texts:
On this course, Micciancio talks about function families (functions parametrized by some value) that can be used in cryptography.

On page 2, he presents the following function family parametrized by bases of full-rank lattices:

For any invertible $ \mathbf{B} \in \mathbb{R}^{n \times n}$, let $f_\mathbf{B}(\mathbf{x}) = \mathbf{x} \mod \mathbf{B} = \mathbf{B} \left(\mathbf{B}^{-1}\lfloor \mathbf{x} \rfloor \right)$.

Clearly, there is a typo there, because $\mathbf{B} \left(\mathbf{B}^{-1}\lfloor \mathbf{x} \rfloor \right) = \lfloor \mathbf{x} \rfloor$ and this is at the same time independent of the basis and useless for cryptography.

So, maybe the correct definition must be $f_\mathbf{B}(\mathbf{x}) = \mathbf{x} \mod \mathbf{B} = \mathbf{B}  \lfloor \mathbf{B}^{-1} \mathbf{x}   \rfloor$. But in this case, the codomain $f_\mathbf{B}$ is the lattice $\mathcal{L}(\mathbf{B})$, but the text just below the definition says

  In other words, $f_\mathbf{B}(\mathbf{x})$ rounds $\mathbf{x}$ to the corner of the fundamental parallelepiped $f_\mathbf{B}(\mathbf{x}) + \mathcal{P}(\mathbf{B})$ containing $\mathbf{x}$. As defined, $f_\mathbf{B}$ is a function with domain $X \subseteq \mathbb{R}^n$ and codomain $\mathcal{P}(\mathbf{B})$.

So, do you have any idea of what the actual definition should be?


texts: Subgroup generation: should we check that order is not 2? or g in not too small?

texts:
For $p=2q+1$,where p and q are primes, we have subgroups of order $p−1$, $q$, $2$ and $1$. To find $G_q$, usually we just check that  $g^q\bmod p=1$ and that's it.

However,here it's mentioned that there is a chance (very unlikely but still) that a group satisfying $g^q\bmod p=1$ is of order $1$ or $2$.

Ok, suppose we start checking  whether $g^q\bmod p$ is equal to $1$ starting from $g=2$ (to eliminatie $g=1$). I don't see how a subgroup can satisfy $g^q\bmod p=1$ and be of order $2$ (so $g^2\bmod p=1$ too). It seems that for all even $a$ in $g^a\bmod p$ the result is $1$. On the other hand, since $p$ is a prime and $g^q\bmod p=1$  holds, then for all odd $a$ odd it's equal to $1$ too. I fail to see, how any generater except $g =1$ can satisfy it. Do we rally need to chech that $g^2\bmod p$ is not $1$?

Additional question, is it a good idea to check all integers in the increasing order starting from $g=2$? Is there any security issues related to a small $g$? Suppose, in the real ElGamal implementation with $p$ of 1024-bits or 2048-bits, I check all $g$ from $2$ till I find the $G_q$ subgroup generator.


texts: Mathematical explaination of file encryption for multiple persons with multiple keys

texts:
Let's say I want to encrypt a document which only can be read by John, Mike, and Dave. This can easily done with PGP/GPG:

Import John‘s, Mike‘s, and Dave's public key
Encrypt the document using those keys, and send it to them
Each of them can decrypt the document using their own private keys.

What I don't understand is the math behind this. How to encrypt data using more than 1 keys? When I studied cryptography at the campus, I learnt the basics of RSA, but only limited to someone encrypting a document for me using my public key, then decrypt it using my private key. Never tried doing this for multiple persons.


texts: RSA - Recover private key if each letter is encrypted separately and we got n,e,m

texts:
I'm curious if is it possible to recover a private key from insecure RSA implementation - each letter of the plaintext is encrypted separately (and no padding).
Let's say I have plain-letters, cipher-letters (for every value of plain-letters), public key $(e, n)$.
I know that it is insecure usage of RSA, but I want to know if it is possible to somehow calculate the private key which was used to encrypting.
If I understand RSA correctly we could have 256 equations (for every ASCII character):
\begin{align}
m_0 &= {c_0}^d  \bmod  \\
m_1 &= {c_1}^d  \bmod   \\
m_2 &= {c_2}^d  \bmod   \\
\vdots & \quad \vdots\\
m_{254} &= {c_{254}}^d  \bmod   \\
m_{255} &= {c_{255}}^d  \bmod  \\
\end{align}
We only don't know d. I read about CRT but seems like not applicable here. Can somebody explain/point if is it possible?


texts: Reversing a known encryption algorithm (4-byte repeating key XOR)

texts:
I've been practicing for an upcoming CTF competition, and I've finally reached the cryptography stage. I'm a complete newbie in this field (my knowledge is essentially that bcrypt is awesome and md5 sucks haha).

