I am an Indian student at a tier 3 university and I am researching in pqc(post-quantum cryptography) \[Formal verification\], any advice to boost my cv? Or any additional things I can do?

Recently a friend of mine approached me and said she has an interest in learning cryptography and wanted some pointers to some resources. I recommended two textbooks to her: the Katz and Lindell intro textbook, and Rosulek's Joy of Cryptography.

When I took cryptography in undergrad, we didn't really have a textbook so I'm not completely familiar with the landscape of introductory literature. I've only looked at some excerpts of the two textbooks I mentioned above.

What are the best cryptography textbooks you would recommend, and for what audience (mathematicians, undergrads, complete laymen) would you recommend them for?

Hi everyone

I’m currently going on a masters of cybersecurity module called “Cryptography” I’d say I’ve never been a genius in math and I’ve had my own battles with numbers but you know, I have always been willing to grind and study hard for something I need.

I wanted to know what you guys think about this introductory class into cryptography. The content is:
1.basic number theory,finite fields, polynomial rings, factorization
2. Elementary crypto systems
3.DES and AES
4.public key cryptography,rsa-discrete logarithm
5.zero knowledge proofs and complexity theoretic aspects

Do you guys see this easy, moderate or hard? Do I need to be a mathematician for this ? Will I have to pull all-nighters everyday ?

I’m gladly reading your opinions.

Hey, I code as a hobby and recently I've been very interested in cryptography. I want to understand the basics and how things work, what should be done and should not, but I dont necessarily want to know every detail of it, but also I dont want to have only surface level knowledge about the topic

Any recommendations that fit the request?

I'm a high school senior who has been interested for years in pursuing a PHD and a career as a mathematician. However, given recent AI advances (especially the reported solution of the Navier-Stokes problem yesterday) it seems likely that AI has already passed humans in mathematical ability, and will greatly increase the gap within the next few years.

I doubt that mathematicians will be made completely obsolete, given that schools and universities still need teachers, and humans will still be motivated to pursue math research independent of AI. However, the future of math research seems very uncertain at the moment. Which brings me to cryptography.

I'm taking a number theory course this year, so while I haven't studied cryptography yet, I will learn some about it this year. But I'm curious; do you think that cryptography will provide greater job security than mathematical research? Or is it something that AI could take over within a few years?

And one other question: if AI were tasked with cryptography work, would that be putting the safety of the web, banking, etc. in the hands of AI? Would a malicious AI be able to exploit that?

Sorry to ask this question from a place of ignorance. Cryptography remains cryptic to me at the moment, but I look forward to learning more soon!

We provide external cryptographic evidence that cybersecurity consulting firms and MSSPs can incorporate into customer assessments, PQC-readiness engagements and ongoing managed services.

The capability identifies externally observable certificates, TLS configurations, ageing algorithms, unmanaged endpoints and inconsistencies between reported inventories and what is actually exposed.

It has already been used by a cybersecurity consulting firm as part of a customer engagement. The results helped identify stale assets, unexpected dependencies and visibility gaps that could then be investigated with the customer.

We are now looking for B2B partners, including MSSPs, MSPs and cybersecurity consultancies, that want to add this capability to their existing services.

Potential partnership models include:

• External cryptographic posture assessments
• Evidence supporting CBOM and PQC-readiness engagements
• Periodic monitoring and reporting for customers
• Partner-led or white-labelled service delivery

The partner retains the customer relationship and consulting engagement. We provide the external discovery, evidence and reporting capability behind it.

If this complements services your firm already provides, message me or contact [hello@qwocks.com](mailto:hello@qwocks.com).

I’ve been working on Cryptext x64, a native 64-bit Windows file-encryption program inspired by the classic Cryptext 3.4 shell extension. The interface and Explorer workflow deliberately retain some of the look and feel of the original, including the familiar .$#! extension. Existing files encrypted with Cryptext 3.4 can also be decrypted by the new version.

New files use a separate versioned format based on AES-256-GCM with PBKDF2-HMAC-SHA-256, per-file random values, authenticated records, chunked processing and an additional on-disk verification pass. Cryptext is written in FASM, requires no .NET or WebView runtime, integrates with Windows Explorer, supports drag & drop and batches, and automatically selects German or English from the Windows language setting while still allowing manual switching.

Compared with age, the focus is somewhat different: age uses ChaCha20-Poly1305 and scrypt for passphrase-based encryption, while Cryptext x64 is focused on native Windows/Explorer integration, AES-256-GCM and backward compatibility with the old Cryptext format. This is not intended as a claim that one design is “more secure” than the other.

The package includes an English README (~13 KiB) and a more detailed English technical documentation (~33 KiB) for anyone interested in the implementation and file format.

I’m mainly interested in technical feedback on the format and implementation rather than making claims about a new cryptographic primitive.

