texts: Problem with a reduction using Hybrid Argument

texts:
I have an issue with this proof.
We define two games:

$$H'(\lambda):$$
1) Pick $R \in \mathcal{R}(n,l)$ (the space of truly random functions from $\{0,1\}^n$ to $\{0,1\}^l$

2) we define $\mathit{Enc}'_k(m)=(r,R(r) \oplus m)$, where $r$ is random from $\{0,1\}^n$.

3)$\mathcal{A}$ is an adversary who chooses two messages from $\{0,1\}^l$

4) A single bit is choosen randomly by a challenger $\mathcal{C}$, and the message $m_b$ is encrypted

5)Receiving the message $m_b$ adversary must guess what message was encrypted.
 It is the CPA-game and so we assume that $\mathcal{A}$ have access to the encryption oracle.

The other game is $H''(\lambda)$ defined as before but

$\mathit{Enc}_k''(m)=(r_1,r_2)$ where $r_1,r_2$ taken randomly from $\{0,1\}^{n}$ and $\{0,1\}^l$

I know that the difference between them is the second part of the Encryption algorithm, but I don't understand why in $H'$ game there are collision problem.
The proof tells that calling $E(\mathit{bad})$ the problem of collisions in encryption queries, it sufficies to prove that $E[\mathrm{BAD}]$ have negligable probability and so

$$\Pr[E(\mathrm{BAD})]= \sum_{i,j} \Pr[r_i=r_j] \leq (q^2) 2^{-n}$$

Why in the first scheme there are collision problems and why if there are collision problems the two schemes can be distinguishable?


texts:
RSA keys are notoriously blobs. I'm looking to make something more human readable.
I want to take the mathematical operation and convert it to a number that can be easily expressed as a series of words against a set indexed wordlist.
The first step is converting the RSA.key file to a binary number. Next step is subtracting, or adding one, and dividing by 24. Number theory.

Once that number is obtained, the words that make up the dictionary, and their respective numerical value, or even the raw value of the word, depending on its position, say for instance, "helpful" could have an index value of 1171 or could be given a value of "85121662112" based on a concatenation of the index value of the letters against a standard alphabet. These words are operated on, exponents, multiplication, division, addition, etc., until the original value of the RSA key can be recreated. This should allow the RSA keys to be easily checked for manipulation and verify the authenticity, or easily communicated by phone.

Any thoughts?
It isn't exactly pure cryptography, but cryptographic adjacent.

My question is "Does anyone have any input on pseudocode or python implementation?"


texts: What are the required security properties for salts?

texts:
I was recently thinking about password hashing (maybe caused by the PHC progression).

I started to think a little more about it and got stuck at this question:

What security properties do password-hashing related salts actually need?

I think they need to be globally unique (that's how I usually construct them). This means the same salt should never be used twice - by anyone. This would mean I'd had to choose my salt to be collision resistant resulting in 512-bit length and a CSPRNG for generation.

Is this overkill or are shorter and less defensive solutions also secure? (this is basically the same question as the bolded)

If you need to make assumptions regarding the schemes, standard schemes (without pepper) should be assumed, like bcrypt, scrypt, Argon2, PBKDF2.


texts: Does humanly verifiable one time pad authentication exist?

texts:
Firstly some predicates:-

Sufficient hardware generated one time pad key material.
No pad reuse.
Messages of 160 characters length (think Twitter).
28 characters only in use (A-Z, space and full stop alphabet. Think
Morse).
The very vast majority of messages based on English grammatical form.
The messages would be typed on a computer and read via computer.

Would it be possible to authenticate a one time pad message manually by hand using say pen and paper?  Perhaps even a spread sheet, but certainly no programming languages. Hence the typical HMAC is out.  The character set and message length are not unmanageable with some determination.

But most importantly, the authentication only has to be manually provable to work. He will not be authenticating every message, just those he chooses to test.  That means that the user has to be able to verify to himself that the algorithm works on the messaging system.  So he can take an arbitrary message, authenticate and satisfy himself of correctness.  The purpose is to create confidence in a manually verifiable way that the system is working correctly and not a fraud or victim of a Man in the Middle attack.

High security is of secondary importance, subservient to the need for provable manual verification of authentication.  Whilst a one time pad is totally secure, the authentication algorithm needn't be.  Any degree of authentication will be of interest for this question. It would be nice if any proposed solution could have the security level quantified in bits.

I appreciate that there is a spectrum of levels of security for the authentication mechanism.  Clearly it ranges from no security (no authentication) to very secure (HMAC calculation). I think that unfortunately we're looking at the lower end of the scale towards the no security end, as the overriding criterion is human computation.

The most basic and brute force approach that occurs is simply sending the same message in multiples.  So m ⊕ k1 | m ⊕ k2 | ... and so on.  I believe that you'd get 4.8 bits of security for every concatenated message, but I'm probably wrong.


texts: What is the idea behind hashing the QueryString in OAuth?

texts:
In OAuth 1.0a and 2.0 using MAC Authorization, I need to generate a hash of all the QueryString Parameters, which requires normalization (alphabetical ordering) of them.

I'm trying to understand what this offers from a security perspective over just generating a hash of Secret Key + Nonce + Timestamp?

My guess is that the additional entropy makes it harder to brute force the secret key, but I'm not really sure if that is the case.

Does anyone know what QueryString hashing offers in terms of security on top of simpler hashing?


texts: Are coprocessors (Intel Phi) a threat for modern key stretching functions?

texts:
Modern key stretching functions (password-based key derivation functions, also used for password hashing) are memory-hard to mitigate parallel attacks, and as far as I know this is working well. Last year there was the password hashing competition (PHC 2015) where new password hashing functions were presented, Argon2 is going to be the new recommended password hash.

In the last few years Intel introduced its Xeon Phi coprocessors, which are devices with a moderate numbers of cores and great memory. At first sight this seems to be the perfect weapon for a hardware-accelerated dictionary attack (or brute-force) on these memory-hard KDF.

Is it really feasible? How?

If yes, is there a way to emulate this architecture's behaviour on such tasks?


texts: The logic of preferring PBKDF2 over iterative SHA2

texts:
I have studied PBKDF2 for the application of hashing passwords, and frankly I don't understand the justification for the complexity of PBKDF2 over iterative hashing with a cryptographic hash function.

Here is an example: (obviously if you want a longer/shorter hash, choose a longer/shorter digest)

|| - concatenation operator
let password be a user supplied byte sequence
let salt be a random byte sequence supplied by the runtime
let iteration_count be a positive integer in the millions

Algorithm:
iteration = SHA256( salt || password )
for ( 2 to iteration_count )
     iteration = SHA256( iteration )
let hash = final value of iteration
// Store hash, salt and iteration_count

As long as the iterations are tuned to take a target amount of CPU for the security policy, for what purpose justifies using a more complex routine than that?

On my computer with Java, it takes approximately 2 million iterations to fill about 1 second of CPU time to generate the hash.

The biggest advantage to me with this design is, next year when the computer is running faster, I can update my entire user table statically, stretching the iteration count a little further. In fact, if I had a huge operation and performance was going to be a problem, I could run a constant depth extension of the hashes, to wit:

update table USERS set ITERATION_COUNT++, set hash = SHA256( hash )

Besides simply telling me not to roll my own, can some experienced experts please convince me why this security design is poorer than the venerated PBKDF2? Thank you very much in advance. I am eager to learn something new here.


texts: The security of Hidden Field Equations - sentence

texts:
I am reading this paper "The security of Hidden Field Equations (HFE)"

and at the end of the page 3 the author wrote:

  The random oracle paradigm would be to ignore that the function
  formulae exist.

I know what is the random oracle paradigm but sincerily I do not understand why the

"The random oracle paradigm would be to ignore that the function
 formulae exist."

Could you explain me please what that sentence means?


texts: Periodic re-keying during full drive encryption

texts:
A man encrypted a hard drive in 1996 using three key 3-DES with a 64 bit IV and CBC mode in the following manner using known 1990s algorithms on a 1996 PC.  Here is how he did it.
Start with a randomly generated 256 character (full 0-255 range on each character) key generator.  Randomly generate a 64 bit IV in a separate manner, (not sure an IV is required in this scheme, except you should do everything you can to follow protocols).  Salt the 256 byte key generator with the IV and hash it with MD5 in order to produce the 128 bits that will provide the material for the first two 3-DES keys and then hash that result in order to use the first 64 bits of that hash as your third key.  Take your keys and your IV and encrypt the first 128 blocks of plaintext in CBC mode.  Then, re-key in the following manner.
Salt your original 256 byte key with all three keys and hash it with MD5 in order to produce the first 2 encryption keys and hash that result for your third key.  The last 64 bits of the second hash will be your IV for the next 128 blocks.
You repeat this pattern of re-keying every 128 blocks until the entire hard drive is encrypted.   When finished, you store the initial 64 bit IV and detailed instructions of how you encrypted the data in plaintext.
The question is, has this individual gained much security from periodically re-keying, as opposed to standard 3-DES for the entire drive?
You suffer two MD5 hashes of 280 bytes and a 3-DES key setup penalty every 128 blocks.  So far, this looks like a couple percent increase in drive encryption time at most.  The way I see it, it comes down to whether or not the suggested proposal provides enough additional security to justify the performance penalty.
Let's say an attacker acquires the ability to recover 3-DES keys 15, 20, or 30 years from now.  There is a typically a significant delay between the time an attack becomes practical and the time in which it becomes trivial.  For example, when DES keys were first brute forced, the attack was not trivial.  This could mean the difference between having to brute force a new key every 1 KB of that hard drive when it takes half an hour to do so, as opposed to recovering one key and decrypting the entire hard drive using the same key.


texts: Why is the lite version of Cramer-Shoup not IND-CCA2 secure?

texts:
In the lite version of Cramer-Shoup we have a group $G$ with generators $g_1$ and $g_2$, private key $a_1, a_2, b_1, b_2$, and public key $A = g_1^{a_1} g_2^{a_2}$, $B = g_1^{b_1} g_2^{b_2}$. Encryption works by picking a random integer $r$ and sending the tuple $(g_1^r, g_2^r, A^r m, B^r)$. When decrypting we check the $B^r$ portion of the ciphertext is correct and, if so, obtain $m$ by calculating the inverse of $A^r$ and multiplying $A^r m$ with it.

Consider the following formulation of DDH: for random group elements $g_1, g_2, u_1, u_2$ and random integer $r$, $(g_1, g_2, u_1, u_2)$ is indistinguishable from $(g_1, g_2, g_1^r, g_2^r)$. Cramer-Shoup lite can be shown to be IND-CCA1 secure under this assumption. The proof goes by employing a hypothetical CCA1 attacker $\mathcal{A}$ which breaks Cramer-Shoup lite to break DDH. Our challenge instance is a quadruple $(g_1, g_2, u_1, u_2)$. We simulate the IND experiment for $\mathcal{A}$ with our own generated private and public keys; thus we can also simulate its decryption oracle since we have full knowledge of the scheme's private key. When $\mathcal{A}$ commits itself to a message pair $m_0, m_1$, we send it one of this messages (randomly chosen) encrypted, but with $g_1^r$ replaced with $u_1$ and $g_2^r$ with $u_2$. Thus $\mathcal{A}$ receives $(u_1, u_2, u_1^{a_1} u_2^{a_2} m, u_1^{b_1} u_2^{b_2})$, which is a valid encryption iff $u_1 = g_1^r$ and $u_2 = g_2^r$ for the same exponent $r$. $\mathcal{A}$'s response (ciphertext is valid or not) is correct with non-negligible probability, so we can distinguish the DDH quadruples with non-negligible probability.

