texts: Why create a subkey in the digital signature algorithm

texts:
In the signing step, wikipedia, a subkey is created.

A key k is randomly chosen from 1..q-1.

What's the use of that k?

If the k is to make less exposure to the private x; however, x is inevitably used in the signing part when computing s.


texts: Using Diffie Hellman with a shared secret

texts:
For a crypto course I need to realize a small software project where a client and a server want to communicate over a unsecured network. They both have the same secret. So I bascially have to secure Diffie Hellman against MIM attacks.

Now I must admit that I don't really understand the mathematics behind DH, but I grasp the concept with easy words: Both generate a random private key, share their random generated public key. Then both parties can calculate the symmetrical key from that.

Is there an easy way to secure DH against MIM? My workaround would be to just use the DH sym key, add the shared secret (as "salt") and generate a new sym key from it by using PDKF2. But I'm sure there is smarter way to do this?


texts: Super-simple encryption of short strings

texts:
I want to anonymise the initials of experiment participants by giving each a pseudonymic set of initials, by encrypting their true initials. Their initials are only two or three letters in length.

These are data from individual human experiment participants that I publish online and in scientific journals. The convention (from a more innocent time) is to inset each participant's initials in a graph of their data. Using Github I will publish all the code and anonymised data, excepting the key (more background: https://plus.google.com/+AlexHolcombe/posts/1sNgTnnAtYz). Symmetric encryption seems fine.

Is there a suitable algorithm simple enough to quickly implement in the R statistical language?  I came across the Vignere cipher, which seems to be exactly what I need, but I know almost nothing about cryptography so perhaps that is naive.
http://www.counton.org/explorer/codebreaking/vigenere-cipher.php


texts: Meaning of "integers modulo 4 " in "Fully homomorphic encryption modulo Fermat numbers" scheme

texts:
My question refers to the paper "Fully homomorphic encryption modulo
Fermat numbers" by Antoine Joux. On page 3, the author describes a basic concept of the system:

  As many FHE systems, we deal with noisy messages. In our case, the high
  bits of each block are used to hold significant bits, while the low bits contain
  noise. A fundamental identity that makes the system work is that given two bits
  x and y , we have:
  x + y = 2(x ∧ y) + (x ⊕ y).
  Thus, if we can add the values of two bits as integers, or even as integers modulo 4, we are simultaneously computing an AND and a XOR gate.

I don't understand the difference between "integers" and "integers modulo 4". If we have only two variables which hold a single bit, the sum of both can be a maximum of 2. So what is the necessity to use a modulo 4 ring? And why not modulo 3, modulo 8 or any other number?


texts: should one worry about timing attacks with signature verification?

texts:
To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was different.

In ECDSA and DSA you compare $r$ to some value to see if the signature is valid. But I'm thinking that there's no need to do a timing insensitive equality test because, with signature verification, you're using all publicly available information anyway?


texts: How can I decrypt 8 times repeated 128-bit AES key encrypted by 1024-bit RSA?

texts:
There is a 128-bit AES key $m$, and it's encrypted by 1024-bit RSA modulus $n$ as $$c = (m\mathbin\| m\mathbin\|\ldots\mathbin\|m)^e \bmod n.$$

There are eight $m$ in $m\mathbin\| m\mathbin\|\ldots\mathbin\|m$.

Is there any way to find a message $m$?

The key is repeated 8 times, but I can't utilize this information to decrypt.


texts:
My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the data.

If you have a situation where it is hard to guarantee that the NONCE will always be unique, but you have a fast (whatever that means in your context) encryption implementation, can I take away the leverage that repeated NONCES give by adding an additional encryption step the normal CTR mode process?

E.g. replace

AES256(key, NONCE) XOR Plaintext

with

AES256(key2, (AES(key1, NONCE) XOR Plaintext))

I understand I loose CTR mode's ability to work with arbitrary length plaintexts (which is fine for me, I'm happy working in blocks), and that I have doubled the amount of encryption I need to do,  but I think this retains the advantages of CTR mode (as opposed to ECB mode) while gaining some protection against repeated NONCEs.

Is this approach valid?  Is there a lighter way to gain some protection against repeated NONCEs?

I am focusing on CTR mode because my communication channel is not necessarily reliable and I worry about the need to "resync" if I use any of the chained modes.


texts: Developing algorithm for detecting plain text via frequency analysis

texts:
I'm currently attempting the Matasano Crypto Challenges as a basic intro to cryptography. For solving some of the earlier challenges I utilised n-grams to determine which is going to be the most likely English plain text. It has been quite successful.

I'm up to attempting to break repeating XOR, which involves grouping bytes in their suspected single byte XOR group, and cracking them in this fashion. As this will be disjointed text, it appears I will need to use frequency analysis as opposed to n-grams.

I implemented a basic scoring system (similar to the below source code) source.

function getEntropy(str) {
    var sum = 0;
    var ignored = 0;
    for (var i = 0; i < str.length; i++) {
        var c = str.charCodeAt(i);
        if      (c >= 65 && c <=  90) sum += Math.log(ENGLISH_FREQS[c - 65]);  // Uppercase
        else if (c >= 97 && c <= 122) sum += Math.log(ENGLISH_FREQS[c - 97]);  // Lowercase
        else ignored++;
    }
    return -sum / Math.log(2) / (str.length - ignored);
}

With short cipher texts though I've had the issue that garbled text with more printable ASCII has scored higher than correctly formed English. I.e. FKDASDOFD may score higher than THE RIVER, as it's got a space which isn't counted towards its score.

From this, I've been trying to come up with a way of perhaps scoring the letter count against it's expected frequency, while penalising the score for each letter the further it is away from it's expected value according to normal distribution.

For example, a very rough though process of algorithm I'm trying to implement.

1) "a" has a frequency of 8.167%.
2) Evaluate the frequency in the candidate plain text and compare that      against the expected value (8.167%).
3) Penalise the 'score' by multiplying it by [1-(std dev cumulative prob)]. For example if it was 1 std dev away from expected, multiply the score by [1-0.68], 3 std deviations, [1-0.997], etc.
4) Add the cumulative score for each letter to evaluate the most likely plain text.

My questions are.

Is there a better, established, algorithm out there for performing frequency analysis?
Is it simply the nature of short cipher / plain texts that there will be inherent inaccuracy in evaluating the probability of English plain text?
Is my proposed method ridiculous / naive / stupid in some way?

Thanks folks, attempting to learn so sorry if there are trivial mistakes or invalid assumptions in this question.


texts:
Question:
Suppose that there are 10000 = 10^4 banks and 10 payment card organisations (PCOs).

How many secret keys will be needed if each PCO shares a unique secret key with each bank?
How many extra secret keys will be needed if every two banks share a unique secret key?

For question 1, I figured that if there are 10,000 banks and 10 PCOs:
 10,000 * 10 = 100,000.

For question 2, I need to calculate the number of keys if every 2 banks share a key (so I guess for 10,000 banks there would be 5,000 keys?)
 5,000 * 10 = 50,000, right?

I recall that the solution could be calculated differently, something along the lines of 5,000(5,000-1)*10/2 but I don't understand the logic of this.
Could someone please explain?
(I would appreciate explanation of logic or a direction for research to understand because I feel like this should be quite straightforward and I am unsure).
Thank your for taking the time to read this!


texts: Why is $e=0$ allowed in Schnorr signatures?

texts:
In a Schnorr signature (Wikipedia style), we have:

$R = kG$, where $0<k<n$ is a nonce and $G$ is the generator point.
$e = H(R \| M) \bmod n$, where $H()$ is a hashing function and $M$ is the message.
Finally $s = k - xe \bmod n$, where $x$ is the private key. The signature is then either $(R,s)$ or $(e,s)$ depending on convention.
Verifiers check that $R = sG + eP$, where $P = xG$ is the public key.

Strangely, if $e=0$ then no knowledge of $x$ is proven, as all steps can be carried out by someone who knows only $M$. So, why is $e=0$ not disallowed?

The only answer I can find to this is that breaking the hash function to obtain $e=0$ should generally have twice the security level (in bits) of that required to directly break the public key. And, it is most convenient to skip the extra steps of checking zero-ness of $e$, so for practical reasons the case of $e=0$ is glossed over.


texts: Is it possible: Derived key based on variable number of private keys?

texts:
I have a MySQL database that I want to encrypt with AES_ENCRYPT() and have to provide access to a variable and possibly changing number of users.

Is it possible to derive an encryption key based on a variable number of users such that each user can access the data with their unique private password, but no attacker can access the data without such a password?

The original process encrypted the database with a key held on the server. I proposed as one step better to do so with a shared key held by all users with access to the system, but not stored on the server.

This would be better but ideally each user would access the data with individual private keys such that

Any given key(s) could be revoked
New key(s) could be issued
No access would be possible without a valid key

Is such a system possible?


texts: Is Finite Field Multiplication Distributive? Moving Affine Transform in AES

texts:
In AES the output of the SubBytes step is equal to:

$a_{0-15} = d*c_{0-15}^{-1}+b$

where $d$ is a constant 8x8 matrix and b is a constant 8x1 matrix both in $GF(2)$. The inversion is done in $GF(2^8)$.

After ShiftRows the output column of each MixColumns can be expressed in terms of four select $a$ values.

$m_0 =  2a_0+ 3a_1 + a_2 + a_3$

$m_1 =  a_0 + 2a_1 + 3a_2 + a_3$

$m_2 =  a_0 + a_1 + 2a_2 + 3a_3$

$m_3 =  3a_0 + a_1 + a_2 + 2*a_3$

Is there any reason that you can't take $m_0$ for instance and write it as:

$\begin{align*}
m_0 =& 2(da_0+b) + 3(da_1+b) + (da_2+b) + (da_3+b)\\
=& 2da_0+2b + 3da_1+3b + da_2+b + da_3+b\\
=& d(2a_0+3a_1+a_2+a_3)+b\\
\end{align*}
$

This would be the MixColumns operation followed by the affine transform.


texts: Hypothetical DES weakness: dual encryption identical to single encryption with specific keys

texts: If there always existed a $k_3$ such that $\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$,  how would that affect the security of the DES block cipher?


texts: "Random permutation" in the random oracle model?

texts:
I'm trying to read through a paper on ring signatures - "How to Leak a Secret" by Rivest, Shamir, Tauman (link: https://link.springer.com/content/pdf/10.1007%2F3-540-45682-1_32.pdf )

In section 3.2 it is said

  We assume the existence of a publicly defined symmetric encryption algorithm
  $E$ such that for any key $k$ of length $l$, the function $E_k$ is a permutation over b-bit
  strings. Here we use the random (permutation) oracle model which assumes that
  all the parties have access to an oracle that provides truly random answers to new
  queries of the form $E_k(x)$ and $E^{−1}
_k (y)$, provided only that they are consistent
  with previous answers and with the requirement that $E_k$ be a permutation

What exactly does this mean? Is $ E_k $ available to (and only to) parties who know the secret key $k$ and does it give random answers to new queries in the same sense as a random oracle, except it's bijective and there's also the inverse oracle? And is this assumption equivalent to the random oracle model? That is, can we construct $E$ given access to a random oracle?


texts: Automated security protocol verification tool for eCK model

texts:
I want a tool that (runs on Win7 and) can perform automated verification of a protocol in the eCK security model as described in Microsoft Research's paper "Stronger Security of Authenticated Key Exchange".

