texts: How to renew keys for a statically-encrypted database

texts:
Preamble

Before I ask this question, please accept that I fully understand that 'rolling your own' is never a good idea, and that I am a relative n00b. The only reason I am doing this the way I am is that there are major constraints - I have no high-level crypto libraries (like, say, NaCl) available, and this will run on a mainframe. The crypto API I must use makes initialisation vectors my responsibility, but not keys -- I simply present a key token, and encryption and decryption are performed elsewhere in a 'leakproof' part of the system. So please don't criticise me for my environment, and please recognise that 'don't' do anything' is not an option.

Environment

A legacy database which will contain credit card numbers (PANs)
The PANs will be encrypted to protect against unauthorised online access by (eg) sysadmins and offline access to backups of the DB
A single key will be used for all PANs
Cipher will most likely be AES256 in CBC mode (the API may restrict me to ECB mode, but I'm trying to change that).
Each PAN will be encrypted with a different initialisation vector, which will be stored with the encrypted PAN
PANs are constantly being purged from the system. We can establish a maximum lifetime.
Storage space is limited -- I can pull an extra 16 bytes for the IV, but any more will be hard.
It is not practical to scan and update the database if I want to change the single key -- the DB runs at about 40,000 I/O per second for most of the 24-hour day and the system runs non-stop.

The Challenge

Find a way to be able to expire the single key and introduce a new one

The Proposal

Here's my current thinking, which I recognise has weak points.

Cryptographic keys are generated, and stored encrypted under a master key, in a completely separate component of the system, with its own access rules. Keys are identified for use by an alphanumeric key token.

At any time, I have two available keys, called 'A' and 'B'

For encryption:

Obtain a 16-byte cryptographically sound random number
Set the last bit on, signifying key A
Call the encryption API with the resulting IV, and key token A
Store the IV and the encrypted data

For decryption:

Test the last bit of the stored IV
If the bit is 1, select key Token A; if not, select key Token B
Call the decryption API with the IV and the selected key token

Now, when I need to expire the key, I simply need to change the encryption to set the last IV bit off and use key B. Decryption does not change.

Around six months later, when I have no more A IVs left in the system, I can swap again.

Each time I swap, I can generate a new key for encryption from this point on.

My questions are these:

If I cannot obtain a cryptographically sound random IV, just how bad would it be to use a high-resolution clock? The clock I have in mind is high-resolution (10 nanoseconds or better, and guaranteed not to repeat, as I won't be doing more than about 10k encryptions per second). I understand that the IV should not be predictable, but just how (precisely) predictable is such a clock?
I have to cater for the possibility that a PAN may get left over from a previous key which is no longer available; for example, a PAN which was encrypted with an earlier A key, but which fails to decrypt with the current A key. Assuming I don't want to increase the number of bits I 'steal' from the IV, is there a good, simple way to verify that the decryption is with correct key. I'd prefer to avoid the extra overhead of something more complex, like, say, an HMAC. Suggestions?
Any other comments or criticisms (within my constraints)?


texts: How does hill cipher key exchange takes place?

texts: I am giving a presentation in my college where hill cipher is a part of the presentation. I just wanted to know, how is the hill cipher key matrix is exchanged securely in order to decrypt the message?


texts:
the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows:

  Hash the 32-byte private key using SHA-512, storing the digest in
     a 64-octet large buffer, denoted h.  Only the lower 32 bytes are
     used for generating the public key.
  Prune the buffer: The lowest three bits of the first octet are
     cleared, the highest bit of the last octet is cleared, and the
     second highest bit of the last octet is set.

I am not sure I understand what the seconde step accomplishes.. More concretely, if one were to replace SHA-512 by another hash function, let say blake2 for efficiency is the pruning(encoding) still necessary? and why? are there security relevant properties related to that?

Thanks!


texts:
Assume Alice and Bob both separately come into possession of the same randomly generated 256 bit secret key.

Alice has Bob's public ECDSA key.

Alice wants to verify that Bob has possession of the 256 bit secret key.

Bob signs the 256 bit secret key and then stores this signature on a server.

Alice then verifies that Bob has possession of the secret key by verifying this signature.

Is it safe to store this signature on a server -- as in, does this signature reveal anything about the secret key to the server?

(Edited to better explain the goal)


texts:
Is there a way of maintaining malleability in a homomorphic encryption system while making it infeasible to perform chosen ciphertext attacks?

I have been reading about homomorphic encryption and malleable cryptosystems lately and have found it fascinating. I still have a lot of reading to do, however, I came across a statement in my reading that suggested malleability is inherently counter to security against chosen ciphertext attacks.

While I read up more about this relationship, I am curious to learn if there a way to maintain malleability while making a chosen ciphertext attack computationally infeasible? Why or why not?


texts: Can we quantify strength of encryption scheme ?

texts:
Was wondering if we have any (or can we come up with) "units" for strength of encryption like in Physics. Most of our comparative analysis of encryption schemes are based on number of S boxes or number of rounds or proofs in a particular model or some times even performance of algorithms.

Is it possible at all for quantifying the security of encryption schemes objectively ? irrespective of the scheme's internal workings ?  Say AES provides "X" units of Strength (under a particular attack, say IND-CCA2) Similar to how we quantify in Physics for temperature, pressure, weights etc.

I would imagine such metric should consider the encryption algorithm as black box


texts: How to compute initial buffer of SHA-512?

texts:
I'm reading Cryptography And Network Security of William Stallings.

In the SHA-512 section it is said that there is a 512-bit buffer is used to hold the intermediate and final result and every 64-bit obtained somehow (obtained by taking the first sixty-four bits of the fractional parts of the
square roots of the first eight prime numbers).

However, if I convert the first of the binary digits to base 10 I get:

a = 7640891576956012808

I searched the square root of 2 in high precision( https://apod.nasa.gov/htmltest/gifcity/sqrt2.1mil ) and did not match. Why?


texts: OpenSSL cipher suite support / key requirement for ecdhe_ecdsa_with_aes128_cbc_sha256

texts:
I hope this is the right place for that kind of question.
So actually I am trying to test the TLS implementation of some industrial device. I have to write my own TLS implementation for this, for which I am using the OpenSSL library and I also do testing via console commands, the version is 1.1.1f.
The device I test only supports the cipher suite tls_ecdhe_ecdsa_with_aes128_cbc_sha256 (0xc023).
As a preparation I want to test an OpenSSL client vs. an OpenSSL server and I am using the follwoing commands to set up both (the certificate has been generated before with OpenSSL as well):
openssl.exe s_server -accept 2 -cipher ECDHE-ECDSA-AES128-SHA256 -key cs_key.pem -cert cs_cert.pem -msg -state -debug -tlsextdebug -bugs

and
openssl.exe s_client -connect localhost:2 -tls1_2 -cipher ECDHE-ECDSA-AES128-SHA256 -msg -state -debug -tlsextdebug -bugs

The server aborts the TLS handshake with an alert message and the console output
11096:error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:ssl\statem\statem_srvr.c:2284:
shutting down SSL

This also happens when I use my real device as client.
My questions are:

Why does the server say there was no shared cipher when I explicitely set up the server to support only that one cipher suite? I suppose it is supported by the OpenSSL implementation as otherwise the s_server call would fail.
How can I make this work?

Addendum:
If I support all the ECDHE-ECDSA ciphers in the client hello by using
openssl.exe s_client -connect localhost:2 -tls1_2 -cipher ECDHE+ECDSA -msg -state -debug -tlsextdebug

the handshake fails in the same way.
Solution:
In the meantime i stumbled over this and found out this issue is a matter of proper key generation. By applying the proposed solution in the linked thread I was able to get my example working.


texts: Why is the padded RSA construction given in the picture not CCA secure？


texts: Ciphertext indistinguishability under a noisy channel w/ error correction

texts:
The objective is to broadcast information over a noisy digital channel (corruption rate of say, 10-20 %, where bits flip). Assume the broadcasting software is public and there is no possibility of embedding secret information so a public key cryptosystem must be used. Let the adversary have full knowledge of the software but no control or knowledge of a broadcasting node.

Traditional methods to do this such as a "secretbox" or some other DH mechanism will give you a bit-string which is indistinguishabile from random but that string will be subject to corruption if transmitted naked.

So you have to use error correction coding. How to do this so that an adversary listening to the channel cannot detect the presence of the communication by detecting error correction codes? An adversary can do this by continually attempting to decode "noise" over the channel. Decoding tends to fail on random strings.

Note that this only has to be done for the DH part, afterwards an unauthenticated stream cipher can solve this.

From my search it seems that perhaps only Goppa codes in a construction similar to McEliece's Public key cryptosystem can help, but I do not know how to proceed.


texts: What is the most efficient 1-out-of-N Oblivious Transfer construction described in current literature?

texts:
I have been studying Oblivious Transfer for my bachelor's thesis and have been surprised at the number of variations of OT.
From what I've read so far, the constructions proposed by Naor and Pinkas in "Efficient Oblivious Transfer Protocols" and "Oblivious Transfer and Polynomial Evaluation", as well as Tung Chou and Claudio Orlandi's construction proposed in "The Simplest Protocol for Oblivious Transfer", but I am not sure.
I will continue to research this topic and any feedback is appreciated.


texts: Any point in waiting for the SHA-3 standard?

texts:
The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter?

That is, can we just assume it's going to be as specified by the submitters (specifically for SHA-3-256 it's the Keccak-f-1600 permutation, in a sponge construction with r=1088 and c=512 and the pad10*1 rule)? Or might NIST wind up tweaking something, meaning we might have to re-hash a bunch of things if we made this assumption -- which, depending on application, could be inconvenient.

(EDIT: of course, waiting is also inconvenient, thus there is a risk-benefit question here -- again, depending on application.)


texts: What is the DK function when generating an AES key for Kerberos 5?

texts:
I'm trying to understand RFC3962. So far I understood everything, except for the last part: generating the derived key from the PBKDF2 output.

  To generate an encryption key from a pass phrase and salt string, we
     use the PBKDF2 function from PKCS #5 v2.0 ([PKCS5]), with parameters
     indicated below, to generate an intermediate key (of the same length
     as the desired final key), which is then passed into the DK function
     with the 8-octet ASCII string "kerberos" as is done for des3-cbc-
     hmac-sha1-kd in [KCRYPTO].  (In [KCRYPTO] terms, the PBKDF2 function
     produces a "random octet string", hence the application of the
     random-to-key function even though it's effectively a simple identity
     operation.)  The resulting key is the user's long-term key for use
     with the encryption algorithm in question.

tkey = random2key(PBKDF2(passphrase, salt, iter_count, keylength))
key = DK(tkey, "kerberos")

I understood that the random2key part means nothing in this context, but I don't understand to which function is referenced with DK.


texts: Is using quantum computing to break passwords non-sense?

texts: I understand the concept of 'trying all possibilities at once' but can anyone explain this with respect to the fact that my PC only accepts one password at a time? There's no input field that accepts all these possibilities and the same goes for the passphrase field in encryption... Why should we be afraid of quantum computers while being on conventional computer systems?


texts: EC threshold private key's multiplicative inverse and derived-key sharing

texts:
I have two devices, and each has a private key xPriv-i.   Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub.  As a simplification, please assume this is all done securely and correctly.