I am having trouble understanding why the argument fails for IND-CCA2. Is it because $\mathcal{A}$ can use $u_1$ and $u_2$ in subsequent decryption queries?


texts: Ciphertext size of any CPA-secure public-key encryption scheme

texts:
I know that, for any CPA-secure public-key encryption scheme, the size of the ciphertext after encrypting a single bit is superlogarithmic in the security parameter. That is, for $(pk,sk) \leftarrow Gen(1^n)$ it must hold that $|Enc_{pk}(b)| = w(\log n)$ for any $b \leftarrow \{0,1\}$.

The problem is that I took it as a heuristic, thus I don't know the big "WHY". So, finally, why and how can I show that?


texts:
From RFC8446:
For concreteness, the transcript hash is always taken from the
following sequence of handshake messages, starting at the first
ClientHello and including only those messages that were sent:
ClientHello, HelloRetryRequest, ClientHello, ServerHello,
EncryptedExtensions, server CertificateRequest, server Certificate,
server CertificateVerify, server Finished, EndOfEarlyData, client
Certificate, client CertificateVerify, client Finished.
Messaages starting with Encrypted Extensions and after are encrypted. When calculating the hash (ex. SHA256), it is done over the encrypted form as they arrived, of over the decrypted text ?
Thank you.


texts: cipher text only attack - how to know when to stop when brute-force attack?

texts:
Possible Duplicate:
  How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

My question is about a cipher text only attack - I have as input only the initialization vector and one cipher text.

I know the key domain: letters "a-h", and the padding is zero's (don't know if that helps).

Problem is that after XORing (as part of the CBC schema) most of the remaining letters are not part of the domain of "a-h", so I get almost readable text with all the keys I try in the brute-force attack.

How can I know for sure the key I got is the correct one (meaning how do I know when to stop the bruteforce attack - meaning how to know the plain text I got is fully readable)?

What I have tried so far:

I was trying to use a dictionary to check if the words I got in the plain text are words in English and as I said most of the text is readable because of the small domain and the CBC schema which XOR before the encryption function:
CipherTextBlock1=E(IV xor PlainTextBlock1, key) => CipherTextBlock2=E(C1 xor PlainTextBlock2, key) and so on...


texts: random number generator 10-side dice alternative

texts:
A lot of sites (e.g. Dirk Rijmenants') refer to 10-side dice to generate random number for one-time-pad. I was thinking about new ways to generate random numbers, letters and passwords. here what I got…

To generate random numbers:

Take out keys numbers from 0-9 from old keyboard, calculator or mobile pad and put it in a cup shake it then take one out write it on paper threw it back, shake, and take another... so on till get my numbers.

To generate random letters for OTP:

Take out letters key from an old keyboard put them in a cup shake it and take one out write it on paper then threw it back, shake and take another one... repeat till get my otp letters.

To generate random passwords:

take out letters key from black keyboard (for small letters) and another one white for capital letters, symbols/numbers keys black keys for symbols, white for numbers, then put all keys (72 keys) in a hat, shake it and take one key out write it down throw it back shake, take another one... untill I get my true random password.

Can any one confirm that way as a true random numbers, letters and passwords generator?


texts: How can Shamir's method for secret sharing work in the GF(256)?

texts:
I have been reading about Shamir's secret sharing, and maybe i completely misunderstand something, but the field is meant to be a prime. However, when i look at the implementations of this algorithm, they all use GF(256).

I do understand the beauty of such field, since that's the best compromise between the size of the chunk of the data and the number of keys that one can generate, but i was unable to find how they got around the requirement of a prime.

Alternatively, of course, i have misread something.


texts: what is contained in a public key certificate

texts: Public key certificate is a digitally signed document which verifies the sender is indeed the person. May I know how can the receiver tell the sender is indeed the person solely based on information on the public key certificate? What are contained in the certificate? Does a public key certificate contain the same information as in any certificate?


texts:
I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low exponent RSA paragraph' of this article- http://www.cims.nyu.edu/~regev/teaching/lattices_fall_2004/ln/rsa.pdf):

Someone sends a message, $m$ to 3 people (without any padding) with public keys $n_b$, $n_c$ and $n_d$ and public exponent of 3. The article says:

  By using the Chinese Remainder Theorem, the eavesdropper computes a number $c$ such that $c = m^3 \mod n_b \cdot n_c \cdot n_d$.

Maybe I don't completely understand the Chinese Remainder Theorem, but I don't understand how you could choose a system of congruences to solve that would end up being equivalent to $c = m^3 \mod n_b \cdot n_c \cdot n_d$ when you don't know what $m$ is. Can you please help me understand what to use as the system of congruences to get to that point because I think I understand the rest.


texts: Is it possible I can open pedersen commitments without revealing r?

texts:
With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$.

In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$,
then de-commit by revealing $(m, r)$. $c' = c$, then the commitment hold.

I am wondering if I don't need to reveal $r$ to verifier, instead I can reveal $m$ only and construct a proof of knowledge on $r$ to have the sample result. As $s = h^r$ if $s = {{c}\over{g^m}}$, I can use Schnorr Protocol to prove that I know $r$ in $s = h^r$ for $s = {{c}\over{g^m}}$.

If verification hold, mean that provers know $r$ with $m$ in a relationship $c=g^m h^r$. Am I right?

I would like to add follow-up question if the answer is yes.

To prove the knowledge of $r$ in $s = h^r$ for $s = {{c}\over{g^m}}$. I can use Schnorr Protocol to construct the proof. But if it is possible to make it only available for designated verifier to verify the proof?

I read a paper is about Designated Verifier Signature, but it is about creating proof on a signature $s=m^x$ where $m$ is the message and $x$ is the private key of signer.

So is it possible to make Schnorr Protocol only can be verified by a selected verifier with know public key?


texts: With OpenSSL and ECDHE, how to show the actual curve being used?

texts:
Using

openssl s_client -host myserver.net -port 443

I can see the cipher negotiated is indeed using ECDHE for session key exchange:

SSL handshake has read 5894 bytes and written 447 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384

Both the client and the server use exactly the same OpenSSL version "OpenSSL 1.0.1e 11 Feb 2013" and I can get the list of available, builtin curves using:

openssl ecparam -list_curves

However, how do I find out which elliptic curve is actually being used in the session?

For completeness, here are the TLS handshake messages relevant to curve negotiation from a real-world session (using the openssl command given by Thomas):

ClientHello:

>>> TLS 1.2 Handshake [length 013c], ClientHello
    01 00 01 38 03 03 52 6c 53 04 fb 32 94 d4 f4 91
    53 fe 59 5c d1 58 7f e0 67 e0 22 db da f4 8d ac
    dc 15 68 21 3d ec 00 00 a0 c0 30 c0 2c c0 28 c0
    24 c0 14 c0 0a c0 22 c0 21 00 a3 00 9f 00 6b 00
    6a 00 39 00 38 00 88 00 87 c0 32 c0 2e c0 2a c0
    26 c0 0f c0 05 00 9d 00 3d 00 35 00 84 c0 12 c0
    08 c0 1c c0 1b 00 16 00 13 c0 0d c0 03 00 0a c0
    2f c0 2b c0 27 c0 23 c0 13 c0 09 c0 1f c0 1e 00
    a2 00 9e 00 67 00 40 00 33 00 32 00 9a 00 99 00
    45 00 44 c0 31 c0 2d c0 29 c0 25 c0 0e c0 04 00
    9c 00 3c 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0
    0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00
    11 00 08 00 06 00 03 00 ff 01 00 00 6f 00 0b 00
    04 03 00 01 02[00 0a 00 34 00 32 00 0e 00 0d 00 [>>  ?
    19 00 0b 00 0c 00 18 00 09 00 0a 00 16 00 17 00
    08 00 06 00 07 00 14 00 15 00 04 00 05]00 12 00  <<] ?
    13 00 01 00 02 00 03 00 0f 00 10 00 11 00 23 00
    00 00 0d 00 22 00 20 06 01 06 02 06 03 05 01 05
    02 05 03 04 01 04 02 04 03 03 01 03 02 03 03 02
    01 02 02 02 03 01 01 00 0f 00 01 01

ServerKeyExchange:

<<< TLS 1.2 Handshake [length 014d], ServerKeyExchange
    0c 00 01 49 03 00 17 41 04 7e 74 d7 ed f4 7b 2f
    ...


texts: Apple OS X can create encrypted AES 128/256 DMG volumes. Here is written about a men who was able to hack it. And also that DMGs use PBKDF2-HMAC-SHA-1. I couldn't find more information about encrypted DMGs. So does that mean that apples encrypted DMGs could be hacked?


texts: Make AES CBC more secure by destroying each block?

texts:
Assume AES in CBC mode is used to encrypt an arbitrary file. The key and the IV are generated out of secure random data and are both different for each file and of proper length and strength. Then the key the IV are encrypted with RSA. Now the AES encrypted file will be transmitted via an insecure transport from the sender to the recipient. The RSA encrypted key and iv are also transmitted via an insecure transport. The recipient now decrypt the IV and key via it RSA private key and then decrypt the file with the key and IV. So far so good and pretty common. Assume further that authentication is not necessary and GCM mode is out of scope here.

The question is now: Does it add "more security" (or will it even be "less secure") to "destroy" the encrypted AES file by flipping a bit (or two) of each AES block and store information about the flips alongside with the key and IV in the RSA encrypted part (so that the recipient can decrypt properly)?

Background of the question is the idea that an attacker, who "sees" the AES encrypted file, needs maybe more time and computing power to run a brute force attack because even when he has the right key and IV the decryption would fail because the blocks are all invalid?

Or is this "security by obscurity", useless, even dangerous or just another kind of "self invented encryption" (which is typically a bad idea)?


texts:
I'm not sure if this questions belongs here or in the Information Security Stack Exchange, but here goes...

With SCRAM (RFC5802), is there anything that prevents an attacker masquerading as the server from sending an iteration count of one?

If there's nothing preventing this, then it seems that such an attacker could get hold of a weakly hashed password and easily crack it:

Client              Server
------              ------
username,nonce  ->
                <-  nonce,salt,iterations=1
ClientProof     ->

then, offline,

AuthMessage     = client-first-message-bare + "," +
                  server-first-message + "," +
                  client-final-message-without-proof

foreach password in dictionary
    SaltedPassword  = Hi(Normalize(password), salt, i) // with i==1
    ClientKey       = HMAC(SaltedPassword, "Client Key")
    StoredKey       = H(ClientKey)
    ClientSignature = HMAC(StoredKey, AuthMessage)
    ClientProof     = ClientKey XOR ClientSignature
    check(ClientProof == StolenClientProof)

The problem I see with SCRAM is that the client has to trust the server with the iteration count before the the client can even authenticate the server.