Does anyone know such a tool?


texts: In practice, do large prime generators account for difference in gaps between primes?

texts:
It is my understanding that a method for creating large primes is to:

pick a random large number,
check the number against trial division of a set of smaller prime numbers,
check with something like Miller-Rabin
if not prime increment by 2 and repeat

Is this method used in practice? And if so, does it matter that the method is biased towards primes that follow large gaps? How would you alter the method to make it more fair?


texts: Elliptic curve over prime field with high order roots of unity

texts:
Suppose I have an elliptic curve defined over a prime field $\operatorname{GF}(p)$ where $p$ is a large prime (e.g. 256-bit). Suppose also that $p = kn +1$, where $n$ is a relatively large power of $2$ (e.g. $2^{32}$). This structure implies that $\operatorname{GF}(p)$ has $n^{\mathit{th}}$ roots of unity.

My question is: does the fact that $\operatorname{GF}(p)$ has "high order" roots of unity make curves defined over this field inherently less secure?


texts: Geometry of the outputs of linear congruential random number generators

texts: I learned that possible $m$ long sequences produced by linear congruential random number generators(of the form $r_{i+1}\equiv ar_i+b \mod n$) fall on hyperplanes. Using this fact I have come to think it might be possible to significantly narrow down the number of possible output sequences. Sadly I found the information of this topic to be quite scattered around in various academic papers and similar. I would highly appreciate it if anyone could point me either to the appropriate resources or even provide an answer to this question. Thanks for any replies in advance.


texts: Is this JS library using openssl genrsa -rand improperly?

texts:
pem, a JS wrapper around openssl, has the following code in it:

var params = ['genrsa',
    '-rand',
    '/var/log/mail:/var/log/messages',
    keyBitsize
];

Am I correct in thinking that that is an improper usage of the -rand option (poor entropy = bad seed for random number generator)?

Cause this dude just closed the issue thinking it's OK, and if he's wrong, it'd be nice if someone could explain in better detail than I can why what he is doing is unsafe.

If I'm mistaken and it is safe, I'd be curious to hear why.

Thanks Cryptography StackExchange!


texts:
I would like to use a PRG in order to achieve the commitment properties (i.e. Hiding and Binding), however, if we look at a general PRG we cannot state that it has the Binding property.

First I show that it could be shown that it has the Hiding property: given the PRG result on a random seed $s$, i.e. given $g=PRG(s)$, the receiver cannot tell the pre-image of $g$ with more than negligible probability since if there exist a receiver that can produce the pre-image than we can construct a distinguisher to the PRG with the same probability of success.

On the other hand, if we look at the binding property, we cannot state the above, since there exist PRGs that output the same result when operating on seed $s$ and when operating on seed $s+1$ for every even $s$. This can be easily proven. (And thus, the sender surely can commit on even $s$ and later open $s+1$).

My question: Does there exist a variant of a PRG that is proven to provide the commitment properties?


texts: NIZK proof for Order-preserving encryption

texts:
Suppose a cipher c=Enc(K,m), where Enc() is the order-preserving encryption scheme. Can NIZK be used to prove that c does indeed encrypt m? The Schnorr NIZK is based on discrete logarithms equality. I don't know if it can be used for order-preserving encryption.

Thank you!


texts: Circular hash collision where digest is pre-image: Could hash(a) = b, hash(b)=c, then hash(c)=a?

texts:
For any SHA-family of algorithms (including Keccak) except for SHA1, would it be theoretically possible for there to exist a pre-image a whose hash digest b is the pre-image to the hash digest c which is the pre-image to a thus completing a circle (i.e. circular hash or collision of pre-image a with the digest a)?

${{hash(A)\to B}}$, ${{hash(B)\to C}}$ , ${{hash(C)\to A}}$

Given the use of XOR and bit-rotations, as well as padding and pre-processing and the many steps involved in hash functions such as SHA256 or SHA512, would it be possible for the above circular hash scenario to exist? (despite the unlikelihood of it being found)

P.S. candidate values include an all-zero string for pre-image or digest, or any valid-length output (i.e. 256, 512).


texts:
in Bilinear pairings, what is the difference between Type 2 and Type 3?

I understand in Type 2, there exists an efficiently computable homomorphic function $\phi : G_2 \rightarrow G_1$ , which is not present in Type 3 pairings.

But what I don't understand is what is the use of the homomorphism in cryptography?

For those who might need a refresher, for a bilinear pairing $e : G_1 \times G_2 \rightarrow G_T$ , we define

Type 2: $G_1 \neq G_2$ and there is an efficiently computable homomorphic function $\phi : G_2 \rightarrow G_1$
Type 3: $G_1 \neq G_2$ and there is NO efficiently computable homomorphic function


texts: Bit commitment with 1-out-of-2 oblivious transfer

texts:
I know a protocol for bit commitment using regular OT (Bob has 1/2

chance of learning the bit Alice transferred to him) which goes like this:

  COMMITMENT PHASE
  Alice chooses a bit $b$
  For $i=0$ to $i=n^2$
  $\;\;\;$Alice chooses $x_{ij}$ for $1\leq j\leq n^2$ randomly so that $(\sum_jx_{ij}) \equiv b \pmod 2$
  $\;\;\;$Alice and Bob do an oblivious transfer $OT(x_{ij}=y_{ij})$ for every $j$

  REVEAL PHASE
  Alice sends to Bob committed bit $b$ and all of the $x_{ij}$.
  If $(\sum_jx_{ij}) \not\equiv b \pmod 2$ for one $i$, Bob rejects. Otherwise, he accepts.

So this protocol uses $n^2$ iterations of OT. I'm trying to find a protocol that would use instead $n$

iterations of $\binom{1}{2}-OT$ (1-out-of-2 oblivious transfer) with exponential security in $n$. I'm thinking

about using $xor$'s and random bits but the only way I can think about has linear security (I think) ...

  COMMITMENT PHASE
  Alice chooses $b$ and $2n$ random bits $\{b_1,b_2,\dots,b_{2n}\}$

  such that $b_1\oplus b_2=b$, $b_3\oplus b_4=b$, $\dots,b_{2n-1}\oplus b_{2n}=b$.
  Bob chooses bits $c_1,\dots, c_n$.
  Alice and Bob do a $\binom{1}{2}-OT$ for every $\{b_1,b_2,c_1\},\{b_3,b_4,c_2\},\dots,\{b_{2n-1},b_{2n},c_n\}$.
  REVEAL PHASE
  Alice sends to Bob committed bit $b$ and all of the $b_i\in b_{2n}$.
  Bob checks if $b_1\oplus b_2=b$, $b_3\oplus b_4=b$, $\dots,b_{2n-1}\oplus b_{2n}=b$.

  If it fails once, he rejects, otherwise he accepts.

I would like some of your inputs to know if I'm heading in the right direction.


texts: Is using same key pair for both encryption and signing secure in RSA

texts: In GPG, we can use same key pair for encryption and signing. Can't/Shouldn't we do this in RSA. I am using  RSAES-OAEP and RSASSA-PSS, not raw RSA btw.


texts: What are the advantages of using OFB (Output Feedback Mode)?

texts: I have a problem with OFB mode, because I have heard that it is stronger than CFB.


texts: Is there an encryption scheme that provides $Pr\{M_1 = m_1\wedge M_2 = m_2 | C_1 = c_1 \wedge C_2 = c_2\} = Pr\{M_1 = m_1 \wedge M_2 = m_2\}$

texts:
Question:

Consider the following definition of perfect secrecy for the encryption of two messages.An encryption scheme (Gen, Enc, Dec) over a message space M is perfectly-secret fortwo messages if for all distributions over M, and for all $m_1,m_2 \in M$ an d $c_1, c_2 \in C$ with $Pr\{C_1 =~c_1 \wedge C_2 =~c_2\} > 0$:

$^{(*)}$$Pr\{M_1 = m_1\wedge M_2 = m_2 | C_1 = c_1 \wedge C_2 = c_2\} = Pr\{M_1 = m_1 \wedge M_2 = m_2\}$,
where $m_1$ and $m_2$ are sampled independently from the same distribution over M. Prove that no encryption scheme satisfies this definition.

My induction:

So I think if an encryption scheme provides $^{(*)}$ then it can't provide the corectness condition.

($Pr\{k\longleftarrow Gen();c=Enc_k(m);\hat{m}=Dec_k(c):m=\hat{m}\}=1$)

because let $m_1,m_2=m$ and $c_1,c_2=Dec_k(m)$ in $^{(*)}$.
it's seems that we can't determine if $c$ is the cipher of $m$ or not but I can't also prove that

$Pr\{k\longleftarrow Gen();c=Enc_k(m);\hat{m}=Dec_k(c):m=\hat{m}\}<1$


texts:
I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage.
The description says, what this function actually does:

  The CryptSignAndEncryptMessage function creates a hash of the
  specified content, signs the hash, encrypts the content, hashes the
  encrypted contents and the signed hash, and then encodes both the
  encrypted content and the signed hash. The result is the same as if
  the hash were first signed and then encrypted.

If I understood correctly, this solution could be susceptible to an attack called surreptitious forwarding?

Surreptitious forwarding uses the naive "sign and encrypt" approach to allow B to forward a message of A, destined to B, to a third party C and make C think the message was from B, destined to C (although it was from A to B, and just forwarded by B). This is possible because B can decrypt the signed message and re-encrypt it for C.
However, although a message can be forwarded "illegally", the actual message content cannot be changed.

Does this in turn mean, if I include the receiver in the signed data, I am not susceptible to this attack?


texts: What is meant by domain separation in the context of KDF?

texts:
This is a quote from my cryptography notes:

If $h$ is a random function oracle of output length $n$ then also the two KDF constructions:
$K(x) = h([0] \| x) \ldots \| h([L] \| x)$
$K(x) = h(x \| [0] ) \ldots \| h(x \| [L])$
yield random function oracles of otput length $L \cdot n$.

They call this property domain separation. What does this property mean? Can it  be applied to only this setting or is it more general? What about the proof of this quote, is it inmediate?


texts:
This is a super basic cryptography and I don't get it. My professor only explained it to us on a very abstract level, which I just agreed to without questioning it.
The DLP says it is easy to calculate a^x, but it is not easy to find x with a logarithm if you use a cyclic group. The idea behind the cyclic group is to shuffle the numbers. If you don't do it, you can guess your way to the exponent, because the numbers are ordered and you know if you get a two high or two low number, you can guess in the right direciton.
So very abstract, I do get it. But very concrete, I don't.
What I don't get
I mean, with the DH Alice send g^x and g, Bob sends g^y. So the evil person gets both g, g^x and g^y. And she wants to find log_g(g^x) which gives her x. What is her problem? She knows g and she knows what what the number (g^x) is.
I mean, I don't know how to type this in on a calculator because we only used log_e (also called ln) and log_10 (which is just log on my calculator). If I take my calculator and I type log(100), which is log_10(100), I get 2. Which is the number I looked for. Why can't Eve do the same?
Sorry, this is a very stupid question, but I am too emeberassed to ask anyone else than you ^^


texts: The use of the term "sound" in cryptography

texts: In the context of interactive proof systems, we often see the term "sound" used. What is the sense of this word?


texts: What is certainty in a real world zero knowledge proof?

texts:
This question follows directly on from How do I explain zero knowledge proof to my 7 year old cousin?

