texts:
I'm reading the article about SPDZ protocol for secure multiparty computation (and also improvements for offline phase like MASCOT).

However I'm thinking about practical application of SPDZ for AES encryption/decryption.

I have the following assumptions:
There are 3 parties $P_1, P_2, P_3$ from which $P_2, P_3$ each has a share to compute AES encryption/decryption, so no party should have knowledge of the whole clear-text AES key. Party $P_1$ has a clear-text, which should be encrypted, and do not want to share its value either.

I believe that I understand the setup correctly. Now, using the SPDZ, there is an offline preparation protocol which should distribute across parties shared secret key $[[\alpha]]$, triples $(\langle a \rangle, \langle b \rangle, \langle c \rangle)$, and pairs of random values $\langle r \rangle$, $[[r]]$. These are distributed to all parties using public key $pk$ and verified using $\Pi_{ZKPoPK}$.

Then in online protocol parties share their inputs $x_i$. And SPDZ can perform addition and multiplication on circuit using shared secrets.

How can the AES encryption/decryption computation be done in MPC? What is the secret AES key and how can the key be shared between 2 parties and have a different party join in the protocol with the plaintext? Should parties $P_2,P_3$ share the key using SPDZ and then party $P_3$ will use its share to see the real clear-text and cipher-text?

I would like to know it from practical point of view, there are many theoretical articles, I do not understand how to implement it in real world.


texts: Where can I learn basic cryptography to know more about passwords and Bitcoin?

texts:
Basically my knowledge in passwords consist of setting up a Diceware master password back then, and I know hashes are not convertible back to the original password.

Some basic question I want to know the answer for is how can a password be predicted from the hash? Like it can be known how many characters long it is exactly or at least roughly?


texts: What is the practical impact of using System.Random which is not cryptographically random?

texts:
I recently noticed a .NET software using PBKDF to derive an encryption key from a password string. This password string was dynamically generated using System.Random. Now, I know that System.Random is not really cryptographically random and should not be used for security purposes. Moreover, there are several flaws in .NET's implementation of System.Random.

But my question is this:

What is the practical impact of using System.Random to create a password string and deriving a key from it. Is it really possible for us to reproduce the key at a later time? Are there feasible attacks that will allow me to deduce the random string generated in this context with high probability? Or is it the kind of vulnerability that can only be exploited in specific "lab" conditions or scenarios?


texts:
Say that a friend of mine and I have both generated new PGP keys, and we want to use a video call to verify each other's new keys because we live on opposite sides of the planet. While we could both somehow share our public key and then read back the fingerprint, reading a fingerprint is a bit cumbersome, especially given that we both have to do it.

After I came across this "problem", a potential solution dawned on me, but I wanted to check here whether it will actually securely verify the new keys.

I download what purports to be my friend's new key from somewhere.
I encrypt and sign a message containing two random English words using my friend's alleged new key.
We start the video call, and I tell my friend the first word in the email.
My friend decrypts the message and checks that the word was indeed the first word.
My friend then tells me the second word in the email (which I can verify since I sent the email).

I believe that if we both get our words "right" according to what was in my original mail, I can now trust that the key I have is my friend's new key. Furthermore, my friend can now trust that the key that signed that email is my new key.

While this may seem like a very roundabout way of achieving this, it is actually very simple to do if you're on a UNIX box:

shuf -n2 /usr/share/dict/words | tee /dev/stderr | gpg -sear <friends-key> | mail -s "Key verification keywords" <friends-email>

My question (finally) is now whether this scheme truly does verify our new keys, or whether there is some gaping hole I've missed?

Update 1: Come to think of it, the signature here can easily be forged as an attacker can just re-sign the encrypted blob with their own key. However, if the fingerprint is also included inside the encrypted part of the message, I believe it would still be secure.. The new command would be:

(shuf -n2 /usr/share/dict/words; gpg --fingerprint <my-key>) | tee /dev/stderr | gpg -sear <friends-key> | mail -s "Key verification keywords" <friends-email>

The friend would then check that the signing key has the same fingerprint as the one contained in the message before trusting it.

EDIT: I only say video call because it would be easier for someone to pretend they're my friend if all I had to go on was the voice.


texts: How to make an AES implementation using lookup tables immune to cache timing attacks?

texts: I recently made a very naive implementation of AES using lookup tables, but it's totally unsafe because of timing attacks. I am not interested in using the processor specific instructions for AES, which is used practically, since I wanted to make a cool project with AES ! Is there any way to prevent my AES implementation from being insecure  ?


texts: What are differences between $E(F_p)$ and $E(Z_p)$?

texts:
When I read some books about elliptic curve cryptography noticed that. sometimes symbolized elliptic curve over $F_p$ is $E(F_p)$ and sometimes symbolized elliptic curve over $Z_p$ is $E(Z_p)$.

I know p is prime number In both cases.

I wonder. Is there a difference between that symbols or they have same meaning .


texts: Slide attack: creating an actual attack on the Simon Cipher

texts:
I have been reading the Simon Cipher paper.  It has the line: "The SIMON key schedules employ a sequence of 1-bit round constants specifically for the purpose of eliminating slide properties and circular shift symmetries", and I am curious.

I have read on the theoretical attack, but I am trying to find an approach to learn about the actual attack.  I hope to break the Simon key schedule to make it susceptible to a slide attack and the SIMON32/64 bit-width is small so it might be possible.   If I remove the constant z0 that is added to protect from a slide attack, I should be able to succeed in the attack.

Is there a good primer for slide attacks?


texts:
In the paper of the Honey Badger BFT link, which is a BFT algorithm, that makes use of cryptography, there is described an algorithm for a reliable broadcast with erasure codes. Following part of the algorithm is relevant for this question:

upon input(v) (if Pi = PSender):
  let {sj}j∈[N] be the blocks of an (N −2 f, N)-erasure coding scheme applied to v
  let h be a Merkle tree root computed over {sj}
  send VAL(h,bj,sj) to each party Pj, where bj is the j-th Merkle tree branch

upon receiving VAL(h,bi,si) from PSender,
  multicast ECHO(h,bi,si)

upon receiving ECHO(h,bj,sj) from party Pj,
  check that bj is a valid Merkle branch for root h and leaf sj, and otherwise, discard

The formulation "check that bj is a valid Merkle branch for root h and leaf sj" opens the question of how I can verify that. How is the tree supposed to look? Is it a binary Merkle Tree? If yes, what is the j-th branch then? Is it a tree of depth 1, so that every block is a branch of the root?

For an example of 10 (1,...,10) parties, me being party 5 and the sender being 1: I received VAL(h,b5,s5) and then for example ECHO(h,b10,s10), how can I verify with just having h, b5, b10, s5 and s10, that b10 is a valid Merkle branch?


texts: Key Derivation Function (KDF) usage for password storage

texts:
Is it safe to use a KDF implementation in order to store passwords?
More broadly, is this standard? Do IT-companies really use KDF? Or do they usually rely on other algorithms?
If you have any practical example for the second question, I would appreciate it.


texts: What are limitations of Universally Composable (UC) framework?

texts: I am beginning to read some UC framework papers, and I guess it is similar to the simulation-based security analysis. I can understand the main advantage of UC is to assist us to analyze the composable protocol. But I am wondering what are the main limitations of UC? I note that it is non-trivial to transform simulation-based security (or game-based security) into UC security. But does there exist compiler to transform form simulation-based security to UC security.


texts: How is an X.509 public key used for TLS?

texts:
Wikipedia's TLS article says:

  The client responds with a ClientKeyExchange message, which may contain a PreMasterSecret, public key, or nothing. (Again, this depends on the selected cipher.) This PreMasterSecret is encrypted using the public key of the server certificate.

The parenthetical remark is interesting. It implies that if there is no premaster secret (which I believe is the case for a DHE key exchange), then the server's public key is not used. However, the server needs to prove that it has the corresponding private key. So where does that proof happen in the protocol if RSA key exchange is not being  used?


texts: How do I use LDPC for distributed error correction

texts: If I have bit sequence X at Alice and correlated sequence Y at Bob. How do I use LDPC to correct errors in Y such that X = Y. All examples I've seen about classical LDPC assume X is modulated, passed through a channel, and then demodulated at Bob to calculated LLR for the LDPC decorder. In my case I don't want to send X. Sending the syndrome of X is OK, but how do I go about using that information for belief propagation at Bob and how do I get LLR?


texts: Is that possible to prove that 'I do not know something' (i.e, the private key for a Bitcoin wallet) using cryptography?

texts:
Is that possible to prove that 'I do not know something' (i.e, the private key for a cryptocurrency wallet) using cryptography?

The problem might be nonsense at first glance. But the intuition for this might be to prove that I do not hold the crypto coins under a specific wallet.


texts:
When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$.

I believe this would be the correct solution (correct me if I'm wrong):

Each party computes $x_i + y_i = z_i$
Each party shares $z_i$ with the other 2 parties
Each party uses Lagrange basis polynomials to compute the secret (using the 2 obtained values).

My question is this: if the shares are in the form $(i, f(i))$  (for $1$ to $i$) my assumption is that the involved parties can use Lagrange basis polynomials because they will know the "$i$" of the other parties that sent them their computed $z_i$. Is that correct?


texts: Is there a hash function whose security can be extended by length?

texts:
Some old hash functions have been proven to be unsafe. This is mainly due to two reasons:

The computation power of machines are increasing.
People have discovered algorithmic flaws in those hash functions.

Strictly speaking, these two reasons have very different implications. The first may be remedied by extending the length of the block sizes, the number of rounds, or other variables used in the algorithm. But the second reveals intrinsic flaws in the algorithm design.

Hash functions are usually based on simpler cryptographic primitives, and there should be provable reductions from the security of the hash function itself to that of the underlying primitives. Thus I'm wondering whether there exists a hash function whose algorithm design is provably secure (given that the underlying primitives are secure), and its overall security only depends on the length of variables. Such an algorithm can be easily extended to cope with increasing computation power without much effort.

Is there such an extendable algorithm? If so, what is it? And why do people keep inventing new algorithms instead of extending this algorithm? If not, why?


texts:
Does SHA-1 meet the strict avalanche criterion? I've been looking for a paper to cite on this, but haven't found one.

It's something that seems to be easy to check (in "On the Design of S-Boxes", Webster & Tavares lay out how it can be done), so it is surprising to not find a paper on it.  Has it been put down as a small result in some other paper?  Or has the SAC been discarded as a useful metric?  Or have I somehow missed the relevant paper (accept my apologies if so!)?  Any pointers would be gratefully appreciated.

Edit: is Hash function balance and its impact on birthday attacks relevant?  Is the "balance" metric simply a better/different way of expressing the SAC?


texts: Authenticated Encryption with smallest Overhead (Input and Output)

texts:
I'm searching for the authenticated encryption algorithm that produces/requires the least overhead in total. This includes the authentication tag that it produces and the additional input that has to be sent along the message for a secure use of the algorithm in a communication protocol.