I suppose the client could enforce a minimum iteration account to mitigate this attack, but this is not mentioned anywhere in the SCRAM spec.


texts:
ok, well... first: it's a "just for fun" question. I don't have a project dealing with this... I've simply a bit time and would like to talk a bit about some (maybe stupid) possibilities and try to learn something...

I always thought (before I was looking at the algorithm) that algorithms like cbc provide security against modifications of the encrypted data (so the idea was -> if you can decrypt the last block, everything must be fine) ... obiousely that's not the case. And here are my questions:

a) why? ... why wasn't it designed like this? Today we need MAC's to confim the integrity. So, we need 2 different algorithms to achieve this goal... wouldn't it be easier if one algorithm would do all of it?

b) ... could CBC be modified in a way so that it would support it? In this case my "security Tag" could be ... well... don't know... maybe sending the first block again? If it matches, everything was fine? Or does it have a huge flaw I don't see right now? ... or, is it simply not practical because of the computational power it needs or... lack of parallelization... things like that...

(I modified the pictures from Wikipedia to show the first idea that crossed my mind)


texts: Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?

texts:
The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes place in a signing operation. Two modes are described for this attack, one where the adversary has no knowledge of how the moduli are modified by a fault, requiring 60,000 faults for the recovery of a 2048-bit private exponent, and another one where they have a dictionary of possible moduli, reducing that number to at least 28 faults.

However, if the adversary was able to modify the modulus however they like instead of relying on random modifications from different faults, would it be possible for them to reduce that number even further? If so, how could they do that, for example, are there special values for moduli that make this attack recover more exponent bits at a time? Or would the attack largely be the same, only removing the need to guess what the faulty moduli are?


texts: Why use Needham-Schroeder if we have Diffie-Hellman?

texts: If we want to establish secret symmetric key between two entities, why use Needham-Schroeder if we have Diffie-Hellman? With DH we don't need to have any trusted party, so what's the point of NS?


texts:
“Brainwallet” is a program that takes a passphrase (hopefully a good one) and deterministically creates a Bitcoin wallet. This wallet can be used for transactions, then deleted from the computer. To get access to the wallet again, you only need the passphrase to re-create it.

Does something similar exist for GPG? If yes, where can I get it?
If not, is it even possible to create such a program? Maybe it's just a bad idea?


texts:
I want to use CBC MAC. First I hope to find some implementation of block cipher which I will use in CBC mode, which I understand is CBC MAC. But I have two questions:

1) If the length of the message to be authenticated is not multiple of block cipher block length, what shall I do?

2) Do I need to use session keys with CBC MAC? e.e. use different key for each message. Or I can use one key for long time period?

2) To strengthen CBC MAC one recommended way as mentioned on Wiki is to put the length of the message in the first block. But how should I encode the length, as string? Or in binary? If block length of cipher is say 64 bits, do I encode the number as 64 bit number? e.g. if message length is 230, I should use following value as first block:

00000000 00000000 00000000 00000000 00000000 00000000 00000000 11100110

?


texts: X509 certificates: Two Algorithm Identifiers?

texts:
I'm wondering why there are two Algorithm Identifiers in a X509 certificate. One is in the "to be signed" part and the other one is at the end right before the actual signature.

Are they used for the same purpose? Do they have to be the same? Can implementations choose which of these two fields they evaluate?


texts: Proof that lottery does not know outcome of draw

texts:
Could a variable participant lottery system cryptographically prove that they have zero knowledge of the outcome of a draw?

Participants do not choose numbers in this lottery and winning numbers are not drawn. Instead, they simply enrol with a wager. Winners are selected by taking all wagers and building an array of 'tickets' where the number of ticket entries per participant is proportional to their wager. A random index is chosen from this array, this is the winner.

I found a similar question but the answers assume that the number of participants is fixed. I'd also like to keep the participants from having to perform bit commitment as some have suggested - for trusting participants this is a PITA.


texts: Subtracting a point in elliptic curve cryptography?

texts:
I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption:

Pm + kPb - nb(kG) = Pm

Where Pm is the plaintext, Pb is participant b's public key, nb is participant b's private key, G is a base point in the elliptic group Ep(a,b), and k is a random positive integer chosen by participant a.

I am able to compute nb(kG) and kPb, but I'm unsure how to subtract the two. How is this done?


texts:
I would like a user to choose a point on an image which is represented by (x,y). This is meant to be a security token. When a user uses this location to login they are unlikely to to choose the exact same (x,y), rather they will choose a point nearby (x_g, y_g). The user may also be required to enter a password.

ATM I'm thinking of using a simple modulus function that will round (x,y) => (x mod 16, y mod 16). Other ideas include:

 multiplying x,y prior to applying the modulus function, (x,y) => x*y mod 16
 adding a salt to x and y prior to applying the modulus function, (x,y) => (x+salt mod 16, y+salt mod 16)
  adding the numerical representation of a hashed password to x and y. (x,y) => (x+pwordHash mod 16, y+pwordHash mod 16)

I'm also considering how this maybe extended to more than one point.

Problem

I wish to know if any of the above ideas are suitable or if there exists better better solutions for calculating a secure sketch. It is assumed that an attacker will have access to the salt and the secure sketch. The system will not store any record(i.e hash) of the actual point. The user will need to verify that the system has found the correct point.


texts: Computationally expensive key derivation whose difficulty is asymmetric

texts:
I am looking for a primitive or a construction that meets the following requirements. Is such a construction (a) theoretically possible, and (b) in existence right now?

Given are:

a long secret $X$
a authenticated cipher that takes a key $K$ with encryption function $\mathcal{E}_K$ and decryption function $\mathcal{D}_K$
a trusted server $S$
a set of trusted clients $C$
an attacker

Every client has a copy of $X$ in the encrypted form of $\mathcal{E}_K(X)$, where the decryption key $K$ is the same across all clients. I am trying to find a pair of functions $\mathcal{F}_S$ (on the server) and $\mathcal{F}_C$ (on the clients) such that $\mathcal{F}_C(Y, e) = \mathcal{F}_S(Y) = K$, where $e$ is a cost factor and $Y$ is a secret value that varies between each client.

I need $\mathcal{F}_S$ to be computationally inexpensive so that the server can generate many different values of $Y$ (to provision many different clients) quickly, yet all clients arrive at the same value $K$ with which to decrypt secret $X$. On the other hand, I need $\mathcal{F}_C$ to be computationally expensive so that it is prohibitively computationally expensive to the point of infeasibility for an attacker to (a) guess a valid $Y$ given only $\mathcal{F}_C$ and $e$ (i.e. Kerckhoff's principle applies for $\mathcal{F}_C$ with respect to $Y$), and (b) derive a new tuple of $(Y_1, e_1)$ given an existing tuple $(Y_0, e_0)$ that is known to the attacker to generate $K$.

Similar issues have already been solved in other contexts.

Key derivation functions such as HKDF per se are not news. However, they do not seem to allow fixing the output value to generate a series of input values that all generate the same output value.

Computationally difficult functions exist in the context of passwords (such as Argon2, scrypt, bcrypt, PBKDF2). However, not only do these suffer the same issue as key derivation functions in general, but these are symmetrically expensive, which means that the load on the server is immense when provisioning clients.

I've also thought about approaching this issue by making the client perform a brute-force computation of varying missing parts of $K$, but this gives attackers an undue advantage if the missing parts must be chosen such that computationally weak clients can finish the brute force search in less than a minute, but an attacker (a) is able to parallelize and very quickly run the brute force search to recover $K$, and (b) having determined $K$ is able to trivially generate their own $K$ with missing bits.

Another attempt involved a Diffie–Hellman protocol, but it seems infeasibly difficult to fix the shared secret and generate two inputs that then yield the fixed shared secret.


texts:
Here the key stream is used as keys for the second level of block cipher encryption.

I guess this is not vulnerable to:

padding oracle attack because it is basically counter mode
stream cipher attack, because it isn't just simply XOR-d
malleability, because XOR-ing something on the ciphertext changes the entire plaintext

A significant disadvantage is that it needs a new key expansion for every element of the keystream.

Am I correct in the above?
Are there any more advantages to this architecture?
Any further disadvantages?

Explanation: I modified the standard CTR mode by replacing the XOR with a full block cipher, which has the Keystream(i) values as keys for encrypting or decrypting the successive blocks of plaintext/ciphertext.


texts: Fiat-Shamir transform to Sigma protocols to turn into NIZK

texts:
I'm reading about the Schnorr's zero-knowledge proof for DLOG and the Sigma protocol for DH tuple proof, and I want to know how one applies Fiat-Shamir transform to both of them, to turn them into NIZK proofs.

I know that Prover would need to hash some public parameters to get the challenge, and then compute a proof for that challenge, so that the Verifier can also compute the same challenge using the hash from the public values, and can verify the proof, and there is no interaction between them. But, which of the public parameters one needs to hash to get a challenge? More precisely, how does the challenge look in NIZK proof, and is the proving and verification steps left the same? Also is the security guaranteed due to the random oracle model and usage of hash functions or there is something else going on in the NIZK proofs?


texts: Refreshing Procedure in FHEW: membership test

texts:
I am facing an issue regarding the paper FHEW: Bootstrapping Homomorphic Encryption in less than a second. It concerns the MSBextract algorithm during the refresh procedure.

Especially, they mentioned that we could change this algorithm to a more "general" one that would allow to check the membership for different subsets of integers $\bmod t$ in only one refresh procedure. However, I can't find an "efficient" approach to this problem (the one I have in mind needs more than one refresh).

Does any of you have some "hint" to guide me to the right direction?

P.S. They also mentioned a xor-for-almost-free procedure if the plaintext modulus is turned to $t=6$. I don't really understand that as - I believe - it perfectly works with $t = 4$ with the subset $S = {1;3}$. If I am wrong, please let me know.


texts: Using SHA1 to obfuscate published resource IDs

texts:
First off, yes I do know that SHA1 is cryptographically insecure (and has been for a long time). So this question is more academic than anything. It's also very contrived, but bear with me.
I want to publish a table of string IDs with timestamps, but at the same time I don't want somebody to be able to look at the table and use it to enumerate all the resources available.
TmQ5YqqOOPPiEewdntZx  2021-05-05 13:26:38
SVQBu941OWIyDXzSgo2F  2021-05-05 13:26:44
gkxMiz6hEPqV36TidyeG  2021-05-07 09:56:43
vU2OxFFQ4I0gXHGofL8A  2021-05-07 09:56:43

So I can hash the IDs in the table (HMAC is pointless, as the client would need to be aware of the secret used by the table generator):
d3399d662fc58daf44647f188cb6ef30bf76938c    2021-05-05 13:26:38
fc95d2f3af27034ff5a991d5b9a0080cbf45d007    2021-05-05 13:26:44
cd982afcff4ae5e907960f51ae1504a38f4665d1    2021-05-05 13:53:42
e0f31185494f54a3a16ac3483572989f98850c36    2021-05-07 09:56:43

A client, who already knows an ID can hash it, look it up in the public table and check the timestamp. The table should be useless for anyone who doesn't already know an ID.
My thoughts are:

Even though SHA1 is cryptographically insecure, I'm not using it for verifying the ID, but using it for obfuscation
Even if somebody can generate a collision, it doesn't give them the ID needed to request the resource
I don't want to use SHA2 as the shortest hash I can generate is 256 bits, which consumes 60% more storage (imagine I have a lot of them, and I'm very cheap!).