Most of the simplistic answers there suggest that proof is obtained iteratively, slowly reducing the probability of Peggy simply randomly going through the cave. Or counting leaves over and over.  The Wikipedia page suggests the Peggy should demonstrate her magic skills 20 times. Later on there is mention of repeating the proof 128 times. That's a bit of a statistical difference.

In a real world situation of proving something like the existence of a correct 256 bit AES key, how many times would the proving have to be attempted for certainty?


texts:
The classic discrete logarithm problem is to find $x\in\Bbb Z_p$ such that we know generator $g$ of $Z_p$ and $p$ is a prime with $\frac{p-1}2$ a Sophie Germain prime and we are given $h\in\Bbb Z_p$ such that $g^x\equiv h\bmod p$ holds.

Suppose given $g^x\equiv h\bmod p$ we know how to generate $g^{x^{2^i}}\bmod p$ at every $i\in\Bbb N$ in $O((\log ip)^c)$ time at a fixed $c>0$ does it help to solve finding $x\in\Bbb Z_p$?

Also is it known how to generate $g^{x^{2^i}}\bmod p$ at every $i\in\Bbb N$ in $O((\log ip)^c)$ time at a fixed $c>0$?


texts:
How is synchronization of counter values achieved in the HOTP protocol?

As I understand it, the server increments its counter value only if a match (of  the OTP value) is found. What happens at client side?

Suppose server verifies 50 successful attempts from client which implies counter value at server is 50. What if a fresh request comes from a different client with counter value 0?
The server could only check for counter values 50,51,52 if window size is 3,or 50-100 if window size is 50. In both the cases there will be no match as client side counter value is 0.


texts: HMAC SHA256 for deriving session keys using random nonce

texts:
I need to derive session key in order to create an application layer secure channel between mobile app and a bluetooth device. My scheme is similar to
this scheme that uses a HMAC and counter.

Provided that between mobile app and BLE device have already share a same key $K$ (256-bits) through provisioning process, I plan to derive session key with these steps:

Let $A$ be 16-bytes of generated random number from mobile app and $B$ be 16-bytes of generated random number from BLE device. Both are treated as nonce or IV.
Mobile app sends random $R_A$ to BLE device $A$ and BLE device sends its random $R_B$ to mobile app $B$ on unsecure communication channel.
Both mobile app and BLE device derive session key using:

Session Key = $\text{HMAC-SHA256}(K, R_A||R_B)$

The random $R_A$ and $R_B$ are both concatenated.

Now both parties will share the same session key for upcoming communication using AES. I use this scheme because my BLE device is limited on its processing power for asymmetric method.

Is it safe to implement this scheme for deriving session key?


texts: How to go about distributed private/public key pair generation?

texts:
I'm trying to implement a protocol in which two parties generate a private/public keypair, where both know the public key, but each party has only one part of the private key and cannot derive the full private key without having the other part.

Can this be achieved by using existing distributed key generation protocols? I've found this, could the two parties retrieve a single private key corresponding to the shared public key with their combined shares?


texts: Is it necessary to transmit two or three points of an elliptic curve?

texts:
Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? Therefore we need a faster compress-decompression method for these two or three points, than just $x$-coordinates. The latter requires solving two or three quadratic equations to find $y$-coordinates.

I just invented one interesting method such that compression is bit slower, but decompression is much faster. Number of bits in the compressed form remains the same, i.e., $2\log(q)$ or $3\log(q)$ respectively. Is it useful for cryptographic society? If I am right, the Diffie-Hellman protocol and ECDSA require transmit just one point for each party.


texts: What are the approaches to private computations?

texts:
I'm talking about the ability to safely run a virtual machine on a physical device that is not trusted. It is necessary that the owner can not access the data that the virtual machine operates on. I am interested in what theoretical or practical implementations exist without special hardware.

I know about homomorphic computations (this in theory fully satisfies my question), but for now it's incredibly slow. It will take many years before the protocols of homomorphic calculations just approach application in practice.

I also read about Intel SGX, which implements enclaves. The RAM stores only encrypted data, which is decrypted at the input to the processor and is again encrypted at the output. The disadvantage of Intel SGX is that you need special hardware. How could you do something like this without a special hardware? How can we store a key for decrypting data from RAM so that the owner of this physical device can not recognize this key?


texts: Security implication of deriving key with fixed salt for files authentication

texts:
Context:
I need to calculate MAC for a collection of files just for future integrity and authentication verification.

This is the conceptual order of steps:

Derive a 64 bytes key from user input password, using PBKDF2 (with sha512) with 10k iterations and fixed salt.
Then, use this derived key to calculate the MAC using HMAC+BLAKE2b(512) and store the output for possible future verification.

PBKDF2 is used instead of HKDF because I can't ensure that the input will have enough entropy.

The key derivation step happens once (on app initialization) and later used multiple times to calculate MAC of arbitrary number of files. Generating an random IV is not possible because I don't want (as far as possible) generate a derived key for every file. Having duplicated MAC digests for duplicated files it is not an issue.

Question: For that purpose, are there some security implications having that salt as a fixed byte string?

Answer: As @SEJPM pointed me, the general security model of MAC algorithms assumes that the keys will be reused for calculate arbitrary number of MAC's, so this scheme should be secure.


texts: Would key stretching help mitigate concerns with "verifiably random"?

texts:
Daniel J. Bernstein (and others) have expressed concern over how "verifiably random" curve parameters are generated.  He points out that hashing a public seed doesn't prevent, say, the US government (NIST/NSA) from choosing a seed that produces parameters with a one-in-a-million weakness that is not yet known to the academic community.

If the seed were hashed iteratively instead of just once, would this help address these concerns?  If my thinking is correct, iterating a hash function $2^{40}$ times on the seed when producing the standard should make one-in-a-trillion weaknesses mostly infeasible and one-in-a-million weaknesses much more difficult.


texts: How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?

texts:
To get some certain properties for my use case I need a prime $P$ which has the form:

$P=2\cdot Q \cdot R \cdot S \cdot t+1$
with $Q,R,S,t$ primes as well.

Why that form - Use case

Together with this three factors $q,r,s$ are used. The values $v$ of interest have the form
$v(a,b,c) = q^ar^bs^c\bmod P$,

Those factors have the following properties:
$q^Q \equiv 1 \bmod P$
$r^R \equiv 1 \bmod P$
$s^S \equiv 1 \bmod P$

and the equation holds:
$q^{a+dQ}r^{b+eR}s^{c+fS} \equiv q^{a}r^{b}s^{c} \bmod P$, with any $d,e,f \in \mathbb{N}$

so

$|\{v(a,b,c), \forall a,b,c \in \mathbb{N}\}| = QRS = \frac{P-1}{2t}$

If another factor is added:

$v(a,b,c,T) = q^ar^bs^c T\bmod P$, with any $T\in\mathbb{N} < P$

you can achive:

$|\{v(a,b,c,T), \forall a,b,c,T <P \in \mathbb{N}\}| = P-1$
Two different $T$ have $0$ or all values equal.

That those properties work the prime $P$ need to have the form:

$P=2QRSt+1$

(constructed myself, there might be better options)

It also works with $t=1, T=1$. With this half of all values ($(P-1)/2$) can get generated.

How safe is such a prime?

A user and also possible attacker has access to the source code and all runtime variables. For a given $v$, which is not computed at the local PC (its just a random number) the attacker should not be able to determine the values $a,b,c$ and $T$ in:

$v(a,b,c,T) \equiv q^ar^bs^c T\bmod P$

or to be more exact, he should not be able to derive one $v'$ out of another $v$

$v'(a',b',c',T') \equiv v \cdot q^{a'}r^{b'}s^{c'} T'\bmod P$

The attacker knows all other values $P,Q,R,S,q,r,s,t$

$Q,R,S$ need to be about the same size, $t$ is much smaller $t\ll Q,R,S$, in use case less than $t<1000$;

I read about safe and strong primes. Both don't hold for that kind of prime form. How much safety get lost with that form? Would it help if

$Q,R,S$ are safe/strong primes

if $P+1$ has a large prime factor

You know about other enhancements?

Comparison to normal discrete logarithm

The form above is different to the normal discrete logarithm problem form like:

$v'\equiv g^x \bmod P'$ and finding $x$ for a given $v'$

I'm not familiar with all discrete log. solving algorithms. Does it make a difference if there is only one base ($g$) or three of it ($q,r,s$)? Three harder or faster solving?

Assuming $S$ is a safe prime and largest out of $Q,R,S,t$. Could you compare the mean solving time complexity of

finding $a,b,c,T$ for a given v solving:

$v \equiv q^ar^bs^c T\bmod P$

with finding d for a given $v'$

$v'\equiv g^d \bmod S$, with g prime root of $S$

Or is it harder/faster? How would a normal form look like which has about the same solving time (to get an idea how much worse my form is)?

(toy) example

$P=35531=2 \cdot 11 \cdot 17 \cdot 19 \cdot 5+1$
$r=4999, q=21433, s=3181$


texts: Does Hinek and Lam's Paper prove that Common Modulus Attacks is possible with non-coprime public exponents?

texts:
We know that Common Modulus Attacks work with coprime public exponents $(e',s)$ such that $${e_1}s+{e_2}t=\gcd(e_1,e_2)=1$$
I am reading Hinek and Lam's Paper: Common Modulus Attacks on Small Private Exponent RSA and Some Fast Variants (in Practice). Got confused, it seems they proved that Common Modulus Attacks would work with non-coprime public exponents, with the condition of "Small Private Exponent RSA".
Is my understanding correct? Is there some example for this?


texts:
I am making a program for personal use that will not contain super-sensitive information.  I am using this to explore cryptography. Would it be acceptable to use a password to generate a key for AES, or should I make a file, store it somewhere separate of the program, and call it for encryption/decryption.  If the password is too short to be an AES key, should I hash it or pad it?