I use ECIES to encrypt an archival file: I compute a shared secret between the ephemeral key e and xPub  == e * xPub.   Then I use the hash of that as the input to a symmetric encryption algo.   The file's public key ePub is placed in the file.   Again, this mechanism works today and is done correctly.

My friend Bob also has two devices.   His combined key is zPub

I would like to give my friend Bob access to my file, without decrypting it or reducing the security beyond trust in Bob.

The trivial solution is for each device to compute xPriv-i and encrypt it for Bob's zPub.   These can be safely sent to Bob and he can archive them, without decrypting them.

What I need, eventually, is to compute a new value that ePub-prime ... such that if Bob computes ePub-prime * zPriv ... it will equal to ePub * xPriv.  In other words... i need a new ePubBob

So, instead I encrypt and send each ePub * xPriv-i individually to each of Bob's devices.   Each device can then compute ePub * xPriv-i * modular-multiplicative-inverse(zPriv-i).  Then the fragments can be safely linearly combined into ePub * xPriv/zPriv by any device ... and stuck in the original file as a share-key.

I would like the linear combination to work with M of N devices, so I use Lagrange interpolation similar to Shamir's secret sharing algorithm to perform the combinations.   However, there's a problem, the "mminverse(zPriv-i) fragments" can't be recombined....

If I simply recombine them, I wind up with ePub * xPriv * mminverse(zPriv-i1) * mminverse(zPriv-i2) instead of ePub * xPriv * mminverse(zPriv).   That's because the mminverse's can't be linearly recombined ... they are essentially "in the denominator"... and the polynomial won't work.

Either:

The devices need to securely and in some distributed manner compute the EC private key's modular
inverse... and then appropriately fragment it along the same
polynomial.  If so, how can this be done?
There's some other thing I'm missing... what is it?

(Please ask me if there's more clarifying information you need)

Actually it looks like this answer may solve my problem:

Shamir's Secret Sharing of modular inverse


texts: Is it possible to have perfectly secure public-key cryptography with oracles?

texts:
It is a basic theorem of cryptography that it is impossible to have a perfectly secure public-key encryption scheme.  That’s because the adversary can search through all possible private keys.
But I’m wondering if it can be made possible using oracles.  My question is, do there exist sets of natural numbers $A$ and $B$ such that if Alice has access to an oracle for $A$ and Bob has access to an oracle for $B$, then these oracles can be used as private keys for a perfectly secure public-key encryption scheme?
I’m thinking that perfect security may be possible in this setting since there are uncountably many sets for the adversary to search through.


texts: Hashing large messages, how does it work?

texts: Is the message divided into chunks, each chunk hashed separately, or something else?


texts: Can we modify any hash function like SHA-1 or MD5 to perform multiple iterations at once to gain calculation speed?

texts:
Is it mathematically possible to adapt a given hash function (f.e. SHA-1 or MD5) so it performs a known number of iterations at once?

Concrete example would be:

data = SHA1_10000(data)

instead of:

for (i = 0; i < 10000; i++) data = SHA1(data)

while resulting in the same output, but being 10000 times faster.


texts:
I am trying to implement the D-XOR and S-XOR count in python but despite reading multiple articles on how to perform the calculation I have failed to understand the process used. I would appreciate it if someone could demonstrate the process using an example. Below I have included some of the references that detail the process.
GF(256)
MDS=[[2, 3, 1, 1],
    [1, 2, 3, 1],
    [1, 1, 2, 3],
    [3, 1, 1, 2]]

Generator Coefficients=100011011
Generator Polynomial = x^8 + x^4 + x^3 + x^1 + 1

references:

https://tosc.iacr.org/index.php/ToSC/article/view/806/760
https://eprint.iacr.org/2016/422.pdf
https://eprint.iacr.org/2016/422.pdf
https://ieeexplore.ieee.org/document/8409223
https://eprint.iacr.org/2017/1084.pdf
https://eprint.iacr.org/2019/1090.pdf


texts: Debug client certificate authentication on path with openssl

texts:
Website on https://example.com/login will request client certificate authentication.

If it was directly on https://example.com then using openssl s_client example.com:443 will show client certificate names.

How to get client certificate names on subpath with openssl commandline?
Checking with browser and Wireshark I see that there is GET query made in http-over-tls and then server asks Hello Request


texts: Why are LFSRs represented as polynomials?

texts:
Disclaimer: I am neither an electronics engineer nor am I a mathematician.
I understand what an LFSR is. I can derive the periodic sequence if an LFSR is described by it's taps.
My question is - why are LFSRs represented as polynomials?
What is the advantage of representing taps as x^n? What is the x? What is the constant at the end?
I see a very similar question - Why is the polynomial of an LFSR called so?
But I am still asking my question because I don't understand the answers. I don't understand what a delay operator is. So the answer is not useful to me.
Also that answer doesn't really cover the advantage of representing it as a polynomial.


texts: Does EAX use the same keys for encryption and authentication?

texts:
I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the described scheme  the same input key $K$ appears used on all
   OMAC (authentication) & CTR functions. Did I miss something important
   as it would be surprising that the requirement of distinct
   authentication/encryption keys is not respected with EAX ?

I also have two other questions, but of less importance:

When comparing with GCM, I noted that C/AD length parameters are not
taken into account in MAC calculation. Does it have real importance
for security (message extension attack)?
Initial counter ICB for CTR function results from one OMAC operation;
so as ICB LSBits are not set to 0 value, it means to    handle
incrementation of a 128 bits word at each block cipher call by    CTR
function?


texts: How can JWE support an integrity check given that it uses a public key to encrypt the message?

texts:
As far as I know JWE (JSON Web Encryption) supports both integrity and confidentiality. I agree about the confedintiality because only the recepient with a private key can decrypt a message. What about the integrity? Given that the Content encryption key is encrypted using a public key, anyone (who knows the public key) can generate JWE and receipent won’t know for sure whether its coming from the specific sender.
Can a sender somehow sign the JWE using its own private key (note that this another key pair) so that the recipient can verify the integrity?


texts: Question on proof of coin-tossing in "how to simulate it"

texts:
I am reading Professor Lindell's "How To Simulate It - A Tutorial on the Simulation Proof Technique" paper, which is very enlightening.

I am trying to follow through the proof of the security of Blum's coin-tossing protocol and have some questions: in the end of page 41 it says ": Let $b_1$ be the value committed in the commitment $c$ sent by $A$ (since $A$ is deterministic and this is the first message, this is a fixed value)."

I don't understand why we can assume $A$ is deterministic?
In general, should the security proof work for probabilistic adversaries?


texts: How can AES-like block cipher without non-linear component be broken?


texts: How does Permutation and Substitution work?

texts:
I'm a little confused on how permutation and substitution works, I've been reading about S-DES and how it goes through P-Boxes and S-Boxes but what goes on inside P or S in the algorithm?

Are these p and B boxes generated from the key?

If for example I have some plaintext of 11010011011110100001 and want to permute or substitute it, what process would I follow? - Preferably by hand so I can understand it...


texts: Partial proof of work: an hash function that validates parts of input, insensitive to the rest

texts:
In typical proof of work, there is a one-way hash-function that takes binary inputs and generates an output $h(x,y)$ where $x,y\in\{0,1\}^M$ are binary inputs, so that finding $x$ for a certain $y$ such that $h(x,y)=0$ becomes a complex problem.
Is it possible to design $h(x,y)$, such that it is insensitive to parts of input, say it completely discards parts of input $x$, without revealing those positions? While we can just concatenate the "sensitive" bits, and apply any one-way function, the description of such a hash function would contain and reveal the bit positions. Is there way to achieve this partially sensitive hash, without revealing the sensitive/non-sensitive pattern?


texts: mDP kay agreement protocol where z's are found on the step where the common key is generated?

texts:
Whilst I was studying the mDP protocol I came across into the following step:

  Group Key agreement:
  Each $U_i$ checks whether $z_1 \bigoplus ... \bigoplus z_n = 0$ and whether all signatures $\sigma_i$ are valid and aborts if any of these checks fails. Otherwise, $U_i$ proceeds as follows:
  iteratively for each $j=i,...i+n-1: z'_{j,j+1}:=z'_{j-1,j} \bigoplus z_j $
  ...

But I cannot understand on the notation what does it mean by $z'_{j-1,j}$ where does it find it is the $z_i$ received from the other participants?

The paper is in springler and is titled as;

"Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys (Full Version)" authored by: Abdalla Michel, Chevalier Celine,Manulis Mark,Pointcheval David

an alternative from Pointcheval's web site.


texts: Would calculating the nth prime ruin encryption?

texts: I'm sure there is some proof that the nth prime can be found. But if we knew, would encryption that relies on primes be easy to decrypt?


texts: Why GCM operation mode with AES-128 is recomended and can we use AES-192 and AES-256 with GCM?

texts:
It happens that on the internet I often find that AES encryption should use a 128-bit key only if it is used in conjunction with the GCM mode of operation.

Why only with 128-bit keys?

What happens if I use one of 192 or 256?

Can it be? Why is this recommendation made?


texts: MD2 was a hash function based on swapping bytes in a state array permutation, much like the RC4 stream cipher, whereas MD4 was a novel construction. MD4 replaced MD2 despite the fact that MD4 is more badly broken. Even MD5, an improvement upon MD4, is more badly broken than MD2 is! The best collision attack against MD2 has a time complexity of 263.3 compression function evaluations and a memory requirement of 252 hash values, which is only slightly better than the birthday attack and not significantly different from the collision attack against SHA-1 (263.1 time). It seems to me like people could have saved a lot of trouble by using MD2 until the collision attack became feasible, skipping MD4, MD5, and even SHA-1, but clearly this did not happen. So why was MD2 dropped for MD4 and friends?


texts:
So this is an age-old example of why encrypting images with ECB is a terrible idea, since the underlying pattern of the image remains the same. Referenced from: If you encrypt an image (AES), is it still an image and can you view it?

In this question, the answerer shows that is is easy to reconstruct an image (in the ppm format) with:

# First convert the Tux to PPM with Gimp
# Then take the header apart
head -n 4 Tux.ppm > header.txt
tail -n +5 Tux.ppm > body.bin
# Then encrypt with ECB (experiment with some different keys)
openssl enc -aes-128-ecb -nosalt -pass pass:"ANNA" -in body.bin -out body.ecb.bin
# And finally put the result together and convert to some better format with Gimp
cat header.txt body.ecb.bin > Tux.ecb.ppm

The variation in this particular question is that, 1. I do not know what the header is, and 2. The header is not separated from the image.