Obvious response will be:

Just use SHA2, and it's a valid response. I could just truncate the hash if I'm that concerned about storage space and transfer costs. 160-bits is still a larger address space than 62^20, so collisions are unlikely
Just SHA2, it's faster than SHA1. Yes it is, and actually SHA512 is faster than SHA256 (in .Net anyway)
Use something else.

If #3, please let me know.
Obviously, I'm going to use SHA2, but is there a cryptographic reason for not using SHA1 (or even MD5 if I was feeling really retro) in this instance. Like I said, the question is mainly academic.


texts: Relation between factors and their sum on RSA

texts:
In RSA and other crypto based on prime factors. If I would know the sum of $p+q$, would it reveal any more information than just knowing $p\cdot q$?
Edit: I do not know either $p$ or $q$. The question relates to the fact that if I know the sum and the multiplication, can I find the factors $p$ and $q$ faster compared to when I don't know the sum?


texts:
I am a master student in computer security, I am preparing a dissertation thesis in the theme is: Algebraic cryptanalys by auxiliary channels, I need reference on this theme (book, thesis, ...), and even I'm looking for specialists in the subject to contact them and work together.
  thank you for your attention.


texts: Confused about final subtraction of modulus in Montgomery Multiplication, during modular exponentiation

texts:
I'm confused about how one might supposedly bypass the final subtraction of the modulus in radix-2 montgomery modular multiplication, when used in a modular exponentiation algorithm. The following two papers put forward the conditions for bypassing the subtraction.

Montgomery Exponentiation with no Final
Subtractions: Improved Results
Montgomery Multiplication Needs no Final
Subtractions

I don't understand exactly what is required in terms of the "preprocessing and postprocessing" to eliminate the need for the repetitive subtraction of the modulus at the end of the montgomery multiplication.

My understanding after reading the above papers is that, to eliminate the final subtractions, you must:

Zero-extend each input operand to the modular exponentiation by two

e.g. new[2049 downto 0]  = (0, 0, old[2047 downto 0])

Increase the loop bound inside the Montgomery multiplications by two, such that two more iterations of the loop are executed

I've made these modifications to a working algorithm, however the results are not as I expect and I do not understand why. Therefore, I assume I am misinterpreting something in these papers, or leaving out a critical step.

Let us refer to my (working) radix-2 montgomery modular exponentiation function in (C-like pseudocode). Note that I have extended the operand width by two most-significant zero digits (just to make sure I'm not overflowing). They used to only be 2048 bits.

let NUM_BITS = 2048
let rsaSize_t be a 2050-bit vector type

// Montgomery multiplication: outData = XYr^(-1) modulo M,
// where the radix r=2^n    (n=NUM_BITS)
function montMult( rsaSize_t X,       // Multiplier
                   rsaSize_t Y,       // Multiplicand
                   rsaSize_t M,       // Modulus
                   rsaSize_t outData) // Result
{
    rsaSize_t S = 0;  // Running sum

    for (i=0; i<NUM_BITS; i++)
    {
        if (X.bit(i)==1) // Check ith bit of X
            S += Y;

        if (S.bit(0)==1) // check LSB of S
            S += M;

        S = S >> 1;   // Rightshift 1 bit
    }

    // HERE IS THE FINAL SUBTRACTION I WANT (NEED) TO AVOID
    if (S >= M)
    {
        S -= M;
    }

    outData = S.range(NUM_BITS-1,0);
}

//  montgomery modular exponentiation using square and multiply algorithm
//  computes  M^e modulo n, where we precompute the transformation of the
//  base and running-partial sum into the montgomery domain
function rsaModExp( rsaSize_t e,     // exponent
                    rsaSize_t n,     // modulus
                    rsaSize_t Mbar,  // precomputed: montgomery residue of the base w.r.t. the radix--> (2^2048)*base mod n
                    rsaSize_t xbar,  // precomputed: montgomery residue of 1  w.r.t. the radix--> 2^2048 mod n
                    rsaSize_t *out)  // result
{
    for (i=NUM_BITS-1; i>=0; i--)
    {
        montMult(xbar, xbar, n, xbar); // square
        if (e.bit(i)==1)
            montMult(Mbar, xbar, n, xbar); // multiply
    }

    // undo montgomery transform
    montMult(xbar, 1, n, out);
}

Am I missing something in the papers? I do not believe this is an implementation error, as my code matches exactly what is put forth in the papers. I believe that I might be a conceptual error. Any and all help appreciated.

Thanks!


texts: Multithreading PBKDF2 or javascript alternative

texts:
I'm using PBKDF2 in browser (can't use bcrypt, users are likely to have passwords > 72bytes, or whatever the number was). PBKDF2 is running in a webworker, something like so

const key = PBKDF2_HMAC_SHA512.bytes(passphrase, salt, Math.pow(2,17), 64)

This key is used to encrypt data to be stored in the user's localstorage. Now I wonder, seeing as I'm already using a webworker, why not use multiple? Would I not be able parrallelize it? Could I not do something like(simplified, in reality each key is generated in a separate web worker)

const key1 = PBKDF2_HMAC_SHA512.bytes(passphrase, salt1, Math.pow(2,17), 16)
const key2 = PBKDF2_HMAC_SHA512.bytes(passphrase, salt2, Math.pow(2,17), 16)
const key3 = PBKDF2_HMAC_SHA512.bytes(passphrase, salt3, Math.pow(2,17), 16)
const key4 = PBKDF2_HMAC_SHA512.bytes(passphrase, salt4, Math.pow(2,17), 16)
const key5 = new Uint8Array(64)
key5.set(key1)
key5.set(key2, 16)
key5.set(key3, 32)
key5.set(key4, 48)
const key = SHA_512.bytes(key5)

Would this not be 4x more secure? Or more importantly, could I not halve the rounds per instance of pbkdf2 and still end up with 2x the security? If I'm wrong, could someone point me in the right direction for a faster/more secure parallelizable kdf?


texts:
I am trying to test MD5 collisions presented in “Collisions for Hash Functions MD4, MD5, HAVA” (PDF) by Xiaoyun Wang, Dengguo Feng, Xuejia Lai, Hongbo Yu; 2004.

I wrote a PHP script to test it, but it doesn't produce the expected hash output. I tested everything several times and found no errors in my code. I don't know what is wrong. Please help me to find the reason and test the collisions.

Here is my PHP script:

<?php

$M='2dd31d1 c4eee6c5 69a3d69 5cf9af98 87b5ca2f ab7e4612 3e580440 897ffbb8
634ad55 2b3f409 8388e483 5a417125 e8255108 9fc9cdf7 f2bd1dd9 5b3c3780';

$N1='d11d0b96 9c7b41dc f497d8e4 d555655a c79a7335 cfdebf0 66f12930 8fb109d1
797f2775 eb5cd530 baade822 5c15cc79 ddcb74ed 6dd3c55f d80a9bb1 e3a7cc35';

function fix_word_length($str) { //we need this because some hex words u see r less than 8 chars (e.g. the first hex word: 2dd31d1) / this pads them on the left with '0's

    return str_pad($str, 8, '0', STR_PAD_LEFT);

}

function convert2binary($str) {

    $str=str_replace("\n", ' ', $str); //replaces line feed chars with space
    $str=explode(' ', $str); //this converts each hex word to an array element / sorry for the name, but str is really an array after this operation
    $str=array_map('fix_word_length', $str); // pad hex words with a length less than 8 chars by '0's on their left
    $str=implode('', $str); //joins all hex words together again (with spaces between them removed). / str is now a string again
    return pack('H*', $str); // convert hex encoding to raw/binary and return it

}

$M=convert2binary($M);
$N1=convert2binary($N1);

echo md5($M.$N1);

?>

The output hash is 8da3a17b43e0e134bdc17557ffef15ff instead of the 9603161ff41fc7ef9f65ffbca30f9dbf mentioned in the article.


texts: Are slide attacks effective if the primitive is sandwiched? And key schedule vs. Even-Mansour

texts:
Suppose you have a cryptographic permutation consisting of identical rounds, that makes it vulnerable to a slide attack. But if you sandwich it between two XORs of key material. Is it still vulnerable?

Even-Mansour block cipher construction works on such a principle although it says nothing about a permutation with identical rounds.

What is the reason for why AES and most other block ciphers employ a key schedule instead of an Even-Mansour construction?


texts: Why does libSTARK use binary fields as opposed to prime fields for zk-SNARKs?

texts:
zk-STARKs make use of FRI for low degree testing of polynomials.

The zk-STARKs paper states on page 11:

  we stress that ZK-STARK could also operate over prime fields but we have not realized this in code

With a footnote

  the FRI system requires p to contain a sufficiently large multiplicative subgroup of order $2^{t+\mathcal{O}(1)}$; such prime fields abound, as implied by Linnik’s Theorem.

This helpful blog post which explains and implements code similar to libSTARK states:

  STARKs “in real life” (ie. as implemented in Eli and co’s production implementations) tend to use binary fields and not prime fields for application-specific efficiency reasons

If binary fields give some kind of advantage, what advantage do they provide?


texts: Trying to understand textbook exercise question regrading RSA

texts:
I am preparing for the final exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. Any hint would be great.

Question (Exercise 9.14 of textbook):

Observation:
Similar to $RSA$ decryption that $e.d = 1$, we to find some number $r$ such that $E*r = 1$ so that $(m^E)^r \ (mod \ N) = m$. But what should that $r$ be? Any hint would be great.


texts: Polynomial multiplication and division in $2^{128}$

texts: I want to multiply and divide polynomials, and implement the extended Euclidean algorithm for polynomial greatest common divisors, over a Galois Field of size $2^{128}$. Moreover, I want to use the previous algorithms on an 8-bit microcontroller (ATMega128). Where can I find relevant libraries in C or Assembly? Ι would prefer C, if the implementation is not too inefficient. Thanks in advance.


texts: OTP Random Pad Renewal Without Extending Message

texts:
So I recently learned about the concept of a One Time Pad; and I from what I understand it means that if a XOR key is completely random and equal to or longer than the plaintext, it makes it so that anyone trying to break the encryption would basically only be able to narrow it down to all appropriate possibilities from the selection field.

Is there a way to renew the key over each transmission between clients sharing a key? In other words, if the original key is xxxxxxxxxxxxxxxx and the sent data is made of the first half being a message and the next half being some form of data, can a pre-determined protocol be fed the data to generate a new full-length key? Or is it impossible to do this without compromising the integrity of the randomness of the new key? What would theoretically be required of such a protocol to make it secure?