I just realized that I could link to my stack overflow account! I am sorry if this question is misplaced.


texts: Book request about elliptic curves, RSA and DSA

texts:
I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :)

I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am interested in ECC and its application in GPG and SSH protocols, I googled some MIT courses but they seem too brief for deep understanding, so, please advice :)

Aim: I wanna make some research on topics to become a skilled person in this area.


texts:
I came across some ambiguous part in my cryptography lecture slides and wanted to learn. There are examples below slide(page 18-34) and after that there are some questions at the end I couldn't fully comprehend examples therefore have difficult time to solve it .
Please look this slide for reference page 18-34
You are given an oracle that can decrypt RSA ciphertexts as introduced in the lecture. The oracle uses modulus N=61, exponent e=3 and an unknown private key d. As an attacker, you can query the oracle with arbitrary ciphertexts. The oracle decrypts every ciphertext and responds with:

1: the plaintext ends with 1 (in binary)
0: the plaintext ends with 0 (in binary)

Your task is to decrypt a given ciphertext c by using clever multiplications with si, as introduced in the lecture: ci=c⋅seimodN. In task a-c you are asked to provide the bounds [x,y] for the plaintext m. These have to fulfill the following: x≤m≤y
So the questions are that
   a) You use si=2 to compute a new ciphertext and send it to the oracle. The oracle responds with 0.
    What is now the new interval of the plaintext?
    Format: x,y  Example: 4,15

   b)You use si=4 to compute a new ciphertext and send it to the oracle. The oracle responds with 1.
     What is now the new interval of the plaintext?
     Format: x,y  Example: 4,15

   c)You now continue the attack and retrieve the following results from the oracle:

   - si=8:1
   - si=16:0
   - si=32:1
   - si=64:0
   - si=128:0

     What is the original plaintext?
    Format: x
    Example: 42


texts: Quick scan which data (hmac/fernet) can be decrypted with a key?

texts:
I am designing a secure vault, which stores tens of thousands of encrypted messages and authenticated with Fernet/HMAC, A user query the vault with a key, could I use some kind of index to tell if the key can be used to decrypt any of the stored messages?

Or do I have to try decrypt them one by one?


texts: I understand that it is a system that "establishes the authenticity of the binding between public keys and their owners", but how does one join this web of trust? Do you have to physically meet one of the existing members, and they can get you in?


texts:
I am going to apply a simple substitution cipher to my input, then encrypt the result with a Hill cipher.  How can this be broken, in a chosen-plaintext threat model?

In other words, instead of the standard mapping of letters to numbers (A=0, B=1, .., Z=25), I will randomly reorder them (e.g., A=22, B=12, ...), where the particular bijection between letters and numbers is part of the key.  Then, I'll encrypt the result using a Hill cipher.  So far I've been using a Hill cipher with a $2\times 2$ matrix, but I'd also be interested in the answer for a general $n \times n$ matrix.


texts:
I have an arbitrary long list of hashes (e.g. git tree hashes), and I'm wondering by how much I am increasing the risk of hash collisions by condensing them into a single hash, like so:

import hashlib
...
rehash(list_of_hashes):
    return hashlib.sha224("".join(sorted(list_of_hashes))).hexdigest()

My feeling is that it doesn't increase the odds by an amount I need to worry about, but wouldn't mind confirmation by experts.


texts: Using a mono-alphabetic substitution cipher with a different language per word

texts:
How much harder is it to determine the secret key for a mono-alphabetic substitution cipher, if each word is translated into a different language before the cipher is applied?

If somehow computers could create their own language or set of languages such that there is a one-to-one correspondence between words and they are optimized such that the significant information obtained from the multi-language frequency table is minimized, would it result in something better?


texts: RSA: deduce the public key from message & signed message

texts: In RSA, is deducing the public key from the (message, signed message) pair possible? If so, how can it be done?


texts: Does GCM (or GHASH) only provide 64-bit security against forgeries?

texts:
In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would be $2^{64}$.

So of course I immediately checked the relevant security theorem (corollary 4):

$$\mathbf{Adv}^{\text{auth}}_{\operatorname{GCM}[\operatorname{Perm}(n),\tau]}(\mathcal A)\leq \frac{0.5(\sigma+q+q'+1)^2}{2^n}+\frac{q'(\ell_A+1)}{2^\tau}$$

with $\sigma$ being the total plaintext size in blocks, $q$ being the total number of encryption queries, $q'$ being the total number of decryption queries, $n$ being the size in bits of the underlying permutation, $\ell_A$ being maximum authenticated input length in blocks and $\tau$ being the tag size in bits.

Now clearly from this we can see that performing $2^{n/2}=2^{64}$ queries yields a strong enough advantage for a break.

Now my question is:
When talking about "n-bits of security" or "needs $2^n$ operations to break", do we usually talk about "online" security, ie queries to an oracle can be done and cost $1$ or "offline" security where no oracles are available or do we need to make this decision depending on the situation?

TL;DR: Does GCM offer 64 or 128 bit security?


texts: AES 256 CBC - Storing local data, how to save IV vector?

texts:
I want to use AES256 CBC for protecting small data (<100kb) against misusage for my application in the local store folder. I'm not an expert at data encrypting so I'm to try to understand it step by step.

I want to just make sure myself that I understand it well. I have a key for decrypting/encrypting and then IV which I generate for every new encrypting. And because IV is not a secret I can append it at the end of data something like that: encrypted data + IV and then during decrypting I just read the last 16 bytes and use the IV for decrypting. I'm right? Or is there any error I don't see?

My main intention is to hide data from the user and not allow them to change the data. So maybe, it would be better to use Authenticated Encryption (GCM?). What do you think? There are a lot of types of encryptions and I can't decide for any.

I'm using the OpenSSL library.


texts: Can I use HMAC-SHA1 in counter mode to make a stream cipher?

texts:
Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey).

Would it be secure to feed it like a block cipher in counter mode to get a random pad suitable as an stream cipher?

Of course, I'm talking about not repeating the counter value ever to encrypt data (so this construction would also need some random IV or treating the counter value as a nonce forever).


texts:
I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have PKI, but for simplicity in these examples I will not use PKI). I can use sign-encrypt-sign (as described here ECIES with ECDSA):

ECIES(Bob's public key, M || ECDSA(Alice's static private key, M))

And in this case I have structure of message for sending:

[Alice's ephemeral public key, Alice's static public key, ciphertext, Mac's tag]

I understand that this is secure, but for example Alice do:

fetch Bob's static public key
generate ephemeral key pair
SK = ECDH(Bob's static public key, Alice's ephemeral private key)
Kenc || Kmac = KDF(SK)
Ciphertext = Encrypt(Message, Kenc)
ECDSA's tag = ECDSA(Ciphertext, Alice static private key)
HMAC's tag = MAC(Alice's static public key || Ciphertext || ECDSA's tag, Kmac)

Alice make ECDSA's tag first and after that make MAC's tag based on Alice's static public key, Ciphertext, and ECDSA's tag. Alice have structure of message:

|Alice's ephemeral public key, Alice's static public key, Ciphertext, ECDSA's tag, MAC's tag|

I think this is secure as sign-encrypt-sign, because ECDSA's tag is signed by Kmac and Eve can not just take this message, throw away Alice's ECDSA tag, sign the ciphertext with Eve's own key because after that she need to make MAC's tag and she can not, because she do not know Kmac.

Do I correct understand that this is secure as sign-encrypt-sign?

If this correct, I am not sure that MAC's tag is necessary in this scheme. Alice would do:

fetch Bob's public key
generate ephemeral key pair
SK = ECDH(Bob's public key, Alice's ephemeral private key)
Kenc || Kmac = KDF(SK)
Ciphertext = Encrypt(Message, Kenc)
ECDSA's tag = ECDSA(Alice's public key || Ciphertext || Kmac, Alice's static private key)

And Alice have structure of message for sending:

|Alice's ephemeral public key, Alice's staic public key, C, ECDSA's tag|

I think Bob can use ECDSA's tag for verifying that message was not changed and that this message was sent by Alice. Eve can not compromise the message because she have to know Kmac which is used to make correct ECDSA's tag, is not it?

Or, for example, can I use last scheme only for handshake message and after that encrypt next messages by using symmetric cipher and MAC?


texts: Post-Quantum Public Key Cryptography with EC math properties

texts:
Is there any quantum resistant public key cryptography with similar properties of elliptic curves?

Assuming lowercase for scalars and uppercase for points. The properties I'm interested are:

Reusing the same public key.
Given $k = a + b$ then $k \times G = (a + b) \times G$
Distributive Scalars: $(a + b) \times G = a \times G + b \times G$
Distributive Points: $k \times (A + B) = k \times A + k \times B$
Commutative Sum: $(a + b) \times G = (b + a) \times G$
Commutative Mul: $a \cdot b \times G = b \cdot a \times G$

How existing solutions map to the same properties?
I'm interested in the direct applications not how it fundamentally works.


texts: Is GCM mode of authenticated encryption quantum secure?

texts: Regarding post-quantum symmetric cryptography, it has been recommended to move to AES-256 or similar ciphers with 256-bit keys. How is authenticated encryption affected? Is AES-256-GCM considered quantum-safe? what are the other alternatives for post-quantum authenticated encryption?


texts:
I'm a RSA n00b when it comes to the mathematics for RSA. After spending some time reading, watching lectures, etc. I pretty much have everything down, except for how to figure out the equation for determining the private key $d$.

Reading this very Q/A forum, a person said, "There are better ways to find $d$ from $e$ if you know $\varphi(n)$. But if you don't, you're in trouble, because you need to factorize $n$ to do that."

Taking that comment to heart, what is the "better way" to find "$d$" if you know $\varphi(n)$?

$m=42$    Message to be encrypted

$p=61$    Prime 1

$q=53$    Prime 2

$e=17$    Random Exponent greater than 2

--

$n=3233$

$\varphi(n)= 3120$

I know that $m^e = c \mod n$ is to encrypt and you get $2557$. To decrypt the equation is $c^d = m \mod n$, but my hangup is figuring out $d$. Can somebody spell out the equation, process, etc on figuring out $d$?


texts: How to apply encryption on sensitive data exchange?

texts:
I have the following scenario to which I have to apply cryptography to protect sensitive data:

An embedded Linux computer box will be creating and accepting file packages with contents that should not be accessible to anyone outside a restricted group of persons. These packages will be sent to and retrieved from the box via http or USB drives.

A software tool will exist that can create and extract the packages. This tool will only be accessible to the restricted group.
Another tool will exist that can create packages but not extract them. This will be freely distributed.

These statements also apply:

The files can be easily obtained by any potential attacker.
The box can fall in the attacker's hands at any time but we assume that they will not gain root access to it.
There will be many boxes around and a file created by either of the tools or any box should be accessible by any other box.
The boxes are distributed and are no longer accessible to the restricted group of persons (i.e. to change keys, pass phrases, etc.).

