texts: Does SRP also authenticate the server to the client?

texts:
The Secure Remote Password (SRP) protocol lets a client prove to a server that it knows a specific password without revealing that password to the server. The server stores a cryptographic verifier for the user account. If an attacker impersonates as the server it cannot learn the user's password.

Now, does it also work the other way around. If a SRP password authentication succeeds, does that also prove to the client that the server knows the correct verifier, and thus assuming that the verifier was kept secret that the client is talking to the real server? (Or at least to the server that it originally gave the verifier to?)

Reading the protocol description I think it does, but as far as I can see the description nowhere mentions this property as something SRP is supposed to do. So maybe there is something I'm missing.

SRP protocol on Wikipedia
The Stanford SRP Homepage


texts:
I've got a question about the signature of a CA.

As I understand, the CA takes the public key of the client and signs it with
his own private key by using "md5WithRSAEncryption" (like explained here: http://en.wikipedia.org/wiki/X.509#Sample_X.509_certificates".
What does it mean exactly?
Can you give me a formal explanation for better understanding?
Does the CA use both algorithms?

Second question
In the first certificate example from wikipedia in section 'Subject Public Key Info:' there is defined the 'RSA Public Key:'
Is that the plain public key which the CA got from the Client or is there something done on it?

Please give more hints for better understanding if you can.

Thanks before


texts: How to calculate end point from private key in elliptic curve cryptography

texts: The drawing of lines on the elliptic curve is repeated n times, where n is your private key, resulting in a point Ω. When calculating Ω, is there a short cut function that lets you skip having to actually iterate n times? If not, does not seem that difficult get n by just brute force..


texts: Can libsodium's X25519 encryption construction be generalized?

texts:
It is my understanding that libsodium's sealed_box is based on X25519, a Diffie-Hellman function: By combining the X25519 key agreement with a symmetric cipher and having a recipient derive the symmetric key, a message can be constructed that can only be decrypted by making use of the X25519 private key.
Can this construction be generalized to other Diffie-Hellman functions (ECDH with other curves, or the ordinary non-EC Diffie-Hellman)?


texts: Software implementation of a commutative cipher?

texts:
I've got an application (detailed below) that calls for the use of a cipher that is commutative.  I've been doing some googling & reading, and there are two algorithms that seem to get mentioned in these discussions--SRA (not RSA) and Pohlig-Hellman exponentiation.  (Supposedly SRA is a variant of RSA?).  I need something strong, so XOR will not serve.

I'd hoped to run across some actual software that implemented one of these guys so I could play around with them & demonstrate a scheme I have in mind, but I have not been able to find any.  It looks to me like these things are not in the source code that comes with Schneier's Applied Cryptography, frx. Can anyone recommend a source for implementations of either SRA or Pohlig-Hellman?

Here's how I'm thinking to use this tech if I can get my hands on it.  I work for a healthcare provider A, which operates in the same geographic area as our colleague/competitor provider B.  We know that we share some patients, but we don't know which, or even how many people we have in common.

We could just swap lists of say, the SSNs of our patients & find out who we share, except that we don't really trust each other to treat this sensitive data w/the care that it's due, and wow would people freak out and hate us if it got out that we were making free w/their SSNs, etc. etc..  So--please take for granted that sending raw SSNs is neither practical nor desirable.

But here's what we maybe can do.  I grab my commutative-cipher software, generate an encryption key, save it off somewhere safe, and produce a file of encrypted SSNs (each SSN encrypted separately with my key).  My colleague at provider B does likewise.  Then we swap encrypted lists, and each encrypt the other guy's encrypted SSNs with our own keys.  Then we swap the doubly-encrypted lists.  Because the cipher is commutative, encrypting with key A first, and then key B should give the same results as encrypting with key B first and then key A.  Which means that any values that are shared on the two doubly-encrypted lists represent the same SSN, and therefore a shared patient.  So we know exactly who we share, without exposing the SSNs of our entire patient list.


texts: What weaknesses would SHA256 hash array building and hashing the result have for password storage?

texts:
You allocate a 1MB array.  Salt the password (this is the only time the salt is used other than being stored at the end) and hash the password with SHA256 8 times.  Place  31,250 copies (125,000 was an error) of the first hash to fill the array, so it cannot be de-allocated or used for anything else until the process is complete.  You then use the first hash as salt for the 1MB array and hash the entire array salted with the hash 8 times and place copies of the result in the second 1 KB block of the array.  Keep repeating the hash and fill procedure until the entire 1 MB array is over-written step by step and then finally hash the entire 1MB.  That is the hash you store next to your salt.
The default I am trying for is 8,000 SHA-256 hashes with a 1 MB memory requirement.
If the user wants higher memory requirements, the array can be 1 MB, 2 MB, up to maybe 8 MB.  The algorithm is simply copying intermediate hashes 125 times, 250 times, etc.  If the user wants more iterations, each hash is performed somewhere between 8 times, 16 times, 32 times etc.
I'm trying to make it so an attacker cannot de-allocate the 1 MB array or use it for anything else for the entire duration.
How would this stack up against BCrypt or SCrypt in terms of defending passwords against offline attacks?


texts: How does Truecrypt change password without the need for a complete re-encryption of volume

texts:
From what I understand:

TrueCrypt takes the password as message
Add salt
calculates a digest
use digest for encryption

From what I understand. A good hash function

has Second pre-image resistance .i.e. It is difficult to find $m_2$ such that $m_1\neq m_2$ and $hash(m_1) = hash(m_2)$ .i.e. it is difficult to find a salt to produce the same digest

I observe that truecrypt can change my password in seconds (I assume the data is not reencrypted). How is this done while keeping the data on hard drive encrypted?


texts:
I've been working on cryptopals 1.6, breaking XOR, and have got it working. I found this answer that explains why hamming distance works, and after some consideration I believe I'm starting to understand it.
One thing that I stumbled on was key size estimation, step 3. I finally found a write-up:
fn score_keysize(keysize, bytes) {
  let block1 = bytes.getblock(size=keysize)
  let block2 = bytes.getblock(offset=keysize, size=keysize)
  let block3 = bytes.getblock(offset=keysize*2, size=keysize)
  let block4 = bytes.getblock(offset=keysize*3, size=keysize)
  let hamming = hamming(a,b) + hamming(b,c) + hamming(c,d)
  return hamming / 3
}

And this works. I tried a variant but didn't even get nearly as good results. Almost all of my attempts, with some variance, got a lower score the larger the key became, this included.
fn score_keysize(keysize, bytes) {
  let block1 = bytes.getblock(size=keysize)
  let block2 = bytes.getblock(offset=keysize, size=keysize)
  let block3 = bytes.getblock(offset=keysize*2, size=keysize)
  let block4 = bytes.getblock(offset=keysize*3, size=keysize)
  let hamming = hamming(a,b) + hamming(c,d)
  return hamming / 2
}

Could someone explain why that's so much worse? Or is it dependent on the text?


texts:
Diffie-Hellman Key Exchange Basic Protocol:

    Let G be a cyclic group of order $n$ and generator $g$.

    Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$.

    Alice computes $h_A = g^a$ and Bob computes $h_B = g^b$.

    Alice sends $h_A$ to Bob and Bob sends $h_B$ to Alice.

    Alice computes $(h_B)^a = g^{ab}$ and Bob computes $(h_A)^b = g^{ab}$.

    The common symmetric key is $g^{ab}$

As we all know, this basic protocol is vulnerable to the man-in-the-middle attack.

Therefore I propose the following variant, where Alice and Bob use a digital signature scheme, both having a pair of public and private keys for signing (the public portion of this keypair is shared beforehand):

    Let G be a cyclic group of order $n$ and generator $g$.

    Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$.

    Alice computes $h_A = g^a$ and Bob computes $h_B = g^b$.

    Alice sends $(h_A,sig_{sk_A}(h_A))$ to Bob and Bob sends $(h_B,sig_{sk_B}(h_B))$ to Alice.

    Alice verifies the signature. If ok, proceed to next step. Otherwise abort. The same for Bob.

    Alice computes $(h_B)^a = g^{ab}$ and Bob computes $(h_A)^b = g^{ab}$.

    The common symmetric key is $g^{ab}$

This variants differs from the Station-to-Station Protocol, which provides security against man-in-the-middle attacks.

Is my variant of the basic protocol also secure against man-in-the-middle attacks? What is the advantage of the STS Protocol when compared to this variant?

Thanks in advance.


texts:
In some paper, the terms "cryptographic hash function" and "deterministic hash function" would appear?
I'm wondering what's their difference, and are there some other types of hash functions?
Like the cryptonote whitepaper in 4.2.1


texts: Is this method of encryption theoretically unbreakable?

texts:
I implemented a Stream Cipher using Cryptographically Secure Random Numbers for the key values. The key stream was as long as the plaintext stream. This key data set won't be reused. Have I met all the requirements for a truly theoretically unbreakable encryption process?

I know programmers without the math or general crypto background are strongly encouraged NOT to avoid AES, Two Fish, etc. in favor of their own, amateur approaches. Yet I can't see where I've missed a requirement. I look forward to those with domain expertise to show me if I've failed to understand something here. Thank you.


texts: Vulnerabilities in specifying the hash algorithm used for signature verification on a per-message basis

texts:
Let's say that I have a 4096-bit RSA key and when I sign data, I typically use SHA-512. As far as I understand it, the hash algorithm used to sign/verify a message is specified in the message. If a hash algorithm is susceptible to collisions, then it doesn't matter how large my RSA key is, and signatures can be forged.

So what is to prevent someone from forging a signature by selecting MD5 as the hash algorithm used to "sign" a message?


texts: what is the difference between IBE and ABE schemes

texts: Can somebody explain in simple words. real life example light help and limitations of these schemes etc.


texts: Proving I can solve an equation without disclosing the solution (zero-knowledge proof)

texts:
Given a (potentially multivariable) equation $f(x)=0$, Peggy wants to prove to Victor that she knows a solution $x^\star$ to it without actually disclosing anything information about the value of $x^\star$.
Is there a slick way to pull off this zero-knowledge proof?
If possible, I want a solution

in the continuous context where $x\in\mathbb{R}^n$ (and, if necessary, $f$ is well-behaved and infinitely differentiable.)
in the discrete context, where $x\in GF(p)$ (i.e. modulo a large prime $p$).

For a continuous example: $f(x) = [ x_1 \cdot x_2 - 2 , x_1^3 - x_2 + 1] = [0, 0]$. A solution is $x^\star = (1, 2)$.
For a discrete example: $f(x) \equiv 2^{x_1} + 3^{x_2} - x_1 \equiv 0 \pmod{5}$. A solution is $x^\star=(1,2)$.
In both cases, we want to show we have that solution without disclosing the value.
Edit: You can absolutely assume that $f$ can be efficiently evaluated, making the problem in NP.
Edit 2: I in particular want a slick solution that doesn't involve just considering the boolean computation circuit. Something more akin to the zero-knowledge proof that one knows of a Hamiltonian path by considering providing it on an isomorphic graph.


texts:
Is it possible to use Time-based One Time Password (TOTP) algorithms to generate tokens from multiple channels (where a channel is defined as a "user" using a certain shared key $K_c$ for channel $c$), and in so doing identify the channel itself from the OTP?