Let's take for instance GCM:
It requires a 96-bit IV which is usually split into a 32-bit explicit nonce and a 64-bit counter. The authentication tag has to be 128 bits long (according to Ferguson). Thus, the total overhead is 196 bits.

But what about other algorithms such as CCM or EAX, etc.? Can they use shorter IVs or are they also secure with 64-bit authentication tags? Do they have other vulnerabilities that affect the overhead? What about an even smaller 32-bit tag?

If there are more authentication encryption algorithms that require the some amount of overhead which is the one with the least computational effort?

I know this question might be related to this post. However, he wants to use AES-CTR and then do his own MAC computation with HMAC instead of using a single authenticated encryption algorithm. I'd just like to use one algorithm like GCM, CCM or EAX.


texts: Security strength for encryption and authentication (wrapping) of cryptographic keys

texts:
Let $K$ and $M$ be AES secret keys. The purpose is to wrap $K$ using $M$ to allow $K$ to be used at a later time (see, e.g. NIST SP 800-38F, section 3.1). One method to achieve this goal is to use $M$ with an Authenticated-Encryption algorithm such as AES-CCM or AES-GCM. Another way is Encrypt-then-MAC such as AES-CBC + AES-CMAC with independent keys $M_1$, $M_2$.

The general question is how one must choose the values for the parameters in the above methods in order to preserve the security strength of $K$. To be more specific:

What should be the size of $M$ (relative to the size of $K$)?
Suppose $K$ is an AES-256 key and $M$ is an AES-128 key. Presumably, encrypting $K$ with $M$ will reduce the security strength of $K$ to 128 bits since the complexity of a brute-force attack on the wrapped key is $\mathcal{O}(2^{128})$.
What should be the size of the authentication tag (relative to the size of $K$)?
Now suppose both $K$ and $M$ are AES-256 keys so there shouldn't be an issue with the encryption mentioned in the previous paragraph. However, in all the algorithms mentioned above, the maximal tag size is 128 bits so in all the cases the authentication can be attacked with complexity of $\mathcal{O}(2^{128})$ regardless of the size of $M$.


texts: estimating entropy/randomness as fail-safe mechanism

texts:
Real-world encryption systems are often not broken algorithmically but because the implementation has a bug. Sometimes the bug only happens in circumstances that could not have been foreseen, such as weak random numbers, or an error in a library causing e.g. predictable IVs.

So I wonder, are there workable methods of estimating randomness or entropy that could be helpful to detect (a subset of) actual failures in cryptographic systems?

As a simple example, such an estimator could be fed with consecutive CTR IVs and alert higher protocol layers when there is an apparent failure, because all IVs are identical for example. Or an estimator could be fed with encrypted DES output to detect a bug in the implemention.


texts: Do I need to implement multi precision arithmetic operations?

texts: I want to implement Elliptic Curves arithmetics (for edu purpose and better understanding) for special NIST primes: point addition, exponentiation, etc.. all operations needed for EC encryption/decryption, digital signatures, and key exchanges. I'm interested in only special NIST primes, not in implementation for a general curve. Do I need to implement a multi-precision arithmetic for some fixed word size (32, 64) such as add/sub, reduction, inversion, Montgomery reduction, and so on? As far as I understand these primes are selected so that implementation is fast comparing to a general implementation.


texts:
Is there a way to generate thousands of PGP keys at a very very fast rate?

I am generating thousands of 3072-bit PGP keys looking like part of a personal research project. Obviously, this is a very slow, CPU intensive activity. I have turned off strong randomization with the --debug-quick-random, am generating them using --batch and maxed out all of my personal CPUs. But this is still not fast enough.

Is there a way to generate perhaps thousands of keys very rapidly? My goal is to get a 16-bit hash collision on the KeyID. I know this is entirely impractical for real security, this is mostly for research purposes. I have not reviewed the GnuPG code, but I am trying to avoid writing any code just yet.

Thanks!


texts: Rehashing PBKDF2 hashes - do iterations stack?

texts:
Let's suppose I have a bunch of PBKDF2 hashes in a database. For the sake of keeping this simple, let's say I've used 10 iterations. A few years later I decide to upgrade to 20 iterations. I want to upgrade all hashes in one go so I rehash the old hashes instead of waiting for all users to log in. Do I use 20 or 10 iterations?

Basically, what I'm asking is this:

pbkdf2(20, password) == pbkdf2(20, pbkdf2(10, password))
pbkdf2(20, password) == pbkdf2(10, pbkdf2(10, password))

By == I mean equivalent in terms of security.

Which of the two is true?


texts: Are non bijective sboxes weaker (on feistel networks)?

texts:
I have heard it anecdotically that non-bijective sboxes are potentially weaker to be used in designs like feistel networks. (since by design, it is allowed for the sbox to be non-reversible)

Is that a fact?

The first thought I had on this was that it may related to the fact that the probabilities of S are not uniformly distributed and so, if you choose the most favorable outcomes you may have an edge over the bijective counterpart in e.g. bruteforcing.

But again I new to the field, so any insights on the matter would be greatly appreciated.


texts: Constructing Bent functions of 8 variables

texts:
I have gone through many literature on bent functions but could not find even a simple examples of creating bent functions. One theorem say like this       If $f(x)$ and $g(x)$ are two bent functions of $V_n$ and $V_m$ them $f(x) \oplus g(x)$ gives bent function of $V_{m+n}$. Can i get any example of creating bent function on V8 by xoring bent function on $V_6$ and $V_2$?   Basically if $V_6$ is having vars $x_1$ to $x_6$ and $V_2$ from $x_1$ to $x_2$ then how we will have function on $V_8$ having $x_1$ to $x_8$.
Any reference to document which generates bent function with example will be helpful to me.


texts: Stream Cipher : Never use stream cipher key more than once

texts:
Possible Duplicate:
  Taking advantage of one-time pad key reuse?
  How does one attack a two-time pad (i.e. one time pad with key reuse)?

Denote C is cipher text, m is message, and PRG(k) is a psuedo randomize generator, generate an key.

Because we have :

C1 = m1 xor PRG(k)
C2 = m2 xor PRG(k)

--> C1 xor C2 = m1  xor m2

So, this is a problem because if m1 and m2 is a real text (a text that is in normal life)  and use ASCII, you can predict m1 and m2 if you know m1 xor m2.

I don't understand last statement so much. Why we can predicted m1 and m2 when we just know m1 xor m2 ? I have though some additional information, such as in normal text, E is the most appearance character, after that is T... but I still cannot explain.

Thanks :)


texts: Quantum Cryptography Used in a messaging application

texts: Is it possible to create a messaging application and apply a quantum cryptography technique to encrypt the messages between two parties within the application?


texts:
Studying the basics of Diffie-Hellman key exchange, I'm stuck at a basic operation used in the end of the key exchange (where you show that both computations actually are the same). Can someone explain this step in detail?

(g^a mod p)^b mod p = (g^a)^b mod p

Where p is a prime and g is the primitive root to p

Thanks,


texts:
I would like to implement an anti-counterfeiting scheme for tools my company manufactures. This would ideally be done via RFID/NFC tags. However, the environment in which these tags operate would either be behind a heavy firewall or not web-enabled at all. So a database of unique, valid numbers isn't feasible. I'd rather have some sort of generic key programmed to the tag that the software could then verify. However, since all the tags will contain common data, this presents the possibility that a tag could be cloned since the data (or at least a portion of it) on the tag will be identical.

In other words, I am not interested in protecting the contents of the secret message. Rather, I am concerned about ensuring that the tags cannot be cloned and then embedded on other, counterfeit tools.

While AES-128 is high security, I am questioning whether or not this encryption method is cloneable. If so, what other encryption technologies might I want to look into? I've been looking into the Algebraic Eraser and SecureRF, which use a public-key methodology.


texts: Security implications of using constant string to verify AES key?

texts:
I know that you can use for example CBC-MAC to verify data integrity and thus the password upon decryption.

But would there be security implications of just adding a constant string to the plaintext and if the first block is identical upon decryption we know the key was correct?


texts: How to create and validate potential grids when attacking a Playfair cipher?

texts:
First up: I am not asking you to decypher anything. This question is about attacking a Playfair cipher; more specifically – how to create potential grids when doing so.

I'm currently working on a message in playfair cipher text. The issue is there is no grid, and only potential crib is attack. I was told there is a key used, but we have to discover it.

What I‘ve tried (and been able to do)

After using frequency analysis, I managed to find that QK appears to be the letters th since it is the most common diagraph. I found that C and V are most common letters in the ciphertext after the letters QK.

iagraphs that follow QK

VE - CQ - AH - RQ - VM - BC - BP - VU - SG - SH - CF - UV - UY - SZ - SQ - VQ - FH - AE - RZ

QK - VE = 1
QK - CQ = 4
QK - AH = 1
QK - RQ = 2
QK - VM = 1
QK - BC = 1
QK - BP = 2
QK - VU = 1
QK - SG = 1
QK - SH = 2
QK - CF = 1
QK - UV = 1
QK - UY = 1
QK - SZ = 1
QK - SQ = 1
QK - VQ = 1
QK - FH = 1
QK - AE = 1
QK - RZ = 1

Most common after QK: CQ

ciphertext:

QKVEPTQDEURAQKCQFCQGNWKWQARIVTVQQADVGHQKCQQHFMUQUHGBNWPMPFQKAHMSDHPRRB
ZRSMYKVXVRVUQWPZPFBPFHDZZUUWUVLWSPKQPMHVKMVTBPACWYQKRQMVWLQKVMSFNQQANW
KDMKMVRADPGEEVVYQHYVKZYMGBUEYVDQTIPLVUVYPZRPOYWKRASHUVUYEVLDSEOKMKHDUM
SUIZSEXKMVQKBCHUXQMVTKOYISCMKXQKBPHCPXIMGWVRVUQADECMGBYOESUVGEQANWNKCF
KXFHFLMTOYSGSNQKVURQOYKNOPSHAHDWQHUMMVKBKBYKAHDWQKCQQDEGESSLSMEVCQQCKT
QKSGQDRIMVRHOPRHOYWKUZSPKZULQLVURQRQRHHDWKAHVYQKSHVZHNSZKFQHSDVQQATPHU
XYQLCQQDESKIVWQAIGKZRNALCEVQQAKIBPYOGSWXGEKBQCESSLSMEVQKRQDEMVRZVUASKF
TIDMQHQVRVSWBVQDKXOVDCNWPMYOWXGEDHUVCFTIPBQKCFZUUHQLCQQKUVRZBKQKUYGSKF
UQVRVUTIHUBSILRABKQKSHFHOGWVGZPXBVUVZRBIVUQLCQOYQDRPOPSHVZHNSZSEXCUVCH
BPCIVXIMDEGMPFSNQKSZELBVEVUYVYAHPMPFCBMCFSPUEPBTVOBPASRVSWQKBPCYQHWOVC
RAOPKBXWQKSQLSMIFZPWPONWHRLRMVSHVZHNVQQAEDBIIVFHCWQAUSHFQDXGMSVEFHCWQA
WVCGGBDCFTGOARKXEGLFBSVYQKVQQAQLMKAQSFRZVEVYQHWXUHMTDCNWKWQADSAHYKFHOG
QKCQVYFNCNMPHRLRMVSHVZHNAHXCMSVYQKFHQKAEMBIZVEGMGMLPRQTIPLVURYGEESNYKI
EVCWMIVQQAFCQXVUVEOVUVFDBKGBARKFVQVOQADZVUOGFHHSIKHRBPVYAHLMSHEDKOOGDH
PWOVWLQKRZOVPOUYVYQAMSUFWYYVCIMCIXSZGBWXGEKXCBVWQAVIVXQHDUOGFHHNFHZPCE
UHMCBVOXQRTMRNFCNWNMVEKMVFPZPFFHLRZCPBPFSMAPXKMTZDBUVMVTRYMVWLQDEM

I'm pretty sure uv/vu is er/re. But I am asking myself if one of these could be e…

Question

I am having trouble figuring out how to get the right idea to help create a potential grid that would lead to the deciphering the text. How can/should I create and validate potential grids when attacking a Playfair cipher, based on what I’ve got so far?