Thanks in advance!


texts:
I wish to send some small data that RSA alone can encrypt, and I send a shared secret along with it.

A --> B ; RSA(data||shared_secret)  // B will verify the shared_secred and authenticate A;

vs

A --> B ; RSA(data||shared_secret) || SHA-256(data||shared_secret)

RSA is RSA-OEAP, not something home grown.

Will verifying the shared secret be enough for message integrity and authenticity? Or, should I also send a hash of the message?
I wish to ask because it seems redundant to send twice as much data if I do not need the hash.


texts: Git uses SHA-1, and it is common to sign Git commit or tag hashes to authenticate a repo.  Is this insecure now?


texts:
Given a d value = -(10240/10241)

How would I convert this into 64 bit limbs?

I have to expand on this because of stackoverflow quality algorithm, I've tried using python to get the integer rep/hex rep, but it's not a whole number, so I'm a bit lost


texts: Why is stateful CTR slightly better than stateless CTR? Does the adversary know the value of counter in CTR mode of operation?

texts:
This might be a stupid question but is really fundamental in my understanding of CTR (I'm a newbie to cryptography theory).

For CPA security, the adversary only knows the IV, and may query the oracle for random values of IV+$ctr^*$ where $ctr^*$ is the counter.

For stateful CTR, what do we assume is predictable - the nonce or the counter?


texts:
I was reading Bruce Schneier's book Applied Cryptography, and he makes a comment about Digital Signatures, that they can be used as a building block for more advanced protocols.

What are examples of things that use digital signatures as a building block?


texts: Practical sources of entropy on an Android device?

texts:
What Android API's can be used a practical sources of entropy ?

Given the requirement of sourcing entropy on the phone for purposes of seeding a PRNG, what are good options ?

Edit:

I have a hard external requirement to periodically supplement the entropy of the RNG, which in the case of SecureRandom, I will do by calling setSeed and passing in the new entropy.

The Android docs for setSeed state:  The given seed supplements, rather than replaces, the existing seed. Thus, repeated calls are guaranteed never to reduce randomness..

As a result, I'm pretty confident that this is the safe and correct way to supplement the entropy of the RNG, but I need guidance as to appropriate on-device sources of entropy.

I have a FIPS compliant HSM on the server side that will contribute, but I need a safe source of additional entropy on the mobile device side.

Recommended options include the lower-order bits of random chunks of memory and phone sensors, and I would appreciate comment in this regard.


texts:
I don't understand what an active s-box is (in reference of design criteria 8 of the DES).

Because according to DES, all 8 s-boxes are used every round. But this is not what active means.

So my question: What is an active S-Box, and what does it mean when an s-box is active (or when two or three s-boxes are active)?


texts: Is it safe to encrypt data using XOR along with CSPRNG seeded with a truly random number?

texts:
I was wondering a couple of days ago whether I could reverse the normal encryption order to produce a good AES based cipher variant. The method is as follows:

Two users, Alice and Bob, each have a copy of a shared key they want to use for AES. They each also have one shared seed to use for the CSPRNG. For Alice to talk to Bob, she would use AES with her initial RNG seed and shared key to generate a block of random data. Subsequent random numbers are generated as follows:

r[0] = AES(key, ASeed);
r[1] = AES(key,AES(key,ASeed));
r[2] = AES(key,AES(key,AES(ASeed)));
etc

She would then XOR the results of her random number with the plaintext to get the ciphertext. Furthermore, when she sends the encrypted data to Bob, she also sends a sequence number in the clear, indicating how many random numbers need to be computed for Bob to decrypt the data.

Bob would do the same when he wanted to talk to Alice.

The only major flaw I see in this setup is the sequence number which is sent unencrypted. It needs to be, otherwise Bob will not be able to know which random number to XOR the ciphertext with to get the original plaintext. An attacker could deliberately change this sequence number to mess up Bob's decryption method. This is a source of DoS against Bob, who is then made to decrypt junk data.

However, Alice and Bob could agree on using a HMAC scheme to prevent someone without the key from sending a legit message. In this case, the plaintext is still exposed, but cannot be changed. The sequence number can also be a signal for an attacker about how the encrypted data is organized.

Anyone has any opinion on this? It is clearly inferior to the old method, Since it leaks info in the sequence number.

//good old AES
AES(key,data);


texts: Why do we need password in a server which uses TLS?

texts:
Suppose a server uses TLS to protect communication between us and the server.

I observe that in the TLS handshake protocol, password is not mentioned anywhere.

Then why do we need to have a password? What is its purpose?


texts: Why does Carter-Wegman MAC have 2n-bit output?

texts:
The Coursera course on Cryptography 1 has a section about Carter-Wegman MAC. Here is the image of slide:

Now my question is both $F$ and $S$ output $n$-bit strings. We XOR two $n$-bit strings and we should get an $n$-bit string as a result. But the slide says the output result is a $2n$-bit string. How is this possible?


texts: Is there a way to sign a message without being allowed to see it?

texts:
I want to sign a message while not being able to see the message.

Logically, there should be a way, I just don't know how this translates into cryptography.

Here is an illustration for what I mean:

A man writes a message on a piece of cardboard. He wraps the cardboard in carbon paper and brings it to another man.

That other man is the signer. He puts his signature on the carbon paper, which in turn also transmits it onto the original piece of cardboard. However, the signer is not able to see the message, since it is hidden in the carbon paper. (The fact that the paper is fragile is without loss of generality, one can image something more tamper-proof of course).

The first man then returns home where he unwraps the piece of cardboard, with the message which is now signed by the signer. But the signer does not know the message still.

There are use cases for this and I would be very interested how this could be reproduced in cryptography.

EDIT: Trying to clarify something, I am sorry my inability to be more clear:

The thing is that the message creator may want to pass the message to third parties that he does not trust. It must be possible for a third party to read the message and verify that the message was signed by the signer. But, assuming that the signer signs many messages every day, it should not be possible for the signer and the third party to cooperate in order to identify which message the signer signed WHEN.


texts:
Up to now, the pairs of strings that create an MD5 collision that have been discovered all contain non-ASCII (binary) characters.

Are there two known ASCII-only strings which have the same MD5 hash value? For instance the set of characters [0-9A-Za-z]?


texts: Is there any block cipher which is also a pseudo-random-permutation over the key

texts:
As block ciphers are defined as a pseudo-random-permutation over the data (keyed with the key), I was wondering, if there are also constructions for which key and data can be switched and the cipher is a permutation over the key space for a fixed (data) input?
So the question is, if the output space of $E_k(a)$ for all possible $k$ covers the entire space of $\{0,1\}^n$
More formally:
$E_k$ is a block cipher with key size equal to block size: $\{ 0, 1 \}^n \times \{ 0, 1 \}^n \rightarrow \{ 0, 1 \}^n $
and $\exists a \forall k_1, k_2: E_{k_1}(a) = E_{k_2}(a) \Rightarrow k_1 = k_2$
Or more generally: with $f$ a function $\{ 0, 1 \}^n \rightarrow \{ 0, 1 \}^n$
$\forall k_1, k_2: E_{k_1}(f(k_1)) = E_{k_2}(f(k_2)) \Rightarrow k_1 = k_2$
Or is this even true for every block cipher?


texts: How to prove secret value in Pedersen commitment is equal to secret value in Fujisaki commitment?

texts: We have Pedersen commitment C to the secret value x, and Fujisake commitment C' to the secret value x. How can we make a zero-knowledge proof of equality for x value in the commitments?


texts: Does gpg's symmetric encryption keep information about the filename?

texts: If I encrypt a file with gpg -c file.zip, and change the filename. Is there any way I can restore the filename as I used as a password. or the name encrypted to?


texts: Is this a UC-secure commitment scheme in the ROM?

texts:
To prove UC-security (universally composable security) of a commitment scheme, we must show that a commitment scheme is extractable and equivocal.

That is, we must construct a simulator that is able to extract the commitment of an adversary corrupting the sender (extractability) and construct a simulator that is able to open anything for an adversary corrupting the receiver given a commitment (equivocal).

Consider this commitment scheme in the Random Oracle Model:

Commit phase: The sender computes $c=\mathsf{RO}(M)$ where $\mathsf{RO}$ is the random oracle and $M$ the message to commit. It sends $c$ to the receiver.
Opening phase: The sender sends $M$ to the receiver. The receiver checks if $c=\mathsf{RO}(M)$.

It seems to me that this protocol is UC-secure since the simulator has control of the random oracle. Thus, it can always know the message $M$ by looking at the calls to the random oracle. The simulator can also open any message $M'$ it wants by returning $c$ to future queries of $M'$ by the adversary corrupting the receiver.

My questions are:

Is this correct?
If so, what is the point of constructing UC-commitment schemes in the ROM like
https://eprint.iacr.org/2014/908.pdf
and
https://link.springer.com/content/pdf/10.1007/978-3-540-24638-1_4.pdf
since this protocol seems much more efficient than the others.

Thank you!


texts: Is this problem same as discrete logarithm?

texts:
Given $g,h\in\mathbb Z_p$ where $g$ generates $\mathbb Z_p^\star$ Discrete logarithm problem is to find $z$ such that $g^z\equiv h\bmod p$ holds.

Take the problem given $g,g',h$ where $g^z\equiv h\bmod p$ holds at some $z$ find $h'$ such that $g'^{z}\equiv h'\bmod p$ holds.

If we know $y$ such that $g^y\equiv g'\bmod p$ then $g'^{z}\equiv h'\bmod p$ is known or if we know $z$ then $g'^{z}\equiv h'\bmod p$ is known.

If we know $g'^{z}\equiv h'\bmod p$ and $g^z\equiv h\bmod p$ then is it easier to find $z$?
What is the best way to find $g'^{z}\equiv h'\bmod p$ if we only know $g,g',h$ with $g^z\equiv h\bmod p$?
What is the best way to find $f$ such that $f^{z}\equiv 1\bmod p$ if we only know $g,h$ with $g^z\equiv h\bmod p$?


texts:
It is accepted that the javascript library lacks the ability to create an adequate PRNG. My understanding that this was mainly due to the limits of a sandboxed browser enviroment that javascript resides in.

Is this correct? Can server side javascript generate provably secure cryptography due to system wide access?

I have developed an interest in node.js specifically.


texts: How to key an HMAC with keys from separate mutually untrusted parties?

texts:
The problem is as follows:

There are two parties, both of whom would like to HMAC a message with a key. Although the keys are known to one another, both parties do not trust that the other one created a truly random key.

The HMAC result must not be easily attackable by a third party. So it is necessary the final key has substantial entropy whether or not one party didn't supply any.

In an optimistic world, both parties generate cryptographically secure 256-bit random numbers to key the message with.

In a less optimistic world, one party generates a secure 256-bit random number but the other party gives back 256 bits of data with hardly any entropy at all whether due to laziness or malice.

If both parties are lazy and/or malicious (worst case), then we can accept that failure is impossible to avoid. We assume for the problem that at least one party sees a good key as being in their best interest.

What would be the best way to structure an HMAC call so that I can use two keys such that one key being weak only means the strength is lower-bounded by the good key and not completely sabotaged due to some sort of subtlety?