To elaborate, let's say that I have a file called Tux.ppm which I encrypt as follows:

admin@ubuntu32:~/Documents$ openssl enc -aes-128-ecb -nosalt -in Tux.ppm -out image.bin
enter aes-128-ecb encryption password:
Verifying - enter aes-128-ecb encryption password:

Though it is not relevant to the question, for the sake of completeness, the encryption password used was foo.

Now, if I know what the header initially looked like, reconstructing the image is simple. Say, if I know that the header for Tux.ppm was:

P6
265 314
255

Then, if I simply create a new file, call it header.txt, add the above content to it, and execute:

cat header.txt image.bin > sampleTux.ppm

Then sampleTux.ppm is still entirely recognizable:

Nevertheless, the illustrate a certain point, if I mess the header up just a little bit (e.g. modify the width to 275 and the height to 324), the image screws up beyond recognition.

Say that I've now been given a file called image2.bin. I know that this image was initially a PPM image which was encrypted like above (i.e. it was encrypted with its header). I know that it is a P6 type image which uses the 255 color-encoding format. What I don't know is the width and the height of the initial image, so I cannot construct a new header for it.

How can I create such an "ECB Pengiun" for image2.bin? How can I get information about its initial width and height without guessing it (if that is at all possible)? As illustrated above, that width and height has to be quite exact, otherwise the image completely distorted.

EDIT: In the interest of making better guesses. Assuming that the image not compressed and was created from a standard A-series (A4, A5, etc.) paper, I know that is has a ratio of length-in-millimeters = sqrt(2) * height-in-millimeters. Furthermore, it has a possible DPI of 72, 150, 300 or 600... which still leaves a lot of possibilities.

Maybe I could narrow down the possibilities further if I knew the amount of pixels in the initial file? Could I just get this information from the size of image2.bin or would I have to do something infeasible such as reverse-engineer the process which AES encrypted the file in the first place?


texts: Summary of definitions of cryptographic variables and operands

texts: I have recently developed a fascination for cryptography since I looked at some of the complicated questions on this Stack Exchange website. I'm a good portion through Crypto 101, but it's getting more and more inconvenient to have to look up what each operand and variable does or means (respectively). Is there any good summary or Cheat-Sheet that defines rather basically common things like E: Encryption Function or ⊕: XOR? I understand this is a very novice question, but I have to break out of being a beginner somehow. Any help is appreciated!


texts: Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation?

texts:
We are in the processing to understand if our software applications is FIPS 140-2 compliant or not. Currently in our application, we are using our own implementation of AES algorithm. AES is a FIPS 140-2 compliant algorithm.

The question would be whether this would render our app not FIPS 140-2 compliant since we are not using FIPS validated library (Advanced Encryption Standard Algorithm Validation List) even though we are using a FIPS compliant cryptographical algorithm.

Again, we are not try to certify our application for FIPS 140-2, rather we just want to make sure that we are FIPS 140-2 compliant.


texts:
When I connect to a secure sever that has is equipped with SSL certificate.

Logically, the first step is the handshake to discuss the cipher suites etc.

However, the very first time my web browser does a DNS request and comes up with the location of the site, and my browser connects to the website even before starting the handshake, is this step secure (encrypted by the public key of the websites web server by getting its public key from the built in keys in the browser) or no?

Update:
What I mean here, what happens the very first thing when I open the browser and type https://randomness.org the very first time my broswer (computer) and the server come in to contact. Is this connection secure?


texts: How did LinkedIn "salt" all their passwords?

texts:
First, just to make sure I understand "salting" correctly:
You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much less useful in cracking them.

Assuming my understanding is correct, then I'm having trouble how LinkedIn salted their passwords:

  One of our major initiatives was the transition from a password database system that hashed passwords [...] to a system that both hashed and salted the passwords [...] That transition was completed prior to news of the password theft breaking on Wednesday.

Doesn't salting require you to have the plaintext password? How can you salt a hashed password?


texts:
Is this library secure? Link to github repo
Here's his explanation:

Cypher does not encrypt through allocation based on mapping patterns. Cypher encryption process is completely mathematical and therefore, no pattern can be observed in the encrypted data result. Furthermore, Cypher encryption process result is not persistent, which means that encrypting a particular object with a particular key multiple times is highly unlikely to result in the same data - see demonstration below.

let data = "Cypher AAA", key = "_b7gBiG1oo";

console.log(data.encrypt(key)); // Possible OUTPUT: x%7~(yo~6}103V3I'Iv
console.log(data.encrypt(key)); // Possible OUTPUT: xMeqv|D~~21c1Z'oOw
console.log(data.encrypt(key)); // Possible OUTPUT: tmu~4~v|l^&X"~1I'|

I'm no expert in this field, but based on his description is seems like it can't be reversed or cracked.


texts: Preferred SHA-2 hash algorithm for MGF1 in RSA

texts:
Does it make any difference to the security and efficiency if we use SHA-256 or SHA-512 for the Mask Generation Function MGF1 that generates the masking / padding within the OAEP encryption scheme and the PSS signature scheme?

A lot of implementations also seem to sport support for SHA-224 and SHA-384 for MGF1. Does it make any sense to use these truncated hash functions for something that needs to generate a mask of a particular size (close to the size of the key size for RSA)? Or would that simply add unnecessary overhead?

It seems to me that SHA-512 would be more efficient because of the output size alone. However, most implementations seem to default on SHA-1, SHA-256 or the same hash as used to hash the data for PSS.


texts: Generating DH key with specific bit-length

texts:
In PKCS#3 the generation for DH secrets mandates to generate them with a minimum size if length is specified:

The central authority may optionally select an integer $\ell$,
the private-value length in bits, that satisfies $2^{\ell-1} \le p$.
[…]
An integer $x$, the private value, shall be generated
privately and randomly. This integer shall satisfy $0 < x < p-1$,
unless the central authority specifies a private-value
length $\ell$, in which case the integer shall satisfy
$2^{\ell-1} \le x < 2^\ell$.

(Math formulas re-typeset in LaTeX for readability; see comments.)
The normal way to do this would be generate a random number over the whole range and loop if it does not fit (pseudo Java):
do {
    x = new BigInteger(lSize, random);
} while(2^(lSize-1) > x || x > 2^lSize || x > p-1); // x.bitLength!=lSize || x > p-1

However this results in looping at least half of the time. Would it be safe to set the most significant bit by hand and generate the rest randomly. I think yes - as the bits are supposed to be independent:
do {
    x = new BigInteger(lSize-1, random);
    x = x.setBit(lSize);
} while (x > p-1);

Is this an acceptable optimization?


texts: Why it is not recommended to create your own random generator number?

texts:
I read in a book: mastering bitcoin that one should not create his own random number generator and instead use a cryptographic secure pseudorandom number generator (CSPRNG)

Why is it so? Say I'm writing a simple python code to choose a number between 1 and 2^256 in the following way: create an array with 256 bits, fill up each index with a random number (1 or 0)

Why, or in what way, it is inferior to the CSPRNG? and how is this code is predictable?


texts:
I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit.

I am using the SRP protocol for authentication (a type of EKE protocol). As a result of this, both parties will calculate the same large integer value and need to hash it into a key they can both use.

I would like to use SHA256 to generate the key, but its output is twice the length required.

Can I just truncate the hash to the lower 128 bits or something?

What is usually done in this case?


texts: Proper method of writing pseudo random sequences into binary files?

texts:
I am working in Python and created a B.B.S. implementation that outputs a sequence of pseudo random positive integers into a Python list.  I would like to write this data to a binary file and pass it through ENT and Diehard to see how well it does, but I have no idea how to properly do this.

So far I have been writing these pseudo random sequences in python lists into binary files with the struct package, but even PRNG's like B.B.S. are horribly failing these tests, so I know I must be writing the data to the file incorrectly.

Would anyone be able to tell me the correct way to write a pseudo random sequence of integers of form [85285422, 1065539406, 1143357354, 812899410, 796171749, 531684531, 771767949, 527982099, ...] in a python list into a file for testing with ENT and Dieharder?


texts: Why do some key derivation functions (like PBKDF2) use a salt?

texts:
Let me start by explaining my understanding of the various concepts involved in this question:

Salt: Random bytes of data used as secondary input for a password hashing function, like so:

hashfunc(<password>, <salt>) -> <hash>

And both the <hash> as well as the <salt> that was used are then stored (in a database, for example).

This prevents attacks using rainbow tables, making it more difficult for an attacker who has access to the output of the hash function (<salt> + <hash>) to deduce the original <password>.
Key derivation function: A function that takes a password <password> and an integer <size> as input, and generates arbitrary bytes of the desired <size> as output, like so:

kdf(<password>, <size>) -> <bytes of length <size>>

This allows us to turn a plain-text password like "admin123" into a key of a certain size that can be used by other cryptographic functions (like AES encryption, which requires a key of size 32).

So if my understanding is correct, then key derivation functions have no use for a salt. After all, the derived key isn't intended to be stored - it'll be used as input for another cryptographic function, and then it'll simply be discarded. Unless someone steals the derived key from the computer's memory in this short time frame, there is no risk of a rainbow table attack.

And yet, according to wikipedia, the PBKDF2 key derivation function takes a salt as input:

  The PBKDF2 key derivation function has five input parameters:

  DK = PBKDF2(PRF, Password, Salt, c, dkLen)

What purpose does this salt serve? Did I misunderstand the purpose of key derivation functions?

Related questions:

PBKDF2 and salt does not answer my question because the answers seem to assume that the derived key will be stored, which, according to my understanding of key derivation functions, should never happen.


texts: Lattice based cryptography: How do negative coefficients in $Z_q[x]/(X^n+1)$ work?

texts:
I saw that in lattice-based cryptography schemes, for example Dilithium, coefficients in $Z_q$ are allowed to be negative. For example, in Dilithium the secret key is $s_1 \in R_q^{k \times l}$, where $R_q = Z_q[X]/(X^n+1)$. In the reference implementation and also in the paper, all coefficients for $s$ are in the range $\{-2,\dots,+2\}$, so they explicitly allow negative numbers.
So far I was the impression that $Z_q = \{0, \dots, q-1\}$, but it seems lattice-based cryptography often also allows negative numbers. How does the arithmetic (i.e. addition) work when also negative numbers are allowed? And what terms would I need to look up to read up about the underlying mathematical concepts used when also negative numbers are allowed?


texts: Using ChaCha20 as a PRNG with a variable-length seed

texts:
As far as I understand, the key stream of the ChaCha20 cipher may be used as a seeded PRNG, where the seed is used to set the key and the nonce. As described in RFC7539, ChaCha20 can be used with a 256-bit (32-byte) key and a 96-bit (12-byte) nonce, allowing a seed of maximum 352 bits (44 bytes), thus limiting the counter to 32 bits (4 bytes).