My overall objectives are to:

Generate hash outputs that will never "collide" provide the inputs to such hash function never collide.
Identify from the hash output (the OTP) what the "channel" was that created it, and whether it is a valid OTP. This is trivial for a single channel generating OTP's, but you need an "authenticator" for every channel. I want one server side authenticator for multiple channels/users and be able to derive from the OTP itself what the channel/user is.

My current approach:

Suppose two OTP's were generated with the same time sequence constant $i_0$, and shared secret keys $K_1$ and $K_2$ respectively. Let $A$ and $B$ be the OTP's:
$$\begin{align*}
  A &= \text{HMAC-SHA-1}(K_1, i_0) \\
  B &= \text{HMAC-SHA-1}(K_2, i_0) \\
\end{align*}$$
Would it be possible on the server side during validation to establish without the shadow of a doubt (mathematically speaking) that $A$ is "linked" to channel 1 ($K_1$), and $B$ to channel 2? In other words, every OTP generated using $K_1$ will be different to those OTP's generated using $K_2$ regardless of the truncation of the 160-bit output of HMAC. I believe this is the equivalent of enquiring as to uniqueness of the output of a hash function given unique inputs.

If this happens, and the two "sequences" are different, can their difference be quantified in terms of say a Hamming distance?


texts: Attack against $\operatorname{DESA}_{k,k_1} (x) \underset{\text{def}}= \operatorname{DES}_k(x)⊕k_1$

texts:
Problem 5.16 in this pdf, from the book: Christof Paar, Jan Pelzl, Understanding Cryptography

5.16. This is your chance to break a cryptosystem. As we know by now, cryptography is a tricky business. The following problem illustrates how easy it is to turn a strong scheme into a weak one with minor modifications. We saw in this chapter that key whitening is a good technique for strengthening block ciphers against brute-force attacks. We now look at the following variant of key whitening against DES, which we’ll call DESA:
$$\operatorname{DESA}_{k,k_1} (x) \underset{\text{def}}= \operatorname{DES}_k(x)⊕k_1$$
Even though the method looks similar to key whitening, it hardly adds to the security. Your task is to show that breaking the scheme is roughly as difficult as a
brute-force attack against single DES. Assume you have a few pairs of plaintext–
ciphertext.


texts:
I need some help with the following statement from the book A Graduate Course in Applied Cryptography* - Dan Boneh and Victor Shoup, in 8.10.1    The key derivation problem, page 320 of v0.5:

  Later, we will see examples of number-theoretic transformations that are widely used in
  public-key cryptography. Looking ahead a bit, we will see that for a large, composite modulus
  $N$, if $x$ is chosen at random modulo $N$, and an adversary is given $y := x^3 \bmod N$, it is hard to compute $x$.

To be specific, my doubt is related to how do we really prove that RSA problem can keep hard, despite small and known exponents $x^3 \bmod N$, for an adversary who doesn't know $x$. The authors said that "we will see examples" in the book. But I couldn't find them. Can you please give me some direction for such proof?


texts: Question about modifying the MD5 plain text to cause a collision

texts:
I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition

  The MD5 collision in Problem 25 is said to be meaningless since the
  two messages appear to be random bits, that is, they do not carry
  any meaning. Currently, it is not possible to generate a meaningful
  collision using the MD5 collision attack. For this reason, it is sometimes
  claimed that MD5 collisions are not a significant security threat.
  The goal of this problem is convince you otherwise. Obtain the file
  MD5_collision. zip from the textbook website and unzip the folder to
  obtain the two Postscript files, rec2.ps and auth2.ps.

THe zip file is at this link : http://www.cs.sjsu.edu/~stamp/infosec/files/MD5_collision.zip

The question asked was:

  c. Modify rec2. ps and auth2. ps so that they display different messages
  than they currently do, but they hash to the same value.
  What are the resulting hash values?

In this question, we have to modify both the files such that their hash is same again (They have the same hash before modification). The problem is that whenever I change anything and try to make it same in both files, still the hash value changes.

Technically the hash should be same, as the author is calculating the MD5 using the IV's hash value. Thus if we do not modify the value before eq{ , then it should have the same hash value if both files have same modifications.

This does not happen, please help. (I am editing it using Notepad)


texts: How does CCM handle variable-length messages?

texts:
Since CBC-MAC is insecure for variable-length messages if nothing is done to handle them, I'm wondering how it can be used with variable-length messages.

Rogaway's critique of CCM indicates that it is not an online mode of operation (the length must be known ahead of time for CCM). So, can it be altered/modified to be online? Like by perhaps appending the length of the message as the last block?


texts: I hope somebody can help me to find out how DES P box has designed. I am doing DES by hand so I want to know how these numbers are arranged?


texts: Does the adversary know the random seed s? If he does not, isn't one possible construction simply the random seed itself? if the output needs to be bigger than random seed s cant I just add a hardcore bit to the random seed s? Also, regardless of the number of leading bits of the output that are revealed (even n-1 where n is length of output), will the output be computationally indistinguishable from a truly random string?


texts: Perfect Forward Secrecy in PGP/asynchronous email

texts:
Looking at the RFC for PGP email/asynchronous chat with PFS here https://tools.ietf.org/html/draft-brown-pgp-pfs-03 can anyone tell me why the following scheme is no good?

Alice and Bob retrieve each others long-term public keys. When Alice sends the first email to Bob, she encrypts her message with Bob's long-term public key, generates a one time public key and signs it with her long-term private key and includes it in her email to Bob. Bob receives the email from Alice, and when replying, uses Alice's one-time public key to encrypt his message, and also includes his reply email a one-time public key signed with his long-term private key. etc etc. Of course, one-time public/private keys are deleted once they're used to decrypt a message, just as ephemeral Diffie-Hellman keys are deleted in something like ECDHE.

This provides PFS for Bob, and basically PFS for Alice (excluding the first message of Alice).

Why is this scheme not widely-used in PGP? Is it just because key generation takes a few moments? Or that, Alice having multiple communication partners (that might take forever to reply) means storing multiple one-time private keys? (This can of course be mitigated by making the one-time private keys expire after a short time, eg., one week like with Pond).

Thoughts welcome.

(by the way, I'm not really suggesting this as a revolutionary scheme. I'm genuinely trying to understand asynchronous messaging better, and destroying this basic PGP scheme would be helpful in my understanding).


texts: Would hashing a ciphertext (so $H(Enc(pk,m))$) compromise it in any way if both schemes are secure by themselves? This doesn't seem to be the case but I couldn't find a definitive answer.


texts: I need to know number of encryption/decryption operations?

texts: If i want to break quadruple DES (say EDED), what is complexity? Like for EDE, it is O(2^112).


texts: Is it possible to decrypt only a portion of a gpg encrypted file?

texts:
I have very large encrypted files that I need to process in a highly parallel fashion (the files are composed of distinct records of data). Currently, the process begins by first decrypting the data, then starting the parallel work with each worker seeking to it's assigned file offset. I already have a way of aligning to record boundaries, so don't worry about that.

My (limited) understanding of GnuPG encrypted files is that the data is encrypted using a symmetric algorithm and then the key is encrypted with the public key of the recipient. Since I am the recipient, I understand that my public key can list algorithms I support.

Can I make use of this so that when the file is encrypted, I will be able to interpret it in a chunk-like fashion? For example, I could piece together a valid decrypt-able chunk by reading a certain number of bytes preamble of the file and then seeking to a calculable valid offset and continuing my reading and ending at a calculable valid offset?

Thanks!


texts: Can I alter encrypted data without decrypting it?

texts:
I didn't find a direct solution for it. Can I modify encrypted data without accessing it?
If there is an example, I would appreciate it.


texts: How To prove Any Change to $v=a\cdot y+b$ maks $y=(a)^{−1}\cdot (v−b)$ Uni. random value

texts:
This question is related to data integrity.

Let a finite field be $\mathbb{F}_p$, where $p$ is a prime number.

I have a fixed value $y$ and two uniformly random values $a$ and $b$.

Hypothesis: $a,b,y,v \neq0$

I consider the server as an attacker who may modify the value $v$. The change to value $v$ may apply a clever change to value $y$ (see below).

I compute $v=a\cdot y+b$, and send it to the server. The server can do any change to $v$. So it computes a function of $v$, as $f(v)$.

Assume that I can magically detect if $y$ becomes a uniformly random value. So as long as the server cannot change $y$ to an arbitrary value $y'$ the security property is satisfied.

I can download $f(v)$ and remove the random values to obtain $y$, so I can do: $y=(a)^{−1}\cdot (f(v)−b)$

Question: How can I prove that ANY change to $v$ makes $y$ a uniformly random value?

To clarify I want to make sure the server cannot modify $v$ to apply an arbitrary change to $y$. In other word, my security needs would be satisfied if the server only can change $y$ to a uniformly random $y'$ (by changing $v$)


texts:
Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much is the time it takes to solve the DLOG problem in the group generated by $g$ dependent on $n$? I.e. if the order of the group element is small and stays small, but we keep increasing the size of the field that it belongs to, how much will computing the dlog slow down?

The reason why I started thinking about this is the MOV reduction for bilinear pairings. As I understand it, even though we have the index calculus algorithm in the target group, we are somehow able to make sure that the generator $e(g,h)$ in the target sits within a larger field extension of $\mathbb{F}_p$ and this somehow prevents us from translating the ''efficient'' DLOG from the target group to the source groups.

Anyone care to elaborate on the details?


texts: How can I encrypt + authenticate short strings into similar short ciphertexts?

texts:
I wish to manipulate short ASCII strings (namely unpredictable domain names) into a form which cryptographically assures authenticity and confidentiality, for use in the local part of email addresses.  Furthermore, the resulting email addresses should be valid according to most address validators (including the many many non-standards compliant ones).

I therefore envisage that the resulting ciphertext must be as compact as possible (many validators have arbitrarily short length restrictions) once it is encoded using a very restricted subset of ASCII characters (probably just [a-z0-9\.\-], since many email address validators do not properly accept quoted/escaped characters and may erroneously transform the address in such a way that character case is lost).  Most ciphers that I've tried produce far too much ciphertext to meet these requirements.

As an aside, it may be interesting to note that my proposed encoding uses the same alphabet as the plaintext.

A given plaintext should always produce the same ciphertext (when using the same key), so there should be no random component here.

Strong authenticity is more important than strong confidentiality, but a mere encoding will not provide sufficient confidentiality.  There is no particular requirement for asymmetric ciphers.  For the sake of argument, assume unlimited computational resources are available to perform encryption/decryption.

Suggestions for possible ciphers and/or encoding schemes would be most welcome.


texts: how many blocks are encrypted at a time in DES Algorithm?

texts:
I know that block ciphers encrypts data in the shape of specified blocks and DES also belong to block cipher family. I totally understand the procedure of DES, but I am confused that is DES take all the blocks of 64 bits of any plaint text and apply the process to all of blocks at a time or it encrypts first blocks then 2nd and 3rd and so on..
can anyone explain it Please??


texts:
I learned modern block cipher and saw this example.