(In case of doubt: I am looking for a “how to”. This is not a “decypher this” question.)


texts:
I'm designing a cryptography assignment for a college security course, and one of the problems is to perform a simple meet-in-the-middle attack on a 2-round, 2-key cipher.

Since we want this to be a reasonable attack for students to mount on their own laptops or school computers, the cipher needs to be very fast to compute. However, all of the ciphers I've looked at so far require significant key expansion via a key schedule, and since each encryption/decryption performed is with a different key, this expansion must be performed for every encryption/decryption operation, which we're finding in practice has a big performance penalty.

What I'm wondering is: are there any block ciphers that don't use key expansion?

These don't have to be secure by any stretch of the imagination: just secure enough that it's easier for students to do the assignment directly than break the block cipher via some other means.


texts:
In the GnuPG 2.1 release notes, there is this phrase:

  For many people the NIST and also the Brainpool curves have an doubtful origin

I've read elsewhere that people have doubts about the NIST curves, but I've never heard anything disparaging about the Brainpool curves. What could the release notes be referring to?


texts: RSA padding: what is it and how does that work?

texts:
If I am not mistaken, plaintext RSA is not secure. So, I have read that padding and hashing is needed to make the RSA algorithm secure. However, I am confused on what does padding or armoring mean in this context. What does RSA-padding mean, how does it work?

For instance here I have read about this, but I do not really understand the meaning behind the notion of padding. Can anyone enlighten mean about this?


texts: New to cryptology, studying Message Authentication Codes

texts:
I understand the basic operational theory behind MAC, but I'm getting tripped up on some of the finer details.  Also the differences between MAC, HMAC and MIC are getting lost on me, including the different utilizations between them, the benefits of using one over the other in a given situation, etc.  As such, I'm hoping I can get an overview on MACs, covering a few specific points.

Firstly, I get how a MAC verifies that the message is unaltered, but I don't get how that translates to verifying the message originator.  Just because the message is unaltered doesn't mean it came from a specific host.  To me that sounds like there is an assumption that the session key has not been compromised.  So this would protect against message tampering but not eavesdropping?

Secondly, is the MAC based on the plain-text or the cipher-text?  Also, how is the key selected?  Is it unique to the MAC or is it related to the session key?

As far as I understand MAC vs HMAC vs MIC, HMACs are keyed hash functions which use the message and a key to produce a digest used in the verification process, MACs do the same but can be based on universal hashes or even algorithms which are not hashes, and MICs can be based on any algorithm that can be used as a MAC, but do not utilize keys, and so can only be used to provide message integrity, and not authentication.  If I'm mistaken on any of that, I'd appreciate some clarification.

As with my previous post, I know this is probably an extremely basic question to be asking in this forum, so I'll apologise if this is irksome to anybody.  But I'm only just getting my feet wet in cryptology.  I'm not even sure that my understanding on this topic is incorrect, I'm just not 100% sure that it is correct.


texts: What is the function of the secret key “r” in Poly1305?

texts:
Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute.  I've read the original paper on the implementation, and I think I understand what it does, but not how it works.  In particular, if the security of the MAC is dominated by the security of $AES_k(n)$, why must $r$ be kept secret?

In other words: what are the security properties of $Poly1305_r(m)$ by itself, before adding $AES_k(n)$?


texts: What can I do, if my SRP password verifier was stolen?

texts:
I've got a system that works like this:

Client -> Server: authenticate me

Server -> Client: ok, you are authenticated

Server -> Client: now do some computations for me

And I use SRP as an authentication mechanism. Everything works fine, until somebody steals my password verifier. If the password verifier is stolen, the attacker is able to work as a server, because both server and attacker have the same amount of data for clients authentication.

Client -> Attacker: authenticate me

Attacker-> Client: ok, you are authenticated, because I have verifier

Attacker-> Client: now do some extremely heavy computations, so I can burn your computer

What to do in this situation? Can I invalidate the stolen verifier or something?

I thought I can use this formula to compute verifier: $g^{hash(x|\text{salt}|\text{invalidation date})}$

So server will be forced to send invalidation date first, so client will know if verifier is too old. But this is very hard to implement, because of time synchronization.

And one more option. Client may store server's public key in configuration file as well as sever's host and port. Then client can send server some challenge to encrypt. But I don't know is it good solution or not.


texts: Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack

texts:
The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a suitable pairing can be used to find discrete logarithms. Exactly how is this done in this case?
If a larger example would better illustrate the power of the technique then $E(\mathbb{F}_{8111}):y^2=x^3+x+300$ has order $8269$ and $8269|8111^3-1$


texts: Does impersonating an SRP server give you enough information for an off-line dictionary attack?

texts:
In a comment to an answer I wrote to another question, CodesInChaos wrote that:

"Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search."

and further that:

"If the server successfully impersonates a legitimate server [...] they learn the public key of the client. Knowing the public key allows a password guessing attack, which is only partially mitigated by using a good password hash."

This initially surprised me, since I'd somehow assumed that SRP was designed to avoid this kind of attack scenarios.  However, upon a closer review of the SRP design specifications, it does seem to me that this attack does work, and in fact seems unavoidable given the SRP design.
The point is that, to complete the authentication process, the client and the server must prove to each other that their keys match.  In SRP, the client is the first to send its proof (and the SRP design spec insists on this; I'm not sure what attack would be enabled if this were not done, but I assume there must be one, or the spec wouldn't be so explicit about it).  But this proof value must be something both the client and the (legitimate) server can compute, and thus it must be entirely determined by:

values chosen by the client and sent to the server during the authentication process,
values chosen by the server and sent to the client during the authentication process, and
the password and/or the verifier (which itself is determined by the password).

Thus, having received the client's proof, an attacker spoofing the server can now try to guess different passwords, keeping the other values the same, and see which password yields the same proof.
A technical detail to note here is that, in earlier phases of the SRP authentication process, the server is supposed to provide the client with the salt $s$ and public ephemeral value $B = kv + g^b$, which depends on the verifier $v$.
The first is not actually an issue for an impostor, since not only does SRP assume that the client won't verify the salt supplied by the server, but even if it does, obtaining the correct salt from the real server requires no authentication.  The second looks like it could be an issue, but as far as I can tell, it actually isn't: since the server never needs to (and indeed must not) divulge either $b$ or $g^b$ to the client, the impostor is can just pick any $B$ value they want without the client having any way to verify it.

Now, so far, everything looks clear.  But what's confusing me is the section "Computation of $B$" from the original SRP-3 paper (Wu, 1998), which, in explaining why $B$ is not computed simply as $B = g^b$, first describes what looks like exactly the attack outlined above and then goes on to say:

"Since this attack comes from an impostor who does not know $v$ (anyone who does know $v$ can already perform a dictionary attack), one way to thwart it is to force the host to commit to its value of $v$ in Step 4. [...]
"Modular addition appears to be the simplest operation that leaks no information about $v$ while at the same time enabling SRP to resist a dictionary attack by a fake host."

What I don't see is how including $v$ in the computation of $B$ would actually "force the host to commit to its value of $v$", since there's no way the client can actually verify that $B$ was computed in the specified manner.  Or maybe there is, and I'm just missing something?
So is the argument given by Wu in that section just complete nonsense, or is there actually something to it?  And if there isn't, is there any reason why the verifier $v$ should be included in the calculation of $B$ in SRP?  And, most of all, is SRP actually resistant to dictionary attacks by fake hosts, as the 1998 paper seems to claim, or isn't it?


texts: How are messages from server secured when using SSL certificate

texts:
In case of using SSL the certificate server has a primary key and a public key that is published to all clients - as far as I understood. So in this case when message is encrypted by public key (on client side) only the owner of private key (which is the server in this case) has ability to decrypt it.

But I do not understand how this works the other way, I mean when the message is encrypted by private key then does it mean that whoever has the public key can decrypt it? That would mean that only the messages toward the server are secured and messages which come from the server can be read by anybody with public the key.

Update:
in my case I have web server in DMZ hosts multiple web services (WCF), the clients are non-server application (they are standalone .NET application) reaching these web services via internet using https protocol.

My server has SSL certificate issued by Versign, the point is that my client do not have any type of credential and any machine with that application (or similar app) should be able to consume the services, the point is that the information passing between client machine and server must be encrypted and signed, so this is my question is having the certificate and using the transport security enough to make sure that nobody can read the messages passing between client and server or do I have to somehow come up with some kind of ad hoc client credential and add message security.
This link describes that SSL is good for Intranet and for internet message security is suggested why? what does happen if I only use SSL and no message security for the internet scenario?


texts: Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?

texts:
I recentely asked "IND-CCA1 RSA padding?" about whether there is a IND-CCA1 secure variant of RSA. The original version of the question also allowed usage of ECC which would allow usage of ElGamal, providing IND-CPA and somewhat IND-CCA1.

Now I have the same setting as in the above question, meaning I need a cryptosystem with some homomorphic property and maximal security notion (IND-CCA1 would be optimal, but IND-CPA would also be OK). But this time I'm asking for a post-quantum scheme having a homomorphic property and being IND-CCA1 secure.

So finally the question:
Is there any post-quantum public key encryption algorithm providing IND-CCA1/CPA security and a partial homomorphic property?

Please exclude fully homomorphic encryption schemes from the answers. I know most of them are PQ safe, but they're too slow. And of course please also exclude schemes being even slower than FHE schemes.


texts: How to determine if padding has been used while encrypting a message with RSA?

texts:
I am trying to decrypt a RSA encrypted text file. I have a 2048 bit public key.
Analyzing the public key with openssl reveals the exponent used is 3.

openssl rsa -pubin -inform PEM -text -noout < publickey.pub

Public-Key: (2048 bit)

Modulus: [..snipped..]