My problem is, how can I use this PRNG if I want to provide a larger seed? Say, I seed the PRNG from an entropy source where I a can guarantee a minimum of about 4 bits of entropy per byte, and want to seed the PRNG with 64 bytes or more to be confident that it has been provided about 256 bits of entropy.

I reckon a cryptographic hash function, such as SHA256 or SHA512, could be used to compress the collected entropy bytes to be used as a seed, but it would be desirable if this could be solved by only using the available ChaCha20 primitive.

Another possibility seems to be to use ChaCha20 to construct a Davies–Meyer one-way compression function, treating a variable-length seed as blocks of 44 bytes (to input as key and nonce for the next block), taking the final 44 byte output as input seed to the PRNG.

It seems that Davies–Meyer was designed to be used with block ciphers, but ChaCha20 is a stream cipher.

My questions are:

Are there any obvious problems with using Davis-Meyer like this?
Are there any obviously better approaches to feed this PRNG with a variable-length seed?


texts: Messages of different lengths and one-time computationally-secret

texts:
I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs.

  Let $\Pi=(Gen,Enc,Dec)$ be an efficient secret-key encryption scheme that is not fixed-length. That is, for any $n$ and any $k \leftarrow Gen(1^n)$ the encryption algorithm $Enc_k(\cdot)$ can encrypt arbitrary length messages $m \in \lbrace 0, 1 \rbrace^*$.

  Prove that $\Pi$ cannot satisfy definition of being one-time computationally-secret when the adversary $\mathcal{A}$ in $PrivK^{eav}_{\mathcal{A}}$ may output messages $m_0$ and $m_1$, that are NOT of the same length.

I just can (I think so) start this proof - if $Enc_k(\cdot)$ is some PPT algorithm, then there exists a polynomial $p(x) \in \mathbb{Z}[x]$ such that

$\forall n,k \leftarrow Gen(1^n), m \in \lbrace 0, 1 \rbrace^*: ||Enc_k(m)||<p(||k||+||m||)$.

Unfortunately I have no idea how to do the rest of the proof - by contradiction, or not? If you could help me with the rigorous proof, I'd be really grateful for your time.

P.S. Reminder (one-time computationally-secret).

  An (efficient secret-key) encryption scheme $(Gen,Enc,Dec)$ is one-time computationally-secret if for any PPT adversary $\mathcal{A}$ it holds that $Pr[PrivK^{eav}_{\mathcal{A}}(n)=1]-\frac{1}{2}$ is negligible function, where $PrivK^{eav}_{\mathcal{A}}(n)$ denotes the output of the following experiment:

  (a) The adversary $\mathcal{A}$ on input $1^n$ outputs a pair of messages $m_0,m_1$.

  (b) Let $k \leftarrow Gen(1^n)$ and let $b \in \lbrace 0,1 \rbrace$ be chosen uniformly at random. Then a ciphertext $c \leftarrow Enc_k(m_b)$ is computed and given to $\mathcal{A}$.

  (c) $\mathcal{A}$ on input $c$ outputs a bit $b'$.

  (d) The output of the experiment is $1$ if $b'=b$ and $0$ otherwise.


texts: How do you determine which classical technique was used?

texts: For a class assignment we had to encrypt a message of at least 140 characters using only one of the classical cryptographic techniques. For extra credit we can decrypt someone else's message. I figure that the first step is finding out which method they used and go from there. Is there a way to accomplish this?


texts: Padding Oracle: Why should padding be 0x01?

texts:
I just finished reading about padding oracle attacks at https://blog.skullsecurity.org/2013/a-padding-oracle-example, and it blew my mind. I think I understand almost all of it, but I do not understand one critical thing:

When looking for good padding, why should the first one (last byte of the message) be 0x01 when you've found the right symbol? Additionally, why should the pattern for the next to last byte be 0x02 0x02 and the next 0x03 0x03 0x03, etc.

I understand the padding scheme requires that if you have 4 bytes of padding, the bytes should be 0x04, 0x04, 0x04, 0x04. And if you have 2 bytes of padding, it should be 0x02, 0x02, etc. That's not the problem. The problem I do not understand is: Why should you get padding when you decrypt your now-modified sequence of bytes?

In other words, pretend I had the string "Hello!" and a block size of 8 bytes. I would expect there to be two bytes of 0x02 padding after whatever the encrypted "Hello!" string turns out to be. Now, in the attack, I add 8 bytes of zeros before it, run it through decryption, incrementing the last byte until I get valid padding. I do not understand why the padding should be 0x01 at this point, not 0x02, as was in the original. Similarly, when it moves on to the next byte to figure out, they are looking for 0x02, and 0x03 for the next, etc. Why is this?


texts:
Let $h$ be a bitstring and let $P(h, n)$ be the n-bit prefix of $h$. A partial collision of length $n$, for a hash function $H$ is a pair $(x,y)$, such that $P(H(x),n)=P(H(y),n)$.

What is known about this type of collisions? I'm particularly interested in md5. Can rainbow tables be adapted to quickly look for these? What values of $n$ are feasible to bruteforce (perhaps in an optimized way, like with rainbow tables).

I'd also like to know about the pre-image case: given $x$ and $P(H(x),n)$, how to find $y$ such that it's a $n$-partial collision for $x$.


texts: representing binary finite fields in ASN.1

texts:
In SEC 2: Recommended Elliptic Curve Domain Parameters two types of finite fields are utilized - $\mathbb{F}_p$ and $\mathbb{F}_{2^m}$. In the case of sect193r1, $\mathbb{F}_{2^m}$ is the finite field, where $m = 193$ and is defined by $f(x) = x^{193}+x^{15}+1$

In SEC 1: Elliptic Curve Cryptography, the following ASN.1 structures are presented:

FieldTypes FIELD-ID ::= {
    { Prime-p IDENTIFIED BY prime-field } |
    { Characteristic-two IDENTIFIED BY characteristic-two-field }
}
prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
Prime-p ::= INTEGER -- Field of size p.
id-fieldType OBJECT IDENTIFIER ::= { ansi-X9-62 fieldType(1)}
ansi-X9-62 OBJECT IDENTIFIER ::= {
    iso(1) member-body(2) us(840) 10045
}
characteristic-two-field OBJECT IDENTIFIER ::= { id-fieldType 2 }
Characteristic-two ::= SEQUENCE {
    m INTEGER, -- Field size 2m
    basis CHARACTERISTIC-TWO.&id({BasisTypes}),
    parameters CHARACTERISTIC-TWO.&Type({BasisTypes}{@basis})
}
CHARACTERISTIC-TWO ::= TYPE-IDENTIFIER
BasisTypes CHARACTERISTIC-TWO ::= {
    { NULL IDENTIFIED BY gnBasis } |
    { Trinomial IDENTIFIED BY tpBasis } |
    { Pentanomial IDENTIFIED BY ppBasis },
    ...
}
gnBasis OBJECT IDENTIFIER ::= { id-characteristic-two-basis 1 }
tpBasis OBJECT IDENTIFIER ::= { id-characteristic-two-basis 2 }
ppBasis OBJECT IDENTIFIER ::= { id-characteristic-two-basis 3 }
id-characteristic-two-basis OBJECT IDENTIFIER ::= {
    characteristic-two-field basisType(3)
}
Trinomial ::= INTEGER
Pentanomial ::= SEQUENCE {
    k1 INTEGER, -- k1 > 0
    k2 INTEGER, -- k2 > k1
    k3 INTEGER -- k3 > k2
}

$x^{193}+x^{15}+1$ is a trinomial but the "basis type" for it only consists of one integer? It seems to me that there are probably close to three integers - the exponents for $x$? eg. $193$, $15$ and $0$? idk - I guess it's just unclear to me how you're supposed to get $x^{193}+x^{15}+1$ from the ASN.1 or, conversely, how you're supposed to denote $x^{193}+x^{15}+1$ in the ASN.1.

Any ideas?


texts: Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?

texts:
In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter seems arbitrary and forces the scrambling pattern to repeat every 232 16-byte block.

Is the algorithm expected to be secure for significantly longer stream lengths if for example the IV were a 128b nonce XORed with a 64b or 128b counter, or are there known cryptanalysis issues that begin to arise?


texts: How do we perform second order differential power analysis attack?

texts:
I have read papers which describe that the power traces(acquired from a side channel resistant implementation like masking) need to be centered and squared, then a correlation needs to be performed with the hypothetical power model to perform second order DPA.
Suppose if I have a matrix of $m \times n$, where $m$ represents the number of traces and $n$ represents the number of samples, I have computed the mean matrix along each $m$ trace, so size of mean=$m$ by 1, I then subtract each power trace as:

power_trace_new(i,j)=(power_trace(i,j)-mean(i)).^2,

I then use this trace to correlate with my hypothetical power consumption.

Is this the correct way to do it? Or is there any other way to perform second order DPA?


texts: How to use a stream cipher to sign a message?

texts:
Are there known constructions which allow to sign a message M
(let's say it will be sent as clear text) using a stream cipher C
and a symmetric secret key K?
So, we have M, C, K and we want to send M|S
where S = SIGN(C,K,M) and | is the concatenation operator.


texts: Possibility of the encrypted text being the same as the supplied plain text!

texts:
I was learning DES when it occurred to me that there could be a possible case where a (key, plainText) pair could result in an encryptedText such that, plainText == encryptedText.

Quickly I found out that there exists weak keys (especially for DES!) that make it quite vulnerable. So, the worst that can happen with these weak keys is that double encryption would return the original plainText.

I want to look at one example where the output of the DES would be same as input.

What I've already tried:

A brute force: wrote a generator for random [key, pText] pairs and DES over them to see if the eText is same as pText. Got a C Language implementation from here. Specs: len(pText) = 64b, len(key) = 56b, Generated random cases: 10M. I do understand that the number of cases barely scratches the surface, but I was hoping (naively I guess) I'd find at lease one such case.
Gave a little thought and realised that, if the crypto function in the Feistel Structure returns 0 in every round, at the end of 16 rounds, we'd have the same output. This depends upon the inputs to that function (which are in-turn derived from the talked about pair)
Yet another thought is that: if the input is small enough (yes assuming we have padding enabled) the output would also be of the same size, which means that there's a very high probability that the pText is same as eText. Just to make my thoughts more clear, if input is of size 1 bit, say 1, the output could be 0 or 1, implying, the chances of my case occurring is 50%!

May be I should see the mathematical model of the DES and infer if it's possible, but I feel like I've already spent too much time on this!

Please suggest me how do I go about cracking this case!