How many padding bits must be added to a message of 100 characters if
8-bit ASCII is used for encoding and the block cipher accepts blocks
of 64 bits?

There was a solution, but I totally didn't understand.

Solution
Encoding 100 characters using 8-bit ASCII results in an 800-bit
message. The plaintext must be divisible by 64. If |M| and |Pad| are
the length of the message and the lengeth of the padding.
|M| + |Pad| = 0 mod 64 --> |Pad| = - 800 mod 64 --> 32 mod 64

What I'm curious are following questions..

Why encoding 8 characters using 8-bit ASCII results in 800-bit message?
What padding means?
What last sentence means? (difficult to understand)


texts: I'm looking for a simulation of the Quantum Key Distribution protocol.  Does anyone here have one that they could recommend?


texts: How to map the points of an elliptic curve cyclic group to $\mathbb{Z}_q$ using a hash function?

texts: Let $E$ be an elliptic curve defined over $\mathrm{GF}(q)$, where $q=p^r$. Let $G$ be a cyclic group of points of $E$. Then how we can map points of $G$ into $\mathbb{Z}_q$ using a hash function.


texts: What's the probable usage of Interlock Protocol

texts:
I've recently read some articles about the Interlock Protocol, Article by Ron Rivest and Adi Shamir.

I'm wondering if it is possible to protect Key-exchange under Public-Key cryptography from the MITM attack by using this protocol?

There's a method here.Suppose Alice & Bob has exchange their public key, but replaced by Mallory's public key. So Alice have Pkm, Bob have Pkm, Mallory have Pka, Pkb.

Alice.................Mallory.......................Bob

           A->Pkm(1:1)    M->Pkb(1:1)........1

M->Pka(1:1)....B->Pkm(1:1)................................................2

           A->Pkm(1:2)    M->Pkb(1:2)........3

M->Pka(1:2)....B->Pkm(1:2)................................................4

           A->Pkm(2:1)    A->Pkb(1:1)........5

B->Pka(1:1)....B->Pkm(2:1)................................................6

           A->Pkm(2:2)    A->Pkb(1:2)........7

B->Pka(1:2)....B->Pkm(2:2).................................................8

Then Mallory could cheat both Alice and Bob, and they will not recognize. Interlock-protocol seems insecure.

Of course Alice and Bob can ask a question when they're comunicating. Alice sent A->Pkm(1:1), and need a response 'B->Pka(2:1)' after she sent A->(2:1), but she just received the B->(1:1) as step 6, Alice know there's a Man In The Middle.

This method need Alice and Bob know each other very well, and both have a question they can answer but Mallory can't. So if they have such pre-shared questions & answers, why don't they use these question's hash value as a pre-shared key? Alice Just notice Bob the key is the 1st/2nd/3rd... one from the 'Pre-Question-Table', and they don't need public-key cryptographic's help.

Is it true? So what's the area when we can use the Interlock-protocol?


texts: Decrypting an encrypted aes 256 cbc text with random IV, decrypts the string

texts:
This may be a basic question but bear with me.

I started encrypting a text with aes 256 cbc mode generating a random iv of 16 bytes and a key.

text = 'hi I am learning encryption.';

Then I created another random iv and tried to decrypt the encrypted text. ( I know we are supposed to use the same iv we used for encryption to decrypt the ciphered text).

The result came as

(some rubbish text) encryption.

Then I padded the main text with 16 random characters, encrypted it and decrypted it I get my actual text padded with some junk text at the start.

I am unable to figure out why it messes with the first 16 bytes of text and then successfully extracts the remaining.

Can you explain?


texts: Why does TinyJAMBU-128 claim only 112-bit security?

texts:
I am trying to understand the security level of TinyJAMBU-128.
As shown in Table 4.1 page 12 of this document, TinyJAMBU-128 claims 112-bit security. However, it has a 128-bit key. How have we lost 16 bits of key? What is the obvious attack that has $2^{112}$ time complexity?


texts: Condition on Vector Boolean Function to be Bijective

texts:
Suppose the vector boolean function be

$$\begin{align}
f:F^n_2 \longrightarrow F_2^n \\
(x_1,\dots ,x_n) \longrightarrow (x_2,\dots x_n,g) \\  \\
g:F^n_2 \longrightarrow F_2 \\
(x_1,\dots ,x_n) \longrightarrow \{0,1\}
\end{align}$$

What should be the condition on the Boolean function $g$ so that $f$ becomes bijective i.e. 1-1 and Onto?


texts: Reed Solomon secret sharing and as a one-time symmetric key?

texts:
Shamir's Secret Sharing is just a special case of Reed-Solomon where only one coefficient is used to store the secret instead of the entire polynomial.

Sarwate however, suggests that the latter can be done by sacrificing information theoretic security:

  The second aspect of Reed-Solomon coding schemes considered in the
  McEliece-Sarwate paper is that it is not necessary to fill up $S(x)$
  with $m-1$ randomly chosen symbols.  In fact, the secret can be all
  $m$ symbols $s_0,\ldots,s_{m-1}$ instead of just $s_0$ being the
  secret.  One advantage is that we can use a smaller finite field.  If
  the secret is $1000$ bits, say, and $m=10$, Shamir's scheme would
  operate over $\mathbb F_{2^{1000}}$ and each share of the secret would
  also be $1000$ bits long. $10$ kilobits ($10$ one-kilobit shares)
  would be needed to  recover the secret.  On the other hand, a
  Reed-Solomon coding scheme could divide the secret into $10$ $100$-bit
  symbols and operate over $\mathbb F_{2^{100}}$.  Also each share would
  be $100$ bits long, and, as before, only ten such short shares would
  be needed to recover the secret.  This reduction in the field size
  does come at some cost in security.  If only $9$ shares are available
  to a cabal and they guess at possible values of the tenth needed
  share, they can come up with a  "short list" of only $2^{100}$ values
  that the $1000$-bit secret might have.  Shamir's scheme in a similar
  predicament would have a list of $2^{1000}$ possible values of the
  secret, thus providing perfect security.  The trade-off between
  reduction in security and ease of implementation as well as storage of
  each share of the secret is something that needs to be evaluated for
  each application.  The most secure scheme has shares that are as long
  as the secret while the Reed-Solomon scheme can be used to reduce the
  share size at the cost of reduced  security.
  source

Has anyone else agreed with Sarwate on this? Is it proven to be true?

Suppose you have a $10,000$-bit secret which you split into $100$ $100$-bit shares. Being in possession of $99$ shares can you really not learn anything about the $10,000$-bit secret even if parts of it are known or can be guessed? With complexity less than $2^{100}$.

And wouldn't it imply that this can be used to encrypt? The last share can be withheld from source of data and be effectively its encryption key.


texts:
I have found interesting for me paper about constructing collisions in SHA 0. On page 60 the author determines M variable which is a concatenation of 32-bits vectors $M^{(i)}$, but I can't find any explanation about this

$$\forall i,0\leq i\leq 79,M^{(i)}_{0,k}=0\text{ if }k\neq 1$$
$$\forall i,0\leq i\leq 79,M^{(i)}_{0,k}=m_0^{(i)}$$

$M$ with superscript $(i)$ means a 32-bits vector which refers to $i$-th word W.

What does $M$ with two subscripts $0$ and $k$ mean?

It is very important to make it clear because whole process of getting right mask $M$ is based on the first mask $M_0$. Please help me to understand the author's definition.


texts: Math to replace s-boxes - Good or bad idea?

texts:
The following was going through my brain for the past week. If my thoughts are generally known to the cryptographic community would someone provide a link or two. Even if I’m making a classic newbie mistake.

Cryptographic internal functions operating like $x=f(x)$ can be table lookup s boxes with the inverse s box as a separate table.  A 16-bit sbox and its inverse can be implemented with a little math and no tables. Use the prime $m = (2^{16})+1$. Then pick constants $p$ and $q$ such that the recursion

Seed = Seed * p % m;

touches all values, 1..$2^{16}$.  Then select $q$ such that $p * q ~~mod~~ m = 1$.

p = 49374; // example values
q = 32065;
y = ((x+1) * p % m)-1; // forward
x = ((y+1) * q % m)-1; // reverse
// x+1 puts the 16-bit x into the range (1..2^16) where the recursion works.
// the -1 at the end makes the result fit in 16 bits.

There are over 32000 values of $p$ for which the recursion touches all $2^{16}$ values.

“Mod 0x10001” can be implemented with little more than a subtract. No actual division is required. Is this a reasonable part of a good encryption algorithm? Perhaps to replace 2 8-bit s box tables?

Getting carried away - - 32-bit (non invertible) sbox

Because $m=2^{32}+1$ is not a prime there is no full ($2^{32}$ term) sequence recursion of the form

Seed = Seed * const % m

This % m operation can also be formed with only a subtract if we don’t care to be super accurate. Or a test and subtract 1 it we want to be accurate.  Thus encryption code performing

z ^= ((x+1) * const % m)-1

can be performed in decryption to recover the prior value of $z$.

Is this “32-bit sbox” a useful concept?


texts: Suppose I have a secret 'X'. Which can be use as a seed to a deterministic random number generator to generate a number 'Y'. Is there any way to prove to others, that I have the secret 'X' which generated this number 'Y' without revealing the secret 'X' using zero knowledge proof, such as Schnorr's protocol.


texts: CPA-secure of $\Pi$ implies CPA-security of $\Pi||\Pi||\ldots||\Pi$

texts:
Katz and Lindell book claim that from the theorem:

  Any private-key encryption scheme that is CPA-secure is also
  CPA-secure for multiple encryptions.

Follows the fact that:

  If $(Gen,Enc,Dec)$ is a fixed-length ($M_n = \{0,1\}^n$) CPA-secure ES
  then $(Gen,Enc',Dec')$ with $M_n' = (\{0,1\}^n)^{*}$ and
  $Enc_k'(m) = Enc_k(m^{(1)})||\ldots||Enc_k(m^{(s)})$ is also CPA-secure.

Why is it the case?

What strikes me more is that a similar theorem to 1. holds for CCA-security:

  Any private-key encryption scheme that is CCA-secure is also
  CCA-secure for multiple encryptions.

However, the construction does not hold (according to my slides) in the later case:

  Assuming $(Gen,Enc,Dec)$ is CCA-secure with $M_n = \{0,1\}^n$ then one
  can show that $(Gen,Enc',Dec')$ is not CCA-secure.


texts: What NIST protocol was allegedly backdoored by NSA in 2006?

texts:
From a recent NY Times article:

  Cryptographers have long suspected that the agency planted
  vulnerabilities in a standard adopted in 2006 by the National
  Institute of Standards and Technology and later by the International
  Organization for Standardization, which has 163 countries as members.

  Classified N.S.A. memos appear to confirm that the fatal weakness,
  discovered by two Microsoft cryptographers in 2007, was engineered by
  the agency. The N.S.A. wrote the standard and aggressively pushed it
  on the international group, privately calling the effort “a challenge
  in finesse.”