The ideas I have are

HMAC(message, key1 || key2)
HMAC(HMAC(message, key1), key2)
HMAC(message, HMAC(key1, key2))

However, this is starting to feel like one of those problems where there is some subtle issue that I'm probably unaware of with all these seemingly straightforward choices.

Edit

After some discussion below, I feel I may need to include some more important details.

Party 1 will hand off an allegedly random 256 bit string to Party 2. Party 2 will also generate an allegedly random 256 bit string. Party 2 will be responsible for generating the HMAC but Party 1 will have the opportunity to reject the result. Both parties know each other's secrets and at least one party cares about having a strong secret although it is possible that the other party is malicious or lazy.


texts: What does it mean to have "signature verification with RSA-4096" if the key is only 3072 bits long?

texts: Trying to understand some crypto terminology while looking at processors.  I figured if a processor supports "up to RSA-4096 signature verification", that it would use a key that is 4096 bits long.  However, in the same reference manual it says that the RSA key sizes supported are 1024, 2048, and 3072 bits.  Does this make sense, or is this a typo in the manual?


texts: Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256

texts:
In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest):

Level I:  At least as hard to break as AES-128 (exhaustive key search)

Level II: At least as hard to break as SHA-256 (collision search)

Level III: At least as hard to break as AES-192 (exhaustive key search)

Level IV: At least as hard to break as SHA-384 (collision search)

Level V: At least as hard to break as AES-256 (exhaustive key search)

If I understand it correctly, then (in classical way, not using quantum computers and the Grover's algorithm) for exhaustive key seach on AES-128 we need to go through $2^{128}$ possibilities and in collision search of SHA-256 we need to go through $2^{128}$ possibilities to find a collision (thx to the Birthday paradox).

So my question is - how does the security Level I and Level II differ?  And the same - why is security of AES-192 lower than security of SHA-384.


texts: Is it safe to send a hashed password over HTTPS or what is the most secure method of authentication?

texts:
My rudimentary understanding of HTTPS and the Diffie-Hellman key exchange is that the client and server can establish a secured connection by generating the same key based on their private secrets and shared secret. That key is then used to encrypt/decrypt the data being passed back and forth between the two parties.
This means that I have established a secure connection, but says nothing about the identity of the client connecting to my server. It could be anyone with a browser. My question is, in order to identify a client after already having established an encrypted connection, is it safe to establish the user's identity by sending a username and hashed password over said connection? Is this a sort of standard procedure?
In most of my use cases, my client and server are going to be either NodeJS or Java applications that I have programmed, some running on the same machine and possibly on a different server in different locations, so I am not too concerned about creating any kind of system to allow users to sign up. Would a preset hashed password be secure enough, or should I use asymmetric keys like SSH? I'm just not totally sure what the pros/cons are or what the standard way to authenticate a client is. Do I even need to hash anything, or can I just have the user send a plaintext password and check it against my database since the connection is already encrypted anyway?


texts: What do numbers in a crypto algorithm stand for? Is there a convention?

texts:
What do the numbers stand for in the names of cryptographic functions, for example AES-256, RSA-1024 or SHA-256?

Do they always refer to key sizes, or is it a different measure for every algorithm?

Is there some convention about this?


texts: OT extensions paper: Why is $G_{m+1} \nleq m \times AND_B$?

texts:
I am reading this paper, in which Beaver shows how to take a small number of Oblivious Transfers (OTs) and extend them into an arbitrary number of OTs by implementing a pseudo-random number generator inside of a garbled circuit. Very cool.

He then goes on to show that, while this works in the settings where the parties are computationally bounded, it is in fact impossible to do OT-extension when the parties are not computationally bounded.

This is where I'm getting stuck. I don't understand his proof of Lemma 7. What does "Bob applies 1" mean? What are $x$ and $y$? (I thought they were Alice's and Bob's respective inputs to an $AND$ gate, but that does not seem to make sense in the context.)


texts: Shortest key in symmetric algorithm used only once is unsecured?

texts: Considering a message of n bits, one ridiculously short key of 1 bit and using this cryptographic function which performs the XOR operation to each bit of the message, resulting in a single ciphertext, could we assume that if the attacker doesn't know anything but this ciphertext, that this system is anywhere close to being safe?


texts:
I've read that we can study the security of modes of operation by assuming the use of an ideal block cipher. I've also seen a paper suggesting that the ideal cipher model could be something else than an ideal block cipher.

Are there protocols relying on an encryption mode and whose the proofs have been done by assuming that this encryption mode is ideal, that is, we don't consider an ideal block cipher, but rather an ideal encryption scheme ?

Finally, what could be an ideal cipher with respect to an encryption scheme ? For a block cipher, this is a random permutation (we have an elf wich fills a table step by step to describe this random permutation). What would this elf do in the case of an ideal encryption scheme ?


texts: Multi-secret sharing (Packed secret sharing) - Some questions

texts:
In the publication - "Communication complexity of secure computation", I have encountered a small problem - on page 5 of the literature under the heading "Theorem 1" they have described a $(c,d; k,n)$ multi-party secret sharing scheme.
Here, $d$ denotes the minimum number of parties that must come together to recover the secret, $k$ denotes the number of secrets, $n$ denotes the number of parties and $c$ denotes the maximum number of parties who together cannot gain any further information about the secret by collaborating.
I quote the text when it describes a $(t - k + 1, t + 1, k , n)$ multi-secret sharing scheme - (note $k \leq t< n$).

Theorem 1: There is a $(t– k+ l,t + 1; k,n)$- multi-secret sharing
scheme to share $k$ elements of a finite field $\mathbb{F}$ among $n$
players, with $k < n,$ where each multi-share is a single element of F.
Proof: Let $S_1, \ldots,S_k$ be the Dealer’s secrets. Assume that
$a_l,....,a_k$ and $e_l,....,e_k$ are pre-selected elements
of $\mathbb{F}$ that are known to the Dealer and all $n$ players.
A generalization of
Shamir’s secret-sharing scheme suffices. In the Distribution Phase,
each player $i$ receives the multi-share $p(a_i),$ where $p(x) \in F[x]$
is an otherwise random degree $t$ polynomial such that
$$p(e_i) = S_i, 1 \leq i \leq k.$$
More specifically, $$p(x) = q(x) \prod_{i = 1}^{k}(x – e_i) + \sum_{i = 1}^{k}S_i L_i(x),$$ where $q(x)$ is
a completely random degree $t – k$ polynomial, and where $L_i(x)$ is the
Lagrange polynomial.

i. I seem to only see the $k$ multi-shares distributed to k out of n parties. Is this understanding of mine incorrect? What is the role of the other $(n-k)$ parties?
ii. Are there any further resources online that I could refer to for such multi-secret sharing schemes? (preferably not academic literature as I'd like to work through some examples.)
Thanks very much in advance.


texts:
In a Schnorr group as used for DSA, of prime modulus $p$, prime order $q$, generator $g$ (with $p/g$ small), how can we efficiently exhibit an $x$ with $0<x<q$ such that $g^x\bmod p<p/k$, for sizable $k$ but $k\ll\sqrt q$ ?

I see that for small $k$, it is enough to try incremental values of $x$ until finding an $x$ that fits, with expected cost $O(k)$ modular multiplications in $\mathbb Z_p^*$. Is there better?

Assume $p$ is an $l$-bit prime; $q$ is an $n$-bit prime with $q$ dividing $p-1$; and $g=h^{(p-1)/q}$ for some (random?) $h$ in $\mathbb Z_p^*$. For concrete values, assume $l\approx1024$, $n\approx160$, $k\approx2^{64}$.

Update:  I'm expecting the problem to be hard, and thus that the more difficult problem of exhibiting $x$ with $g^x\bmod p$ in a range of width $p/k$ must be hard.


texts: how to efficiently compute private key in DSA with known parameters

texts:
For textbook DSA, as defined below. If $r, s, k, g, p, q, m$ are all known, is it possible to efficiently compute $x$ from all these given values? How does the math work out?

Secret key: $x\stackrel R\gets \mathbb{Z}_{q}$
Private key: $X=g^{x}\in \mathbb{Z}^{*}_{p}$
Signature:
$\text{Algorithm }S_x(M)\\\quad{
m\gets H(M)\\
k\stackrel\\\$\gets\mathbb Z_q^*\\
r\gets(g^k\bmod p)\bmod q\\
s\gets(m+x\,r)\,k^{-1}\bmod q\\
\text{return }(r,s)}$
Verification:
$\text{Algorithm }V_X(M,(r,s))\\\quad{
m\gets H(M)\\
w\gets s^{-1}\bmod q\\
u_1\gets m\,w\bmod q\\
u_2\gets r\,w\bmod q\\
v\gets(g^{u_1}\,X^{u_2}\bmod p)\bmod q\\
\text{if }(v=r)\text{ return }1\\
\text{else return }0}$

where $H$ is just SHA-1.


texts: Question about using Montgomery form for elliptic curve operations on bls12-381

texts:
Since the prime for bls12-381 is not of a form to allow easy modular reduction , is the best approach to use the Montgomery multiplication + reduction algorithm?

(q = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab)

If I do this, can I convert the affine point coordinates into jacobian projected and then into their Montgomery form at the very start, so all modulo multiplications inside the point double / add algorithms use the Montgomery algorithm? Then only convert out of Montgomery form and then back to affine coordinates at the very end.


texts: Can Diffie-Hellman be scaled up or force-multiplied?

texts:
I'm not too familiar with the math involved with the exchange of keys, I've read it over several times, but math isn't my strong point. My understanding is that smart people are hard at work to overcome the difficulty of factoring the shared secret.

So assuming that quantum processors overcome the current implementations and 'brute-factor' the keys involved, can the exchange be scaled up similarly to other forms of encryption?

Is there a way to scale up the effort of required to brute-factor the shared key so that not even a Quantum Computer could efficiently compute it, while still maintaining acceptable performance for the good-guys with consumer-grade non-quantum computers?

Sorry if this has already been asked, but like I said math isn't my strong point, I'm not even sure how to identify if its been asked.


texts: Formal definition of collision resistance for hash function

texts:
In my cryptography class, the professor said that collision resistance for a fixed hash function is not a "precise" definition. The reason is since a fixed hash function is a single instance of a computational problem it can't be hard(at least for a somewhat precise and complete definition of collision resistant). Note that it is not said that we know solutions for a fixed hash function. However, the definition seems to make more sense for a family of hash function. So this is more of a theoretical question than "in practice".

How would you explain this differently?


texts: Independently choose lanes and threads param on Argon2

texts:
I'm researching on using Argon2 on a JavaEE server-side application.

I'm a bit reluctant to set the parallelism parameter larger than 1 on a JavaEE environment where threads are supposed to be managed by the application server etc, etc.

One idea is to use the low-level API and set lanes to -lets say- 4 and threads to 1.

In the future, I could set threads to 4 to speed things up or revert back to 1 thread if things don't work out well.

I've done some basic examples with the reference implementation and I've seen setting lanes/threads independently to be working as expected.