Thanks! :)


texts: Calculation of failure probability in basic Ring-LWE-DH key agreement

texts:
This is the basic unauthenticated Ring-LWE-based Diffie-Hellman key exchange, based on Peikert's Ring-LWE KEM: (from BCNS15)

Alice and Bob have shared public polynomial $a$ randomly drawn from $R_q = \mathbb{Z}_q[x]/(x^n+1)$, and a known error distribution $\chi$ with standard deviation $\sigma$
Alice generates random small secret polynomials $s_A, e_A \in R_q$ according to distribution $\chi$, calculates $b_A = a \cdot s_A + e_A$ and sends it to Bob
Bob generates random small secret polynomials $s_B, e_B \in R_q$ according to distribution $\chi$, calculates $b_B = a \cdot s_B + e_B$ and sends it to Alice
Alice calculates $k_A = s_A \cdot b_B = a \cdot s_A \cdot s_B + s_A \cdot e_B$
Bob calculates $k_B = s_B \cdot b_A = a \cdot s_A \cdot s_B + s_B \cdot e_A$

$k_A$ and $k_B$ are approximately equal except for the error terms. So, Alice and Bob use a reconciliation function rec(.) such that rec($k_A$) = rec($k_B$) = $K$ is the common shared secret.

The basic reconciliation scheme (from BCNS15) rounds each coefficient of the polynomial to 0 or $q/2$, and $q/2$ is treated as 1, so that $K$ is an $n$-bit string. BCNS15 says that this scheme has a failure probability of $1/2^{10}$. How is this calculated?

Here is the general approach I have been trying:

For successful key exchange, we must have $|k_A[i] - k_B[i]| < \delta$ for $i \in \{0, 1, \cdots, n-1\}$, where $k_A[i]$ and $k_B[i]$ denote the $i$-th coefficient of polynomials $k_A$ and $k_B$ respectively and $\delta$ is the error tolerance of the reconciliation scheme
In this case, $k_A - k_B = s_A \cdot e_B - s_B \cdot e_A$ and $\delta = q/4$
Let $p$ be the probability that $|k_A[i] - k_B[i]| > \delta$ for some $i$, that is, the probability of error in decoding any one bit of $K$. Then, the total failure probability is $1 - (1 - p)^n \approx np$ for small $p$
Let the error distribution $\chi$ have a support $[-t\sigma, +t\sigma]$, where $t$ is a factor determined by the precision of the sampler implementation. Then, the maximum possible absolute value of any coefficient of $s_A \cdot e_B$ or $s_B \cdot e_A$ is $nt^2\sigma^2$, so we must have $2nt^2\sigma^2 < q/4$ or $q > 8nt^2\sigma^2$


texts: Cryptool - DES (ECB and CBC ) - double encyption

texts:
So, I uploaded a text file in Cryptool and encrypted it with DES-ECB with the key FF FF FF FF FF FF FF  FF. I encrypted the cipher text again, with DES-CBC using the same key. Then, I encrypted the obtained text with DES-CBC again.

The first 8 characters match the encrypted text of ECB. The rest of it is different. I would like to know why those 8 characters are similar and why the rest of it are not? It would be very helpful if anyone could explain this to me.


texts: Hash email address with a non-random salt for moderate security?

texts:
Crypto noob here. I have an application that has only moderate security requirements (internal use, limited audience). I want to send a unique url with a token in it to each user. If anyone has the url, they can submit information on the user's behalf.

Can I just hash their email with a secret salt to produce the same token every time? I realize these won't expire, and knowing the token lets anyone spoof the user, but these are acceptable for my application. When they submit information, I'm thinking I can just re-hash their email with the secret, and make sure it matches the submitted token.

Is this a bad idea? Which hashing algorithm should I use? Should I change my approach?


texts:
I have three questions:

Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication?
How much HMAC-SHA256 is slower than HMAC-SHA1?
Are the security improvements of SHA256 (over SHA1) enough to justify its usage?


texts: I have read that in general stream ciphers do not provide data integrity. Can ChaCha20 be implemented in such a way (perhaps like counter mode with message authentication in AES) to provide this?


texts: Password hashing security of argon2 versus bcrypt/PBKDF2?

texts:
I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU systems.

Practically speaking, if I have had a key-derivation-function running for one second on my server, how much of a security margin am I roughly gaining by running argon2 for one second (e.g. using 2GB of memory, otherwise default settings).

I am looking for more of a theoretical answer / guess based on the cryptographic differences between these schemes.


texts: exchanging private key between service and iPhone app - digital signing

texts:
I need to do digital signing of my request data which will be sent to the server. My server sends distinct private keys to her clients after authentication and expects all responses to be digitally signed with those keys for next x days. In order to represent a private key instance in iOS it expects a .p12 file with a password input.

Since the private keys change dynamically for every user, I can have a persistent certificate or .p12 on my device to read the private keys. In that case, is it advised to send the .p12 file as part of the JSON response in base 64 format over the wire after authentication, create a .p12 file buffer and do message signing? Is this safe? Or is there any security vulnerability in this approach?


texts: Is using derived keys for HKDF + AES-GCM safe

texts:
I have an existing system which takes a cryptographically secure BLOB from user and pass it to lower API which calls HKDF-Expand to get 2 keys: one is effectively discarded in this scenario and second is actually used.

Previously this second key was used to authenticate-encrypt using AES256-GCM data from user (again get from user and passed to lower API). However this turned out to be problematic and some metadata needs to be added to the format in some cases. However it is hard to do while maintaining backward compatibility.

I'm consider 'versioning' the API by generating the key twice - once with key from user and once with key from user XORed with 1 - as it will allow to avoiding changing of API or similar tricks. My intuition is that I should get a two unrelated keys due to avalanche properties.

However I'm not a cryptographer so I'm not sure if there isn't something fishy about such schemes.

// info is publicly known; operation discards first 256-bits for key that
// is not used
(_, key1) <- HKDF-Expand(key, info)
(_, key2) <- HKDF-Expand(key ⊕ 1, info)

def decrypt(data) {
    decryptedData <- AES256-GCM-Decrypt(key2, data)
    if decryptedData is not null {
        return parseFormatWithMetadata(decryptedData)
    }
    # Try to use old format
    decryptedData <- AES256-GCM-Decrypt(key1, data)
    if decryptedData is not null {
        return (decryptedData, default metadata for v1)
    }
    return null;
}

def encrypt(data, metadata) {
    if metadata != default metadata for v1 {
        return AES256-GCM-Encrypt(key2, metadata || data)
    } else {
        return AES256-GCM-Encrypt(key1, data)
    }
}


texts: Proven secure scheme under random oracle

texts:
Currently I am trying to understand random oracle model in order to make a small presentation about it but I seem to be very confused about it.

Since it's an hypothetical model without a real life application (no function can be completely random), how cryptographic functions are modeled as random oracles (e.g are all hash functions modeled as random oracles?) and how can a cryptographic scheme can be secure under random oracle if there is not concrete proof or implementation of that model?

I think that one difference of standard model with the random oracle model is that is actually secure under some assumptions. Are there any security proofs for random oracle at all?

Can you give an example of a cryptographic protocol/function modeled as an random oracle and one that is not?

Is a hash algorithm an secure under RO until there is a proof that it isn't? (Doesn’t  sound very logical).

I have read various sources and most posts from this sitw for random oracle but I didn't find much answers to the ones I stated, so I hope this won't be labeled as duplicate.


texts:
Since there is not much info anywhere on the Internet related to this:

Does anyone know if OpenSSL's default CSPRNG is Dual_EC_DRBG or not?
Their wiki is not very clear…
Related to the first question, does anyone have any experience with OpenSSL on Mac changing the default CSPRNG?


texts: Sorting over encrypted data with different symmetric keys

texts:
I'm working on a security project. I need to perform a sorting on the lists of encrypted integers and strings. The encryption used is symmetric. The clients send the encrypted data in a list to the server (encrypted by different symmetric keys, each key is shared b/w a client and the server). On receiving the list, server may again encrypt it using another key shared between the server (such as authentication server) and the service provider's server. If service provider server wish to sort the encrypted data, then how can it be achieved? It cannot decrypt the original messages encrypted by different users' keys. I found a paper, https://eprint.iacr.org/2014/1017.pdf, however, it performs sort over the data encrypted with same key. But in my project requirements are different where each data element is encrypted by a different key of the client. (each key shared b/w a client and the server).

Any help is appreciated.


texts: What does "G2" mean when used with X509 certficates and certificate authorities?

texts:
For example "Google Internet Authority G2"?. I thought it was another way of specifying Class 2 (for organizations, for which proof of identity is required) but then see certificates such as "VeriSign Class 3 Public Primary CA - G2".

It couldn't be something so simple such as Generation 2 could it? Hope someone who woks for a CA can explain these naming conventions. Thanks in advance.


texts: Reusing PGP key when generating SSL Certificate Authority?

texts:
Does it make sense to reuse some of the keys from my PGP (GnuPG, GPG) key block when generating my own SSL Certificate Authority (a toy one for myself and a few web services of mine)?
In an ideal world people would have one key pair in a trustworthy hardware device, and they could use it to certify everything, e.g. their own SSL Certificate Authority (as opposed to generating an RSA key with Openssl as it is advised in every online tutorial).
Is it possible?
Are there any benefits to it?
(I know about Monkeysphere, but that's a somewhat different story.)


texts: Why does this RSA example break when: 1) setting p or q as non-prime, or 2) setting p and q as the same number?

texts:
This answer talks about how non-prime numbers would make the algorithm easier to break, not that the algorithm doesn't work full-stop:
Why does RSA need p and q to be prime numbers?

Question 1:
this implementation uses the number 57, which is not prime as it divides by 3.

Choose p = 13, q = 57, e = 5 and message 'm' = 4
Therefore n = pq = 741 and (p - 1)(q - 1) = 672
encrypt message m as m^e mod n = 4^5 mod 741 = 283
calculate decryption key d as e^-1 mod (p–1)(q–1) = 5^-1 mod 812 = 269
decrypt '283' by 283^d mod n = 283^269 mod 741 = 199 ≠ 4

How does using a non-prime number cause the result to be wrong?
I suspect the answer has something to do with the way that an inverse mod calculation looks for prime factors using the Euclidean algorithm, and if n is not the product of two prime numbers then it will give a different answer. But how is (p-1)(n-1) affected by p or q not being prime?

Question 2: p and q are the same prime number:

Choose p = 11, q = 11, e = 3 and message 'm' = 2
Therefore n = pq = 121 and (p - 1)(q - 1) = 100
encrypt message m as m^e mod n = 2^2 mod 121 = 8
calculate decryption key d as e^-1 mod (p–1)(q–1) = 5^-1 mod 100 = 67
decrypt '8' by 8^d mod n = 8^67 mod 121 = 24 ≠ 4

How does using two (prime) identical numbers cause the result to be wrong? For this one I don't know where to start.


texts: Why should keys be hidden from an eavesdropper for a pseudorandom function?

texts:
What advantage would knowing the key used for a given pseudorandom function give over having access to an oracle for that function $F_k(\cdot)$ and the actual key $k$ which will be used?