  “Eventually, N.S.A. became the sole editor,” the memo says.

What protocol was adopted by NIST in 2006, then subsequently broken by MS employees in 2007?


texts:
AES-CTR is not considered as a CSPRNG, why ?
Is it unsecure to use it when a password is hashed with Argon2id to produce the seed to generate all random data needed for an end-to-end encyption system such as keys and IVs.


texts: Which categories of cipher are semantically secure under a chosen-plaintext attack?

texts:
I am trying to get my head around the circumstances under which a cipher is (or is not) semantically secure under a chosen-plaintext attack.

I can't seem to find a good reference explaining this.

I think I am missing a fundamental concept, so If I explain it as I see it perhaps someone can correct me.

Semantic security means that the adversary cannot learn anything about the plaintext from the ciphertext (except for the length of the message which is known beforehand).

I.e. the message is entirely indistinguishable from random bits.

So it seems to me that if a stream cipher is using a true PRG, it's output will always be indistinguishable from random, a chosen plaintext attack will not assist the adversary.

However if the encryption is deterministic then a chosen plaintext attack will reveal "information" about messages, as the ciphertexts can be compared to one another.

Am I missing something?


texts: what is the maximum size of the payload data when using ed25519

texts:
When using ed25519 what is the maximum size of the message/payload data?

From the specs:

  The Diffie-Hellman key exchange is then defined as follows: each party
  generates a random number 1 <= d < N (the private key), computes Q = d
  G (the public key). The parties exchange their public keys and compute
  the shared secret as Z = d Q_peer.

So once both parties have computed the shared secret, what is the maximum size of the message data that could be encrypted and therefore decrypted by the "secret"?


texts: AES CTR with a non random and predictable nonce?

texts:
after reading a lot of stuff about AES CTR and its IV i'm still not sure if it is ok to use a predictable IV or not.

I searched the web and found some programs / devices that use encryption in this way.

For example Lora. Lora is a low speed Network for exchanging data
(temperatures or humidity sensors ) over a complete cities with thousands of devices.

Example:
I've found source code of the Lora Mac on the Web which is doing exactly that.

A Sequence counter that uses every value only once over the entire Node lifetime.

And a little 1 Byte counter for every new 16 Byte Block.

The IV is Initialized by

static uint8_t aBlock[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};

after this

    aBlock[5] = dir;           ( direction of message)
    aBlock[6] = ( address ) & 0xFF; (Hardware address of device)
    aBlock[7] = ( address >> 8 ) & 0xFF; (Hardware address of device)
    aBlock[8] = ( address >> 16 ) & 0xFF; (Hardware address of device)
    aBlock[9] = ( address >> 24 ) & 0xFF; (Hardware address of device)
    aBlock[10] = ( sequenceCounter ) & 0xFF; (counter that never repeats)
    aBlock[11] = ( sequenceCounter >> 8 ) & 0xFF; (counter that never repeats)
    aBlock[12] = ( sequenceCounter >> 16 ) & 0xFF; (counter that never repeats)
    aBlock[13] = ( sequenceCounter >> 24 ) & 0xFF; (counter that never repeats)
    aBlock[15] = ( ( ctr ) & 0xFF );  ( a counter value that is incremented for every 16 Byte Block)

Is this secure enough?

Source Code:
https://github.com/Lora-net/LoRaMac-node/blob/master/src/mac/LoRaMacCrypto.c
Line 108: void LoRaMacPayloadEncrypt()

http://www.semtech.com/wireless-rf/internet-of-things/


texts: Can an altered RSA private key still work as the original?

texts:
I am interested in understanding public-key encryption using RSA. On the Khan Academy website, I noticed an anomaly when testing out the tutorial.
I created the following public/private keys:
-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQCYIpH5BT9+1MPf+xqI7khDJZmhMLVltXPf0JJY0mk3gXMQtOar
IocOlKmtWDhz+24KZHa6LuK6edpehKoBjdlhGf1GK+IwSR2uc9TnduuaDB2ETByZ
ZA/4Cbdcw9uroeF2IQV9/MNBUJsV8WHDzMefEhf3cVgdIvhw4IUjbCcOlwIDAQAB
AoGAfzEn6ZJBq8AmozRE0wak076z2tfmUMqLviuarzf7T7Sihu03jQyo7b/MvGht
ikpDjdzAhph8ZntJ3ov7tqDpg8Cm/Un/JvTfk1TGvR5okD2qX0Ww0143+oPC7EWC
1HNq+fcls80mr9XtH0fsPSByBxSOyn7nkdCqDxgiNYVMogECQQDfvMhdTmnpSyT6
9b/4RUHF5ggh+WHagpUL7mUNmeMkBYVyegLtXy2Vy6idVeW6Noaa7Ga1H5sdFDcf
ZdDidexhAkEArhKZ6Q6rG22ULeHfvipU9LiaGpaFstbLCI/RItfrmPXuDjIr6wxU
CQTHMrnzBQCrl0ANg0jp0eGJGNd+Tzkd9wJAOoxuamxgrtopPTseF1wYUC9YJXvb
LZFKa6rg6uRAWmbPexuOtItZpH99Cl82FLq8EsKWRgOVVdC6dA7y0LBHQQJBAIMW
ywVx4HW1XeP3uBFzu6rX4mWneWQm0ZvPAoYk6O22NuJF8kD+dcKc8I5I7rSTvqUW
vZZisIM4P5CPqDVtJB0CQCuh0H2k4nb1MYbgpRmEELDhtNBE6canR/DM8G8M0V7J
BXH1XyyzVP/nxNYH7wyAZlBgCPbMYGLIWDT2EojBgZI=
-----END RSA PRIVATE KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYIpH5BT9+1MPf+xqI7khDJZmh
MLVltXPf0JJY0mk3gXMQtOarIocOlKmtWDhz+24KZHa6LuK6edpehKoBjdlhGf1G
K+IwSR2uc9TnduuaDB2ETByZZA/4Cbdcw9uroeF2IQV9/MNBUJsV8WHDzMefEhf3
cVgdIvhw4IUjbCcOlwIDAQAB
-----END PUBLIC KEY-----

My secret message was Hey What's up dafpunk.
So, I encrypted the above message using the public key, which looks like this:
KBevdNKidVNPFufMxVQ9o3Roq+NeieEEo7KjPyJaeQ01uRtosJ6SeXb72Hola/3DegYLgXiVBvbgIQupmcbNH2xw0GfwQ1NZpLPypuJnYgZQC2oH/OtKKmChA+EHnbFQeIo+zGIJpmD3+mTLwtE6v3ZCAcQrDdAb8CEZ/wd27pQ=

When I tried to decrypt the message using the private key, I got the expected Hey What's up dafpunk. This can be verified in the tutorial's web plugin.
But when I changed four values in the private key, the secret message still was decrypted. I didn't think the private key could be allowed to be changed and the secret message to be decoded. What gives?
Here is an example of the change (it's a bit hard to see so I spaced out the change to be more obvious). You can compare it with the actual private key to verify the length is the same as long as you remove the added spaces near the asdf change.
-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQCYIpH5BT9+1MPf+xqI7khDJZmhMLVltXPf0JJY0mk3gXMQtOar
IocOlKmtWDhz+ asdf Ha6LuK6edpehKoBjdlhGf1GK+IwSR2uc9TnduuaDB2ETByZ
ZA/4Cbdcw9uroeF2IQV9/MNBUJsV8WHDzMefEhf3cVgdIvhw4IUjbCcOlwIDAQAB
AoGAfzEn6ZJBq8AmozRE0wak076z2tfmUMqLviuarzf7T7Sihu03jQyo7b/MvGht
ikpDjdzAhph8ZntJ3ov7tqDpg8Cm/Un/JvTfk1TGvR5okD2qX0Ww0143+oPC7EWC
1HNq+fcls80mr9XtH0fsPSByBxSOyn7nkdCqDxgiNYVMogECQQDfvMhdTmnpSyT6
9b/4RUHF5ggh+WHagpUL7mUNmeMkBYVyegLtXy2Vy6idVeW6Noaa7Ga1H5sdFDcf
ZdDidexhAkEArhKZ6Q6rG22ULeHfvipU9LiaGpaFstbLCI/RItfrmPXuDjIr6wxU
CQTHMrnzBQCrl0ANg0jp0eGJGNd+Tzkd9wJAOoxuamxgrtopPTseF1wYUC9YJXvb
LZFKa6rg6uRAWmbPexuOtItZpH99Cl82FLq8EsKWRgOVVdC6dA7y0LBHQQJBAIMW
ywVx4HW1XeP3uBFzu6rX4mWneWQm0ZvPAoYk6O22NuJF8kD+dcKc8I5I7rSTvqUW
vZZisIM4P5CPqDVtJB0CQCuh0H2k4nb1MYbgpRmEELDhtNBE6canR/DM8G8M0V7J
BXH1XyyzVP/nxNYH7wyAZlBgCPbMYGLIWDT2EojBgZI=
-----END RSA PRIVATE KEY-----

That change does nothing to the pub/private protocol, which is concerning. What am I missing?


texts: Is there a security analysis of CryptDB?

texts:
It's interesting to see critical thinking being applied to CryptDB in contrast to all the hoopla around it here. CryptDB is not a major theoretical breakthrough but potpourri of technologies to make it work. But then: I am curious whether there has been a formal security analysis done on CryptDB. All over the web it is just being praised without seemengly any thorough analysis.

On a side note: If there is none, I would like to take it up, but I am new to security analysis, so: Is there a good reference paper for carrying out security analysis on some crypto implementation?


texts: ANSI X9.31: the purpose of the date/time vector in the PRNG?

texts:
What is the exact purpose of the date/time vector $dt$ in the ANSI X9.31 PRNG?

$$ I := E_K(dt) $$
 $$ R := E_K(I \oplus V_{old}) $$
 $$ V_{new} := E_K(R \oplus I) $$

Specifically, the document seems to imply that the seed $V_*$ and key $K$ must be kept secret, but makes no claims on the secrecy of the $dt$ vector, only that it should be increased on each iteration. Can it be known by an adversary? Are there any implications if it is known to an adversary?


texts: Why is one scheme “hiding” while the other one is OK?

texts:
I'm presented with these 2 following commitment schemes $Commit(x;r) = (c,k) $.

This is presented as bad (not hiding)

$Commit(x;r) = (H(x), x)$

So, not hiding means that attacker can deduce $x$ from $H(x)$ in that case. I don't see how this is possible except for an exhaustive search of $H$ ? If this is why the scheme is bad, then can't we do the same for any kind of commitment ? Or is it because $k = x$ ? Since $k$ should arrive to receiver only after he sends his value, I don't see how this is a problem.
This is presented as ok

$Commit(x;r) = (H(r||x), (x, r))$ where $||$ denotes the concatenation of strings.

It seems to me that by the same logic we can find $x||r$ and deduce something about x.