Exponent: 3 (0x3)

After some googling, I found out that the text can be decrypted using eth root attack, if message was not padded. Since attempts to decrypt message failed, I'm doubting my assumption that padding had not been used. Is there any way to know it for sure?


texts: I need to uniquely assign a 32 bit integer to a collection of human readable strings (i.e. they will not be generated with hash collision in mind).  I don't expect more than a few thousand strings.  I would like to evaluate the possibility of using the first 32 bits of the md5 sum for this.  What is the distribution of these bits?


texts: Does a password that's cracked someone's account increase the chances of cracking someone else's account?

texts:
For every find in password that cracks someone's account, does that particular password have a higher probability of cracking someone else's account more than a brute force dictionary choice?

How novel are people's password choices in relation to other people's?

Curious if there are papers about this. There's probably a higher probability that the same password is used for all accounts by the same user but what I'm curious is if a group of passwords that are known to crack x # of users have a higher chance of cracking other users' passwords than just random choices from a dictionary.

I guess I'm curious about if there's increased frequency of that password showing up more than a random choice of word.


texts: How are subkeys, in Feistel block ciphers, derived for each round?

texts:
I'm bit confused about the subkeys that are used in Feistel ciphers. I know that all the subkeys ki are derived from the main key K, but how?

Say I have a simplified Feistel block cipher of i rounds, is it then correct to say that each key ki is the K/i part of the key?

So if the key is 4 bytes and there are 4 rounds, then I use the first 1 byte as subkey for the first round, then the second byte as subkey for the 2nd round and so on?

I can't seem to find this information when looking at articles/explanations of the Feistel cipher. I'm trying to solve an exercise and want to make sure that I can make the assumption that the key should be divided by the number of rounds and then use subkeys from this.

Note: It is specified in the exercise that the Feistel cipher uses 8-bit independent round keys ki. I'm not sure if this aligns with my assumption above.


texts: Is the inverse of a point on an elliptic curve over $\mathbb{Z}_p$ always in the group?

texts:
I'm working on a zero knowledge proof system that uses ECC over $\mathbb{Z}_p$ (currently using NIST P-256 since mbed TLS doesn't support group operations on Curve25519, but the problem should be general). Part of this involves calculating the inverse of a group element. For some point $a=(x,y)$ I calculate

$$a^{-1}=\left(x, \text{mod-inv}(y)\right)$$

where $\text{mod-inv}$ is the modular inverse with respect to $p$, the prime of the group. This seems to be correct; I've verified that $a + a^{-1} = 0$, i.e. that performing the group operation on the two points results in the point-at-infinity. The problem is that $a^{-1}$ doesn't seem to actually be a point on the curve! For example, on NIST P-256 I have the points

$$ a = (59480773761400674036851792405749936131635847707891677548254384759310415166102, 54215024246639578077221526092518955906039351892854133302257636019166433313823),\quad a^{-1} = (59480773761400674036851792405749936131635847707891677548254384759310415166102, 112829638001096970751397729889429500563993392391887472719416027848261694765589)$$.

$a + a^{-1} = 0$ (http://imgur.com/NkK39iL), but letting $a^{-1} = (x,y)$ and $A,B$ be the appropriate constants for the curve,

$$y^2 = 4361752682281060789769969552305091818972826646482745173947303219865743305577,
x^3-Ax+B = 108077544024096556861625085656772704192358526678289221948404493713765226661298$$

which means that $a^{-1}$ is not on the curve. Is this to be expected? Am I somehow calculating the inverse incorrectly? Thanks for any help!

Edit: Changed to additive notation for the group operation


texts: Testing hardware random number generators?

texts:
I would like to know how to test hardware random number generators.
What techniques, tools or tricks to solve the problem ?
Any practical difficulties, implementation complexities etc.


texts:
I'm not a Cryptography expert, but i've seen this topic sometimes on the Web: Master decrypt keys.

Most of the people said that "Master decrypt key" does not exist.

This makes sense if you developed your own Cryptography software.

But if a company releases a cryptography software, where the user must enter the content (string or file), and a password, and then he gets the output, wouldnt the company be able to include the user password in another string encrypted with the company's password in somepart of the file? so no matter the user has encrypted the file with 30 keys, the company could decrypt it's part of the file and get the user key to decrypt the entire file

does it make any sense? I was wondering this for security reasons


texts: Do I need to use AE/AEAD in my particular scenario? Or is it redundant?

texts:
This is my scenario:

A small structured text message (1-2kB) is to be sent over an insecure channel.
Everything except for the header portion (which contains a title, timestamp, category and tags) is confidential.
The message as a whole has integrity and non-repudiation as additional requirements.

This is how I intend to go about it after having done some crypto-related research:

Encrypt the message with AES-CBC/OFB/CTR (key is pre-shared). The IV is added to the front of the ciphertext.
Add the non-confidential portions to the output from (1).
Make a digest-hash(SHA512 or RIPEMD160) of the output from (2) and encrypt it with the message author's private key (public key is pre-shared). Add that to the output from (2).
Send it over the insecure channel.

<---IV---><---AES Ciphertext---><---Header---><---Signature--->

Question:

I know that MAC algorithms and digest algorithms were designed for different purposes, but in this case, my digest is not merely slapped onto the payload, it is asymmetrically encrypted.

So, would the choice of AES-GCM/CCM/EAX have added any additional security?
Does my scheme have any obvious vulnerability that I overlooked?

Any help is greatly appreciated.

EDITS:

Fixed a typo. OBC $\rightarrow$ OFB.
I did not realize that the hashing algorithms are already built into all the major signing algorithms; I thought you had to do it yourself. Thanks for clearing that up.

NOTE: I would have chosen Ricky D.'s advice, but comments cannot be chosen as answers.


texts: Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS signature to a Schnorr signature, so that a verifier who can only verify Schnorr signatures can verify derived signature given public key and message?


texts: Same Ed25519 key for signing and encryption?

texts:
I know this has been asked before, but it's still unclear whether this is an OK practice. The advice seems to never do this unless you have to, but I can think of some examples where this could be useful.
For example, a program that supports encryption and signing like GPG could support generating Ed25519 keys and then use them for encryption (by converting them to Curve25519 keys) and signing (leaving them as Ed25519 keys). This would mean that only Ed25519 keys would have to be generated, preferable from the user input perspective since handling multiple key types could get confusing.


texts: Is it possible for the Rho method against an Elliptic Curve to take more than the sqrt of the total state space? It the reason why this is not generally done because of a meet-in-the-middle attack?


texts: Frey-Rück Attack (FR-Reduction) - Tate Pairing

texts:
I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I wanted to ask which one of the different realizations of the FR reductions is the most efficient or ''prettiest'' in your opinion.

In the following let $E/\mathbb{F}_q$ be an elliptic curve and $P$ a point of prime order $l$. Let $Q=n P$ with $n\in\mathbb{Z}$. And $\tau(*,*)$ is the modified Tate-Lichtenbaum pairing.

The FR-Attack as presented in ''The Tate Pairing and the Discrete Logarithm
Applied to Elliptic Curve Cryptosystems'':

  Suppose that $l^k$ is the exact $l$-power dividing $\#E(\mathbb{F}_q)$ with $k>1$. (The case $k=1$ is ''easy'' since we have in this case that $\tau_l(P,P)$ is a primitive $l$th root of unity.)
  Suppose $P'\in E(\mathbb{F}_q)$ is any point of order $l^k$. In this case $\tau_l(P,P')$ is a primitive $l$th root of unity. (*)
  Now calculate $\tau_l(P,P')$ and $\tau_l(Q,P')$ with the divisors $D_P=(P)-(\infty)$ , $D_Q=(Q)-(\infty)$ and $D_{T'}=(2P')-(P')$. Here $2P'$ or $P'$ can never be $iP$ or $jQ$, so we can calculate the pairings without any problems and get as above the DLP $\tau_{l}(Q,P') = \tau_l(P,P')^n$ in $\mathbb{F}_q^*$.

My first question is why (*) holds. Why is $\tau_l(P,P')$ a primitive $l$th root of unity if $P'$ has order $l^k$?
And why can $2P'$ and $P'$ never be $iP$ or $jQ$? Because of their order?

And in Steven Galbraith ''Supersingular Curves in Cryptography'' he does not specify this proposition, but rather picks random points $P'\in E(\mathbb{F}_q)$ until $\tau_l(P,P')$ is a primitive $l$th root of unity. I'm asking myself which way is more efficient? Since in Frey's version it seems more costly to look for this specific point $P'$ of order $l^k$ rather than trying random $P'$.

In the paper of Ryuichi Harasawa et al. ''Compairing the MOV and FR Reductions in Elliptic Curve Cryptography'' they work with two random points to calculate the DLP:

  Determine the embedding degree $m$, i.e. the smallest integer such that $n|q^m-1$. Define $k:=\mathbb{F}_{q^m}$.
  Pick $S,T\in E(k)$ randomly (not equal to $P,Q$ or the point at infinity $\mathscr{O}$).
  Compute two rational functions $f_P$ and $f_Q$ such that $div(f_P) = l(P)-l(\infty)$ and $div(f_Q) = l(Q)-l(\infty)$.
  Compute $\alpha = \big(\frac{f_Q(S)}{f_Q(T)}\big)^{\frac{q^m-1}{n}}$ If $\alpha=1$ return to Step 2.
  Define $\beta := \big(\frac{f_P(S)}{f_P(T)}\big)^{\frac{q^m-1}{l}}$
  Solve the DLP $\beta = \alpha^n$ in $k^*$

Thank you and all the best,
Luca


texts:
How to calculate "Entropy Rate" of a bit string?
Does "NIST Randomness Test Suite" provide any test to measure Entropy of an
entropy source?
How to check "biased-ness" of a bit string?

Thank you in advance.


texts: Homomorphic system that allows Hamming distance computation?

texts:
How can I work out Hamming distance between two binary vectors securely?
I would like to know how I can apply homomorphic techniques here.


texts: 1/4 oblivious transfer construction from 1/2?

texts:
I have a question about OT?
we assume that sender has $m_0,m_1,m_2$, and $m_3$ and selects random $S_0, S_1, S_2, S_3, S_4, S_5$
and compute this statement than sends to receiver.

$C_0 = S_0 \oplus S_2 \oplus m_0$

$C_1 = S_0 \oplus S_3 \oplus m_1$

$C_2 = S_1 \oplus S_4 \oplus m_2$

$C_3 = S_1 \oplus S_5 \oplus m_3$

Can i change above statement into this?

$C_0 = S_0 \oplus S_2 \oplus m_0$

$C_1 = S_0 \oplus S_3 \oplus m_1$

$C_2 = S_1 \oplus S_2 \oplus m_2$

$C_3 = S_1 \oplus S_3 \oplus m_3$


texts: What Are Secure Limits to Truncate the Authentication Tag (Mac) for Short Messages?

texts:
I have messages with the following fixed lengths:

4 byte
8 byte
16 byte

I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g. using Encrypt-then-Mac schema). Additionally I want the cipher output message to be as short as possible.