Thanks very much in advance


texts: When it comes to RSA signing, I understand why you need to hash the data before signing it, but don't you need to communicate what hash algorithm you use to whoever will need to verify the signature? How does that normally work? How do you communicate the hash function used with RSA signing?


texts: Is a nonce considered 'secret' enough for HMAC?

texts:
We're implementing a mobile application which communicates with a web service, and on first install the user sends its deviceid to the web service (over TLS, unauthenticated at this point) - which determines if the user's device is known to our system. If the device is not known, the user must authenticate with a username and password to associate the device. When the web service responds to the mobile application requesting a username and password, the response includes a nonce, valid for that request and response only.

Once the Username/Password is requested, the client generates a cnonce and a HMAC:

hash_hmac(sha256, nonce || deviceid || cnonce, nonce)

using the nonce supplied previously as the key. When the response is received by the web service, the supplied nonce is invalidated.

As this mobile app is considered to be on a hostile device, we don't want to be storing a secret key in the app which can be recovered.

Is it safe to use the nonce as the key for the hmac in the above example?


texts: What are the number of output bits of the internal function F used in BPS algorithm?

texts:
In the BPS specification document it says

  We denote by f the number of output bits of the internal function F

What is this if the internal function is AES? Would it be the block size (e.g. 128)?


texts:
I am new to crypto and wondered what would happen when we encrypt twice using any algorithm and the same key.
Consider two block ciphers A and B.
We generate the ciphertext as c = A(B(m)) for any message m.
If they are in the same message space and they map to the same ciphertext space, why would using the same key on both schemes make the encryption insecure?
I have understood meet in the middle attack and the general idea of collisions when using two functions mapping to the same ciphertext space.
Is there any other approach?

Edit: I am also looking for attacks except the case where one encryption undoes the decryption of the other.
eg. B is inverse of A


texts: Simple Electromagnetic Analysis vs symmetric cryptography

texts:
I've asked this question here and was advised to post this question on this forum in hopes of an answer.

I'm currently taking a security class and i came into this issue when writing a report about side channel attacks. When reading about electromagnetic attacks, more specifically about Simple Electromagnetic Analysis in Wikipedia (https://en.wikipedia.org/wiki/Electromagnetic_attack), it states:

  It is very effective against asymmetric cryptography implementations...

I understand why it is effective agaisnt an algorithm such as RSA, which is asymmetric, but doesn't the reason for its effectiveness resides on the way the algorithm is implemented and not if its symmetric or asymmetric cryptography?

  For example, a common attack on asymmetric RSA relies on the fact that the encryption steps rely on the value of the key bits. Every bit is processed with a square operation and then a multiplication operation if and only if the bit is equal to 1. An attacker with a clear trace can deduce the key simply by observing where the multiplication operations are performed.

So i don't really understand why it says its effective against asymmetric cryptography.

Thanks for your attention!


texts: Does using pseudorandom generator more than once cause security loss?

texts: Everytime we use the generator with itself there is security loss. Even if this loss is not enough to loose all cryptographic security, there is still some small loss in security. Is there any way to calculate as to how much do we loose in aspect to security?


texts:
I need an implementation of linkable ring signature, a ring signature which allows identifying whether two signatures belong to the same signer. It has important privacy-related applications, like e-voting, but unfortunately there seems to be no public implementation. So I'm going to roll my own.

The simplest method seems to me is described in this highly cited paper: http://eprint.iacr.org/2004/027.pdf . Is it a sane scheme? Are there any known vulnerabilities in it? Are there any standards for linkable ring signatures which describe a good way of doing it?


texts: Why do public keys for RSASSA-PKCS1-v1_5 follow a normal distribution?

texts:
I converted ~1000 public keys generated from chrome's RSASSA-PKCS1-v1_5 implementation, converted them to decimal, prepended a "0." to them, and sorted them.

This is the graph that I got:

It puzzled me a little bit because it looks like an inverse normal distribution. I expected a uniform distribution (i.e. straight line). what gives?

the datapoints are the actual values of the keys, you could say normalized 0 to max, sorted, and then plotted by index in the sorted array.


texts: Is Poly1305 enough for cascading ciphers?

texts:
ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade multiple ciphers? In other words, is one MAC enough to secure both ChaCha20 and AES?
Problem solved: Is Poly1305 an information-theoretically secure MAC?


texts: What differences between Menezes–Vanstone ECC and ElGamal ECC?

texts: After researching ECC encryption, I found that we can use ElGamal cryptosystem with  elliptic curve and can we use  Menezes-Vanstone cryptosystem with elliptic curve. What is the essential difference between the two systems? Which one is better with regards to complexity/performance?


texts: The four  Public-key cryptosystems: RSA, ElGamel, DH, and Rabin (all with others) all require some group operations in an  integer field or multiplication group of some residue classes. When it comes to encrypting blocks of bits in binary how are these public key cryptosystems performed ? Are byte blocks just converted to base 10 and the encryption is perform on each byte? However results of RSA are much longer than a byte each.


texts: Question about modular arithmetic (division)

texts:
I have a question about division operation.

There are two entities, Alice and Bob.

Bob randomly selects a finite set of numbers (set K). (about 10K or 100K)

Alice randomly generates one big number $x_1$ and chooses one element $y_1$ (from Bob's set K).

Alice makes $X$ ($X=x_1*y_1 \bmod n$) and sends $X$ to Bob.

In this case, can Bob figure out what Alice chooses from the set K?

Small number example: 3 ($x_1$) * 5 ($y_1$) mod 7 = 1 ($X$).

Bob knows that there is '5' in the set K, but I think that 1 divided by 5 (mod 7) equals 1.

So I don't think that Bob can figure out what Alice chooses from the set K.

Am I right?

Sorry for my bad English.

Thanks.


texts: Why is Siphash-128 considered "experimental"?

texts: Why is Siphash-128 still considered "experimental"?  What does this mean?


texts: Hardness of iterated squaring in Pailler group

texts:
The (computational) problem of iterated squaring (IS) in the RSA group is defined as follows, where $\leftarrow$ denotes sampling uniformly at random:

Input: $(N,x,T)$, where $N$ is the RSA modulus, $x\leftarrow\mathbb{Z}_N^*$, and $T\in\mathbb{N}$ is the time parameter
Solution: $x^{2^T}\bmod{N}$.

This problem can be traced back to [C+] and used by [RSW] for constructing time-lock puzzles. More recently, it has been used to build verifiable delay functions [P,W]. It is not hard to see that the problem is at most as hard as factoring $N$. My question concerns the analogous problem in the Paillier group (ISP, for short), as used in [LM] and defined as follows*:

Input: $(N,x,T)$, where $N$ is the RSA modulus, $x=v^N\bmod{N^2}$ for $v\leftarrow\mathbb{Z}_N^*$  and, $T\in\mathbb{N}$ is the time parameter
Solution: $x^{2^T}\bmod{N^2}$.

Question: Is the hardness of these problems related? Are these problems  reducible to one another?
Why should they be related? Intuitively speaking, the RSA group is embedded in the Pailler group and constitutes its component of unknown order (which is necessary for iterated squaring to be hard). More formally:
$$(\mathbb{Z}_{N^2}^*,\times)\cong (\mathbb{Z}_N^*,\times)\times(\mathbb{Z}_N,+),$$
and since iterated squaring in the $(\mathbb{Z}_N,+)$ component is easy (as it is a group of known order), one could conjecture that hardness of solving ISP boils down to solving IS.
However, I could not find a reduction in either direction. For instance, to reduce IS to ISP one could try the canonical embedding of $\mathbb{Z}_N^*$ in $\mathbb{Z}_{N^2}^*$ defined as
$$x\bmod{N}\mapsto x^N\bmod{N}^2,$$
but this runs into the RSA problem when trying to map the solution back. In the other direction, one could try the canonical projection defined as
$$x\bmod{N^2}\mapsto x\bmod{N},$$
but it is now not possible to lift the solution back to $\mathbb{Z}_{N^2}^*$. Any ideas?
*Another way to define it would be as follows:

Input: $(N,x,T)$, where $N$ is the RSA modulus, $x\leftarrow\mathbb{Z}_{N^2}^*$, and $T\in\mathbb{N}$ is the time parameter
Solution: $x^{2^T}\bmod{N^2}$.

But it seems less natural than the formulation above.
References.
[C+]: Cai et al, Towards uncheatable benchmarks, CCC'93 (behind a paywall unfortunately)
[LM]: Lai and Malavolta Homomorphic Time-Lock Puzzles and Applications, Crypto'19
[P]: Pietzak, Simple verifiable delay functions, ITCS'19
[RSW]: Rivest, Shamir and Wagner, Time-lock puzzles and timed-release crypto, MIT Report
[W]: Wesolwski, Efficient verifiable delay functions, Eurocrypt'19


texts: salt usage for hashed password storage - design consideration

texts:
This is part of my academic assignment and hence to ensure no one feels i'm asking for the answer. I've given my opinion.

Hashing is mathematical one way function that takes arbitrary length data and converts it to a fixed length output. Important thing is exactly similar text (data) when hashed with same algorithm (MD or SHA  or any other) will always give same output. This brings an important challenge when storing sensitive data using hashing such as passwords - because same passwords when hashed and stored
using same algorithm will generate same hash. Hence salting is recommended to counter “rainbow tables” which is the brute force for hashing.

There is one more attack to keep in mind which is the birthday paradox but because we’re referring to password / passphrase as compared to a lengthy data-set / document hence birthday paradox is out of the question and so are collisions (questions assumes a strong hashing algorithm).

Here is the question:

  You are asked to implement the password storage for a system in which users are authenticated using password logins. You have to implement the storage without using a random number generator, and therefore cannot implement exactly the same salted storage as described in the lectures. There are at least three alternative ways to implement the table:

1. Method S1: use the constant “SA” as the salt for each entry in the table.

Constant salt is the weak link. One may argue that length of the salt is also a security weakness. But the fact that SALT is constant throughout the table.
It will lead to frequency analysis – password: 123456 with salt SA will always give same output across the table.
So I wouldn’t use it.

2. Method S2: for each entry, use the hash of the first two characters of the password as the salt.

password: 123456 will be hashed as hash (salt(password)) = hash(12(123456))

This is more secure from the perspective that SALT isn't constant. (as option 1)
However, password: 123456 with salt (12) as per the rule, will lead to same hash.
This will lead to frequency analysis as similar passwords in the DB will always be stored as same hash.

3. Method S3: use the number 0 as the salt for the first entry, and define the salt of each other entry as the hash of the previous entry.

Thus, the salt is 0 for the first entry, hash(0) for the second entry, hash(hash(0)) for the third entry, etc.