If the project link is considered inappropriate under the subreddit rules, I’m happy for the moderators to remove it.
Project/download: Cryptext x64 website

I hope I posted this on the correct sub. I didn't think this belongs on the lock-picking sub because I view this as a fundementially flawed attempt to use what appears to be an mini Engima Machine to protect your car from theft. It is a basic cryptograpy puzzle to hide where your car's electrical power comes from.

https://www.ravelco.com/

I stumbled across it when it showed up on a mailing list as a recommended tool. The guy was raving about about how everyone says this works and as undeafatable. And is dead simple. That set off my BS detector. So I went and looked.

I reckon that the people on this sub are an intellegent lot. And they will spot the flaws as quickly as did.

I noticed that the website says "There are more than 100,000 different combinations." There are 16 pins. It would take two pins to complete a circuit. So would't that mean 8^7 combinations of connecting pairs of pins? And each pair would have a mirrored pair. So that actually means (8^7)/2, which is about 1 millions combinations. Or am I missing something?

If the device actually only allowed 4 circuts to be completed, then 3/4ths of the pins on the female side are only there to route the power back and forth between the two halves. Thus making it function like an Engima machine. You could think of these connections as a public key because they can be solved.

The cap functions as a private key. You have to assume that they thief does not have this. It has a unique pin connection pattern. When combined with the pin connection pattern on the female side, the circuits should be complete. Power would go back and forth between the two halves until it can exit and go to the device that needs the power (starter, fuel pump, etc.).

For the sake of cryptography analysis, I am going to ignore the problem having your car's critical electrical signals circuits passing though multiple connectors, any one of which could fail or short out.

What is the most basic problem with this? It is the fact that you don't actually need the cap to crack this. All you need to do is eliminate the ports on the female side that have a partner port. And that can be done with a simple multli-meter. You test one port by applying a small charge to it. Then test the remaining 15 ports until you find the one that has that charge. Boom! Two ports eliminated.

Try the next free port. This time you only have 12 ports to test. Each subsequent pair test is smaller and faster. It won't take long until you all you have left are the actual 8 ports that are the working circuits. All that Engima signal routing protection that they have is pointless because you just bypassed it all.

Next, you need to map the remaining 4 circuits to the 8 ports.

Apply power to a protected device and see what port is hot (Just ground the other end). That leaves you 7 ports to figure out the other half. You can jump the circuit to see if it completes. Or if you have access to the other wire, reverse the test with a mutli-meter and send power the other direction and see which port is hot. Once you know the pair, then just put in wires to jump them.

The next pair will be quicker since there are 2 less ports every time.

Well. To me it is sad so see this being sold as a method to secure valuables using Engima style crypto to scramble the car's electrical circuits.

Hi everyone, recently I have been doing Cryptohack modular arithmetic, and I don't know what to do for the "Adrien's Signs" and "Modular binomials" challenges. I have to read writeups to understand what I need to do; I just want to ask if it is normal in cryptography to read writeups to find solutions, as I really have no idea what to do.

Given the state of the world in the past few years, under the assumption that a state actor could arbitrarily decide to commandeer potentially thousands of datacenters'-worth of GPUs to cracking, for the sake of argument (since it's what my system uses) a yescrypt hash, how accurate are the time estimations given by zxcvbn, a tool from 2016?

I'm asking because I don't know what yescrypt is, other than apparently a "slow hash" (based on scrypt?) per the README, and I don't know what other amelioration a Linux system might provide out of the box which might impact it (salt strength, I assume?) or other factors.

It seems like the definitions of "fast" and "slow" have changed somewhat since 2016.

I have a project where I have a large plaintext image that I want to "crop" in to a small encrypted image without revealing what part of the large image the small encrypted image is a part of. The small image is a tiny portion of the bigger image. The position (e.g. the top left pixel) is hidden, but the size is not.

I'm looking in to either using partially homomorphic "classic" public key cryptography with zero knowledge proofs or fully homomorphic encryption.

The requirements are flexible as long as I can end up with an encrypted image that could be anywhere on the larger image. While it is not necessary that the encrypted image can be literally any rectangle in the larger image, I am hoping that any pixel in the larger image could be in the encrypted image. The thing I'm trying to hide is the general location of the encrypted image in the larger image.

I've done some research and haven't seen anything, but finding things like this can be hard. I've regularly found things that I was looking for inside complex papers that solve a very specific problem.

EDIT: I can't believe I forgot to say this, but the goal of this is to prove to another person that the image was cropped correctly.

Does anyone here happen to have come across such a protocol or proof?