The question is what cryptographic solution can we apply to this scenario using standard algorithms and tools/libraries, and how do we protect the key(s) from a leak from the restricted group of persons (we can assume a sub-group of them is 100% trustworthy).
It would be possible setting up a server in a restricted network that could handle the decryption for the tool for the restricted group of persons.


texts: What is the main purpose of using Boolean Circuit Model in Homomorphic Encryption?

texts: Why do we use or have Boolean Circuit Model is it because since it uses gates and bits we could adapt it into a hardware model?


texts: Independent parameters basis for torsion-groups in SIDH: Is the Weil-pairing necessary?

texts:
In the original SIDH paper by De Feo, Jao and Plût, the basis points $P_A$ and $Q_A$ are supposed to be independent points in $E(\mathbb{F}_{p^2})$ of order $\ell_A^{e_A}$ for some small prime $\ell_A$ on some supersingular curve $E$. To check independence, they suggest computing the Weil-pairing $e(P_A, Q_A)$ and check that the result still has order $\ell_A^{e_A}$.
My question is this: Is another valid approach to checking independence to check if some discrete logarithm exists from one point to the other? Of course, $|E[\ell_A^{e_A}]|$ is $\ell_A$-power smooth, so taking discrete logarithms is easy by Pohlig-Hellman, but I am sure if this approach is valid/equivalent with calculating the Weil-pairing.


texts: I'm trying to implement the scrypt key derivation function using JavaScript. When implementing the algorithm, I found that there was a function called SHA1_Compress listed in the specification. Is the function identical to a normal SHA-1 hash function? Or it is a totally different thing? I tried to search the term with Google but found nothing.


texts: hardware and software optimizations for Salsa20

texts: I'm using the Crypto++ implementation of Salsa20 for a software project we are working on and I'd like to know if there are any SSE or software optimizations that will increase the speed of the CSPNG?


texts: Avoiding known plaintext attacks with an additional XOR-Layer

texts:
Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption?

That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the attacker can  retrieve the rest of the message, if he knows any part of it (but secure if he doesn't).

I would try to address this weakness as follows: I would XOR the plaintext with a securely generated 8 byte nonce (used once per message), and then add the nonce as a prefix:

ciphertext = E(key, nonce || XOR(nonce, plaintext))

XOR() applies the nonce repeatedly if the plaintext is longer than 8 byte.

The XORing as such is obviously insecure. But now the attacker doesn't have a known plaintext anymore: He can't know the nonce and therefore can't know "XOR(nonce, plaintext)".

Would this be enough to prevent the known plaintext attack from succeding?

I am not going to implement this, don't worry. I am just curious.

I am also aware that the possibility of an known plaintext attack hints at deeper problems. In reality I would choose another cipher.


texts:
I understand in theory how the common modulus attack works (as described here: how to use common modulus attack?)

Though, I did not understand completely how it worked with a negative $s_i$. Since $e_bs_1+e_cs_2=1$ one of the $s_i$ will be negative, so when I calculate $C_j^{s_i}$ it will be a fraction and not out of $\mathbb{Z}$.

From what I learned from the comments the trick is to calculate $(C_j^{-s_i})^{-1}=C_j^{s_i}$ instead. That way $-s_i$ is positive and $C_j^{-s_i}$ can be computed easily as well es the inverse $(C_j^{-s_i})^{-1}$ (using the Extended Euclidean algorithm). This solves my problem.

(I edited this question to specify my problem, answer it and to explain how it is different from how to use common modulus attack? in the hope that it won't be marked as duplicate anymore.)


texts:
For all $c_0\leftarrow m_0 \oplus k$ there exists a $k'$ such that $c_1  \leftarrow m_1 \oplus k'$, where $m_0 \neq m_1$ and $c_0 = c_1$.

Assuming a truly random $k$, the first assignment is a one-time pad. If we were to repeat the process over all $m \in M$, we would create a Stirling set of the first kind.

To use better notation, each key $k_n$ can be given by $G(k_{n-1},m_{n-1})$ where $k_0$ is a perfectly random bitstream.

The scheme would be a bit impractical, but let's not focus on that initially. Since all $c \in C$ are exactly the same, and assuming that no two $m$s are the same, is it safe to claim that the above scheme is perfectly secure?

Subquestion: Is $k'$ still perfectly random?

To clarify: This construction is completely useless. I thought it would be fun to come up with a OTP variation which allows key reuse, not necessarily one that would be of any practical value.


texts: why was padding changed when keccak became sha3?

texts:
In the original Keccak you would pad by adding a 1 bit proceeded by a predetermined amount of 0 bits and then another 1 bit.

When Keccak was standardized to sha3 the padding was changed. It was then (unless you needed to pad by just one character) 0x06, followed by a predetermined number of 0 bytes and then 0x80.

My question is...  why was this change made?


texts:
Why are homomorphic algorithms slower than regular(symmetric and asymmetric) algorithms?

For example RSA in regular asymmetric cryptography uses the same algorithm as in RSA homomorphic (partially HE) cryptography.

but in homomorphic Whereas there isn't decryption time for execution time homomorphic is slow?


texts: Implementation details of the π step of the Keccak round function

texts:
In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at https://keccak.team/software.html, you can find a reference software implementation as well as a list of third-party ones. At least two of the third-party C implementations, however, refer to an array of 24 integer constants that are evidently used in the π step of the Keccak-f permutation, but they are not mentioned in the specification. In the keccak-tiny-unrolled.c file from David Gil's implementation, for example, the array is defined as follows:

static const uint8_t pi[24] = \
  {10,  7, 11, 17, 18, 3,
    5, 16,  8, 21, 24, 4,
   15, 23, 19, 13, 12, 2,
   20, 14, 22,  9, 6,  1};

In the π step, 24 out of all the 25 lanes comprising the internal Keccak state are moved to different positions. It's a simple 'bijective' mapping, but the order in which the lanes are processed by David Gil's program isn't obvious because the state array is flattened to one dimension and the π step is combined with the 'chronologically first' ρ mapping in which each lane is bitwise rotated by a fixed number of positions. All the rotation offsets as defined in section 1.1 are given below (note the indices):

The corresponding rho array from the above-mentioned file looks like this (zero skipped as idempotent, rho and pi arrays' sizes equal):

static const uint8_t rho[24] = \
  { 1,  3,  6, 10, 15, 21,
   28, 36, 45, 55,  2, 14,
   27, 41, 56,  8, 25, 43,
   62, 18, 39, 61, 20, 44};

I don't want to say something blatantly wrong, but now, given this array, numbering the state lanes in the row-major scheme (starting from zero) and knowing that in the actual code (see the keccakf() function) its elements are taken in the order defined in that same array, we can conclude that the first element of the pi array is just an index of the 1-dimensional state array element (a single lane) which should be replaced with the lane rotated by rho[i] positions. The order of lanes in the a array from the keccakf() function then becomes as follows (i - lane stored in a[i]):

0 - 12     7 - 9    14 -  1    21 - 18
1 - 13     8 - 5    15 - 22    22 - 19
2 - 14     9 - 6    16 - 23    23 - 15
3 - 10    10 - 2    17 - 24    24 - 16
4 - 11    11 - 3    18 - 20
5 - 7     12 - 4    19 - 21
6 - 8     13 - 0    20 - 17

For example, the 13th lane rotated by rho[0] = 1 position to the left should take the place of the second one, so a[pi[0]=10] = 2. Similarly, the second lane rotated by rho[1] = 3 positions should replace the ninth one, so a[pi[1]=7] must be the ninth lane.

I'd like to know where these constants come from and why the state is organised in such a way. I've read the linked overview briefly, but it says nothing about any explicit formula for the π constants and I haven't found anything really helpful elsewhere either. Could you please help me?


texts: Determining key size in bits by knowing plaintext and ciphertext

texts:
I need to know how can I determine the key size in bits knowing the ciphertext and the encryption algorithm used?

For example suppose the plaintext was "ABC" and after the encryption it became "DEF" so the key size in bits = 1 bit because each letter is shifted only by 1 to its next character? Or I am wrong?

Please explain it in more details and thanks in advance and sorry for the inconvenience.


texts: What is the formal name for determining the key to a Vigenere cipher using frequency analysis once the key length has been found?

texts:
In short, I am writing a paper about cracking the Vigenere cipher. There are supposed to be three parts to it and each is supposed to be related to an academic article (or anything formal). I chose Kasiski test and IOC for the first two parts to guess the key length. The third part is splitting the plaintext into n groups where n is the key length and then conducting frequency analysis to determine the key (one character at a time).
For the paper I can't just cite a paper about frequency analysis so I need to know the formal name for this technique (if there is one).
Originally, the determine key portion would have been done with brute forcing keys until langdetect trips.


texts:
I need to create an unique token for a web service. I'm doing that in the following in the following way:

var element_id  // auto increment number, every time different
var secret_key  // an secret key
var random_key  // a random generated string of 8 chars, every time different
var timestamp   // the timestamp at the moment of generation

var token = element_id + secret_key + random_key + timestamp;

This will produce a string consisting of 15 to 20 characters. In my system every string generated in this way is unique.

Then I create the SHA-256 version of that string

var sha256_token=sha256(token);

Will the sha256_token be unique in my system as it was the "clear" token?


texts: Are there any advantages and disadvantages with what type of model of homomorphic computation is used?

texts: I am curious about the advantage or disadvantage in using the different models of homomorphic computation (boolean circuits, modular arithmetic, approximate number arithmetic). Are there any specific properties of these models that make them fundamentally different in certain aspects compared with the others?


texts: RSA with common modulus but different ciphertexts and public exponents

texts:
I have two different ciphertexts $c_1$ and $c_2$, and two different public keys that share the same modulus such that $e_1 \neq e_2$ but $n_1 = n_2$.

What attack can I use to recover the private keys?
Common modulus attack works only if $c_1 = c_2$, doesn't it?


texts:
For one of my projects, I need a pairing group which holds the External co-Diffie-Hellman assumption. I am trying to implement it using Charm crypto python modules which provides support for MNT curves. According to Wikipedia:

  In practice, it is believed that the XDH assumption may hold in certain subgroups of MNT elliptic curves.

On searching a little bit more on the web about this assumption, I encountered the following statement in the book, Applied Cryptography and Network Security:

  bilinear maps based on MNT curves, where G1 $\neq$ G2, the XDH assumption is believed to hold.

As one can see, when Wikipedia says that the assumption may hold only for certain MNT curves, the book says it is assumed to hold for all the MNT.  curves. However, Charm Crypto provides modules for only certain MNT curves and therefore, I need to know for sure whether this assumption actually holds for all the MNT curves or not. If someone can provide me with some clarity on this, it would be great.


texts: Zero-Knowledge Proof of honest function execution - Is this possible?

texts:
Assume Alice and Bob share a well-known function $f(x)$. Bob asserts that he has a $y$ such that $f(y) = true$. Bob's $y$ is secret, but he is willing to share a hash of it. Alice wants to purchase $y$ from Bob, but only if she can be assured that $f(y) = true$ before the purchase happens.

I've studied Zero-Knowledge Proofs, but the examples I've seen seem to be focused on proving knowledge of a value without revealing the value itself. This seems different... Alice must somehow know that Bob executed $f(y) = true$ truthfully, without altering $f(x)$ or substituting a different value for $y$. Is this possible without a trusted third party?


texts:
I saw this exercise for evaluating the security(confidentiality, integrity, authenticity, and non-repudiation) of some schemes:

ENC(M) || SignA(ENC(M))
ENC(M || SignA(M))
SignA(ENC(M))
ENC(M) || SignA(M)

Where || is concatenation and ENC (is encryption on secure shared key) and SIgnA is RSA Signature of Alice.