This is what I assess to be same as block cipher in CBC mode.
On the looks of it 0 may seem as a weak "SALT" but it acts as an IV here.
Similar passwords will never be as similar hashes. Hence frequency analysis is difficult.
It also makes it difficult to rainbow table (brute force) an entry individually and you will need entire table to get the plaintext as opposed to other designs wherein once you know the logic you can get plaintext passwords in the table.

- I would use this design. As question expects me to design security and not integrity of the data. CDC is prone to integrity failure as if one entry gets corrupt all subsequent entries will be corrupt.

Kindly give me your thoughts.


texts: RSA factorization knowing N, e=65537 and g=d*(p-17)

texts:
Having known the values for $N$ a large number, $e = 65537$ and another large number $g = d \cdot (p-17)$, how can I use that info to find out $p$ and $q$?

I guess that have something to do with Fermat's little theorem and I noticed that $e$ is the largest prime number of the form $2^k+1$. Can you give me some hint? I am not very familiar with some other theorems that may help.


texts: Is it not secure if we use weak passwords to protect exported PKCS #12 files with private keys?

texts:
Consider a practical scenario as described in Microsoft's Expand Export a Certificate with the Private Key. We can see a certificate with private key can be exported as a PKCS #12 file, where the private key can be protected by a password (in Step 7).

Questions:

If one day this PKCS #12 file is stolen by a hacker, then, can he perform an offline dictioary attack to this file?
Step 5 in that article reads:

  In the Certificate Export Wizard, click Yes, export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)

How does this mechanism works? Is the (un-)exportability guaranteed by a cryptography algorithm (so that no one can change the property), or only by a software method (so that hackers can change the property)?


texts: Secure use-cases of block cipher with 64-bit block size

texts:
In what cases can we use a weak block cipher like DES ?

More precisely, Are there specific situation in which a weaken block cipher can still be used, for instance for certain types of plaintext ?


texts: What is the complexity of finding SHA-1 collisions?

texts:
Given the recent news about SHA-1 collisions, what is the complexity of finding a SHA-1 collision?

Marc Steven's HashClash is still detailing about 260. Does the previous complexity still hold?


texts: Unbalanced numeric Feistel network implementation

texts:
After reading a comprehensive paper [1] covering various kinds of generalized Feistel networks, I've tried to implement the Unbalanced Numeric Feistel variant, which relies on modular arithmetic for splitting and joining an integer in two smaller parts.
Given the scarcity of example implementations for this kind of cipher, I had to figure out some inexplicit details on my own in order to come up with the algorithm below. Therefore, I would like to pose some questions to clarify my remaining doubts:

Does the implementation below follow accurately the described network generalization? If not, what operations are wrong and what would be the right way of performing them?

Is there any way of reversing the modulus addition ⊞ on the encryption function other than by using modulus subtraction ⊟ on the decryption function? Given two integers $a$ and $b$ from a finite field of length $x$, the operation $(-a-b) \bmod x$ would be reversible in a similar way to the bitwise exclusive-or, but (obviously) the ciphertext would not be the same as the one obtained with the current operations.

What would be the implications of dynamically computing $first$ and $second$ so the $first \cdot second$ finite field is strictly equal to the input $data$?

Algorithm
Given two finite fields of lengths $first$ and $second$ greater than $2$, a number of $rounds$ greater than $2$, a positive integer $data$ on the finite field of length $first \cdot second$ and a positive integer $key$:

Please note that the LaTeX code above was inserted as an image due to the  technical limitations of the MathJax formatting. The markdown source of this question contains a commented-out block with the code used to render it.
Tests
(Python implementation that can be used to test the described algorithm).
import random

class NumericFeistel:

    def __init__(self, key: int, rounds: int, first: int, second: int):
        assert all(number >= 2 for number in (rounds, first, second))
        self.first, self.second = first, second
        self.key, self.rounds = key, rounds

    def function(self, data: int, round: int) -> int:
        globals().update(self.__dict__)
        random.seed(data + key + round)
        return random.choice(range(first))

    def encrypt(self, data: int) -> int:
        globals().update(self.__dict__)
        assert data < first * second
        for round in range(rounds):
            left, right = data // second, data % second
            left += self.function(right, round)
            data = first * (right % second) + (left % first)
        return data

    def decrypt(self, data: int) -> int:
        globals().update(self.__dict__)
        assert data < first * second
        for round in reversed(range(rounds)):
            left, right = data % first, data // first
            left -= self.function(right, round)
            data = second * (left % first) + (right % second)
        return data

for test in range(1000):
    random.seed()
    feistel = NumericFeistel(
        rounds = 2 + random.choice(range(1000)),
        first = 2 + random.choice(range(1000)),
        second = 2 + random.choice(range(1000)),
        key = 42
        )
    data = random.choice(range(feistel.first * feistel.second))
    assert feistel.decrypt(feistel.encrypt(data)) == data

Weaknesses
Using and abusing the random module for producing pseudorandom numbers and implementing the one-way round function may be a really bad idea, but this code is intended to be as readable as possible, and its hypothetical insecurity is a minor concern.
Please note that this only is a recreational exercise and nobody plans to use it for anything but demonstrative purposes. This is not another rolling out my own crypto question.
Bibliography

Hoang V.T., Rogaway P. (2010) On Generalized Feistel Networks. In: Rabin T. (eds) Advances in Cryptology – CRYPTO 2010. CRYPTO 2010. Lecture Notes in Computer Science, vol 6223. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-14623-7_33


texts: What is an impure NIST true random number generator?

texts:
I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components:

  The entropy rate provided shall be no greater than the entropy rate provided by the input to the conditioning component; full entropy shall not be provided by non-approved conditioning components.

This suggests that you can have a random number generator that does not provide full entropy.  So if you use the de-rigour noisy diode source natively generating approximately 50% pure entropy, your generator can only output 50% entropy.  I'm unaware of any source that can natively generate 8 bits /byte entropy.  It would actually be undesirable  to run the source sampling equipment cranked up to 100% for many engineering reasons.

What is the point of a true random number generator that only produces half pure entropy?  Do you only use it half of the time?  Or do you just use every other byte (the random ones), ignoring the predictable ones?  Seriously though, is it just a thinly veiled warning that "it's our way or no way"?  Or..?


texts: Recommendation of lightweight RNG for Miller-Rabin primality test

texts:
Miller-Rabin tests the compositeness of candidate numbers (hence, input $x$) that's often used as a primality test.
The M-R test requires different random numbers for accuracy and confidence in the primality of $x$. To obtain such random numbers, I want to obtain them from a lightweight embeddable RNG, instead of a CSPRNG implemented elsewhere in my project.
So Q1: what's the minimal set of requirements for an RNG for use in M-R test, in addition to guarantee of distinct dissimilar output?
Now. The way I intend to use the RNG, is to seed it with the entire value of $x$ with an additional nonce (64-bit maximum) that's input to the M-R test routine. This means the RNG should be able to accept variable-sized seed, and an additional nonce.
An additional property I desire, is that it have a small state, for example, 128-bit if such implementation is possible and optimally efficient (I would consider slightly larger states if it's more efficient).
So Q2: is there a an existing RNG that meets the criteria (~128-bit state, variable-length seed, nonce)? And preferablely one that's based on one of those from the on-going NIST Lightweight Cryptography Project?
If not, Q3: what commonly-used constructs (LFSR, anti-circular bit-patterns) can I use to design a suitable RNG?

Last-minute clarification
When I say "embeddable", I mean incorporating the RNG code into that for the implementation of the M-R test.
And I'm not asking about RNG for generating RSA primes, I'm asking about a small RNG for use inside M-R test.


texts: How to perform Stampery.com's Merkle Proof?

texts:
I am using the Stampery API to anchor hashes into different Blockchains. I wanted to independently verify that my hash with the given Merkle Proof from Stampery.
I tried to follow their Whitepaper but with no success.

What I've tried so far is the following:

Hash:
265D0E134C56080CBD9049427C39C5B6425FDC909FC16072FC4AA0D6957B7264

Merkle proof:
R 4C83C6F2C253CD8B44A3EDEB076B65877BEBA0DCA2B85497C3B7E74785EC5618
R 9F016BF9C9CD4C4F55D171C211666B214C38C7FBDDCED9BC5D2D4239E6C7CE19
L 5461D61A21A6EF783737F328DA8BB8BF5D24804B8574F0E6CBEC076D026C2FBE
R FD894CD6289981AEEC0CE250C841257276FE56D2A003BFE482B2E669BA4A93AC

Merkle root:
16DA7D280DC9B527985F8749636DFB5E3C6B3856A4C7F7CB3E8BA6AEC9F33EB7

Code:

var mP = [
    "4C83C6F2C253CD8B44A3EDEB076B65877BEBA0DCA2B85497C3B7E74785EC5618",
    "9F016BF9C9CD4C4F55D171C211666B214C38C7FBDDCED9BC5D2D4239E6C7CE19",
    "5461D61A21A6EF783737F328DA8BB8BF5D24804B8574F0E6CBEC076D026C2FBE",
    "FD894CD6289981AEEC0CE250C841257276FE56D2A003BFE482B2E669BA4A93AC"
];

r = SHA3( SHA3( mP[2]+SHA3( SHA3(hash+mP[0]) +mP[1])) +mP[3] );

with $r \neq merkleRoot $. Here I simply applied the SHA3 (Keccak) algorithm (as mentioned in the paper) successive, taking into account the L and R from the Merkle Proof. I guess, that the Ls and Rs decide the order of the operands of the SHA3 function.

I am not sure what I am doing wrong and would be happy for any help!

Edit:
With the help aesedepece I got a minimal node version running:

var crypto = require('crypto');

function SHA256(x) {
    var buf = new Buffer(x, 'hex');
    return crypto.createHash('sha256').update(buf).digest('hex');
}

var hash = "265D0E134C56080CBD9049427C39C5B6425FDC909FC16072FC4AA0D6957B7264";
var mP = [
    "4C83C6F2C253CD8B44A3EDEB076B65877BEBA0DCA2B85497C3B7E74785EC5618",
    "9F016BF9C9CD4C4F55D171C211666B214C38C7FBDDCED9BC5D2D4239E6C7CE19",
    "5461D61A21A6EF783737F328DA8BB8BF5D24804B8574F0E6CBEC076D026C2FBE",
    "FD894CD6289981AEEC0CE250C841257276FE56D2A003BFE482B2E669BA4A93AC"
];

var merkleRoot = "265D0E134C56080CBD9049427C39C5B6425FDC909FC16072FC4AA0D6957B7264";

var r = SHA256(SHA256(mP[2]+SHA256(SHA256(hash+mP[0])+mP[1]))+mP[3]);
console.log(r);


texts:
If i have two 56-bit DES keys, and I use these two key to encrypt a 256-bit AES key. Like this $K_{AT}$ encrypts $K_{BT}$ and $K_{BT}$ encrypts $K$

What is the effective security of key $K$?

Is it $2 \times 56$ bits?

