilobytes to gigabytes range. Most probably involve marshalling together some symmetrically encrypted data along with a metadata block that includes details on key management and transports the data encryption key wrapped with recipient key(s).

Would love any well-designed examples I can look at for ideas, or problems you've encountered with such designs and implementations.

Currently I have:

• PKCS#7 (S/MIME, PEM)
• PGP
• Crypt4GH
• AGE
• Tink's wire format
• JSON Web Encryption

But I'm sure this wheel must have been reinvented many times.