Is there any scenario where this would produce incorrect results?

Is there something conceptually "wrong" or "insecure" on setting a high value on lanes but not utilising it with multiple threads? Like giving some advantage to an attacker?

Thanks in advance.


texts:
Can someone help me see the flaw in this cryptosystem?

Note: This is homework and it is due today at 1:30pm. An answer before that is not expected; I'd just like to understand what the flaw is.

From An Introduction to Mathematical Cryptography By Jeffrey Hoffstein, Jill Pipher and Joseph H. Silverman (Springer, 2008); problem 3.10, found one click away from here:

  Alice chooses two large primes $p$ and $q$ and she publishes $N = pq$. It is assumed
  that $N$ is hard to factor. Alice also chooses three random numbers $g$, $r_1$, and $r_2$ modulo $N$ and computes
  $$g_1\equiv g^{r_1\cdot(p−1)}\pmod N\text{ }\text{ and }\text{ }g_2\equiv g^{r_2\cdot(q−1)}\pmod N.$$

  Her public key is the triple $(N,g_1,g_2)$ and her private key is the pair of primes $(p,q)$.

  Now Bob wants to send the message $m$ to Alice, where $m$ is a number modulo $N$. He chooses two random integers $s_1$ and $s_2$ modulo $N$ and computes
  $$c_1\equiv m\cdot{g_1}^{s_1}\pmod N\text{ }\text{ and }\text{ }c_2\equiv m\cdot{g_2}^{s_2}\pmod N.$$
  Bob sends the ciphertext $(c_1,c_2)$ to Alice.

  Decryption is extremely fast and easy. Alice use the Chinese remainder theorem
  to solve the pair of congruences
  $$x\equiv c_1\pmod p\text{ }\text{ and }\text{ }x\equiv c_2\pmod q.$$

  (a) Prove that Alice’s solution $x$ is equal to Bob’s plaintext $m$.
  (b) Explain why this cryptosystem is not secure.

I can verify A but am having trouble seeing where the cryptosystem is weak.
Avenues I've explored:

The modulus is factorable
The encrypted text is easily decryptable

But I'm just not seeing the answer. Can I have some help?


texts: Is there a way to prove knowledge of a limited resource like a phone number just to the people who already know about it?

texts:
For instance, let's say Bob's phone number is X and Alice has somehow identified that Bob's phone number is X.
Now she doesn't have a direct way to contact Bob, so she wants to post in a public forum with proof that she knows Bob's phone number.
This almost seems impossible since phone numbers are a very limited space and solutions like hashing would not be effective. One possible solution is to have an extremely slow hash (let's say one that takes hour(s) to compute), but this has issues both practically (Bob likely won't bother checking) and theoretically (It's still not difficult for a determined person to find out).
Are there any cryptographic solutions to this, even if they are imperfect? We can assume that there is a period of time after which this information can be made public.
Note: This sounds like something like "proof of knowledge" to me, but since that's not a tag, I'm tagging it as zero-knowledge-proof. Please let me know if this is incorrect.
This was inspired by this but I'm hoping we can get more theoretical answers that answer this specific question.


texts: I thought encryption algorithms (like AES) are used to encrypt texts. So, how are files or folders (containing pictures, videos, etc.) encrypted? What is it that encryption algorithms exactly encrypt?


texts: What would the Internet be like without public-key cryptography?

texts:
The functioning of the Internet as we know it nowadays depends very heavily on public-key cryptography, including several key root systems that depend on its asymmetric properties.

But what would it be like to not have that tool? Could a sufficiently advanced but less convenient private-key cryptography system still make up for what public-key cryptography does? Would the Internet still be able to function in roughly the way it currently does?


texts:
I was wondering someting :
Doing a XOR with a fixed length key on txt files is not secure.
Basically :  My key is "abc"
         abc|abc|abc|abc|abc|abc
         Thi s i s s ome dat a

THIS, is not safe.
BUT ! I was asking myself : why can't I just make a self generating infinite length key ? The user gives me a password, and I just hasing it to create a key, and whenever the length of the file is bigger then the key, i just re-hash the key itself to create a new one !
Example : Let's take a 192 Bytes message. Use SHA256 hashing algo create 48 Bytes keys.

This solution resolve the ciphere vineger problem.
SO MY QUESTION ( here it is :p ) :
Is this one safe ?
Thanks ! ~Amperclock


texts: If and why is it bad to scrypt a bcrypted password?

texts:
This has been already brought up on security SE, but very sadly, this particular interesting issue got watered down in a far broader question.

If and why is it bad to use the following hashing algorithm to store passwords?

scrypt(bcrypt(password + salt))

The standard argument to questions like this, reiterated over and over on Cryptography.SE, Security.SE, and many other places in the Internet (1, 2, 3, 4, 5, 6, 7, 8 and many others) is as follows:

  You should use well-known, well-tested, public algorithms prepared by the world's best of the best cryptographers ONLY. You should use well-known, well-tested, public implementations of these algorithms ONLY. Home-brewing ANYTHING, however slight, is a Bad Thing ™, because frankly you are not competent enough to do this.

By this line of argumentation it is wrong to use scrypt(bcrypt(password + salt)) only because there is no such primitive provided out-of-the box by Oh Esteemed Experts. They only provide scrypt itself, or bcrypt itself, so we must stick to either; but joining them is a home-brew addition, so doing this is Evil.

This kind of argumentation besides, what are the particular evils of scrypting a bcrypted password? In this particular case, there are interesting arguments FOR doing this. Let me present a few arguments and counter-arguments

The primary argument for using this hash:

  Additionally, if someone figures out a more intelligent way to guess the original plaintext for one hashing algorithm, they probably won't simultaneously have a faster way for the other algorithm. Say people legitimately thought ROT13 was a good hashing mechanism. If I used ROT13(bcrypt(x)), wouldn't I still be better off when people 'cracked' ROT13?

Counter-argument, which I don't find very convincing:

  Another potential issue with combining bcrypt and scrypt like this is that there has been very little study into how the two interact. As such, we don't know if there are any weird cases that can cause problems. As a more obvious example, take the one time pad. We compute c=m^k for some message m and some equally long perfectly random key k, and we get perfect security. So let's do it twice, for even more security! That gives us c=m^k^k... oh, wait, that just gives us m. So because we didn't take the time to properly understand how the internals of the system worked, we ended up with a real security vulnerability. Obviously it's more complicated in the case of KDFs, but the same principle applies.

Counter-counter argument that seems to destroy the above one:

  You're doing it wrong. The bcrypt(scrypt(x)) stuff is ok while xor(xor(x,k),k) isn't because an extra bcrypt is something an attacker could do, too.

And also:

  I still don't see why the scrypt(bcrypt(x)) thing could be a problem. If the two interact weirdly, just using bcrypt doesn't make it more secure- an attacker can simply scrypt() what you've bcrypt()'d.

Counter-argument, which I don't find very convincing, because how many lines of code would this be?

  The primary issue is that you have to introduce more code to parse the encoded output of scrypt / bcrypt so that the salt and round count can be stored separately.

The only counter-argument that seems valid to my laymen eye, but still fails to invalidate the primary argument for this cipher:

  Using scrypt and bcrypt together has the problem that they both take time to run - you'll probably wind up halving the number of rounds on each to compensate for having to run both, which is more likely to be insecure than a "full" scrypt on top of a "full" bcrypt is.

So for the last time: Is it bad or good to do scrypt(bcrypt(password+salt)) and why exactly?


texts: Is it possible to decrypt this message with partially known data?

texts:
The following highlighted text must contains 547a5e0e008be33730158d63ce844e67 data. I don't know about encryption method and key.

Is it possible to decrypt it?

Or just give me some idea about encryption method that they use to encrypt it.


texts: How to construct the blind factors in practice?

texts:
I'm Implementing a protocol that uses masking techniques (or blinding factors), so we can mask a value $y_0$ as $m_0=y_0 \cdot r_0$ where $y_0 \in \mathbb{Z}_p$ and $r_0 \stackrel {R}\leftarrow \mathbb{Z}_p$ (let $_p$ be a prime number) and the $m_0$ can be unmasked as $m_0\cdot r^{-1}_0=y_0$ at any time.

My Question is: what function do I need to use to get $r_0$ (or $r_i$ in general)?

Can I Use Pseudo-random generators (PRG)? Why?


texts: is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?

texts:
After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree,  An efficient protocol for authenticated key agreement, I understood that all these approaches enforce implicit authentication --Alice is sure that only a specifically identified Bob can derive the same key -- explicit authentication is enforced by they use of a trusted server or digital certificates, which are parts of Public key infrastructures (PKIs).
As an alternative to PKIs, I learned that PAKE (password-authenticated key exchange) can be used. However, those schemes usually assume parties involved in the key-agreement already have a pre-shared password, or one party has the password and the other has enough information to recognize the password [Do all pake assume that all parties already have a password?]
However, I want to achieve a key-agreement without relying on PKIs or pre-shared secrets.
Hence is there a way to perform a key-agreement resistant to a man in the middle attack without the use of PKIs or pre-shared secret?


texts: Would a HMAC digest make sense in an RSA / ECDSA signature?

texts:
When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was not affected. In fact, unless I missed something, HMAC-MD5 is technically still secure.

In the context of signing data at rest using RSA or ECDSA, where performance is not the critical factor, would it make sense to use HMAC-SHA256 instead of plain SHA256 for the digest function in order to avoid a similar situation in future?

Something like this: $s = k \mathbin\Vert S(k \mathbin\Vert H(m,k))$ where $S$ is some asymmetric signing operation such as RSA or ECDSA, $k$ is a randomly generated key, $H$ is HMAC-SHA256.


texts: Securely computing functions over source code

texts:
I have been studying multi-party computation and want to start implementing it. I think it would be interesting to do this where one of the inputs (say party 1) is some source code, say a .py file.

If for example I wanted to securely compute the number of lines of code this file had, how would I go about it? The functionality would look something like $$f(code.py, \_) = (\_, \text{number of lines in code.py})$$ where $\_$ represents the empty string.

I think MPC is up to this task but are there any better ways this functionality could be realised?

Also, any pointers to packages that would be good to implement this in would be nice also.


texts: Are the Common modulus attack, Common Factor Attack, and Wiener's attack different?

texts:
Is there a difference between:

Common modulus attack
Common Factor attack
Wiener's attack

or are these just a different name for the same attack?


texts: Hide a weakness in ECC by choosing the prime or one of the curve coefficients

texts:
Suppose you are given a value $c$.  Can you find a prime $p$ and an integer $b$ such that the elliptic curve

$$E: y^2 \equiv x^3 -3x + b \pmod p$$

is cryptographically weak?  You need to choose $p,b$ so that all of the following restrictions also hold:

$p$ has some desired size (say, 256 bits)
$1 < b < p$ and $1 < c < p$
$b^2 c \equiv -27 \pmod p$
the order $n$ of the curve is a prime number

By cryptographically weak, I mean that the discrete log problem is easy on the curve (or that some other standard cryptographic assumption is false).