Can anyone help?


texts:
I would like to generate a 128 bit random number with dices, but I have heard that dices are pretty biased, especially low quality (non casino dices).

Would it make sense to generate a higher bit number, like a 1000 bit number? Would that "absorb" the flaws and biases exhibited in the dices. In the sense that the overall bias diminishes, the more bits you add to it?
What is the best method to make the bias go away?

Concatenating the individual numbers thrown into a  128 bit string
Multiplying the individual numbers thrown
A combination of both, for example with 2 dices: (R1+R2)x(R3+R4)x(R5+R6)…


texts: Discrete logarithm algorithm for modulus power of 2

texts:
For those of you that don't know, the modular/discrete logarithm problem:

Calculate b given the others: $a^b≡c$ mod d

I am aware that there is no general algorithm for the discrete logarithm, making it intractable. ($O(n^2)$ and worse for n digits is generally considered intractable, though exponential is for sure)

Even though it isn't standard, for simplicity I'll label time complexities here with the first letter:

$M(n)$ for multiplication
$D(n)$ for division
$E(n)$ for exponentiation

I have two conditions to work with:

d is a power of 2, so $d=2^n$ for some known n (this is convenient because modulo, which is $D(n)$, can be replaced by bitwise AND, which is $O(n)$)
a and c are odd, if not primes, which they probably will be (this could be inferred, since a has to be odd to generate all other odd values, of which c is one)

Naive brute force search would then be $O(2^nE(n))$. The best any algorithm (that I've heard of) does is subexponential - still not polynomial, which is what I'm aiming for.

I have algorithms for some of the other (non-trivial) ones, namely:

(Modular) Division

$D(n)=O(n^2)$ or so
Tested with 65536-bit numbers (Python, took a few seconds)

(Modular) Exponentiation

$E(n)=O(M(n)n)$, in my case, $M(n)=O(n^2)$ so $E(n)=O(n^3)$
Tested with 16384-bit numbers (Python, took a few seconds)

Discrete logarithm has me stumped. Since modulus power of 2 allows usage of various bit twiddling hacks and other shortcuts that normally would never work, I think it can be done in polynomial time for this case. No idea how though.


texts:
I have been reading about FHE lately, and it seems that bootstrapping is the core concept in order to develop FHE schemes. But, I don't exactly understand the idea behind it. I know that the schemes based on Gentry's design are noise-based, and that the noise increases with each homomorphic operation, and if the noise exceeds certain threshold, then decryption will fail. I guess bootstrapping was developed as a solution to this problem. But what exactly is bootstrapping?

I came across following definition, but I don't understand what it wants to say.

  Definition: A $\mathcal{C}$-evaluation scheme is called bootstrappable if it is able to homomorphically evaluate its
  own decryption circuit plus one additional $\mathsf{NAND}$ gate.

I know what a $\mathcal{C}$-evaluation scheme is, but what exactly it means with "homomorphically evaluate its own decryption circuit", and why the "plus one $\mathsf{NAND}$ gate"?


texts: How were the number of rounds for different key sizes of AES selected?

texts: The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?


texts: How can I evaluate the congruency of an AKS primality test?

texts:
Despite the fact primality test is a mathematical issue, it plays a part on the security of many cryptosystems such as RSA. I was trying to understand how it works until I came to the following congruency:

〖(X+a)〗^p≡X^p+a (mod X^r-1,p)

The above reduces evaluating the initial congruency 〖(X+a)〗^p≡X^p+a (mod p) to have less coefficient. How do we evaluate the above one?


texts:
I'd like to generate a passphrase derived from a hash fingerprint. The passphrase consists of short and human-pronounceable words from a phonetically-distinct wordlist. The derivation is a one-way function and it is acceptable for this application to lower the security against collision attacks/reduce the keyspace.

For example, a function that map 5a1138375b1c38ab49800911e6e533e2b3e60e314a042c5bca01324dc75bc710 to daycare qualified irregular plastic and that has a collision resistance as high as possible considering the reduced keyspace of the passphrase.

For this application, is it OK to use a pseudo-random number generator with the hash value as the seed to select the words of the passphrase? Are there better alternatives?

Edit: Below is a visualisation (Mathematica source) of using base conversion which is not a divisor of hash size (in this particular case $|wordlist|=5$ with 3 words derived from a 8-bit hash).


texts: Do you need both client and server side support for TLS 1.3 record padding?

texts: When you enable record padding for a client, does a server need a specific option to support this? Or does the other end only need to support TLS 1.3 as well and can handle the padding automatically?


texts: Is the beaufort cipher just as secure as the Vigenere cipher?

texts: Does the Beaufort cipher have the same strength as the vigenere cipher assuming you use the same complexity of key, or because of it's reciprocal nature make it less secure?


texts: Are there any authenticated stream ciphers that use the same PRF for MAC and cipher?

texts:
A PRF can be used both to generate a key stream for use in a stream cipher, and to construct a MAC to authenticate. The two can then be combined e.g. in a generic encrypt-then-MAC construction to create an authenticated stream cipher, using the same PRF for both (with independent keys). Is this actually done in any real-world authenticated encryption scheme? I see constructions like Salsa20/ChaCha20 stream ciphers combined with Poly1305 (a secure MAC, but not a PRF). Presumably you could combine ChaCha20 with Blake2, which is based on the same round function internally, but even here there are differences in the PRF (as I understand it). Are there any real-world cases where exactly the same PRF is used for both? If not, is there a reason why not?

One similar real-world construction I can think of is CCM mode where the same block cipher (e.g. AES) is used both in CBC-MAC and then in CTR mode. This provides some code size advantages as the same code can be used for both operations (and you only need the encrypt direction of AES too). Presumably similar arguments could be made for an authenticated stream cipher that used the same PRF for both key stream generation and MAC.


texts: Generalization of the DL-assumption in bilinear group pair

texts:
When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then:

  Given $P, zP \in G_1$ and $Q, zQ \in G_2$, compute $z$.

I haven't found this problem in the literature anywhere, so I am not aware of any name of it. It clearly implies the discrete logarithm problems in $G_1$ and $G_2$, but those two do not seem to imply this problem on their own or combined. On the other hand, it is implied by the co-CDH* as well as the q-SDH assumptions - but those are stronger than I need.

I'm wondering the following two things:

Has this problem appeared anywhere in the literature?
Is it implied by any other common assumptions?

It seems very natural to assume the hardness of this problem in a Type 3 cryptographic scheme. Usually the point of working with a Type 3 pairing is exactly to have such a tuple, and use the pairing to decide if the fourth element indeed equals $zQ$ or some other element. So if this problem is not hard and $z$ is private, then you're in trouble.


texts: Understanding how padding works when using Block Cipher

texts:
I'm trying to understand how padding works when using block ciphers.

  Padding may be required when the size of the plain text is not a multiple of the block size

If that's so, then I don't understand the results I am getting on my Ubuntu VM.

I created a .txt file in size of 20 bytes, encrypted it using AES128-ECB. I then ran a command to check the encrypted .bin file size and it was 32 bytes as expected.

What I don't understand is the following scenario — I created another .txt file, this time in size of 32 bytes, encrypted it using same method and when I checked the encrypted file's size I got 48 bytes and not 32.

My question is why is it I am getting 48 bytes instead of 32? Obviously this time the plain text's size was a multiple of the block size and yet it treated it as if it wasn't.


texts: What are different types of signature properties?

texts: I am reading about digital signatures these days. I read about blind signatures, group signatures and ring signatures. Are there other type of signatures as well?


texts: How can convert affine to Jacobian coordinates?

texts:
I have a point in affine coordinates: $(x,y)$.

What should I do when I want to convert to $(X,Y,Z)$ in Jacobian coordinates?
I need it for calculating ECC in a prime field.


texts: Strategy for random CTR initial counter values

texts:
Alice has a secret key which she uses to encrypt messages in CTR mode. CTR mode is critically vulnerable to counter reuse, and Alice has a problem: she has terrible memory and no pen to write anything down. She has good enough memory to send one message, but between messages she sometimes forgets the counter values that she has used. She has the key tattooed on her forearm. She doesn't have a watch that would give her a convenient non-repeating input. She has a balanced coin which she can flip to generate random numbers. She wants to ensure that she won't reuse a counter value, because Eve is lurking around, makes xoring things a hobby and she can even suggest some plaintexts for Alice to encrypt.

In other words, I have an embedded device which has some code and a key in ROM, and a hardware RNG, but no clock (unlike Making counter (CTR) mode robust against application state loss) and no persistent rewritable storage (unlike CTR mode nonce with aggressive key rotation policy). This device emits messages encrypted with AES-CTR, using that one key in ROM. Integrity of these messages is beyond the scope of this question. The device can lose power at any time, and at that point, it loses track of the previous counter value. It typically sends many messages between resets, but in some circumstances an attacker could arrange to cut power off at inopportune times.

What is the best strategy to avoid counter reuse, and after how much traffic does the probability of counter reuse get non-negligible? For example, I can generate a new initial counter for every message, or a new initial counter on every reset. I can start each message at the current counter value, or use a scheme such as 96 bits of randomness and a per-message counter starting at 0. (No message is more than $2^{32}-2$ blocks long.) Does this make a difference in the probability of collisions?


texts: Simple protocol for 1-out-of-2 oblivious transfer

texts:
I'm trying to explain the concept of 1-out-of-2 oblivious transfer to folks who haven't seen this idea before.  I can explain what properties it provides, but it's also helpful if I can show a simple protocol for 1-out-of-2 OT, to give people a feeling that this is achievable.

What's a simple protocol for 1-out-of-2 OT that doesn't need much explanation or advanced cryptography to understand?

I don't need something you'd actually want to use in practice.  It doesn't need to be the most efficient, the most practical, or have a clean security proof: just something that gives the basic idea.  I'm asking only for pedagogical purposes, not to build a real system.  Assume the audience is familiar with basic concepts of cryptography (including things like RSA, Diffie-Hellman, etc.) but may not be familiar with advanced concepts (e.g., zero-knowledge proofs, secure multiparty computation).


texts:
I just learned that a CSR can be signed. See this Why is a CSR signed and which key is used for signing?

I tried to check the csr with below openssl command, but failed with errors "139942025398160:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: CERTIFICATE REQUEST"

  openssl req -in signed_csr_file.scsr -noout -verify

Does anyone know how to check signed csr with openssl ?

Thanks


texts: What are the practical differences between SCRAM and PAKE (OPAQUE) for simple authentication?

texts:
As far as I can tell from reading about SCRAM and OPAQUE is that Wikipedia puts both of them in the category of challenge-response authentication.

It's clear to me that SCRAM has an IETF RFC, whereas OPAQUE only has a draft.

However, what are some practical differences between them? For example, are both suitable for use in an SASL mechanism? What do each of them leak to the other party? What are their strengths and weaknesses?