This is the challenge:

This is my cipher algorithm:

mysecretvalue = ???;
mysecretmessage = ???;
for (i=0;i<strlen(mysecretmessage);i++)
{
    mysecretmessage[i] ^= ((mysecretvalue>>(8*(i%4)))&255);
}
echo strhex(mysecretmessage);

and my output:
e971de14d87fc406c67fc41ac570c3528a4ec216da7fc2168a78df018a70d50bde3ed31bcb72dc16c479d500863ee71ad07fc2178b3ee012d96dc71cd87a9007c53ec41bcf3ec31ade7b901ad93edd0ad97bd301cf6ac612c66bd553c3709017cf7dd91ecb729e53ed71df178a49df01c13f

Decode it! ;)

I'm more interested in a general method of solving such challenges, however if you want to solve this one as an example it will be appreciated as well!

P.S This is all the info the challenge provides. I couldn't find a function named strhex so I assume it's pseudo-code albeit it does look pretty similar to Javascript.


texts:
Regev requires $q$ to be prime on lemma 4.2 of his paper for LWE.

Why does he require that and how this effect the proof of lemma 4.2?


texts:
I've read in DigitalOcean article about SSH that in order for a server to authenticate a client:

  The server sends the client this encrypted message.
  If the client actually has the associated private key, it will be able to decrypt the message using that key, revealing the original number.

But wasn't it enough for the client to sign the message, why do we need the encryption? Also, given that DSA keys can be used in SSH I'm starting to doubt that the article is correct.


texts: How should I store passwords that need to be available in plain text?

texts:
Suppose I need to store login information for a third-party website for a few users, how would I go about doing it?

Since I am logging into a third party website, I need the password in plain-text, not hashed. And no, the website in question does not provide any API.

In addition, the server I am using is accessible to people whose credentials are stored on it, so they will be able to get at least one plaintext/ciphertext pair, namely their own.

Given these two conditions, is there any way of storing user credentials on the server, or should I just ask for them each time the user logs in?


texts: How big could be nothing-up-my-sleeve numbers to initialize key schedule?

texts:
Is it fine if algoritm will have $32$ 128-bit numbers that will be nothing-up-my-sleeve numbers to initialize key schedule?
As I know from wikipedia the Hasty Pudding Cipher was criticized for its performance on smartcards. Specifically, some comments pointed out the difficulty of keeping over 2KB of RAM for the key table. In my case we got 0,5 KB. Isn't it still to much?


texts: How to construct a variable length IND-CPA cipher from a fixed length one?

texts: Suppose we can construct a secure (IND-CPA) encryption scheme for fixed length messages. I was wondering if there is a natural way to extend this construction for messages of variable length such that it is still an IND-CPA secure scheme.


texts: I've captured my tor client network traffic and noticed that in every packet it sends 2 TLS records first of which is always 32 bytes long. The first TLS record seems not to be carrying any data. What is it for?


texts: ECDSA security using same per-message secrets $k$ but different signing keys

texts:
I know that when I have a ECDSA keypair and use it twice with the same $k$ to sign different messages then the private key can be recovered.

If I now have multiple ECDSA keypairs and sign a message with each, and use the same $k$ in each signature, is this still secure?

Note: The signed messages may be identical.

I personally see no problem with it and the math seems to support that in my opinion, but better safe then sorry. This is why I'm asking the question.


texts: If WhatsApp cannot read our message, how can the media forwarding happen in an instant?

texts:
WhatsApp says even the photos shared on its platform are end-to-end encrypted. When WhatsApp says encrypted I assume the data is encrypted in my device and then sent across to the recipient.

When we are sending a photo for the first time we can see the actual upload happening (if you are in a slow network), but when we forward the same picture to someone else, the upload is not happening. It happens in an instant.

AFAIK the photo would have been again encrypted with the key pair for the second recipient and then again sent to the second recipient. Since the second upload is not happening is it that the encryption happens in the WhatsApp server? Is WhatsApp decrypting the media file and encrypting it with the new recipient's key when we forward it? Can it be called end-to-end encryption in that case?


texts:
I was taught that:

although OTP is CPA secure, it is not the case with CCA.

I'm trying to figure how to break OTP with CCA by showing how it fails the IND test.

Note: Saw this answer, but didn't manage to extract a proper proof.

So according to the test, the attacker chooses two messages m1, m2 of the same length, and sends them for the tester.
In the next stage, the tester privately creates an encryption key, randomly chooses which message to encrypt, and returns c* which is the chosen message encrypted.
Now, the attacker is able to use his chosen-ciphertext capability and decrypt any message he wants to (maybe messages - I'm not sure about this detail), as long as his chosen message is not c*, in order to guess which message was encrypted (m1 or m2).

What I already thought of:

Maybe we could split c* apart, decrypt both parts and concatenate.
Or we could also add a 0 in the end of c* and then decrypt the result.

But both methods wouldn't work since the key is in the length of the original message - so it cannot decrypt messages in other lengths.

So I add a condition of which the attacker can only decrypt messages in the same length of c* (and the original messages, obviously).

So now I thought about decrypting c* but replacing the last bit to 0.

Assume c* length is n, so the in the encrypted result, denoted as r*, I know the first n-1 bits are of m1 or m2, except for the last one, so I'd distinguish between the messages by comparing the n-1 bits with each of them (of course that'd require sending different messages for the test).