Let's say the normal MAC output size would be 16 byte (e.g CMAC with AES). Can I truncate the MAC with a short message like 4 byte to get similar security assurances?

According to various NIST standards, minimum lengths of MAC from 64 bit (CMAC) to 96 bit (GMAC) are recommended.


texts: Prove that decryption in LWE based PK cryptosystem works correctly except with negligible probability

texts:
The LWE cryptosystem is defined as follows:

Key Generation:
Secret key: random vector $s \in F_q^n$.

Public key: $\{c_i\}_{i=1}^m$, where $c_i = (\textbf{a}_i, \textbf{a}_i \cdot \textbf{s} + e_i)$, where $\textbf{a}_i$ are uniformly random, and the $e_i$ are chosen according to $D_e$.

Encryption:
Message is a bit $w$. Choose random bits $b_1,\ldots,b_m$ and then the ciphertext is $\sum_{i=1}^m b_ic_i+(0,\lceil q/2 \rceil w)$.

Decryption:
To decrypt $(u,v)$, compute $v-\textbf{s}\cdot \textbf{u}$, and output $0$ if this value is closer to $0$ than it is to $\lceil q/2 \rceil$. Otherwise, output $1$.

The distribution $D_e$ is defined as follows:

$D_e$ satisfies $\sum_{i=1}^{m}e_i < q/4$ for $e_i$ chosen according to $D_e$. Here, $e_i$ are small numbers, and $q$ is some positive integer.

Now, $\textbf{v}-\textbf{s}\cdot \textbf{u} = (\sum_{i=1}^m b_ic_i + \lceil q/2 \rceil w) - (\textbf{s}\cdot \sum_{i=1}^m b_ic_i)= ...$, but then I'm stuck.

Can someone help me out?


texts:
I've been to https://docs.google.com/spreadsheets/d/1mOTrqckdetCoRxY5QkVcyQ7Z0gcYIH-Dc0tu7t9f7tw/edit#gid=1194752368, http://www.righto.com/2014/09/mining-bitcoin-with-pencil-and-paper.html, and https://en.wikipedia.org/wiki/SHA-2#Pseudocode (the pseudocode is for sha256)

The use of those links, not withstanding, I cannot create the 'W' values beyond the first 16 values.  Everything I read is complex beyond my understanding.

In a very simplistic and step by step example, how do I get the 'w' values for SHA256?


texts: Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?

texts:
Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $x$.  I am curious to know if this signature scheme can be used to perform public key validation in the following sense:

Alice provides Bob with a signature $(e,s)$ for some message $m$ and a public key $Y$.
Bob verifies that the signature $(e,s)$ like so:

Calculate $R = (s \cdot G) -  (e \cdot Y)$
Set $e_v = H(R_x || m)$
Accept signature iff $e_v = e$

Can this scheme be used to ensure the public key provided by Alice is indeed of the form $Y = n \cdot G$ (and not say of another form $Y = n \cdot G + n' \cdot G'$?). Assume Alice is computationally bounded and in particular cannot solve the discrete logarithm problem. Or is there a way for Alice to carefully choose the values $(e,s)$ such that Bob accepts the signature even if $Y$ is of them form $Y = x \cdot G + x' \cdot G'$?


texts: Usage difference between x86 RDRAND and RDSEED

texts:
Modern x86 CPUs often have the RDRAND and RDSEED instructions for hardware generation of random numbers.  I just don't understand the difference between them.

Intel has this document: https://software.intel.com/en-us/blogs/2012/11/17/the-difference-between-rdrand-and-rdseed

But I don't understand how this affects the usage of RDRAND and RDSEED.  Namely, in what situations can I use each, for features like generating an encryption key, or for initial seeding of a PRNG?

As for the possibility of an NSA backdoor, that really isn't an issue for us.


texts: RSA code giving result after more than 10 minutes

texts:
I am trying to implement RSA algorithm. I got a code in python. When I run it, it takes more than 10
minutes even when the primes are within 100 and message size is 8 decimal digits. Plese suggest  what may be the problem in the code.
# Write Python3 code here
from decimal import Decimal

def gcd(a, b):
    if b == 0:
        return a
    else:
        return gcd(b, a % b)

p = int(input('Enter the value of p = '))
q = int(input('Enter the value of q = '))
no = int(input('Enter the value of text = '))
n = p * q
t = (p - 1) * (q - 1)

for e in range(2, t):
    if gcd(e, t) == 1:
        break

for i in range(1, 10):
    x = 1 + i * t
    if x % e == 0:
        d = int(x / e)
        break
print('pvt key= ', d)

ctt = Decimal(0)
ctt = pow(no, e)
ct = ctt % n

dtt = Decimal(0)
dtt = pow(ct, d)
dt = dtt % n

print('n = ' + str(n) + ' e = ' + str(e) + ' t = ' + str(t) + ' d = ' + str(d) + ' cipher text = ' + str(
    ct) + ' decrypted text = ' + str(dt))


texts:
Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG).  Can I mix them by XORing blocks safely?  If one of the two has been compromised/subverted, is there any way it can reduce the total entropy of the other source?

The answer here seems to imply this is possible, but does not specifically address the case of one of the two being subverted.

I'm aware of entropy mixing via hashes, but I'm wondering about something with less overhead.

(In case anyone's wondering, I'm not actually implementing an entropy pool, just settling a debate at work.)


texts:
I am going through Steven Kinney's book; "Trusted Platform Module Basics", and pp 90 - 92 discuss how to calculate the authorization digest. He talks about 1H1, 2H1, 3H1, and 4H1 fields which I do not even see in the corresponding diagram. Can anyone explain this process, or point me to a document which does? If you are going to point me to the specs, please advise with document and section if possible.

I had to read the chapter again, and now I think I can explain my question better. My question is about how the authorization block is calculated; specifically which nonceEven is used for it. The book verbiage on page 90 states that the last nonceEven is used, and that leads me to believe that the nonceEven shown in Fig9.6 is not in the input message. Page 91 even says this explicitly; that "...realize that the last nonceEven is not part of the input message that will be sent to the TPM; this value was previously recorded after the also successful authorized TPM command, in this case, TPM_OIAP."
So this leads me to wonder why Figure 9.6 has a nonceEven in it. Is it meant to imply that this is the value, which was created by the TPM previously and will be used to calculate the authorization block? I just think it is a little confusing given the description of the figure, which states "TPM_Sign input message block". That nonceEven should be labeled as last nonceEven. It can not be the new nonce either as this is a diagram of a message input, and the new nonceEven would be generated by the TPM.


texts: Elliptic Curve Cryptography Point Arithmetic Libraries

texts: Are there any libraries out there that perform ECC point arithmetic:adding,subtraction whether it be in C for micro controllers for VHDL for fpgas? Or to go further any libraries that perform ElGamal encryption/decryption?


texts: I don't want to store passwords, can I use them as an encryption key for another field?

texts:
I'm not a 'cryptographic' anything, so if this is a super-dumb question please let me know (politely).

So here's the deal, say I don't want to store passwords because that opens me up to all sorts of failures (see: Facebook). Instead, I want to use the passwords as a key for something else.

Let's assume our process is:

User enters a password, we use 2FA, so we use that password to DECRYPT (via some KDF + et. al.) the Phone Number or Email (whatever the 2FA calls for here), and start the 2FA process;
User passes 2FA, we log them in;

Now, my thought is that this should be an acceptable process, but I'm not a cryptographic expert on anything, so I'm curious on whether this is an adequate method of storing the password + 2FA component. It seems reasonable, after all, we're no longer actually storing the password, and with a sufficiently-strong KDF we add another layer of security by not using the raw password in the encryption process, meaning if someone manages to break it (let's say we use something like AES-256, or whatever the de-facto standard is) and extract the key, they have the KDF-transformed key, not the raw key.

Additionally, my thought here is that this solves the following problems:

Storing the password in plain-text (obviously);
Abusing the MFA components (as a certain, nameless, company has starting using that Phone Number for marketing purposes);

Does this make sense? Am I talking about something the world / experts have decided is a terrible idea?


texts: How secure is a 40 bytes hexadecimal string AES256 encrypted with 50 bytes random password

texts:
Problem

Assume I have a 40 bytes hexadecimal ASCII string and a 50 bytes random password.

data: a7cd8558a341e3525d060e90fb37975efa8dd519
key:  ]*Úf"¢^¨¥GJþPÒYÅ9ÝÁ´!½OïæñÝ{/§@·]%¾âðNQn@:U2çþÇ<uÓ

The data will be AES256 encrypted with the password. The encrypted data will be stored as a key-value pair and that key and the usage of it predicts the decrypted data represents a lower case 40 bytes hex value.

Question

What can I assume how secure the encrypted data will be?

Use case scenario

I'm using Ansible to provision my VM. One of the Ansible scripts uses my GitHub API token. The token is stored as an variable encrypted with AES256 by the Ansible Vault.

Now I'd like to store my Ansible scripts in my GitHub repository. But I'm not sure how much does it cost to decrypt the GitHub API token.


texts: Why is Decisional Diffie–Hellman assumption harder than the Computational Diffie–Hellman assumption in cryptography?

texts: I did not understand why the decisional Diffie-Hellman assumption is harder than computational Diffie-Hellman assumption, I read that there are groups where DDH is known to be easy but CDH is still assumed to be hard.Please, could you explain this one, by using an example?


texts: Is there a complete summarized list of attacks on elliptic curve cryptography? In RSA, there is https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf, so I was wondering if there is such a list somewhere. I have found many online resources for different attacks, but I haven't found a complete list like the one on RSA. Does a complete list exist? And if so could you please share it?


texts: Is there an encryption/decryption algorithm that can give two different outputs?

texts:
The recent revelations that airport staff can detain travellers in an interrogation room and force them to give over passwords to encrypted-HDD laptops under threat of jail time has made me think about some sort of dual password encryption/decryption mechanism.

For example:

Password 1 decrypts all the data as usual.
Password 2 decrypts most of the data, leaving a portion looking like random 0's and 1's.

I think it has to work at the algorithm level, and not rely on software, because the HDD could be removed from the laptop and then any software protection is useless.

My question is, are there any algorithms that can give two different (but similar) results depending on which key is used?


texts: Store hashed email and compare hash values

texts:
I have a number of different systems sending me email addresses, but I don't actually need the underlying email, just a hash of the email address. I know I can compare hash values to find matches across the senders, which is all I want to do, but what if each sending system uses a different salt or hash method.  Is there some way to compare the resulting hash values I have?

Eg. Sender 1 sends me emails using sha1 and no salt.
Sender 2 sends me email addresses using md5 and a salt (which they also send)

Can I take md5(sha1) and sha1(md5) and compare that hash output? Or do I need to specify that all emails should be hashed using the same method? Is there a better way that will allow each sender to select the hash method they want to use but still allow me to compare email addresses across senders?


texts: Should different key pairs be used for signing and encryption?

texts:
In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation:

  When a user turns on iMessage, the device generates two pairs of keys for use with the service: an RSA 1280-bit key for encryption and an ECDSA 256-bit key for signing.