Is there any known way to do this?  Is there a procedure to find $p,b$ (as a function of $c$) satisfying all these conditions, where the procedure succeeds with non-negligible probability (say, probability $\ge 1/10^{12}$)?  Or, is there a proof or heuristic argument that doing so is likely to be impossible?

Basically, this amounts to asking whether there's any way to ensure that the resulting elliptic curve has a non-trivial probability of being cryptographically weak, given ability to choose some (but not all) of the curve parameters.

(For instance, maybe you could choose $b$ however you like, factor $b^2c+27$, select an appropriate divisor as $p$, and hope that the resulting curve is vulnerable to some particular attack; or who knows what.  Your choice of strategy.)

Motivation: If this problem has a solution, then it means that the NSA could have hidden a backdoor in the NIST-recommended elliptic curves (specifically, the P-xxx curves).  Thus, it has implications for how much trust we can put in the those standard curves.


texts:
I'd like to include an authenticated timestamp in my messages.  I'm wondering if I can save a little space by putting the timestamp in the nonce.

Concrete example:

Let's say I'm using XChaCha20-Poly1305 with a shared secret key.
I generate the nonce/IV by concatenating an 8-byte timestamp and a 16-byte random value.
I send concat(nonce, ciphertext, auth_tag)
The receiver runs the decrypt+verify procedure and it succeeds.

Can the receiver then extract the timestamp part of the nonce and trust that it is authentic?

With a more "traditional" composition, like AES-CBC-then-HMAC, the nonce is obviously authenticated.  Is that still the case for these newer AEADs?


texts: Shamir Secret Sharing and Diffie-Hellman procedure

texts:
Alice needs to share an already generated numeric secret $s$ with Bob and she doe not want the world to see it. The problem is that she has never contacted Bob before.

I thought Alice and Bob could generate a line à la Shamir Secret Sharing so that $$q(x)=s+\alpha x.$$

To agree with $\alpha$ Alice and Bob could implement the original Diffie-Hellman protocol for key exchange. Finally Alice could just send $q(1)$ to Bob and he could compute $s$ as $$q(1)-\alpha*1=q(1)-\alpha=s.$$

Theoretically even if Eve could see both the values sent in the clear by the Diffie-Hellman protocol and the value $q(1)$, Eve could not compute $s$ from them.

Is this method already used used somewhere? Do you know some literature which prove this to be secure?


texts: Transforming Gaussian random $[0,1] $ numbers to uniform $[0,255] $

texts:
I am not exactly sure if this is for math stackexchange or crypto:

A TRNG outputs numbers in $[0,1]$ in a Gaussian distribution. I would like to convert them into uniform random bytes ($[0,255] $) to perform byte operations. What is s cryptographically secure method of doing this?

Here is an example distribution from my generator before normalized between $[0,1]$:

Edit:

Output from my original methodology: Normalize values to to be within $[0,1]$, remove first and second decimal place via $x*100-floor(x*100)$, then put between value discrete values in $[0,255]$ via $floor(x*255)$. The resulting distribution is as follows:


texts: How to determine the correct padding to use for rsa signing?

texts:
Before today I didn't know the difference between RSA padding for encryption and for signing, I think this answer describes it pretty succinctly, however, I don't know if there is an optimal padding to use or if there are any deficiencies in current paddings I should be wary of (for example, PKCS for RSA encryption).

I came across RSA-FDH and RSASSA-PSS, but don't know if there are any other paddings available for RSA signing or if the ones I mentioned have any known weaknesses/deficiencies.


texts: How Diffie-Hellman authentication works?

texts:
There are a lot of good videos on a simple Diffie-Hellman in the internet but unfortunately that is susceptible to the MITM attack. I understand how with DH  the two parties are able to calculate a shared secret (shared private key?)

So now i am trying to understand the authenticated version, which should be safe from the MITM attack. Unfortunately i have not found a simple explanation to how it should work.

As I understand it requires the use of some certificates (pre existing keys?). Having some pre existing keys does not make a lot of sense to me, since the whole purpose of DH is key exchange.
And vice versa:
If i can just generate a private and public key for both parties and transfer the public keys than why do i need DH at all?
Is an entirely secure method available to establish a connection between the two parties who don't have some preexisting knowledge of each other (by using authenticated DH)? If so then how does the authentication scheme work?


texts: Encryption scheme that allows compare ciphertexts based on the clear text

texts:
I would like to compare ciphertext based on the order assumed on the message space.

So, do you know if there exists some encryption scheme with the follow property:

Let $c_0 = E(m_0)$ and $c_1 = E(m_1)$ for all $m_0$ and $m_1$ in the message space.
So,

$$c_0 \leq_C c_1 \Leftrightarrow m_0 \leq m_1$$

Note that I used $\leq_C$ instead of $\leq$, because the partial order relation on the ciphertext space may be different from the partial order of the message space.

For example, if I have $c_0$ and $c_1$ such that $c_0 = E(-3)$ and $c_1 = E(103)$, I would like to know that $c_0 \leq_C c_1$ without knowing the clear texts $-3$ and $103$.

If something is unclear, just let me know.

Thank you.


texts: How to compute $m$ value from RSA if $phi(n)$ is not relative prime with the $e$?

texts:
Here is some information we got :
We know the value of $n$, with size $1043$.
We know the value of $p$ (size $20$) and $q$ (size $1023$) as the factors.
$e = 65537.$
$\varphi(n)$ = $(q-1)(p-1)$
When I calculated $\gcd$ and $\text{modinv}$, I got :
$\gcd(e,\varphi(n)) = 65537$
$modinv(e,\varphi(n)) = 1 $
So we can tell that they are not relatively prime.
So, how to compute the d, and get the value of m?
I'm not that good with math, so I cant understanding well the theory.
so can anyone please make an example implementation or write a clear formula?


texts: Strict Avalanche Criterion and Avalanche criterion?

texts: What is the difference between Strict Avalanche Criterion(SAC) and Avalanche criterion?


texts: Elliptic Curve Isogenies, Frobenius endomorphism relation to characteristic equation

texts:
In Schoof's 1995 paper, Counting points on elliptic curves over finite fields, page 236, Proposition 6.1(i) states:

Let $\mathbb{E}$ be an elliptic curve over $\mathbb{F}_p$. Suppose that its $j$-invariant is not supersingular and that $j\neq 0 $ or $1728$.
Then the modular polynomial $\Phi_l(j,T)$ has a zero  $\tilde{\jmath} \in \mathbb{F}_{p^r}$ if and only if the kernel $C$ of the corresponding isogeny $E \mapsto E/C$ is a one-dimensional eigenspace of $\phi^r_p$ in $E[l]$, with $\phi_p$ the Frobenius endomorphism of $E$.

From the proof:

If $\Phi_l(j,\tilde{\jmath} )=0$, then there exists a cyclic subgroup $C$ of $E[l]$ such that the $j$ invariant of $E/C$ is equal to $\tilde{\jmath}\in \mathbb{F}_{p^r} $. Let $E^1$ be an elliptic curve over $\mathbb{F}_{p^r}$ with $j$ invariant equal to $\tilde{\jmath}$. Let $E/C \mapsto E^1$ be an $\bar{\mathbb{F}}_p$ isomorphism and let $f: E \mapsto E/C \mapsto E^1$ be the composite isogeny. It has kernel $C$.

I can see $f$ is defined over $\mathbb{F}_{p^r}$, so this implies existence of an isogeny $E \mapsto E^1$ over $\mathbb{F}_{p^r}$.

How does this imply that $C$ is an eigenspace of $\phi^r_p$?

How does the statement "The Frobenius endomorphism over $\mathbb{F}_{p^r}$ satisfies the same characteristic equation" imply that $C$ is an eigenspace of $\phi^r_p$?

Please help me to understand this.


texts: Get secret_value from multiple hashes md5(known_value_n + secret_value)

texts: The attacker knows multiple hashes like md5(known_value_n + secret_value), for multiple known values. Does it help him to discover secret_value better then just single md5(known_value + secret_value)? secret_value is long enough, 20-30 characters.


texts: Could this be a valid variation of the Schnorr protocol?

texts:
The Schnorr protocol is a 3-steps proof of knowledge of a discrete logarithm, whose interactive version works as follows.

Let $p$ and $q$ be two public primes, such that $q \mid (p-1)$, and let $G$ be  a cyclic subgroup of $\mathbb Z^\times_p$ of order $q$ (i.e. a Schnorr group) with generator $g$. The prover $P$ wants to prove knowledge of $x=\log_g(y)$ to a verifier $V$, by the following steps:

1) $P$ commits himself to randomness $r \in \mathbb Z_q$, and sends $t=g^r \bmod p$ to $V$.

2) $V$ replies to $P$ with a challenge $c$ chosen at random from $\mathbb Z_q$.

3) After receiving $c$, the prover $P$ sends the response $s=r+cx \bmod q$ to $V$.

4) Finally, the verifier accepts if $g^s \equiv t y^c \bmod p$.

My question is:

What is the exact reason why the response $s$ of the prover in step 3 is that one, and not another one? For example, couldn't it also work if the response were, for example, $s=r+c+x$ or $s=rc+x$, and then the verifier had to check if $g^s \equiv t g^c y$ or $g^s \equiv t^c y$, respectively?


texts: Why isn't a range proof calculated using size?

texts: For example a Pedersen commitment for an elliptic curve of maximum $2^{64}$, requires every number between $0 \to 2^{64}$ to be checked. Why do range proofs, in the case of a Pedersen commitment, not just work in the power of 2 instead of the numbers itself?


texts: Does frequent key change weaken encryption?

texts:
Following scenario:
We are using OTR for communication between Alice and Bob which means after each successfull message exchange a re-keying happens for both parties leading to new AES-keys for the encryption and MAC generation.

Lets say Alice and Bob exchange 1000 message-pairs which leads to 1000 re-keying occurrences.

An attacker Mallory is able to record all messages between Alice and Bob.

Mallory brute-forces her way through the encryption by choosing one possible encryption key and trying it for every single one of the 1000 message-pairs.
Doesn't this lead to giving Mallory a better chance of cracking the code of one message-pair because she can use a single key and try this key for 1000 message-pairs (thus weakening the encryption)?

A little further thinking:
Using a single encryption key over a long period might increase the possibility of exposure of the encryption key. So re-keying is an effective means against that. But comming from the above example, re-keying too often might also lead to a weak encryption.
Is there a trade-off between the two of them?

I am not a crypto-analyst or any expert and I am well aware that my language propably doesn't fit into the crypto world by means of being to broad in some statements or not specific enough. I have no problem in understanding probility theory if an answer needs to include it, although I prefer pragmatism over theory.


texts: How to make the range of modulo $p$ to $[-\frac{p}{2};\frac{p}{2}]$?

texts:
I am using NTL (A Library for doing Number Theory) to implement a FHE (Fully Homomorphic Encryption) scheme. In general, the range of modulo p is  $[-\frac{p}{2};\frac{p}{2}]$ in FHE scheme. However, the range of modulo p is  $[-p,p]$ in NTL.

If I want to use the range that is $[-\frac{p}{2};\frac{p}{2}]$, how I can do it ?