So, what exactly is the difference between these 2 schemes and why is one not hiding while the other one is ok ?


texts: How is public key cryptography used for digital signature?

texts: In public key cryptography, there are two different keys used for the encryption and decryption of data . I am wondering how it is used for digital signature


texts: How to compute the dot product on encrypted values?

texts:
Is there a practical homomorphic encryption scheme that can give reasonable execution time results in computing a dot product:
$$a_1*b_1 + a_2*b_2 +a_3*b_3 +\ldots+ a_n*b_n$$
I imagine the scheme will need to support additions and multiplications to achieve this, so I assume we will need something that is fully homomorphic.  Is there any scheme that can do this efficiently?


texts: Cryptographically secure hash function vulnerable to length extension attacks both to front and to back?

texts: Is there any hash function where both $\text{hash}(m\|k)$ and $\text{hash}(k\|m)$ are vulnerable to length extension, but $\text{hash}(m)$ is itself secure?


texts: What exactly is the contents of the LDAP userSMIMECertificate attribute?

texts:
I'm trying to setup an LDAP with user certificates. I have already learned that certificates can be stored in either the userCertificate attribute in DER format, or in userSMIMECertificate in PKCS#7 format, the latter having the advantage of being able to contain the full certificate chain, plus the S/MIME algorithms supported and/or preferred by the client.

However, I'm struggling with what variation of the PKCS#7 format has to be used. I can export certificates as p7b file which - as I understand it - is just a certificate bundle containing multiple certificates, but no further information.

The userSMIMECertificate obviously expects a (signed?) CMS message with no (or at least a negligible) message text. Is this the p7m format created by email clients? But that seems to be encrypted? How can I create the required userSMIMECertificate format?


texts: Probability amplication in OWF without hardcore bits

texts:
We know that OWF $f$ such that none of its bits are hardcore exists. We also know that given an algorithm that solves a problem with non-negligible probability, we can repeat it many times and take the majority of the answers. Now, to predict $x$ given $f(x)$, we deﬁne predictors $P_i$ for $i$ ∈ $[1..n]$, where $P_i$ predicts the $i$th bit of $x$ with non-negligible probability. We would like to guess all n bits by running $P_1.....P_n$ several times each and taking the majority for each bit.

I want to know does this contradicts the definition of $f$?


texts: Can you change an AES encrypted message if you control the IV?

texts: Let's say that an attacker has the plaintext, the ciphertext and the IV of a specific message. If the attacker can control the ciphertext and the IV, could he forge valid plaintext? Let's say that the message is shorter than the block size, just a few bytes. Could the attacker change the value of the plaintext by changing the IV?


texts: Security implications of slow-by-design hashes on relative security vs. hash size

texts:
Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design?

Example: let's say you want 128-bit hashes. This is considered insecure today since this is small enough to be able to be attacked via things like rainbow tables (if you have a ton of storage) and any partial break of the algorithm is more likely to be devastating. But what if your hash function is designed to be slow and expensive? An example would be balloon hashing or franken-hash algorithms like CryptoNight.

Slowing down the hash function makes each iteration expensive to compute, so theoretically it seems that one can get away with smaller security margins. For example let's say you use a partial break or a rainbow table to reduce the hash's strength to 2^64 bits. You still have to evaluate it 2^64 times. If each evaluation takes an average of 100ms even on very fast hardware, this still leaves millions of years to search for a collision even if you have a million CPU cores to work with. The same line of reasoning seems to apply to birthday and multi-collision attacks.

Obviously the wildcard here is ASICs, but techniques like memory hardness or intentional algorithmic complexity can reduce the advantage presented by an ASIC vs. a general purpose CPU (and greatly increase the design and production cost of an ASIC). An ASIC that speeds this up 1000X still takes many millions of years per ASIC for a brute force search. You'd need hundreds of millions of ASICs to search 2^64 hashes in reasonable time, which of course assumes you have some way of halving the security of a 2^128 hash.

Is this reasoning basically correct?

This builds on a previous question I asked about Grover's algorithm. Grover's algorithm can (only in theory so far) roughly halve the security of a hash, but it still requires one classical evaluation per quantum search iteration. This extends the question to include classical security.


texts: AES-CBC with zero IV and a unique first block

texts:
Is it safe to generate the IV for AES-CBC as the following?

It's like the real IV is all zeros.
The first block of data will be a low-entropy but unique data.
Once the first block is encrypted, the ciphertext will look like a random sequence of bytes that will automatically serve as IV of the second block

This would allow to save space since we don't have to store a "real" IV in addition to the low-entropy data of the first block that we need to store anyway.

Is it safe to to this thing?


texts:
There is a requirement for me to both encrypt a file with the clients public key provided to us and sign the same file with our (my own) private key which they have the corresponding public key for.

Should this be a 2 step process (i.e. first encrypt then sign) Or can this be done in one shot using a single PGP command with multiple parameter? If so, can you please provide a sample of what the command would look like?


texts: I was wondering if CFB can be better than OFB in any ways. I would like to know in what cases one would use CFB over OFB.


texts: Is it possible to fake any file's SHA256 checksum with Length extension attack? Is SHA256 completely insecure when file size is not also checked?

texts:
Can fake SHA256 checksum be created trivially for any file by attacker after padding some data after original file i.e. using length extension attack?
E.g:

Alice creates fake linux installation ISO file using length extension attack by padding extra data after ISO and calculates fake
SHA256 checksum of the ISO

Bob downloads Alice's fake ISO file and calculates the SHA256 of the ISO

Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO checksum, Bob
doesn't notice that he has downloaded fake ISO

If Bob had compared the fake ISO file size to the original ISO file size found on official linux distribution's home page in addition to calculating the checksum, he
would have noticed that he has fake ISO not the original

Is this trivial to do?
In other words, is SHA256 completely insecure when a file's file size is not manually checked by computer user?
Does the file size always need to be checked when using SHA256?


texts: How to use the hardcoded server's public key to register a client application?

texts:
I'm designing the security for a smartphone app that can be used to make car reservations.

Clients have to register them with their driver's licence through the application and can then book a car.

Is it a good practice to hardcode the server's public key in the application and then encipher a secret using this public key?

I'm seeing an Eve-in-the-middle attack and authentication as a security issue. How can this be solved? Or how can this process be done securely?


texts: How to show that the following function is not a OWF?

texts:
Given F, which is a Pseudo Random Permutation, I need to prove that the following function f is not a OWF:

f(x, y) = Fx(y)

My first thought would be to create an adversary which tries and compute Fx-1(y) with different values for x, but I'm not sure it would be PPT. How can I solve this?


texts: What is the maximum cofactor of elliptic curve used for ECDSA?

texts: I know that the cofactor of curve 25519 is 8. Is it the maximum factor in the existing curve used for ECDSA?


texts:
Plaintext(binary) : 10101100 //very short for easy understanding

Suppose we have 4 predefined schemes/functions,

rotate (101 -> 011)
flip (1101 -> 1011)
exchange (11011 -> 10111)
stretch (1100 -> 11001100)

We create a function that checks for '0' or '1' in each position of plaintext(binary)

function in simple terms, (suppose plaintext in binary 10101100)

Bit at position 1 is 1, so perform rotate() on plaintext.
Bit at position 2 is 0, don't perform flip() operation.
Bit at position 3 is 1, so perform exchange() on output of step 1.
Bit at position 4 is 0, don't perform stretch operation.
Bit at position 5 is 1, so perform rotate() on output of step 3.
Bit at position 6 is 1, so perform flip() on output of step 5.
Bit at position 7 is 0, don't perform exchange().
Bit at position 8 is 0, don't perform stretch().

In this the output would be dependent on the input, hence it may serve as a hash to the plaintext.
These functions are just for example, more complex functions may be used.
I've used just 4 functions however more functions can be used.

I don't know if this is already the logic in existing hashing schemes but had this thought in mind. Will this work as a proper hashing scheme? (I suppose no)


texts: Is there any cryptographic scheme with block size more than 128 bit

texts: I am asking this question out of curiosity if there are any cryptographic algorithm that has a block length more that 128 bit. I am new to cryptography and I didn't know any. AES 128, 192, 256 all have same block length of 128 bit. Also if the answer is 'NO' then what can be the possible challenges of having larger block size. Thanks a lot in advanced for your help.


texts: How to implement arbitrary s-box in a side-channel-free way in C?

texts:
This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here.
The C language is chosen as it's a common language for implementing cryptographic algorithms. Also, as we're choosing C, the primary platforms under consideration are PCs, smart devices such as cellphones, tablets, and TVs, and servers.
Arbitrary s-box may be required when designing products for sale in jurisdictions that mandates local cryptography standards such as SM4, Camellia, SEED in China, Japan, and South Korea.
Here's my attempt at reducing side-channel when implementing arbitrary s-box. To the best of my knowledge, it's now constant-time, but
Q: how should other side-channel attacks such as fault attack and electromagnetic detector in proximity etc. be prevented?
#include <stdint.h>

const extern uint8_t sbox_table[256];

uint8_t sbox(uint8_t x)
{
    int i;
    uint8_t ret = 0;
    uint16_t mask = 0;

    for(i=0; i<256; i++)
    {
        mask = i ^ x;
        mask = (mask - 1) >> 8;
        ret |= sbox_table[i] & mask;
    }

    return ret;
}

uint8_t invsbox(uint8_t x)
{
    int i;
    uint8_t ret = 0;
    uint16_t mask = 0;

    for(i=0; i<256; i++)
    {
        mask = sbox_table[i] ^ x;
        mask = (mask - 1) >> 8;
        ret |= i & mask;
    }