Is it best practice to use a different set of keys for signing than for encryption?
If so, what are the advantages to it? I had been looking at writing some software that used a single RSA key pair for both signing and encryption but this has made me question it.
Is there also a specific reason they've used RSA for encryption of the AES keys, and ECDSA for signing?


texts: Zero byte header in RSA-OAEP vs. RSA-PSS

texts:
PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway & Bellare.

One of the alterations done for RSA-OAEP is, that the actual padding is only done to a length of $n-1$ (where is the octet length of the modulus) and a single zero byte is prepended to the whole string. This is done, since a message padded to $n$ bytes could be larger than the modulus, thus creating an ambiguity when decrypting.

My question is: The same argument could be raised for RSA-PSS, but here no zero byte is prepended to the padded hash. Why is that not necessary for signatures?


texts: I have heard that to combine two keys HKDF is better than using XOR function. But if you look at the HKDF RFC I could not figure out how to use it for concatenating two keys. What I can see is HKDF can be used to derive a key from another key. So I want to know how to use HKDF to concatenate two keys.


texts: Would knowing the random seed help to break AES or similar?

texts: Consider I knew the seed of the random number generator that Bob uses to send encrypted emails to Alice. Would I have an advantage in deciphering the message? Also, how does, for example, openssl generate a completely random seed so the rest of the generated sequence isn't discovered? Am I missing something here?


texts: Degenerate discrete logarithm in binary field

texts:
Given a field $\mathbb{F}_{2^n}$, are there any choices of primitive element $g$ that make the discrete logarithm easier for that generator? That is, are there any degenerate cases?

For example, if I choose a small generator like $g = x$ in $\mathbb{F}_{2^{256}}$, can I quickly find $n$ such that $g^n = a$ for a given $a$? Or is this equally difficult for any $g$ picked in any $\mathbb{F}_{2^n}$ over any irreducible polynomial?


texts: Importance of round complexity in determining the efficiency of an MPC protocol

texts:
Literature has different ways of specifying complexity of an MPC protocol:

computation complexity that measures the number of (assumed primitive) operations performed by all the parties;
communication complexity, which measures the number of bits communicated between parties during the protocol;
round complexity that measures the number of sequential steps in the algorithm (discounting on operations that can be done in parallel).

I feel that all the above parameters are important, to be discussed, when analyzing the efficiency of any proposed MPC protocol. However, I observed that round complexity is discussed in only few of the works. Hence I wanted to know, how important a role does the round complexity play in determining the efficiency of any proposed protocol. That is, when is considering round complexity of a protocol important?

It would be helpful if you could point me to literature that discusses the nature of functions that can be achieved, using MPC, in constant round and those that cannot.


texts: Is GPG symmetric encryption only based on a passphrase?

texts:
Is the symmetric key derived for AES only dependent on the passphrase?
Is it possible to generate the encryption key such that it is based on my primary GPG private key and temporary passphrase? In this case, the attacker would have to know the passphrase as well as my GPG key to decrypt the text.


texts:
in my textbook it is stated, that if we have a message, it's signature using RSA and modulo, we can also sign the inverse of the message.

However, it is not explained why can we do so.

Could someone explain to me the reasoning?


texts: Need help to understand this RSA common modulus attack Python code

texts:
I am reading Practical Cryptography in Python. I have problem understanding the common_modulus_decrypt() function. I think the prerequisite of RSA Common Modulus Attack is that two public exponents have to be co-prime, meaning $gcd(e_1,e_2)=1$, right? That is what I get from how to use common modulus attack?

If this is true, why does it do the following:
def common_modulus_decrypt(c1, c2, key1, key2):
    key1_numbers = key1.public_numbers()
    key2_numbers = key2.public_numbers()

    if key1_numbers.n != key2_numbers.n:
        raise ValueError("Common modulus attack requires a common modulus")
    n = key1_numbers.n

    if key1_numbers.e == key2_numbers.e:
        raise ValueError("Common modulus attack requires different public exponents")

    e1, e2 = key1_numbers.e, key2_numbers.e
    num1, num2 = min(e1, e2), max(e1, e2)
    while num2 != 0:
        num1, num2 = num2, num1 % num2
    gcd = num1

    a = gmpy2.invert(key1_numbers.e, key2_numbers.e)
    b = float(gcd - (a*e1))/float(e2)

    i = gmpy2.invert(c2, n)
    mx = pow(c1, a, n)
    my = pow(i, int(-b), n)
    return mx * my % n

If gcd is always 1, why bothering with the while loop above? Also, I thought it should use the Extended Euclidean algorithm to get a and b. Why is it doing invert with e1 and e2? Why is it using float()?
The last 3 steps for i,mx,my I can understand, as it assumes b is a minus value.


texts: Verifiable Encryption of a Pedersen Commitment

texts: Can the Verifiable Encryption of a Discrete Logarithm scheme of the paper https://www.shoup.net/papers/verenc.pdf (page 19) be used to verify that a ciphertext encrypts the same value committed in a Pedersen Commitment?


texts:
I'm creating a substitution-permutation cipher (for learning purposes only of course) and I'd like to implement dynamic SBOXs. The cipher will have a block size of 128, and 32 rounds. These SBOXs will be generated from the password. Is the following procedure secure for generating secure SBOXs assuming that the key (32 bits) is CSPRNG:
Suppose the key = "zjfe48rQQWNEh6WFH2ne4MpXXytVGvSA"
First, I take the sha3_512 of key and set it to hash1:
hash1 = sha3_512(key)
Then, I set hash2 to the sha3_512 of hash1:
hash2 = sha3_512(hash1)
Now, I have two hashes with length 64. I concatenate to make a string with length 128:
string = hash1+hash2
Now, I convert string to hex. Since string is 128 bytes, after conversion to hex, it will be 256:
string = string.toHex()
Finally, I use string as an SBOX by splitting the 256 hex characters into a 16x16 array, similar to AES's SBOX.
Assuming that sha3_512 is secure and the password is random, is this construction of an SBOX secure?


texts: Encrypt challenge instead of storing it on the server

texts:
My server and my smartcard (MIFARE DESFire) want to establish that they have the same shared AES key. They want to do that with an untrusted client in the middle.

Usually it works like this:

Now this requires that I store RndA on the server between Generate RndA and Decrypt and compare RndA' with Rotate(RndA).

My question is: Instead of storing RndA on the server, can I safely use the same AES key to encrypt RndA and pass it on to the client for storing?

The sequence becomes:

I feel uneasy about providing the Client with both AES(RndA || RndB') and AES(RndA), but I'm not sure if that is justified.

If that is unsafe, what about the alternatives? Encrypt RndA with a fixed key shared among all smartcards? Or store one more key per smartcard to encrypt RndA?


texts: Multi-round Transposition/Playfair as a secure hand cipher in the computer age

texts:
Given that computers can be easily compromised, there is a need for a hand cipher that can withstand computer attack.  Clearly the traditional hand ciphers fail.

One time pads work.  They also have the important property of being able to burn used keys and thus prevent decrypting old messages if keys are revealed.  But key management is obviously hard.

Schneier's Solitaire cipher is certainly secure.  But it is also completely impractical as a hand cipher.  One would need to be extremely diligent to correctly encipher even a very short message without making a mistake that would make the rest of the message undecipherable.

So strengthening the traditional hand ciphers seems to be a more fruitful approach.  Of the many traditional ciphers, Transposition/Playfair seem to go together beautifully because Playfair combines two letters together and transposition then scatters them.  Transposition defeats the traditional methods of breaking Playfair, and Playfair defeats anagraming transpositions.

The idea is to take the plain text, transpose it, Playfair the result, then transpose that, Playfair that result again.  After two rounds each ciphertext letter is distributed to four plain text ones.  After three rounds eight.

Both Playfair and Transpositions are relatively easy to do by hand.  In particular, Playfair processes two letters at a time, which is faster than ciphers like one time pads.

Transform/Playfair would certainly be secure if enough rounds are used.  It becomes very hard to analyze the intermediate values.  Each Transpose and Playfair would be performed with a different key, possibly based on some key schedule, so the key space would be huge.

But the question is, how many rounds are needed?  My guess is three, but that is just a guess.

A crude brute force attack will certainly not work, there are 25!^2 combinations in each round.  There would be very little to hill climb on.  But what would be a more effective cryptoanalysis?

Or are their better approaches?

("Secure" means in the context of hand ciphers.  So no chosen plain text attacks.  There will be a relatively small amount of text encoded, certainly not megabytes.  Etc.)

(There are other threads about hand ciphers, but I want to concentrate on the Transpose/Playfair here.)


texts:
This is a very basic question, but I cannot get it right. I'm working on a basic asymmetric encryption example.

So $(m^e)^d  \equiv m \pmod n$
(at least with the premise of m < n, I suppose)

If I choose:

m = 14   (my message)
n = 19
e = 3
d = 13  -- because $3 \cdot 13 ≡ 1 \pmod{19}$

Then I encrypt
$14^3 ≡ 8 \pmod {19}$

But I decrypt
$8 ^ {13} ≡ 8 \pmod {19}$

What am I doing wrong?

EDIT My logic behind this is:

$m^e ≡ m' \pmod n$

if $e \cdot d≡1 \pmod n$ then

$m'^d ≡ m \pmod n$

Because $(m^e)^d = m^{e \cdot d} ≡ m^1 \pmod n$


texts:
In this lecture by Dan Boneh on Coursera it was stated at minute 03:37 that

  The Caesar cipher, actually, is not a cipher at all. And the reason is that it doesn't have a key. What a Caesar cipher is, is basically a substitution cipher where the substitution is fixed.

Can someone elaborate what he said? I don't get the part that he says that it doesn't have a key.


texts: Best choice of finite field for AES on a 4-bit microcontroller?

texts:
As the finite field of $GF(2^8)$ are isomorphic to $GF((2^4)^2)$, $GF((2^2)^4)$ and $GF(((2^2)^2)^2)$,
which of the fields is best suited and most efficient for 4-bit MCU and why? Would it be $GF((2^4)^2)$?


texts: Given a linear block-cipher,how can an attacker decrypt any plaintext value encrypted,using 128 chosen ciphertexts

texts:
Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$

$$\operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, p_2)$$

where $k$ and $p$ are 128-bits.

If an attacker uses a chosen-cipher-text attack, how can they decrypt any plaintext by choosing 128 ciphertexts?

I'm not exactly sure in which direction I have to think. I believe decryption will also be linear since in linear algebra the inverse of a linear function is also linear. The fact that the attacker can choose 128 ciphertexts hints at maybe revealing the key 1-bit at a time. Any hints and suggestions would be helpful.


texts: Is it safer to use timestamp in REST authentication?

texts:
I am working on a personal project to build a REST authentication system which authenticate clients via three parameters:

apikey = example-apikey-34433
hash = examplehash-notarealhash-a34io4oehosseesr
timestamp = 2000000000

Every client has a unique apikey and secret key, stored in a database.