My answer is :

Have confidentiality (from ENC), and authenticity from signature, but no integrity because i have the signature of ENC (so someone can use forgery on my signature) and non-reputation i don't think (but i m not sure).
This have all property, because ENC give confidentiality, signature authenticity e non repudation and integrity because i have message and his signature for verify.
In this schema i have confidentiality and authenticity , but no integrity. I m not sure about non-repudation.
With this schema i have confidentiality, integrity and authenticity. I have again doubt about non-repudation.

I m not so clear if autenticity implies non-repudation (using signature).

Anyone can help me on this stuff?


texts: Export from US of crypto software with key-size > 56 bits still needs permission?

texts: Elsewhere someone stated that he couldn't publish his crypto software on the Internet, because US Export Regulations require approval, if the key size is greater than 56 bits. I know that several decades ago there were such extremely rigorous restrictions. Could anyone kindly check whether that indeed remains so even today?


texts: Hash functions with or without secret key

texts:
The classical definition of hash functions (found in books) are OK, but when studying a little more there is a lot of notions that seem ambiguous (contradictory) to me :

Sometimes we have hash functions that need a secret key $k$
Certain papers that design hash functions speak about a family of hash functions, meaning I think, that there is a parameter $k$ that we choose at random to select a function among this family. We could think that this parameter is a secret key, or not, that is not clear for me...
Sometimes we have hash functions that doesn't need a secret key. Besides, if we consider a hash function like SHA-2, we don't need any secret key to use it,  nor we need to select such $k$ at random and I know that for any implementation SHA-2 gives the same result for the same input (this function is deterministic...)
I've read that a hash function that need a secret key is in fact a MAC. However, some papers that speak about a hash function needing a key doesn't say that this is in fact a MAC.

So, I have several questions:

When we want to use a particular collision-resistant hash function (in order to use it for a signature), from a specification of a hash function family, how I have to choose the parameter $k$ ?
Is a hash function that need a secret key necessarily a MAC ?
If not, is this kind of hash function usable like any other collision-free hash function ?  For using it in a signature (for example) ?

Thank you.


texts: Is ISAAC considered secure as a cryptographic random number generator?

texts: The ISAAC site claims it is secure, but I wasn't aware of any trusted 3rd party sources that verified its security.


texts:
A leader should be selected by randomly choosing one of three parties A, B and C. The parties use the following
protocol:

$A → B: N_A$ (where $N_A$ is a nonce)

$B → C:$ $N_{AB}$ $= N_A$ ^ $N_B$ (where $N_B$ is a nonce, and ^ is the ex-or operation}

$C → A:$ $N_{ABC}$ $= N_{AB}$ ^ $N_C$ (where $N_C$ is a nonce)
( Now both A and C know $N_{ABC}$)

$A → B$: $N_{ABC}$
(Now B knows $N_{ABC}$, too)

( Each of the three parties can now compute $p = N_{ABC} mod 3$, where $p = 0$ denotes A, $p = 1$ denotes B, and $p = 2$
denotes C ).

Discuss the security of the protocol and establish if and how is it possible for some of the parties to deterministically choose the leader,
being the others not aware of the fraud.

Then fix the protocol too.

I am training with security exercises, but I don't know how to approach to this. Can you give me some help?


texts: Given A, B, G, H prove the I know x s.t. $A=xG$ and $B=xH$

texts:
Given A, B, G, H .How would I prove that I know x such that
$A=xG$ and $B=xH$


texts: How does the entropy of $r$ influence the security of the one-time pad $F_k(r) \oplus m$?

texts:
In an one-time pad scheme, $s \oplus m$ is uniformly random for any $m \in \{ 0,1 \}^\ell$ if $s$ is uniform in $\{ 0,1 \}^\ell$. By the security of PRF, it seems to be secure to replace the truly uniform string $s$ with the output $F_k(r)$ of a PRF $F: \{ 0,1 \}^\kappa \times \{ 0,1 \}^\ell \rightarrow \{ 0,1 \}^\ell$. Let us consider a case where $r$ can only be chosen from a small range with limited entropy (e.g., $\{ 0...00,0...01 \}$ with $\ell - 1$ leading zeros). Is it possible for an adversary who has no idea about $k$ to distinguish between the one-time pad $F_k(r) \oplus m$ and a truly random string? If possible, how does the entropy of $r$ influence the advantage of such an adversary?
Many thanks for any help.


texts: Min Entropy Value for Health Test per NIST 800-90B for 32 bit Noise Source

texts:
NIST 800-90B recommends Section 4.4.1 Repetition Count Test & Adaptive Proportion Test for health test on Noise sources.
In the equation to calculate the cut-off value C for Repetition Count Test, C = 1 + [-log_base_2 Alpha / H]; Alpha is 2^-20 but how is Min Entropy H being calculated ?

In the equation to calculate the cut-off value C for Adaptive Proportion Test, C= 1 +CRITBINOM(W, power(2,(-H)),1-Alpha); W = 1024, Alpha = 2^-20, How is the min Entropy H being Calculated ?


texts: What is the totient function for an RSA modulus has several factors due to incorrect setup?

texts: $ϕ(n)=p.q−(p+q)+1$ where there are two factor $p$ and $q$, but what if there were 3 (or more) factors such as $(p,q,r)$ due to a typo in specifying the modulus?


texts:
For simplicity let's say I only have RSA and AES on my hands and I want Alice to talk with Bob over a secure channel. With secure I am implying no MITM and Alice and Bob know they are talking to each other and not someone else.

When Alice wants a secure channel with Bob, Alice will ask Bob for his RSA public key, sign a randomly generated AES key with her RSA private key, encrypt the signature and AES key with Bob's RSA public key and send this to Bob. Bob will ask Alice for her RSA public key, will decrypt the signature and AES key with his own RSA private key and verify the signature with Alice's public key. Now Alice and Bob can use the AES key for further communication ...

Am I correct that the part where Alice and Bob exchange their public keys is a potential MITM vector? How can Alice be sure she got Bob's public key and vice versa? Is this what PKIs primarily solve, as in Alice and Bob trusting a third party upfront that - for example - signs their public keys? Or am I missing the point completely and everything of the above is bogus?


texts: Needing to encrypt plain sight information

texts:
Okay here are my requirements.

I need a solution that can do the following.

Lets say I have an encrypted piece of text with the value "20".

and I have UserA and UserB

I give UserA the Keys (/5 and /2), meaning divide by 5 and divide by 2.
I give UserB the Key (/10 and /1) meaning divide by 10 and divide by 1.

using both operations, both UserA and UserB can arrive at the same result the un-encrypted text of "2".

The first operation could be their "SessionID, the second could be a corresponding key for the Session".  Two different users, using two different "Keys" can decrypt the ciphertext using two different but equal operations.

Is there something similar in cryptography where you can provide different keys or functions and arrive at the same result and is cryptographically secure.


texts: Steganography - How many bytes of information can you hide in a $1024 \times 768$ photo?

texts: I have a photo with a resolution of $1024 \times 768$ which means $786432$ pixels in total. Let's suppose it's a 24-bit color RGB image (so 1 pixel = 3 bytes = 24 bits) and I want to hide information by only modifying the last bit of a color value. What is the maximum number of bytes that I can hide in this photo?


texts:
Does evaluating the products of shares $a_jb_j$ give a secret sharing of $ab$?
I think it's a no, but I am not sure on how to prove it.


texts:
If understand correctly from this post and the Wikipedia page for BitLocker and TPM, by default, BitLocker uses symmetric cryptography like AES. However, TPM is capable of performing RSA encryption.
Given that the RSA key is stored in the TPM, why does BitLocker not use asymmetric encryption (i.e., RSA)? By using such an encryption technique, we might be able to defend against the cold boot attack or sniffing on the LPC bus.


texts:
I am reading the "W-OTS⁺ – Shorter Signatures for Hash-Based Signature Schemes," by Andreas Hülsing, and I am stuck in understanding the success probability of an adversary, $\mathcal A$, against the one-wayness function of, $\mathcal F_n$; equation #1, page 7,

\begin{align}
  \operatorname{Succ}^{\operatorname{ow}}_{\mathcal F_n}(A)
    = \Pr [&k \stackrel$\leftarrow \mathcal K_n;\;
            x \stackrel$\leftarrow \{0,1\}^n,\,
            y \leftarrow f_k(x);\; \\
           &x' \stackrel$\leftarrow \mathcal A(k, y)
            : y = f_k(x')]
\end{align}

I read this as follows:
The success of a one-way function, $\mathcal F_n$, given a random key, $k$, from the space $\mathcal K_n$, and random $x$ such that $f_k(x) = y$ is …
I don't know how to read the rest of the equation and I don't know what is the probability here?


texts:
I wrote an algorithm to implement a suggestion in a paper by Ivan and Dodis to convert a regular ElGamal encryption scheme into a proxy re-encryption one (it's at page 6, left column of this but I asked a question related to it on SO where you can see the maths quicker).

The part I'm referring to is this one.

$$\frac{mg^{xr}}{g^{rx_1}}=\frac{mg^{(x_1+x_2)r}}{g^{rx_1}}=\frac{mg^{(x_1)r}mg^{(x_2)r}}{g^{rx_1}}=mg^{(x_2)r}$$

The scheme works by splitting a private key $x$ into $x_1$ and $x_2$.

My question is: if I don't want to share my private key with someone, could I split it in $x_1$ and $x_2$, decrypt part of it using $x_1$, share that encrypted text with someone as well as $x_2$ (probably encrypted under their public key) and have them decrypt it? How easy would it be for them to figure out the whole private key given that information and how could that threat be diminished (if it could at all)?


texts: Needham–Schroeder fix by adding opponent's identity to the first message

texts:
Recap: Needham–Schroeder is as follows:

$A \rightarrow B :   \{A, N_a\}_{pk_B}$
$B \rightarrow A :   \{N_a, N_b\}_{pk_A}$
$A \rightarrow B :   \{N_b\}_{pk_B}$

Then, there is a MITM attack by Lowe as follows:

$A \rightarrow C(A) :   \{A, N_a\}_{pk_C}$
$C(A)\rightarrow B     :   \{A, N_a\}_{pk_B}$
$B \rightarrow C(A) :   \{N_a,N_b\}_{pk_A}$
$C(A)\rightarrow  A       :   \{N_a,N_b\}_{pk_A}$
$A   \rightarrow  C(A)    :   \{N_b\}_{pk_C}$
$C(A)\rightarrow  B       :   \{N_b\}_{pk_B}$

Now $C(A)$ knows both $N_a$ and $N_b$, and he can compute the session key.
The solution that Lowe suggests is to put $B$'s identity to the second message:

$A \rightarrow B :   \{A, N_a\}_{pk_B}$
$B \rightarrow A :   \{N_a, N_b, B\}_{pk_A}$
$A \rightarrow B :   \{N_b\}_{pk_B}$

But what happens if we put B's identity into the first message?