    return ret;
}

```


texts: Understanding Meet-in-the-Middle attack on block ciphers

texts:
I understand how to implement a Meet-in-the-Middle attack on 2DES/3DES, by computing for one half all possible keys and storing the outcome and then subsequently do the same for the other half but compare with the previously stored outcome to see if there is a match somewhere. Very unprecise description I know but just to state that I know how to do it for 2DES/3DES

The problem is for Feistel ciphers, where it seems that the very same technique cannot be used. Consider the below (sorry for the poor drawing):

So for a simplified example let's say the Feistel structure above operates on 16-bit blocks and uses 8-bit independant round keys. Each branch block is thus of 8 bits.The S-box is an 8-bit AES S-box.

Given that the adversary knows the following:

Full access to the code which encrypts a 16-bit block using the Feistel above
Knows exactly two plaintext - ciphertext pairs.

So given the two pairs, the aim is to find the key which maps the plaintext to the ciphertext.

Given the assumptions above, how is a Meet-in-the-Middle attack applied here? I've tried to use the same approach as with the 2DES/3DES, but it just doesn't apply in the same way. I'm in need of a bit of guidance on how to proceed.

I can't see where the "middle" value is, and from where I should compute forwards and backwards to reach such a middle value.

Edit: Forgot to mention that there are 4 rounds in the Feistel cipher.


texts: Generate version 3 x509 certificate from version 1 CA

texts:
Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is signed by this CA?
I use openssl for this.
Thanks


texts: Is there any problem to reuse the prime p, g and a in Diffie-Hellman?

texts:
Suppose I always reuse p, g and a in DH and there is someone monitoring my communication. Is there a way this person can use this to perform some kind of attack to me?

I believe that reusing p and g isn't a big issue, however I'm not quite sure about a.


texts: Does not using padding mean a lack of security?

texts:
I've read several texts which say that if the entire plaintext is a multiple of the block-size padding is not required (and not using padding would not mean a loss of security).
I generally disagree on this. In some special cases, for example in CTR of OFB mode padding could even unveil more information about the block-cipher output than not using it. But many currently used paddings are randomized.

When using a randomized padding with modern block ciphers the smallest change in the block-cipher input will change the entire block-cipher output. Therefore the randomness of the padding contributes to the encryptions security.

My first question is whether the above statement is correct or not and why.
And second: Are modes like CBC/PCBC more secure than modes like CTR/OFB? Or does it depend on the used padding?


texts:
A recent (29 Mar 2021) article "Ring-LWE over two-to-power cyclotomics is not hard" by Hao Chen is available in pre-print here: https://eprint.iacr.org/2021/418
I'm not a cryptographer. Does this article mean that Ring-LWE is unsuitable for post-quantum asymmetric cryptography? Does this means that others algorithms might be similarly affected? Or is the author somehow wrong?


texts: Create a TOTP for machines using HMAC or AES

texts:
I'm trying to create a sort of Time-based One Time Password (TOTP) where machines are involved (not humans). In this kind of TOTP the step is 15 minutes between one code to the next one and both server and client share the same 256 bit secret key (k).
The message (m) is the current unix timestamp that is known by an attacker so suppose the text plain message m is known.
The key k is always the same and the attacker also knows the algorithm used for cryptography.
I think about two possible solutions for this problem:

HMAC(k,m) using sha256 as base algorithm client side, send the result and check server side that the hash is the same, then ok.
AES(k,m) and send crypted message as base 64 to the server. The server decrypt the message and check the time. If the time is included in accepted range then ok.

Possible scenario:
An attacker knows the plain text (time) and the crypted message (that can be the HMAC hashed text for option 1 or the crypted text after AES for option 2) and have maybe 500 possible combination of textplain plus related encrypted text.
Questions:
Q1: is it possible for the attacker to know the key k before a time range of 5 years for both of options with current computational power?
Q2: Which is the most secure option to use? Option 1 or option 2?
I'm studying these algorithms for days but I haven't find an answer to my questions yet.
Note: I studied TOTP in RFC 6238 too but it seems more related to Machine-human than machine-machine TOTP. For machines, with a 15 minutes step, seems more insecure than the 2 options proposed.
Thanks for everyone can help me in these questions, are making me crazy.


texts: Protecting Ed448 against DPA and fault attacks

texts:
There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar.

This paper describes a DPA attack against EdDSA, and suggests a similar countermeasure. However, the randomness must be placed in a specific place:

  This can be achieved by padding
  the key with fresh random bits such that the first 1024-bit block is composed
  only by key and random value, without any bits known to the attacker.

Following their notation, that would mean changing $H(b,M)$ to $H(b,Z,M)$ where $Z$ is the random padding such that the length of $b || Z$ is equal to the block size of the hash.

However, consider Ed448, as defined in RFC 8032 (the issue I'll talk about would also apply to Ed25519ctx and Ed25519ph, but I'll use Ed448 as an example). In the Sign operation, the hash call is SHAKE256(dom4(prehash, context) || b || PH(M), 114). Prehash is a flag indicating Ed448 or Ed448ph. Context is an optional context string. The dom4 function is:

  dom4(x, y):     The octet string "SigEd448" || octet(x) || octet(OLEN(y)) || y, where x is in range 0-255 and y is an octet string of at most 255 octets. "SigEd448" is in ASCII (8 octets).

Now, my question is: what is the proper way to add the DPA countermeasure to Ed448? (And Ed448ph, Ed25519ph, Ed25519ctx)?

My first guess would be to use SHAKE256(dom4(prehash, context) || b || Z || PH(M), 114), with Z being enough bytes to fill the SHAKE245 block size. However, if the context is used, then Z could get too small. Also, the paper states that the first block must be "composed only by key and random value, without any bits known to the attacker". Would the fixed bytes of the dom4 function ("SigEd448" and so on) interfere with this? How to work around this?

Or maybe SHAKE256 is already DPA-resistant?


texts: Crypto algorithm identification (reverse engineering)

texts:
I'm trying to identify a certain cryptographic algorithm used in a program. From examining the executable, it appears it

Has 16 rounds (plus 2 "rounds" for pre/post processing)
Pads the input plaintext to 256 bytes with the results of a linear congruence generator (with a fixed seed). This might be a preprocessing step and not part of the actual crypto algorithm
Each round operates on the entire plaintext (updates all 256 bytes of the output). At the end of each round a 256-byte array is subtracted from the output
Uses a (random) initialization vector, ie the same input produces different outputs

I suspect it's a variant of DES, but the block size listed for DES is only 64 bits. Is there a 2048-bit variant that is commonly used, or some kind of optimization that allows the next round for each block to be computed in parallel while still using an initialization vector? Alternatively, given a plaintext and the intermediate values produced each round is there an easy way to determine the type of cipher?


texts: Calculate shared key having A public Key and B private Key (Diffie Hellman)

texts:
I cannot understand how this works.

$\text{A}_\text{public} = g^a \bmod p$

$\text{B}_\text{private} = \text{B}$

$\text{g} = p$

I also have $p$, I need to get the shared key, that I know both $\text{A}$ and $\text{B}$ get exactly the same value. Im not understanding how can I get the shared key that $\text{B}$ generated only having those variables I wrote above.

Also I know that the shared key is $\text{g}^\text{ab} \bmod p$, how can I get that $\text{b}$ value?


texts: Does this guarantee a unique 32 bit Hash?

texts:
I came across some source code that loosely does the below in order to achieve a 32 bit hash.

The input string is passed through MD5 to get 16 bytes Hash (as usual). Then the 16 bytes are split into 4 byte words . Each of these words are $\oplus$ with each other in order to get a final 4 byte word, this is considered as a 32 bit hash.

The application does not really care about security in sense of pre-image resistance etc. but all it wants is Collision Resistance.

So, does the above guarantee no collisions (any better than birthday-bound)? Of course it depends on the input string's entropy etc., but given that we don't know before hand what possible strings could be passed as input: how do we analyze such scheme for collisions?


texts: Elliptic Curve Cryptography Encryption Results

texts:
I'm playing around with a package that does Elliptic Curve Cryptography from http://jecc.sourceforge.net/

Every time I encrypt a value it produced a different result (same private key). However I'm always able to decrypt this result with the related public key. For a 1 byte result the resulting data is 34 bytes, 2 bytes the resulting data is 35 bytes. I assume some knowledge of the curve is contained in the result.

Is this a feature of ECC or would you assume it is just this implementation?


texts: Lehmer random number generator cipher scheme with moving bits

texts:
Let's consider linear congruential generator:
$X_{k+1} = a \cdot X_{k} \mod 2^{128}$
Such that $a$ is some number which for every 128-bit input $X_{k}$ from $0$ to $2^{128}-1$ will give us different output $X_{k+1}$ from $0$ to $2^{128}-1$. So we got bijection here (we can find many such odd $a$). Now let's say we will choose such 128-bit $a_{1},a_{2}, ..., a_{20}$ as a keys, randomly and also random $m_{1}$ to $m_{20}$. We make $20$ rounds of encryption and every round compute:

$a_{i} \cdot INPUT \mod 2^{128}$
Move 128-bit block with wrapping by $0$ to $127$ places given by a $m_{i}$.

If we wouldn't move block - we got just keyed Lehmer random number generator with a modulus which is a power of two - and it is definitely not secure (because the low $k$ bits form a modulo-$2^{k}$ generator all by themselves).
But with "moving" we get different results (it seem to pass most of the Diehard tests in 32-bit version). $20$ rounds could be enough to avoid attack which we can do without moving bits (without step 2 in round scheme). I mean - there are high probability differentials in this cipher without "moving"; in particular if we reverse all blocks in step 2, we have a one-round differential with an input xor difference of (01111...11110) (that is, all bits except the first and last are flipped) and the output xor difference of (01111...11110); this differential holds with probability > $0.5$. Because the output differential of round $X$ is the input differential of round $X+1$, the entire differential holds through the entire cipher with probability > $2^{-20}$. And without moving and reversing it is even easier to attack. But tow with $20$ rounds we have to guess move number $m_{i}$ in every round (in the end $128^{20}$ possibilities), to find differential, like in version without movig.
Is this type of encryption secure and let us to avoid differential cryptanalysis? How about linear cryptanalysis?
Comment: let's skip the encryption problems with zero-block - it can be solve easily, for example if we will use xoring before every round.


texts:
I would like to know which area of Mathematics would be most beneficial to cryptography. Surely Algebraic Number Theory and maybe to a lesser extend, Elliptic Curves, are closely linked to Cryptography; but are there more fields that would apply neatly to Cryptography?

What topics would you recommend to a Maths graduate who is looking for a career in Cryptography?

(I wanted to tag this as a "soft-question" as they do in math.stackexchange)


texts: Decrypting AES256-CBC with wrong encryption key

texts:
Using OpenSSL library is there any chance that decrypting AES256-CBC encrypted data with wrong encryption key will succeed without an error?

Asking this because I have read somewhere there is 1/256 chance that decrypting broken data won't produce an error


texts: One-time public-private key pairs are used. The next public-private key pair to be used, is recorded with a proof c = sha3(nextPublicKey).


texts:
Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them.

My understanding is that:

PFS ensures that, if the parties' long-term keys have compromised in the future by an active adversary, he cannot calculate the session key.
wPFS ensures that, if a passive adversary has learned the private keys of both peers to the session, and if the session is "clean", he still cannot recover the session key.

I'm not sure whether my understanding is right or not.
And I don't know the if these are the correct definitions of PFS and wPFS.

Can you help me understand PFS and wPFS?


texts: RSA: Recover e given factorization of N and plaintext/ciphertext pair