Hash is a SHA256 hash of the secret key + timestamp. This is to generate a unique authentication hash for every request.

Would this be secure against brute forcing? Because when a client can supply any timestamp, is it true that multiple hashes can be correct?

Wouldn't it be better to just rely on the apikey and (plain text) secret key? Or do you know a better way to do this?


texts:
I am trying to understand how an unbalanced Feistel network works. I came across this image:
It says that the function takes $b$ bits to $y$ bits. Which works on the first step, however clearly doesn't on the next one.
What am I not getting?
If you always apply the function to the side with $b$ bits would that break the cypher? I am guessing it does.


texts: Are there attacks that break collision resistance but not preimage resistance?

texts:
Are there any examples of attacks on hash functions which:

break collision resistance and second preimage resistant, or
break collision resistance and preimage resistant?

I have looked at Rogaway's paper1, but it seems complicated, hence was wondering if a succinct example exists.

1) Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision-Resistance. Phillip Rogaway and Tom Shrimpton. Fast Software Encryption (FSE) 2004, LNCS vol. 3017, pp. 371–388, Springer, 2004.


texts: In textbook RSA with low public exponent, how big does a random message needs to be?

texts:
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod N$ (textbook RSA) used for encryption. Inasmuch as it matters, assume there are $2^r$ ciphertexts available to the attacker, and her goal is to recover one plaintext with odds better than $2^{-k}$. If necessary also assume $n\ge1024$, $e\le2^{16}+1$, $r\le30$, $k\ge40$, or/and $M$ is of exactly (rather than at least) $m$ bits.

If $M^e<N$, then $M^e\bmod N=M^e$ and thus $M=C^{1/e}$, making decryption trivial by $e$th root extraction. $m\ge n/e+k+r$ makes us safe from trying that for each available ciphertext; but not necessarily against improvements, or other attacks.

Up to what bound for $m$ do we know an attack better than factoring $N$ using GNFS?

As an aside: starting with what bound for $m$ (if any) is there a positive security argument?

Updates (main question, now highlighted, remains without an answer proposing a bound):

As rightly pointed by D.W.'s in this answer, regardless of $e$, we must also have $m$ big enough to resist being found by "square-root" attack, a "meet-in-the-middle" search using a space/time tradeoff. To be safe from that we can make $m\ge a+b+k$ where the adversary is powerful enough to make $a$ accesses to a memory system of $b$ bits, say $m\ge 90+70+k$.

There is a simple extension to the $e$th root attack: the adversary hopes that an $M$ is divisible by some small integer $s$ of her choice, computes $C'=C\cdot s^{-e}\bmod N=(M/s)^e\bmod N$, then applies the $e$th root attack to $C'$. Perhaps she chooses $s$ as the successive primes, or some better method. This considerably extends the range of vulnerable $m$ (to, uh..).

Note: I assume all plaintext is random and independent, and the adversary has no access to a decryption oracle (even limited to revealing messages other than the originals and with at most $m$ bits).

Another simple extension to the $e$th root attack: the adversary hopes that $k=\lfloor M^e/N\rfloor$ is small enough to be enumerable, and tests if $C+k\cdot N$ is an $e$th root for small $k$. That's independent, but only marginally extends the range of vulnerable $m$, as far as I can tell.


texts: Recryption of ciphertext with a different key

texts:
Let's have $P$ some sensitive piece of data and $K_1$a secret value, both known to Alice, but not to Bob. $K_1(P)$ means $P$ encrypted using $K_1$.

Alice sends $K_1(P)$ to Bob. Bob keeps the value of $K_1(P)$.

Later Alice decides to change her keys. She needs to replace $K_1$ with $K_2$. The goal is to do some transformation on Bob's side with $K_1(P)$ resulting into $K_2(P)$ without revealing $K_1$, $K_2$ nor $P$ to Bob.

Alice should tell Bob something like this: "There is a value $X$ (which I somehow computed from $K_1$ and $K_2$) and transformation $T$. Use $T$ with $X$ and $K_1(P)$ in order to obtain $K_2(P)$."

$$T(K_1(P), X(K_1, K_2)) = K_2(P)$$

Is this even possible? What cryptosystem should Alice use?


texts: Is ECB mode secure if plaintexts are guaranteed to be unique?

texts:
I've got a scenario where I need to encrypt many small (16-byte) plaintexts. I want to use AES-128 in ECB mode. Notably, each plaintext is guaranteed to be unique, though each may differ by only a few bits.

In this scenario, is ECB secure?


texts:
How do I calculate the number of computations needed to break SHA256 in case we are using it for safely storing passwords (together with a salt)?
Are there any formulas that can be employed?

For example:

  Passwords are chosen to be 5-character strings composed of lowercase Latin letters and numbers, and are stored as SHA256(password XOR s)||s, with s chosen as a 5 byte array filled with random content.


texts:
Consider the following function:
$f_k(mm')=\operatorname{HMAC}_{\operatorname{HMAC}_k(m)}(mm')$

Can I use $f$ as a secure MAC?


texts:
For a simple proof of concept project i'm (attempting!) to do, i've started looking into openSSL elliptic curve cryptography.

However instead of the standard key lengths, 160-512. I'm interested in a resultant key of just 64 bits (less secure I know but that's my projects purpose). Is it possible using elliptic curve cryptography?

I'm quite a novice, is there anything fundamentaly wrong with instead generating say a 256 key and cutting it size to 64bit?

Any advice would be greatly appreicated thanks.


texts: Can I use asymmetric encryption for more powerful write-protection?

texts:
I have a game that I am developing which uses a locally-stored internal database. It does not matter to me whether a user can read the file (which, to me, means I don't need a symmetric cipher), but I don't want it to be possible for a user to alter it without completely breaking the game (essentially, to make cheating more difficult). Obviously file permissions alone wouldn't protect against someone on an administrator account or with a rooted device.

My thought was to use an asymmetric cipher where, opposite how it usually goes, the decryption key is public and the encryption key is private. I would then distribute the already-encrypted database and the game could decrypt it. I believe that this would prevent alterations, because the user would have to be able to properly re-encrypt the altered file for the game to be able to read it (unless they also altered the game binaries), which they wouldn't be able to do.

However, I've done a bit of searching and I can't seem to find this method mentioned anywhere, so I don't know if it is a good idea or if I've overlooked something. Is this a good approach?

Also, I want to use SQLite. I know of SQLCipher, but that uses AES so obviously that wouldn't work for me (because it's symmetric and therefore the user could intercept the encryption key by obtaining the key which is used to decrypt). Are there any public-key SQLite encryption libraries?


texts: Would xoring 2 independant AES CTRs to produce p-rand introduce vulnerabilities?

texts:
Assuming

$$AES_{k_1}(C_1) \oplus AES_{k_2}(C_2)$$

where AES is used in CTR mode, $C$ is a 128 bit incrementing counter, keys and counters for both transforms are random as well as unique, and the XOR occurs on every 16 byte block.

If I did this, would the XORed output be less secure than the size of state used to seed the generator? Does this method reduce security or introduce vulnerabilities to the random output?


texts: Avoiding multiple use of sIgned identities while not learning anything about them

texts:
There is an authority A with an associated public/private key pair (A.priv, A.pub).

A can issue new "identities" by signing data (numbers or bytestrings).
Each number associated with a signature by A is an identity. Here are two examples:

identity_1 = (sign(A.privkey, 1), 1)

identity_2 = (sign(A.privkey, 2), 2)

How can owners of these identities prove on a public system that they

have a valid identity without revealing their number
have not done this proof on the public system before?

Assuming the authority doesn't sign any data more than once, is it sufficient if identity owners just send the signature to the public system or does it tell anything about the data?


texts:
What I am trying to understand is shown in all three properties of a secure hash function, I will focus on Preimage attack resistance.
Preimage resistance: given a hash h, it's difficult to find m s.t. H(m)=h
My question is, what does "given" mean in this case?
Does it mean for a randomly selected h from the output space of H, or can it be a specific hash selected by the adversary?
For example, assume a secure hash function H defined as $H: \{0,1\}^*\rightarrow\{0,1\}^n$. We will build a hash function H' that returns $0^n$ when input=0 otherwise returns $H(input)$.
An adversary in that example knows that if the $h=0^n$ then the message could be 0. So in the case that he can select the h he can violate pre-image resistance, otherwise, in the case, the input is randomly selected, since H' is secure, the probability of getting $0^n$ would be negligible and so the property still holds.
The same goes when selecting two messages m1,m2 for 2nd preimage, and collision resistance.
----------------------EDIT------------------------------
The link @hamidreza posted was really helpful.
In the paper, they describe 3 definitions for preimage resistance, called Pre, e(everywhere)Pre, and an (always)Pre.
Pre: in which the adversary is given a hash of a randomly generated message along with the key (randomly generated as well) of the function.
ePre: I didn't quite get it, I think the adversary has |Y| shots to generate a random message and its hash be included in the given set of hashes Y for a specific key (randomly generated).
aPre: similar to the first one but stronger, the adversary can find a key for which he will be able to generate a collision for a hash of a randomly generated message.
So, to answer my question, the adversary doesn't get to choose the hash for any of the suggested definitions.
Based on Pre at least, the H' that I defined is pre-image resistant since the chance of picking m=0, or any other m s.t. $H(m)==0^n$ is negligible
Are the definitions correct?


texts: What crypto scheme should I use on embedded m2m system with assymetric uplink/downlink bandwidth?

texts: I am working on implementing info security into custom m2m radiolink communication system, which has some restrictions: MCU based endpoint can transmit to gateway with packets max 16 bytes long, and the cyphertext should not exceed that, gateway can also downlink to endpoint with packets up to 64 bytes. Minimization of transmitted overhead is a priority (battery preserve). I need a public key encryption scheme, which can be squeezed into such small payload footprint. Usual RSA based algorithms seem to use too long chunks and not an option. I can afford to send long packets ocasionally (i.e. for session key synchronisation once in a while). The endpoint may get into attackers hands, so no secrets should be stored there. The air traffic is considered fully sniffable, gateway may be considered physically safe. What scheme can I use, which meets these demands?


texts: Message encrypted with a LFSR based stream cipher

texts:
I am learning about LFSR sequence and I came across this question:
A 16-bit message consists of two ASCII characters. This message was encrypted
with a one-time pad, and the key for the one-time pad was an LFSR sequence (mod 2) given
by $x_0 = 1$, $x_1 = 0$, $x_2 = 1$ and $x_{n+3} = x_{n+2} + x_n$ for $n \ge 0$.
The ciphertext is 1111000000001000. Decode the message.