$A \rightarrow B :   \{A, B, N_a\}_{pk_B}$
$B \rightarrow A :   \{N_a, N_b\}_{pk_A}$
$A \rightarrow B :   \{N_b\}_{pk_B}$

Is it still vulnerable to MITM attack or is it secure too?


texts:
I'm creating a small messenger and I wanted to know if it makes sense to store user passwords double-hashed in our backend-database. I wanted the user the register in an app, which should save a hash of the password and login with this hash in our system, which should not save this (1st) hash, but should somehow hash it again.

This would prevent someone who somehow got a (doubled) hashed password from our database from logging in into our api (since he needs to provide the 1st hash) and also would allow the app to not store the passwords of the user in plain text.

Is this a good idea? Should I just stay with the first hash and not hash the password again when using it in our backend-db? I read that something like this might be insecure as hashes become less secure the more often you hash them again. Should I maybe use different hash-algorithms for both actions? Which algorithms should I use?


texts: How many 2-torsion points in an elliptic curve?

texts:
N torsion points have the structure ker([n]) ≅ Zn×Zn , so ker([2]) ≅ Z2×Z2 , gives us 3 2-torsion points.

but ker([4]) ≅ Z4×Z4 ,this means we have 5 subgroup of order 4 . In each subgroup , there is a generator Pi, my question is , these 5 [2]pi are all different order 2 points right? Does not this means we have 5 4-torsion points ??


texts: What does Modification Detection Code (MDC) in OpenPGP do?

texts:
The authentication is often done by an HMAC in modern cryptosystems. What does MDC do exactly in OpenPGP and is it a software hack or an algorithmic authentication?

Also, how to force GnuPG to stop on error when the MDC is not checked? Right now it issues a warning and decryptes. That was a basis for a recent attack.


texts: Keys and mixed encoding - security implications

texts:
Let's say we generate a 256-bit key like: secret = base64(csprng(32)). Assume someone using the secret ascii-decodes the base64-encoded string and uses the output as a key (i.e. ascii_decode(secret)).

Note that in this specific scenario the key is used in a HMAC-SHA256 function.

What are the security implications of doing this? Are there any possible issues?


texts: True/False if a user is a customer without revealing the actual customer

texts:
I have a user A and a third party company B. I want to check if A is a customer of B.

B cannot reveal any information about their customer list to me.
If A is a customer of B, I do not want B to know which customer they are. They should only know True/False answer to wether they are a customer.

What sort of problem is this? I thought this might be a private set intersection problem but the definition seems to violate my second condition. Is this instead a Zero Knowledge Proof problem?

"Private set intersection (PSI) allows two parties to compute the intersection of their sets without revealing any information about items that are not in the intersection."


texts: The mathematical similarity and difference between code-based PKE and multivariate DSS

texts:
In code-based public key encryption schemes, a public key is formed by matrix-multiplying 2 linear matrices to the left and right side of a easily decodeable error-correcting code, so that it'll be difficult to extract useful information that may be used to decrypt ciphertexts.
In multivariate digital signature schemes, a public key is formed by compositing linear equation systems to the inner and outter parts of a easily solvable multivariate (usually quadratic) equation system, so that the resulting composition cannot be easily reversed.
From my understanding, the composition with linear systems is the biggest similarity between code-based PKE and multivariate DSS, and I wonder:

Is there any other aspect where code-based and multivariate cryptosystems are similar?

What are the important differences between code-based and multivariate cryptosystems?


texts: Why is the NIST recommendation for the private key exponent so much smaller than the modulus?

texts: NIST recommends a 256-bit private key exponent for DLP with a 3072-bit modulus. This question answered how the modulus was chosen/calculated, however, why isn't the private key size closer to the modulus size? It would seem that if one achieves order equal to $2^{256}$, this would be a sufficient number of random private key exponent possibilities to make a brute force attack computationally infeasible? So why the disparity between $2^{256}$ private key and $2^{3072}$ modulus?


texts: PRESENT cipher algorithm Big "O" Notation

texts:
I am currently doing a research paper on the PRESENT Cipher algorithms and one of the components that I need to include is time and space complexity.

I have tried reading academic articles and journals, but they have the complexity in the matter of kilobytes.

Would anyone have an idea on what is the time and space complexity of the PRESENT cipher algorithm in Big-O notation?


texts: ecdsa nonce reuse to compute the private key, modular inverse question

texts:
I am following along some cryptography challenges:, in particular ECDSA Nonce Reuse here (second problem):
https://blog.coinbase.com/capture-the-coin-cryptography-category-solutions-fe94d82165c5
I understand all the math, except this part:
def modinv(a, modulus): return pow(a, modulus — 2, modulus)
def divmod(a, b, modulus): return (a * modinv(b, modulus)) % modulus

Why is it modulus - 2? Shouldn't it be modulus - 1? I thought the modular inverse of a mod n would be $a^{n-1}$? Since $a * a^{n-1} = a^n = 1$?
Is it something to do with the fact that the EC group is size order, but the "group in the exponential" is size order - 1? I don't really understand though. We need to compute the private key as $\frac{ks'-z}{r}$. But according to ecdsa: https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm r and s are all calculated mod n? So why are we doing n - 2? But then confusingly, k is selected in the set [1, .., n-1].
So yeah just a clear cut explanation would be helpful. Thanks.
Thanks for the help!
Oh wait, maybe this is really dumb: we just want the private key, and the private key exists in the integer multiplicative group [1, .., n-1], which is size n-1.


texts:
If one is going to use an HMAC, I.E: http://php.net/manual/en/function.hash-hmac.php, where exactly are they storing the key?

Without some sort of secure storage (i.e not in a local file or code), I feel like one is fooling oneself when using a HMAC (as with the above function). I missing something related to the storage of keys?


texts: Attacking Scrypt Under Access Pattern Leakage

texts:
Could cache-timing channels (such as exist for certain
block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared compute cluster?

Sub-questions:

If not, how can an attacker do so if they both share one physical machine?
Is scrypt's memory-hardness exploitable if both the attacker and user are NOT in a shared compute cluster, at all?
How many memory address locations are required to be known in order to mount an efficient dictionary attack against that user’s scrypt-hashed password in constant space?


texts:
In this paper on pg. 1241 the authors discuss bullet point on Adaptive Zero-Knowledge :

I am new to Zero-Knowledge and I am having trouble understanding what they are saying.

I think they are saying the probability an adversary A in the real world wins and the probability an adversary in the ideal world wins are close (negligible). But I don't know what the difference is between S and S' or what $S^{crs}$ or $S^{proof}$ are.

Also, when they use notation like $A^{S'(crs,trap,.,.)}$ is really confusing - I have no idea what this means.

I'm not looking for a complete breakdown of what this means - but if someone could even summarize what the importance of adaptive zero-knowledge that would be great.


texts: How does one design a traffic analysis resistant protocol?

texts:
I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation.  How does one make an instant messaging protocol which is resistant to traffic analysis?

I'm interested most specifically in server side attacks on users' contacts/friends lists.  In particular, the messaging system's servers are considered compromised, or even outright hostile.  I'm curious about the server aspect because Tor and I2P offer traffic analysis protection at the network level.

I could imagine an anonymous open mailbox like protocol.  A public key's hash identifies a public mailbox that's used for hello messages.  A hello message contains a seed for selecting a series of subsequent mailboxes that actually get used for communications.

You probably don't want attackers identifying the public mailboxes used for hello messages though.  You could perhaps scale the mailbox range with the user base to ensure that all mailboxes saw non-zero traffic while avoiding asking every participant to attempt to decrypt all messages as public key hello message.  Or maybe implement "please reuse" queue for mailboxes.

Is there any standard crypto literature on designing traffic analysis resistant protocols?


texts: Is AES-GCM suitable for per chunk encryption?

texts:
I was looking through Google's encryption flow and noticed that they split each file into chunks and then encrypt each chunk individually with AES-GCM with its own key.

Since AES-GCM starts to get vulnerable around $2^{48}$ messages (though, some people suggest $2^{36}$), how can they keep things secure if they have millions of users uploading files constantly?

I'm new to cryptography, so excuse my ignorance. Does the $2^{48}$ limit only actually matter on a per user basis or is it in general? I wanted to do try something similar using AES-CBC with a SecureRandom IV and HMAC for per chunk encryption since you don't have to worry about the collision. However, seeing their encryption flow, I wanted to learn more about what is the proper way of going about things.


texts: Limitations of Elliptic Curve Cryptography?

texts:
Simple question, what are the limitations of ECC, both in terms of application and how secure it is?

I heard that the NSA were able to read emails a few years back due to a backdoor they had discovered on a particular NIST elliptic curve. Is this something we can continue to expect, and what other potential drawbacks exist?


texts: How to plot the distribution of a ciphertext?

texts: Is there any plot or visualizing program  that can plot the distribution of a plaintext and then the distribution of the ciphertext after applying a ciphering encryption algorithm? I am interested from stream ciphers


texts: Adapting RSA Timing Attack for Square And Multiply from right-to-left vs left-to-right

texts:
I'm trying to reconstruct the fairly well-known RSA timing attack by Kocher. I'm working with simulated timing data, so I have completely noise-free "measurements". My attack is successful in guessing the exponent, as long as I use a "right-to-left" square and multiply method, i.e. an algorithm as follows (R=b^d mod m, with d having w bits):
R = 1
for i from 0 to w-1:
  if getbit(d, i) == 1:
    R = R * b mod m
  b = b * b mod m

The attack hinges on the conditional reduction when using Montgomery modular arithmetic, which my simulation uses. For each bit, I simulate the two paths (bit is zero/one) and group my measurements by whether an additional reduction was performed. I choose the path which shows the larger difference of means between the groups. Another criteria that works well is checking which path reduces the empirical variance of all measurements when I subtract the time taken by the square+mult vs just square.
Now I'm trying to adapt the attack to a left-to-right square and multiply:
R = 1
for i from w-1 to 0:
  R = R * R mod m
  if getbit(d, i) == 1:
    R = R * b mod m

I can't seem to find a suitable criteria to choose between the two paths when iteratively guessing the bits. When I just press on, correcting wrongly guessed bits as I go along, the attack still works on the lower bits, but is completely wrong (always guessing 1) for the higher bits in the beginning. I can't find any sources on how to adapt the attack to this kind of square and multiply algorithm.


texts: Homomorphic encryption methods that could support logical XOR, AND?

texts:
Recently I'm researching about logical circuit calculation and I hope to use homomorphic encryption to protect the whole process. I've read Gentry's paper and use some websites like https://asecuritysite.com/encryption/hom_xor, and I wonder if there are some other methods?
Few days ago, I thought that position transformation like Caesar cipher could just support my thoughts. For instance, $(4 \gg 1) \oplus (5 \gg 1) = (4 \oplus 5) \gg 1$. But my professor told me that this is unreasonable and could even not be seen as "encryption" for lacking of random number. Is he right? Or maybe I could adjust this thought so that it is able to be accept as a "homomorphic" calculation for logical operation?


texts: How to calculate y value from ((y*y) mod prime) efficiently

texts: i am working ECC-224 bit. can any one tell me, how to calculate y value from ((y*y) mod prime) efficiently for large bit numbers.


texts: Schnorr identification scheme without changing k flaws

texts:
The Schnorr identification scheme is being used to remotely log into a home computer which has stored $p$, $α$ and $β(\equiv α^a(mod p))$ - with $a$ the password. This works thusly:

1) The user chooses $k$, forming $γ \equiv α^k(mod p)$ and sends $γ$ to the remote computer.