texts:
Is there a way to recover the public exponent e (assume in this case it is in fact not public) used in an encryption if I know the following:

Factorization of N : p and q
one plaintext m and its encryption c = m^e mod N

Obviously I can just bruteforce if e is small, but is there a more elegant way? (or just assume e is too large to simply bruteforce)


texts:
SageMathCloud security (http://goo.gl/dCujW1) is as follows:

  Only the hash of your password is stored by the server, which uses 1000 iterations of the sha-512 hash function, with a salt length of 32.

While that does sound like a nice salt, I am a bit doubtful of the 1000-iteration idea. While this does make brute force attacks 1000 times slower, isn't it true that every extra iteration squares your chances of collision?


texts:
Actual Question below.

Consider the use of double encryption applied to the AES algorithm with two 128-bit keys. How much storage and computation would be required to execute a meet-in-the-middle attack?


texts: Why does computing g^a * g^{-a} with the PBC library result in zero?

texts:
My example code is as follows:

 /*
 *  Example 1
 *  1) Calculate g^a
 *  2) calculate g^{-a}
 *  3) multiply g^a * g^{-a}
 *
 */

Note: here pub->p is a type A pairing.

element_t g, gA,gInverseA, a;

element_init_G1(g,pub->p);
element_init_G1(gA,pub->p);
element_init_G1(gInverseA,pub->p);

element_init_Zr(a,pub->p);

element_random(g);
element_random(a);

element_pow_zn(gA,a);
element_invert(gInverseA,gA);

element_mul(gInverseA,gInverseA,gA);
element_printf("\nValue %B",gInverseA);

Why does it output zero?


texts: What is the meaning of "transcipher" (if such term exists)

texts: recently I heard the term "transcipher" during a discussion (seems something related to double encryption using two different keys), but I was not able to find any information about such a term in the internet. Is it an actual cryptography term? if so, what does it mean?


texts: How to show that any 2-round key-exchange protocol satisfying a given definition can be converted into a public-key encryption scheme?

texts:
How to show that any 2-round key-exchange protocol satisfying a given definition can be converted into a public-key encryption scheme that is CPA-secure?

The given definition is as followed:

Actually this is an exercise of the book "Introduction to modern cryptography", I can figure out how to prove it.

Can someone help me? Thanks a lot!


texts: How difficult is it to check if a group element is in a sub group?

texts: I am just curious. We have a group $G$ and its subgroup $H$ with a generator element $h \in H$. How difficult is it to check for $x \in G$ that $x \in \langle h \rangle$? Is there a better way than testing $x \equiv h^1,\ x \equiv h^2,\ x \equiv h^3,\ ...$?


texts: Are there cryptographical flaws in this e2ee website chat widget?

texts:
For a product I'm developing I want to verify if the thinking behind it is cryptographically strong and secure. The product is a chat widget on websites of customers. Like an e2ee version of Intercom.

There are 3 parties that will connect to the service:

Customer of the service (i.e. user of the service I will offer)
Service that offers the chat widget + tools for its customers
Visitors are people that use the chat widget

A few features that are important for the product are:

The service should not see the content of messages send between customers and visitors
The traffic between service and customer and visitor are encrypted via SSL. In this product only important the service can't read the messages
The visitor does not have an account with the service
The customer has an account with the service
The customer can reply to chats from multiple devices
The encryption and decryption should be done in the browser of the customers and visitors only. It will rely on the SubtleCrypto API
The messages include a session ID so both users can verify if following messages are from the same sender

I created a diagram with all the steps I think I need to take:

Diagram explained

To be able to use the same public key on multiple devices of the customer it needs to be copied to other devices of that same customer.

The customer logs in the service with their password
We use the password to create a PBKDF2 key in the browser (key stretching)
We generate a RSA key pair
We encrypt the private key with wrapKey with the PBKDF2 key with AES-GCM 256 bits (the service will not have access to the decrypted private key)

Send the encrypted the private key and public key of the customer to our service
The visitor also creates a key pair with RSA-OAEP
The visitor sends the public key to our service
The visitor gets the public key of the customer from our service
The visitor includes a session ID in their message and encrypts it with the public key of customer
Visitor sends encrypted message back to service
Customer receives encrypted message and public key of visitor
Customer decrypts message with their own private key and encrypts message for the visitor with their public key
Encrypted message is send from customer to service
Encrypted message is send from service to visitor
Visitor decrypts messages from customer

Known flaws

The customer can't verify who the visitor is unless the visitor identifies themselves. This is totally fine for our service

What are there other cryptographic flaws in this e2ee service?


texts: Given the key, the plain text and the cipher text can I calculate the IV used in CBC mode?

texts:
If I have the plain text, the ciphertext and the key for an AES-128 CBC operation, can I determine the IV, even if I don't know the padding (assuming the padding follows one of the more common formats)?

I believe it should be possible since my understanding is that the IV is only used as an initial XOR of the plain text in encryption, and should, therefore, be able to be available like this:

AESDecrypt(key, ciphertext) => (PlainText XOR IV);
IV = ((Plaintext XOR IV) XOR (Plaintext))

Is this correct?


texts: Will AES-GCM smaller sized tag (mac) be included in larger sized tag

texts:
I want to make sure that I understand AES-GCM correctly:

If I have:
key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits tag equal 96 bits tag?


texts: Python library that implements additive homomorphism of Elgamal Encryption on the Elliptic curve i.e X25519 or P-256

texts:
I'm trying to find a Python library that implements Elgamal Encryption on the Elliptic curve i.e X25519 or P-256.
My purpose is to use the additive homomorphic property of Elgamal.
I'm using https://github.com/data61/python-paillier
Python library for Paillier to have additive homomorphism.
However, since I'm only encrypting small integers(32bit). Therefore, I think Elgamal will be faster for encryption and will have a shorter key and cipher size than Paillier [If my conceptual understanding is correct].
Hope someone already implemented and using such a library. Looking forward to knowing such a production-grade library.
I found a library that says they implemented Lifted-Elgamal (not sure what Lifted means here)
https://github.com/herumi/mcl
However, it seems they use Type-3 pairing to achieve multiplicative homomorphism in Elgamal. To my understanding pairing operation is expensive since the underlying operations are carried over the extension over the prime field.


texts: Is 3 rounds of Feistel enough for making a PRP?

texts:
I know that one round of Feistel is not enough for making a PRP (Pseudo Random Permutation). I am also aware that two rounds are not enough. How about three rounds of Feistel?
I did a lot of reading on this topic, but it has not been helpful. For example, here they say that because of the Luby-Rackoff theorem, we have a PRP after three rounds, but here it says that it is not enough.
Which is it?


texts: Simultaneous collision for MD5 and SHA1?

texts:
I know that both MD5 and SHA1 are considered cryptographically broken now that collisions can reasonably be computed. The question I have is: What is the likelihood that a collision could be found for data hat is hashed by each independently?

For instance, would it be reasonably be possible to do something such as …

[Hashed Doc] => [MD5]
[Hashed Doc] => [SHA1]

[Fake Doc] + [Padding] => [MD5]
[Fake Doc] + [Padding] => [SHA1]

where the adjusted padding for the fake document caused both signatures to remain the same?


texts: We are given n (public modulus) where n=pq and e (encryption exponent). Then I was able to crack the private key d, using Wieners attack. So now, I have (n,e,d). My question is, is there a way to calculate p and q from this information? If so, any links and explanation would be much appreciated!


texts: Limit AES-256 to Alphanumeric characters

texts:
Is there a way to limit the output of AES-256 to only alphanumeric characters and maintain 256-bit key?
I'm looking encrypting some data and use the encrypted data in a system, and the reason behind using Alphanumeric characters is that the system might have issues processing special characters.


texts: Are there security issues with adding plaintext length to TLS packets?

texts:
I have quite a big problem, because of a software implementation of TLS I had to adapt I had to create something which is now biting me.
It all comes down to this: I need to know the length of the plaintext when I want to decrypt it and the length of the ciphertext when I want to encrypt it. For the 2nd one I've made a (not so nice) workaround.
I have a workaround for the first problem, simply using TLS to encrypt the plaintext and then add a few bytes for the plaintext length and send this over.
So my question is: how big is the security risk if an attacker can see the plaintext length if i would send it in the clear together with the TLS protocol packet?
(more details here)


texts: Enigma - How many possibilities does the plugboard have?

texts:
I try to relate my own calculation with the real result being about 150.738.274.937.250.
The plugboard has 26 letters, and you have 10 wires to connect pairs of letters.
My idea was to calculate first how many possible pairs you can have.
26*25/2 = 325 [(a,a) not allowed, and (a,b)=(b,a) so divide by 2 to remove duplicates]
or just 26C2 = 325.
And out of 325 pairs to choose 10 pairs there are 325C10 = 3.150.234.554.696.452.080 possibilities to connect pairs with 10 wires.
Where is my way of thinking wrong?


texts: What is the correct definition of the blowfish F-function?

texts:
The Blowfish cipher uses a so called F-function which uses S-Boxes (S[i], i=0,1,2,3) to chiffre an integer x, for which I've seen different versions:

source:

uint32_t F (uint32_t x) {
    uint32_t h = S[0][x >> 24] + S[1][x >> 16 & 0xff];
    return ( h ^ S[2][x >> 8 & 0xff] ) + S[3][x & 0xff];
}

source:

uint32_t F (uint32_t x) {
    uint32_t h = S[0][x >> 24] + S[1][x >> 16 & 0xff] % (2**32);
    return ( h ^ S[2][x >> 8 & 0xff] ) + S[3][x & 0xff] % (2**32);
}

F should output a 32 bit value. The second version tries to handle overflows - although I dont see how this works when the values in the S-Boxes itself are 32 bit.

I realize this also depends on the language in which the cipher is implemented.

If we're assuming to implement it in C, the high bytes in case of an overflow in S[0][x >> 24] + S[1][x >> 16 & 0xff] would just be cut off.

Is this just the way it should work for the F-function?


texts: Deciphering the RSA encrypted message from three different public keys

texts:
I have three different 1024-bit public keys with common exponent $e$ but different moduli. A message $m$ is encrypted (without padding) using the three keys, which results in three different encrypted messages.

Given the three pairs of public keys $(N_i,e)$ and the encrypted messages $c_i=m^e\bmod N_i$ , how do I decipher the original message $m$ ?


texts:
The title is asking the question in layman terms, but what I really mean to ask is this:

Let $x \in \lbrace 0,1 \rbrace^{128}$ (an arbitrary input block) and let $K \in \lbrace 0, 1 \rbrace^{128}$ (an arbitrary key for 128-bit AES). Let's mark AES decryption with $AES_K^{-1}$. My questions are:

Is $AES^{-1}_K$ defined for (arbitrary) input $x$? (i.e. Is AES onto $\lbrace 0, 1 \rbrace ^{128}$ for any key?)
If so, is $AES_K( AES^{-1}_K (x) ) = x$ ?

Are those questions trivial or do they require proof?


texts: Encrypt twice with DES using same key ? $\operatorname{DES}(\operatorname{DES}(x,k), k)$

texts:
Does encrypting with $\operatorname{DES}$ in the following way $$\operatorname{DES}(\operatorname{DES}(x,k), k)$$ make $\operatorname{DES}$ as strong as $\operatorname{2DES}$ with 2 keys?

Because we have to run $\operatorname{DES}$ twice now for each key in order to find it - first run $\operatorname{DES}(x,k)$ and the output is the input as text for the second round of encryption? So overall $2*2^{56} = 2^{57}$ just like meet in the middle complexity, right ?


texts: Is there a term for "bootstrapping" encryption by storing an encrypted key?

texts:
Say you want to encrypt a large file, perhaps a backup of a database. Encrypting the file will naturally take some time, due to the amount of data.

Now, if at any point you want to change the password protecting the file, a simple implementation would re-encrypt the entire file.

Another solution is to generate a key K, and use that to encrypt the file. Then encrypt K based on the password, and store the result with the encrypted file (perhaps in some meta data). Now, changing the password only requires a decrypt and re-encrypt of K using the new password, making the operation much much faster.