I'm a lost as where to begin on this one. I am not looking for anyone to just give me the answer, but some guidance (step by step preferably) on what my starting steps should be would be greatly appreciated!


texts: I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?


texts: Challenging $O(2^{n/2})$ for hash collisions using quantum computers

texts:
In "Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound" the authors Akinori Hosoyamada and Yu Sasaki state that it may be possible to perform collision attacks with of a lower order than $O(2^{n/3})$ using BHT [1]. Bernstein remarked for BHT that it would have the same space-time complexity or worse than classical attacks [2].
However, the attack seems specific to increasing the number of rounds that can be attacked, without a direct result on the full hash algorithm (in this case AES and Whirlpool).
Does this result have any direct or indirect impact on SHA-256? In other words could these findings have a significant impact on the space-time complexity of finding collisions for SHA-256?
If so, can a space-time complexity be given? Or are the results too experimental for that to be calculated?

Brassard, G., Høyer, P., Tapp, A.: Quantum cryptanalysis of hash and claw-free functions. In: LATIN 1998. LNCS, vol. 1380, pp. 163{169. Springer (1998)
Bernstein, D.J.: Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete? In: SHARCS (2009)


texts:
So for an unknown number of parties $x$, I make $x-1$ random $n$-bit strings represented by {$r_1, r_2,...,r_{x-1}$}. Where  $s$ is the complete string split up between $x$ parties (yes?).

I then send each party one of the fragments $s_i$, so party 1 would get $s_1$, party 2 would get $s_2$ etc. all the way through to $s_{x-1}$. Along with these fragments. I then send $r_1⊕...⊕r_{x-1}⊕s$ to party $x$.

The message $s$ can then be reconstructed by XORing all the fragments together. Any singular $x-1$ party should not have enough information to reconstruct a message. But then what happens if there are only two parties? if $x=2$, then the message $s$ would be divided between $x-1=1$, which means that that singular party would acquire the entire $n$-bit string on their own, or am I over looking something that prevents this so that any $x-1$ party does infact not have enough information to reconstruct the message, even if it was only 1-bit ($n=1$) in length?

What about if 3 parties share two keys $a,b$? Assuming their fragments are $f_j$ for $a$ and $g_j$ for $b$ (that is these are $r_j$ fragments, and party 1 has $g_1$ and $f_1$, party 2 has  $g_2$ and $f_2$ etc), could they manage to derive the secret if each party makes $z_j=f_j⊕g_j$, using the $z_j$ values of each?


texts: How a chosen prefix collision is more useful than a standard collision concerning hashing functions?

texts:
Recently a paper has been released about SHA-1 chosen prefix collision.

They present what a chosen prefix collision is, but I don't understand how is it more interesting than a standard collision ? They briefly mention x509 rogue certificate, but I still can't get the point.

Can anyone explain to me how interesting it is compared to standard collisions ? Hopefully with an example a bit more detailed ?

Thanks in advance !


texts: Kernel attack on MinRank - How do we check if we can stop?

texts:
I have some trouble understanding how Kernel Attack to MinRank is implemented.
MinRank: Let $k, n, r$ be positive integers, and let $M_0, M_1, \dots, M_k$ be $n \times n$ matrices with entries in a finite field $\mathbb{F}_q$. We want to find (if they exist) $\lambda_1, \dots, \lambda_k \in \mathbb{F}_q$ such that $E_\lambda := M_0 - \sum_{i=1}^k \lambda_i M_i$ has rank not exceeding $r$.
Regarding the Kernel Attack, I understood that, given $m$ random column vectors $\mathbf{x}^{(1)}, \dots, \mathbf{x}^{(m)} \in \mathbb{F}_q^n$, the probability that they all belong to $\ker(E_\lambda)$ is at least $q^{-mr}$; and that, if they do, then $\lambda_1, \dots, \lambda_k$ can be found by solving the linear system of $mn$ equations in $k$ unknown $\lambda_1, \dots, \lambda_k$ given by $(M_0 - \sum_{i=1}^k \lambda_i M_i) \mathbf{x}^{(j)} = \mathbf{0}$ for $j=1,\dots,m$. Hence, generating the random vectors $\mathbf{x}^{(1)}, \dots, \mathbf{x}^{(m)}$ many times, the average number of attempts before we find $\lambda_1, \dots, \lambda_k$ is $O(q^{mr})$.
My question is: How do we check (in the least expensive way) that the vectors $\mathbf{x}^{(1)}, \dots, \mathbf{x}^{(m)}$ gives $\lambda_1, \dots, \lambda_k$ and so we can stop?
Clearly:

If the system $(M_0 - \sum_{i=1}^k \lambda_i M_i) \mathbf{x}^{(j)}  =\mathbf{0}$ has no solution, then we have to try another random $\mathbf{x}^{(1)}, \dots, \mathbf{x}^{(m)}$.

If the previous system has a solution $\lambda_1, \dots, \lambda_k$, and the rank of the $m \times n$ matrix with columns $\mathbf{x}^{(1)}, \dots, \mathbf{x}^{(m)}$ is at least $n - r$, then the rank of $E_\lambda$ is not exceeding $r$ (by rank+nullity theorem).

But is (2) efficient? Maybe it is better checking directly the rank of $E_\lambda$...


texts: Can $r$ and $s$ from an ECDSA signature be negative numbers?

texts:
I have an ECDSA implementation in Mathematica over secp256k1 and $r$ and $s$ are always positive numbers. But if you encode them as bytes, the most significant byte can be over 0x80, which would make it a negative number if the big-number is interpreted as being signed.

I'm asking because the bitcoin implementation has these checks which I don't understand:

if (S[0] & 0x80)
    return error("Non-canonical signature: S value negative");
if (R[0] & 0x80)
    return error("Non-canonical signature: R value negative");

The $r$ and $s$ values that I produce seem that they would fail these checks when they are larger than $2^{255}$


texts: Does it make sense to have a 4000 bit long key?

texts: My question is about the key length of a asymetric algorithm. How is it possible to memorize or remember a key that is about 4000 bits long?


texts: How are precision and security related in a Gaussian Noise Sampler for R-LWE?

texts:
My understanding is that the sampling precision in Gaussian Noise sampler is related to security. But not sure about why is that? I read that when the samples are floating-point numbers and precision after the decimal point is equivalent to 72 bits that can be correlated to 128-bit security.

However, certain schemes use 32 bits precision, so how does that impact the security? And what is a good number to select for the precision value? Also, if the samples are integer values then how to deal with precision and security?


texts: How to represent point-at-infinity in affine coordinate

texts:
In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate.

Whether x=0 and y=0 can be considered as point-at-infinity in affine coordinate?


texts:
If Alice and Bob both start with a shared OTP $P_0$, which is 256-bytes long, and Alice wants to send a 512-byte message, would it be secure to send the first 256 bytes with standard OTP ((a+b)%256 or the like), then generate another 256 bytes of true randomness ($P_1$), run that through the OTP and send the encrypted form of that. Repeat for the second block of 256 bytes and $P_1$, etc. Bob then decrypts the first 256 bytes with $P_0$ and gets $P_1$ from the second 256 bytes. Rinse and repeat, etc.

Is this secure from a passive Eve? If not, why not?


texts:
I have read many pages about encryption but I am really stuck on this. For access control to a building I want to print a 10 character ASCII code on a ticket (as a barcode).

The barcode reader (controlled by an Arduino or mini PC) is not connected to the PC which creates and prints the barcodes.

When both server and client have the same keys, is it possible to validate the codes?

EDIT:
My first attempt was to convert the current date in to binary, and then to ASCII with base64. The problem was that I ended up with a too big code (11 characters).

Considerating everything I came to the conclusion that it would be better too convert the date and time directly into ASCII characters. ASCII characters become readable at position 33, so year 2015 becomes 15 + 33 = ASCII character 0

In this way Year + Month + Day + Hour + Second + Validtime only takes 7 characters.

EDIT2:
I tried different encryptions en base encodings. Because year and month don't vary much, the generated code before encryption looks very much alike. When I use ARC4 encryption, the generated codes are also very similar.

Using DES3 the generated codes are not alike. I have included the two encryption methods in the code below. Because I use Python 2.7 I have to use the base85 module from the mom package. In Python v3 base85 is included.

Here is the code:

from datetime import datetime
from Crypto.Cipher import DES3
from Crypto.Cipher import ARC4
import base64
from mom.codec import base85

sleutel="Dsdfk3#$294ddkwlsslwEefm"
now = datetime.now()
year = chr((now.year - 2000)+33)
month = chr((now.month)+33)
day = chr((now.day)+33)
hour = chr((now.hour)+33)
minute = chr((now.minute)+33)
seconds = chr((now.second)+33)
#validtime from 0 till 9 in this case just a random 4. So 0 would be a few hours and 5 a week etc.
validtime = chr(4+33)
key = ''.join([year,month,day,hour,minute,seconds,validtime])
print key
obj1 = ARC4.new(sleutel)
obj2 = DES3.new(sleutel)
cipher_text = obj1.encrypt(key)
cipher_text1 = obj2.encrypt(key+ 'a')
print "Base64 ARC4 encrypted:", base64.b64encode(cipher_text)
print "Base64 DES3 encrypted:", base64.b64encode(cipher_text1)
print "Base85 ARC4 encrypted:", base85.b85encode(cipher_text)
print "Base85 DES3 encrypted:", base85.b85encode(cipher_text1)

Because I added seconds, every code is unique (as long as it is impossible to print two tickets in one second)


texts: Efficient parameters for group Diffie-Hellman

texts:
I want to implement a basic version of Diffie-Hellman key agreement for groups.

So, my key is $K=g^{abc} \mod p$. Following this, the parameters I would need to transfer would be $K_a = g^{bc}$ etc. The group may become large (up to 100 member), so I don't want to calculate every parameter anew and reuse $K$. Is there an efficient way to do this? I tried multiplying $K$ with $(g^a)^{-1}$ but that did not create a valid parameter since the resulting key was not correct.

Another idea I didn't have implemented yet is to calculate the key as $K=g^t$ with $t=abc \mod p$. I think, that in this case I could compute the inverse $a^{-1}$of $a$ in $Z_p^*$ and get my parameters as e.g. $K_a=K^{a^{-1}}\mod p$. Do you think this would work? Are there possible security issues in this approach?


texts: Trying to finalize my understanding about password storing

texts:
am sorry, an a beginner, so please forgive me if i make mistakes, so here is what I understood:

PBKDF2: uses HMAC, so, the message is the password, and the key that crypts the message is the salt? or is it the inverse? and this is done the number of the rounds $n$ times.

So I guess the second one, because the user will write the password, and then the program will consider this as a key to decrypt the salt?

BCrypt: used to avoid custom hardware cracking, altering the table where the hashes are stored to make the result unpredictable so to force the program to wait and to block? and using only 4KiB in CPU cache to block the program (GPU will become slow since they dont have cache? )?
BCrypt encrypts the password using a key derived from the same password using Blowfish $2^n$ times?

SCrypt: kind of BCrypt but...uses lot of memory to block the process on a huge amount of memory, to block the calculations and force the program to wait?

So, BCrypt uses a small amount of CPU Cache, while SCrypt uses a large amount of RAM?