2) Computer then sends random $r$ to the user.

3) The user computes $y \equiv k − ar (mod (p − 1))$, sends y to Computer.

4) Computer checks if $γ \equiv α^yβ^r(mod p)$ and if so allows login.

$k$ should be random, but the user figures it's fine to use the same 100 digit number instead each time. If another person has been intercepting all the traffic for several logins, can the fact that $k$ isn't changing be exploited?

Here is what I've thought through so far, but I haven't quite figured it out.

Assume it is known that Schnorr scheme is being used.  $p, α, β,$ and $k$ are fixed, but unknown.  As a result, so is $γ$.  $r$ is random and changes with each iteration of the scheme.  By monitoring all traffic, $γ, r,$ and $y$ are known.  Is it possible to solve for the unknown values if several equations are known and the only value that changes is known? Or is this not feasible because of the nature of the equations?


texts: Logarithmic brute-force for stream-ciphers

texts:
First of all, I want to make sure I understand stream ciphers correctly:
I put a plainchar (e.g. byte?) through the stream cipher and receive a cipherchar. Correct?

When I now have a pair of plaintext/ciphertext, I could then brute-force all secrets which map plainchar[0] to cipherchar[0]. For the next character, I only need to try those passwords which succeeded for the first one. This way the brute-force search space is reduced logarithmically.

Is this correct?

Update As @poncho pointed out correctly, the search space is not reduced logarithmically, but the expensive encryption operation which generates the ciphertext for the plaintext. This has to be done for every tried password which is every possible password for brute-force.


texts:
I'm studying for my crypto exam and got stuck on following example:
Is $F'_k(x) = F_k(0||x)||F_k(1||x)$ with $x \in \{0,1\}^{n-1}$ a PseudoRandom Function PRF, under the assumption, that $F_k$ is a PRF?
In the solution, there is a reduction proof stating, that $F_k'$ is a PRF. What gets me confused is the definition for PRF, which states, that $F:\{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n$ has to be an efficient, length-preserving, keyed function, in order to be a PRF. In my opinion $F'_k(x)$ is not length-preserving and can therefore not be an PRF. Can someone explain this to me?
(here || denotes concatenation)


texts: A standard extension of ECIES for multiple recipients (broadcast / multiparty)?

texts:
I have one sender, and a small number (~5) of recipients. The sender knows each recipient's public EC key. I want the sender to broadcast a single message in such a way that any one of the recipients can decrypt it. For reasons that aren't completely technical, I'd like the security properties of the encryption algorithm to be as similar as possible to those of Bitmessage, which uses ECIES, with AES and HMACSHA256 as the symmetric cipher and MAC. I'd like the encrypted message to be as small as possible.

After a brief search, I couldn't find any "standard" (well-studied, or used somewhere high-profile) extension of ECIES for this case. I can obviously:

Choose a random session symmetric encryption key and session MAC key.
Symmetrically encrypt and MAC the message.
Asymmetrically encrypt the session keys with ECIES, once per recipient.

Then I can broadcast a concatenation of the encrypted message and encrypted session keys, and any recipient can decrypt his copy of the session keys and decrypt the message. That adds a lot of overhead, though. So, using Wikipedia's variable names:

When I do ECIES, can I omit the MAC $d$? An attacker doesn't gain anything by tampering with the session key, since that just causes the inner decryption or MAC check to fail. The answer is "no" here if we naively encrypt-then-MAC the inner message, more complicated otherwise as discussed below.
Can I use the same ephemeral EC pair $R = rG$ for all recipients?
Can I use the same IV for all invocations of the symmetric cipher (once per recipient in ECIES, plus once for the message itself)?
If the total length of my session keys is the same as the length  of my $KDF()$ output, then can I get rid of the symmetric cipher $E(k_E;m)$ used within ECIES entirely, and replace it with $k_E \oplus m$? That would obviously render question 3 irrelevant.

I think the answer is "yes to all", but some of these look potentially subtle. Thanks!


texts:
I'm using the Curve25519 code (from http://www.dlbeer.co.nz/oss/c25519.html), and trying to convert from a public signing key (Edwards form) to a public key-exchange key (Montgomery form). There's test code that does that, but it seems to extract the Y coordinate from the secret key, and if I had the secret key I wouldn't need to do this.

I'm a software developer, not a mathematician. I don't see how to go from a packed Ed25519 public key to the unpacked X and Y coordinates required for the conversion.

How can I split a packed Ed25519 public signing key into its X and Y coordinates?

I'm asking for the mathematical explanation and/or references to the functions in that package that will split the packed Ed25519 key into X and Y coordinates.

For reference, I've tried the upp function to unpack the public key, and the ed25519_try_unpack function. Both give the same (incorrect) value.


texts: How does AWS Secret key and access key work

texts:
Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client?

My guess is:

AWS access key ID is a form of unique user/account identifier
AWS secret key is like private key
When AWS CLI sends a API request, the payload is signed by generating an HMAC with the secret key as the key
The HMAC, AccessKeyID and the payload is sent to AWS service
AWS service verifies the identity of the sender and integrity of the message by recomputing the HMAC code.
If it's verified the request is accepted and processed.

Is this accurate? Why does AWS do this instead of asking user to upload a RSA public key? Why is this safer?

EDIT: I think this is how it works -- https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#ConstructingTheAuthenticationHeader


texts: Why is it hard to calculate Logarithm on Diffie Hellman?

texts:
i read something about Diffie Hellman. What i don't understand: Alice selects a randomly generated Number, calculates X = g^x mod p and sends X to Bob.

If she calculates g^x, she needs to calcluate g+g+g+g+g... until she has calced to g^x. Than she calculates it mod p and sends the Result to Bob.

If Eve listens, she needs to calculate log_g(X) to find out what to power g to get X, and then calcs it mod n to see if it matches to X.

What is now the difference between the Work Alice has to do (calculating g+g+g+g...) and Eve (calculating g+g+g+g...).

Is the difference that Alice calculates only one Time mod n (after she calculated g^x) and that Eve calculates mod n for every Number she wants to try?

Thank you


texts: Diffie-Hellman Key Exchange in $GF(2^5)$

texts:
Stuck in a question where the DHKE (Diffie-Hellman key exchange ) is done in the $GF(2^5)$. The irreducible polynomial is $P(x) = x^5+x^2+1$. The $\alpha$ value is $x^2$. If the private keys of $a = 3$ and $b = 12$ what is the session key $K_{ab}$?

Now the calculation of $K_{ab}$ = $\alpha^{ab} \bmod P(x)$. This would translate to $x^{2^{36}}$. Can anyone suggest how to further break this? Should we use the concept of cyclic groups or square-multiply algo here?


texts:
When implementing a XOR cipher with a pseudo-random key equal in length to the plaintext, Is there a significant difference in potential key strength between keys drawn from a pool of either 1000 or 5000 possible characters? (that is, each character in the key may be any one of up to five thousand possible characters) Or is this not likely to be a deciding factor in overall security for a simple XOR?

Edit:
I apologize if my original phrasing was ambiguous. I have hopefully improved it a bit.
(Character pool = A group of distinct character from which the cipher key may be generated.)


texts: What are the benefits of lattice based cryptography?

texts: Previously we visited the benefits of elliptic curves for cryptography. Lattice based cryptography is starting to become quite popular in academia. The primary benefit of lattice based crypto is the resistance to quantum algorithms. Are there other benefits to lattice based crypto? For example, speed, ciphertext/key sizes, etc?


texts: Using round constants to thwart slide attacks

texts: I'm partly unclear as to how the use of round constants in an iterated cipher makes it immune to slide attacks. I mean, I can see how it does from one perspective, but if the solution to slide attacks is by "making each round different", then shouldn't distinct round keys accomplish this, too?


texts: trapdoor commitment from lattice-based assumptions?

texts:
I'm wondering that is there any equivocal commitment scheme (i.e., trapdoor commitment) can be constructed from lattice-based assumptions? I know there are a lot of commitment schemes from lattices as described in More Efficient Commitments from
Structured Lattice Assumptions (described in the introduction) but I do not identify any trapdoor commitment scheme from lattice-based assumptions. Thus I'm wondering is there any equivocal commitment scheme? Recall that Pedersen commitment is an equivocal commitment but is constructed from Discrete Log assumption.


texts: What might be assumed about a PRF if the key has been chosen?

texts:
The defining feature of a PRF $f:\{0,1\}^k\times\{0,1\}^s\mapsto\{0,1\}^*$ is that, if the first parameter is selected at random, it should be indistinguishable from a function $g:\{0,1\}^s\mapsto\{0,1\}^*$ selected at random.

But what if the key parameter isn't selected at random? What, more exactly, might and might not be assumed about the function $f$ in such case?

The question is motivated by the use of a configurable PRF (for both the KDF and the finished verify messages) in protocols such as TLS 1.2, and of secure resumption attacks that exploit assumptions regarding the relation between the master key and the authenticity of resumed connections.

More precisely, is it safe to prevent such secure resumption attacks, by using a hash of all handshake messages when the master key is derived?

In TLS 1.2 the master key is calculated as

  master_secret = PRF(pre_master_secret, "master secret",
                      ClientHello.random + ServerHello.random)
                      [0..47];

One suggestion that has been discussed for TLS 1.3 is to replace the concatenation of the random values with a hash of all handshake messages up to this point. The question is, would this prevent an attacker who is able to select the pre_master_secret value, from also selecting the master_secret for the two connections?

(We might assume the adversary has been able to define the cipher suite itself, including the key agreement mechanism, the hash algorithm and the PRF algorithm, and that the only thing we might assume about these algorithms is that they meet the conventional minimum security requirements for such algorithms.)

The handshake messages to be hashed include a client_hello, server_hello, server_certificate and possibly server_key_exchange and client_key_exchange. The pre_master_secret depends on information present in server_key_exchange and client_key_exchange. I.e. once these messages have been fixed, the pre_master_secret is fixed.

Now, if, for simplicity, we assume that the server_key_exchange and client_key_exchange messages are not included in the handshake hash, the security against an adversary who is able to design the PRF and select the pre_master_secret ought to be reducible to this question:

Suppose you have a function $f$ and that this function is such that, given any pair $v,s$, you might find a value $k$ such that $f(k,s) = v$; could this necessarily be turned into a distinguisher for $f$?


texts: Is the openssl implementation of ECDH missing something?

texts:
From the OpenSSL Wiki:

  Also note that the derived shared secret is not suitable for use directly as a shared key. Typically the shared secret is passed through some hash function first in order to generate a key.

My understanding of ECDH is that it generates a very secure shared secret. Why does it have to be hashed too?