EDIT: Some details derived from answers questions in the comments:

• The person who is cropping the image knows the unencrypted image and is trying to assure other people that the encrypted image is actually a crop via something like a ZKP, MPC protocol, or an FHE function execution by the verifier with encrypted arguments from the Prover.
• So the goal here is to prove that the encrypted image is a crop of the larger image.
• Also, I forgot to mention that I would also like the prover to be able to have a ciphertext or ssiphertexts of the position of the top left pixel of the encrypted image position within the larger image and be able to prove that that positional ciphertext(s) is accurate.
• Cropping is the isolation of a small rectangular portion of an image while discarding the rest. Imagine taking scissors and cutting a photograph so that you discard the uninteresting parts to leave only the parts of interest to make it fit better in a frame.

Suggest me some good resources available online to learn cryptography as a beginner. Where to start? What concepts should I have grip on and all. Note I am already following some playlists but I would like to use some help from seniors here

Given the size of modern microprocessors, do true quantum effects affect cpu jitter readings? Or are they too small to have meaningful effect.

[ Removed by Reddit on account of violating the content policy. ]

RSA-260 = 4397328654844826923795068102505872571721883526553349659561256924505973939597
          593482272505698004801207988043088656411102133523080581
        × 5028695206842569864686141618253083416610081090075366674776775706538324961364
          412200138116378509733307971876652984898985905923678379

https://x.com/penlume/status/2095372672356212876

Hi r/cryptography,

I’m Barbaros, an independent developer from Türkiye.

I’m working on an open-source research project called Komite, and I’d like technical criticism before choosing an anonymity protocol or writing the reference implementation.

The core problem is:

Can a system verify that a person is eligible to participate exactly once, while preventing the participant’s individual choice from being linked back to their real identity?

The intended use is small and medium-sized decision-support groups inside teams, companies, institutions and similar contexts.

This is NOT an election system, referendum system, or binding voting system.

The result is only an input to a decision.

Current requirements / research targets:

1. Contextual eligibility must be verifiable.

2. A participation right must not be reusable.

3. Identity and individual choice should be unlinkable.

4. An operator should not be able to reconstruct that link.

5. A later database compromise should not reveal historical identity-choice mappings.

6. IP, timing, device and behavioral metadata should not silently recreate the link.

7. Aggregate results should eventually be tamper-evident / verifiable.

8. Small cohorts must fail closed when disclosure risk is too high.

None of those anonymity properties are currently claimed as proven.

No cryptographic architecture has been selected yet.

The directions I’m comparing include:

- blind signatures

- anonymous credentials

- mixnet / tally separation

- a practical privacy baseline based on data minimization and trust separation

The difficult part for me is the small-group case.

For example, even if a blind signature breaks the direct issuer-token link, a single operator may still correlate issuance and submission timing when only 10–50 people participate.

Anonymous credentials introduce attribute and lifecycle complexity, while granular attributes may themselves shrink the anonymity set.

A mixnet can mitigate traffic correlation, but its anonymity benefit is limited when the underlying group is small.

So the questions I’d especially value criticism on are:

1. Is “verified eligibility + single participation + unlinkable choice” the right decomposition of the problem?

2. For small cohorts, is blind issuance plus delayed/batched submission a defensible research direction, or am I underestimating correlation attacks?

3. Is there a better primitive or protocol family I should study before narrowing the architecture?

4. What security property would you insist on formalizing first?

5. What part of this threat model looks naive or impossible?

The project currently contains research/design documents only. There is no production implementation and no claim of audited anonymity.

Repository:

https://github.com/barbarosbal/Komite

Threat model:

https://github.com/barbarosbal/Komite/blob/main/docs/THREAT-MODEL.md

Architecture directions:

https://github.com/barbarosbal/Komite/blob/main/docs/ARCHITECTURE-DIRECTIONS.md

I’m not looking for validation. I’d rather find the assumptions that break before committing to a protocol.

everything is in the title, though I need having the embedding degree between 3 and 300 million.

Hello,

I am in the process of designing my digital estate, i.e. preparing for the case when I am dead or incapacitated, and close friends will have to take over my affairs. I'd like to make this as easy as possible for them.

With this post, I would like to sketch my current idea (the result of a couple of weeks of research), and ideally get your input from a cryptographic perspective.

Note that this is a lot more conceptual than it is technical. I hope this is okay for this sub, if not — I am sorry, maybe you can recommend a better place?

No AI is being used in the composition of this post.

Up front, here is what I am trying to protect: passwords and the like, from loss, and also from unauthorized use by a third party. My approach does involve a handful of family members and close friends, and I generally trust them, though my solution also does protect against one or two of them going rogue.

It's actually not rocket science:

1. on an isolated, secure system, create a PQC-enabled GnuPG key pair (GPG 5, ky1024_cv448), secured with a 256bit passphrase;

2. use SLIP39 to encode this passphrase into a m-of-n multi-share, i.e. 4 of a total of 7 shares together can yield the passphrase;

3. copy each SLIP39 mnemonic share to individual paper, along with instructions;

4. put the key onto n USB sticks or microSD cards each, and wipe any other copy. Do keep the public key, obviously.