Is there a name for this kind of design?

Jonathan

PS: Appologies for the somewhat crude description, I am not well-versed in cryptology.


texts: "Safe" or Safest Method for Non-Hardened Key Derivation Functionality

texts:
I'm currently working on the development of an unorthodox system in which, ideally, there would be one master key pair, with thousands of keys derived from it. There needs to be a way to prove that any one of those keys is derived from the master key. In this scenario, the private and the public keys of all of the derived keys can be considered common knowledge and can be used in that verification process. The public key in the master key pair may also be considered common knowledge. The only secret entity is the private key in the master key pair. I am aware that using non-hardened derivation, it is possible to accomplish this goal, yet that it contains many security risks, and the private key in the master key pair could be figured out (making non-hardened derivation as I've seen it, an unacceptable solution, unless you know of a way to make this process safe).

Is there any way to prove that derived keys could only have come from one master key pair, without exposing that master key pair's private key? Is there a safe way to do this with non-hardened key derivation? Is there a way to do this with zero knowledge proofs (they would have to be non-interactive)? Assume that it would not be feasible for the master to simply create and sign a document listing keys they've derived (new keys could be derived at any moment, and there could theoretically be too many keys derived to list within message size constraints). You may also assume that any algorithm that can accomplish this goal can be used (i.e. not necessarily just RSA).

This is for sure an abstract and vague question, so please guide me on what more information you need or how I can amend this question. Thanks.


texts:
I have an unsubscribe link, which needs to be passed a customer id, and a product id, producing a query string something like:

?cid=100&pid=2

I would like to ensure the customer is the one doing the unsubscribing, and that they are unsubscribing from the exact product.  HMAC seems like a logical choice:

?cid=100&pid=2&hmac=<HMAC generated from secret key and cid=100&pid=2>

...and I can validate the HMAC to guarantee authenticity and integrity.

BUT I would also like to keep the customer id and product id confidential if the link is passed around in email, for example.  I can't do that if the HMAC is based off of them.  For example if I just passed the HMAC:

?hmac=<HMAC generated from secret key and cid=100&pid=2>

In this case I cannot not infer the customer id and product id in question (without brute forcing the hash).

Is there a standard way to return encrypted/hashed query parameters?

No, I can't use SSL/TLS.


texts: How to force an adversary to call a certain oracle?

texts:
Consider there is a protocol in real world, which uses a random oracle $\mathcal{H}$. In the ideal world, after the calling of $\mathcal{H}$ by some parties, intuitively I want the simulator gets some information from $\mathcal{H}$.

As Mikero pointed out in this question, the adversary may not call the oracle at all, and he can use some other (random) value instead.

To prevent this, I consider using a CCA-secure public cryptosystem, whose encryption key is only known by the oracle and the decryption key is only known by the simulator, under the assumption of common reference string. Then the output of the oracle, indeed a ciphertext (in hybrid worlds), will look like a random number due to the semantic security, and on the other hand, the simulator will know whether the "random value" is a legal ciphertext generated by the oracle, and the adversary will fail if he decides not to call the oracle.

So my questions are:

Does this method work?
What's the best way to do this?


texts: Hardware Implementation of Pairing over BN curves

texts:
I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be computed over $\mathbb{F}_{p^2}$, and line function, miller variable have to performed over $\mathbb{F}_{p^{12}}$. The chosen Towering strategies is $\mathbb{F}_{p}$->$\mathbb{F}_{p^2}$->$\mathbb{F}_{p^4}$->$\mathbb{F}_{p^{12}}$. I have design hardware architecture for finite field primitives like addition, subtraction and multiplication over $\mathbb{F}_{p}$. The same unit can also perform extension field operation as a series of $\mathbb{F}_{p}$ operations.

Now I need to devise an efficient scheduling policy to execute point addition, point doubling, line function and final exponentiation operations through the suggested unit.

I need to find a suitable combined formulae for point addition and line function, point doubling and line function in projective coordinates, a reference would be a great help.


texts: Pre-computing a log and exp table for a primitive polynomial in $GF(2^8)$

texts:
I'm new on the topic of finite fields, specifically $GF(2^8)$.

I've come across the information that it's possible to implement multiplication using logarithm and exponential tables. But how are these tables formed exactly? Some answers talk about a generator while others talk about using a primitive polynomial. Are those the same?

What I exactly want to know is how pre-compute the log and exp table using the following primitive polynomial: $$x^8 + x^4 + x^3 + x^2 + 1$$


texts:
There are many ARX ciphers, however most use fixed rotations.

I know data-dependent compared to fixed rotations are:

patented (expired)
harder to implement constant time
more expensive in hardware
harder to analyse
attacker can control rotation to some degree

Do data-dependent rotations have any advantage over fixed rotations?


texts: What are the strenghts and weaknesses of Whirlpool Hashing Algorithm

texts: I want to find out if the Whirlpool hashing algorithm have any weaknesses. There are quite a bit of articles explaining the strengths of this algorithm, but for some reason I cannot find any on its weaknesses...perhaps there aren't any?


texts: 2 party AND computation under passive perfect security

texts:
In the book written by Ivan Damagard titled "Secure Multiparty Computation and Secret Sharing", at the end of the third chapter he provides a proof for why it is impossible to securely compute 2 party AND function under perfect and passive security with one corrupt party.

Can someone help me provide an intuitive explanation for why the above is true. I was unable to grasp the solution provided by Damagard. I could not find any other resource regarding the same either.


texts: Hash function with good performance on extremely short messages

texts:
Are there randomized almost universal hashes that are fast for extremely short messages (usually <10 bytes)?

Edit: This is for hash tables, so it only needs to be hard enough to break to make the HashDOS attack not worthwhile.  I am specifically looking for a solution for LuaJIT.  Since Lua interns all strings, this needs to be really fast.  SipHash-1-3 is too slow.


texts: Key confirmation and other benefits of double ratchet

texts:
I'm trying to understand a comment from the Signal blog post Advanced cryptographic ratcheting.

This article uses the term OTR ratchet to refer to a simple asymmetric DH ratchet, where Alice contributes a new $g^{a_i}$ with every message and Bob contributes a new $g^{b_j}$. The current key is taken to be $g^{a_{i} b_{j}}$ for the maximum $i$ & $j$.

It uses the term SCIMP ratchet to refer to a simple symmetric ratchet, where the key is continuously and deterministically evolved through a KDF for each message.

Then finally the article motivates their double ratchet as a combination of the two.

My question is about the benefits of the double ratchet as articulated in this article.

The article does mention what I understand to be the main advantage: OTR ratchet itself has suboptimal forward secrecy. If Bob just sent a message, his latest DH secret key must still be in memory (since it will be used in the next DH round and combined with Alice's next DH message). Then a state compromise will allow the attacker to read the message that was just sent.

On the other hand, with the double ratchet the DH shared key is combined with the chain key. Bob's DH secret key (without the previous chain key) is not enough to decrypt the message that he just sent.

That's what I understand. What I don't understand is the insistence that OTR ratchet requires 3 rounds while the double ratchet requires 2. This is repeatedly described as an important benefit of the double ratchet. The article describes OTR ratchet as a normal 2-round DH followed by a 3rd round "acknowledgment":

  until Bob has acknowledged Alice’s next key, she can’t use it

...later:

  We wanted to incorporate a DH ratchet into our ratcheting protocol because of the “future” secrecy it provides. However, it would be nice if we could eliminate the “advertise” step in the OTR ratchet and bring it down to a “two step” ratchet. In order to achieve a “two step” ratchet, we derive a RootKey in our initial handshake KDF, and both mix it into and re-derive it from every subsequent DH KDF. This makes it possible to chain the key material together so that Alice can create and use a new DH ephemeral key immediately without first advertising it and waiting for acknowledgment.

Let's say your only goal is to avoid the key acknowledgement step. Surely you don't need to do a double ratchet -- just simply don't do key acknowledgement! Do a DH ratchet where Alice sends $g^a$, Bob sends $g^b$ and immediately encrypts something with $g^{ab}$. Why does this article say that the parties "can't" use $g^{ab}$ until Alice acknowledges? I'm willing to believe that OTR does this in practice, but I don't understand why it presents some kind of fundamental barrier. What really goes wrong if you use the key right away?

Again, I understand the double ratchet benefits of ideal forward secrecy (it can protect the message that was most recently sent, while simple DH asymmetric ratchet doesn't [and I know that performing 2 parallel DH that are out of phase by 1 round is another way achieve the same thing without a double ratchet]). But I don't understand the implication that double-ratchet is the only way / best way to allow immediate key use and do away with an extra acknowledgement round. What am I missing?


texts: Can Alice encrypt a message to Bob without hiding anything from Eve?

texts:
I know that if Alice and Bob both have secret-public key pairs, they can use RSA for example. If we remove the possibility that Alice can know anything which Eve doesn't (ie Alice's secret key), is there an algorithm which makes encryption still possible?

(I am new in the topic and haven't been able to find an answer.)


texts: How does ECC go from decimals to integers?

texts:
I realise that elliptical curves are tricky, but there's one aspect that no one seems to explain. I've looked, and it's towards the beginning.  This is the traverse over a red curve:-

This is only three steps (n=3).  For cryptography n must be large. I don't know how large but I cannot believe that all tangential and intersection points occur at coordinates with integer values.  They must be decimal. After all the curve is smooth and continuous.  The tangents can be all sorts of infinitely precise gradients. We know that decimal encryption can't work due to representational and rounding errors. Assume that point G is at (-2,4).  There is no way that point 8G is at (3,3) exactly.  And if n is very large?

I had a look at the wiki article regarding elliptic curve point multiplication, but using an example of 42.57 degrees didn't clear it up any. I think that there's a crucial step I'm missing before the explanation of Integers in ECC. So,

Q: How do traverses over elliptical curves go from decimal coordinates to integer values that can then be used for practical cryptography?

The fact that I've identified this curve as type "red" indicates my lack of ECC knowledge or general mathematics ability.  Is it possible to explain simply or am I reaching beyond my grasp?


texts: Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

texts:
It seems to me that a timing-safe way to compare any two strings is to take a secure hash of both of them and then compare the result.  I would expect that the initial hashing would render any timing attack non-exploitable.

It also seems that when hashing passwords, there is no need for a timing-safe comparison of the hashes, since the salt (which is secret) means that the attacker does not know what is being compared.

Is this intuition justified, or is it incorrect?


texts:
While revising my CAdES library I encountered some "sealing issue" in digital signatures.

The Win SDK signtool.exe has a /seal parameter which produces 1 authenticated attribute in the signature "Intent to Seal" and one unauthenticated attribute "Sealing Signature" in the signed file.

I 've also seen that in PDF files. Couldn't find more online on it.

My questions are:

What is the purpose of "sealing" vs simply signing a message?
What are the OIDs associated with them? What are the relative RFCs?
Is it simply a matter of adding 2 attributes in the PKCS#7 or is there another issue I must take into account?
Is there a difference when timestamping a "sealed" message?