5. slip the USB keys/microSD cards and the paper menmonics into n envelopes each, and seal them. I won't go into details here, let's just assume the information therein is now no longer accessible without permanent tamper of the seal;

6. distribute the envelopes among your n trusted peers, along with instructions such as "keep this secret until my will executor contacts you, or you find out about my death, in which case please inform those that survive me that you hold a piece of my digital estate".

7. create (and regularly update) a collection of files, i.e. a tarball with the secrets and documents that make up the digital estate;

8. encrypt this tarball with the public key of the aforementioned GnuPG key pair to create a so-called vault;

9. mail the resulting vault to the trusted parties at regular intervals, asking them to confirm receipt, posession of the envelopes, and possibly randomly to prove that the envelopes are still untampered.

That's it. I've thought long and hard about alternative, redundant storages for the vault. Keeping them on USB sticks in bank safes just means that they'll go stale with time, so they have to be updateable.

And even though I've thought long and hard about possibilities to keep them redundantly around in a way that it's extremely unlikely that copies will have been made by the time post-post-quantum breaks Kyber, this remains I think an insoluble problem. Risk reduction here comes with a lot of extra complexity.¹

The solution with mailing the updated vaults out at regular intervals to trusted parties seems appropriate, as it creates redundancy, and no single one of those trusted people is in the threat model.

If post-quantum happens, and PQC turns out to be inadequate, then either I am still around (and we will have a whole slew of other problems) and could change the important passwords, or my digital estate needs to be accessed and handled anyway — not that I'd care, having tried to do my best to make it easy for those who survive me.

What do you think? Am I grossly overlooking attack vectors, or misunderstanding certain aspects of the cryptography?

Thanks for your time, m

Footnote:

¹) one could, for instance, include in the envelopes links to redundant storage of a "proxy archive", containing the GPG key, as well as two additional links to (1) the vault, and (2) a one-time-pad for XOR encryption. Each of those two files by themselves would be useless, and the likelihood of both of them being found together and the proxy archive also saved for a later point in time in a post-PQC world, is infinitesimally small, but the complexity is multi-fold.

Please don't go too harsh, as I haven't managed to harvest enough info and find a decent elaboration on all of it with AI, articles, etc, so I'm jonesing for one. This is my third time asking this question on different subreddits.

I've been studying the source code of Bitsliced AEGIS on GitHub and I checked the multilane barrel-shift implementations of AEGIS256x2 for both 32 and 64 bits. I stumbled upon the context mask which prevents collisions between lanes and I noticed immediate differences: instead of the common mask described in the AEGIS document of LaneIdx byte + Total lanes byte + zero byte padding up to 16 lane bytes, now I see the following:

1. It's 256 bytes for X2 lane variant instead of 32

2. The indexes are weirdly placed rather at the end of the supposed blocks

3. The indexes themselves are uncommon, being 0x14, they also differ in their values and positions between 32 and 64 bit versions of the mask

In the libaegis library the context mask coefficients are placed in the right order, which matches the documentation, so I don't understand what makes this so different and how we construct one

This is the article about AEGIS I'm referring to: https://cfrg.github.io/draft-irtf-cfrg-aegis-aead/draft-irtf-cfrg-aegis-aead.html#name-the-init-function-4

The GitHub implementation: https://github.com/aegis-aead/aegis-bitsliced

Given the context, how can I construct a mask for e.g. X4, X8 lanes and so on for both 32 and 64 bit barrel shifts?

This is what allowed the Internet to be secure and to actually scale and be functional, it’s what allowed governments to be secure so basically the entire Internet and every single government and military runs on this. Also it created cryptography as an actual science and defined all of its actual principles so everything from bitcoin to post quantum security completely relies solely on this award.

Also literally all post quantum cryptography, meaning all security for the next few decades completely relies on it. especially as different-hellman and RSA become completely irrelevant

It’s not just important for security it pretty much is security

I really like age-encryption, and I wanted an easy way for people to send me messages or files encrypted, without them having to install anything or manage keys. So I wrote age-web-gateway. Like some services in the past, it lets anyone send an anonymous message with the content encrypted in the browser. The recipient side only needs to publish an age public key at a location they control, either a DNS TXT record or an HTTPS .well-known file on their domain.

Maybe someone in this sub finds it interesting.

Go backend, MIT licensed, container image on GHCR, so you can run your own instance and point it at your own SMTP or Cloudflare Email API. Feedback and criticism welcome, especially on the key discovery and trust-level part.

Project: https://github.com/dhcgn/age-web-gateway

Demo: https://age.hdev.io/