I feel like I'm missing something but can't figure out what exactly.

Does anyone have better example of breaking OTP with CCA, or can justify my answer?

P.S. Just a clarification: I assume of course that key is replaced in each encryption (but it doesn't matter here because decryption is done with the same key).


texts: 8 bit block cipher in CTR mode for practice - counter is 32 bits

texts:
I'm given a very simple 8 bit block cipher in which to encrypt plaintext x  with k k one performs $ x \oplus k $. I am given IV = 0101 and a CTR of value CCCCCCCC (36bits).
My understanding is that counter mode relies on the output block size of my cipher to yield a stream key of b (in this case 8) bits which will then be XORed with my plaintext, and that the bit length of IV and counter should also be b-bits long.
Am I misunderstanding, or did my professor make a mistake with the counter and IV being 40 bits long?
To aide, here is the exact text from the assignment:

Consider a simple system with 8-bit block size. Assume the encryption (and decryption) to be a simple XOR of the key with the input. In other words, to encrypt x with k we simply perform $ x \oplus k $ giving y. Similarly to decrypt y, we perform $ y \oplus k$ giving x.
You are given the following 16-bit input. 1111000011110000 (F0F0 in hex).
You are provided IV as: 00001111 (or 0F in hex).
For CTR assume the stream of bits ot be used for counter to be "110011001100110011001100110011001100" (or CCCCCCCCC)
The key to be used (where appropriate) is 10100011 (A3 in hex).
Compute the encrypted output with (i) ECB, (ii) CBC, (iii) OFB, (iv) CFB, (v) CTR (use IV = 0101 for CTR)


texts: Decrypt AES-encrypted data with another key

texts:
Here is a plain question, all filled with pseudo-real data :)

We have a string: "hello" and two keys for AES: GoodKey and BadKey.
We encrypt our string with GoodKey, and receive something like "lehho".
What will happen if we try to decrypt "lehho" with BadKey? Will decryption algorithm make no sense at some point (like 1/0 makes no sense) OR will it give us some other result, like "goodbye" (which is not original "hello" because of the wrong key)???


texts: Safest method for encrypting a file on a local machine

texts:
I am looking for a safe method to encrypt a local file on my machine. Let's say I have a file containing my logins and passwords -- how can I make sure that the encryption is reasonably sufficient in case this file falls into the wrong hands? I have a Yubikey that supports PGP application, and on it, I have a signature, encryption, and authentication PGP subkeys. I would like to find a protocol that would protect the file even when someone may get the encrypted file AND the USB token.

Ideally, I would like to find a protocol that would not require a specific program/script to create such encryption. The first thing that came to mind is to encrypt it with a symmetric key using PGP (GPG) and then encrypt the output using my own PGP public key. I know I should not invent the wheel when it comes to cryptography; hence, I am looking for established protocols or the combination thereof that have been tested with time and have all their shortcomings well known.

I am aware of password manager apps, but most of them cannot be used offline. The one that can (KeePass2) is a PITA to set up for a 2FA with Yubikey, especially on Linux which is my primary OS. Any alternative?


texts:
XTS is suitable for disk encryption while GCM doesn't.
Both require the same number of block encryption calls.
Both are parallel in encryption and decryption.
XTS is actually even faster in openssl implementation (openssl speed -evp aes-256-xts/gcm), not sure why.
Why even bother to use GCM instead of XTS?


texts: If I have a 256bit ECDSA public key how likely is it that the same public key will be generated by another person. Will it take on average 2^256 tries to generate same public key? If I xor the first 32bytes of the public key over the second 32bytes and only have 32bytes is it now 2^128 tries to generate the same 32byte data? Or less? Thanks


texts: Is there an asymmetric scheme where keys form a graph and a message can only be decrypted across a certain degree of separation?

texts:
Consider a network of trust, where each user u specifies some other set of users whom u "trusts". This forms a graph with users as nodes and declarations of trust as directed edges.

Each user may push encrypted data out to the network along with a maximum "degree of decryption", e.g. if the degree is 2, only direct friends (degree 1) and friends of friends (degree 2) should be able to decrypt the message.

Ideally this restriction could be implemented in the encryption scheme itself. The scheme would have the following properties:

Ability to encrypt a message M = c || d

where c is the message content and d is the max degree

The ability to generate a new key from another private key which can still decipher M (this corresponds to an edge on the graph of trust)
A generated key can only decipher M if it is less than d levels of derivation away from the original key used to create M
No key can be easily derived from a generated key

To spell it out more plainly, when user A trusts user B, A derives a new key from her private key and shares it with B, so B can now decrypt her messages of d >= 1. B does the same and generates a new key from A's shared key, which B shares with C. Now C can read messages from A of degree d >= 2. And so on. (Actually, when B decides he trusts C, he would pass on to C generated keys for every person B trusts.)

I'm wondering if anything like this exists, or if anyone can point me in that direction, or can provide intuitions as to whether this is even feasible. I am new to cryptography and can't even tell whether this is likely to be already done, doable, or impossible.


texts:
I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al.  There are some difficult points.

This is the distinguisher based on differential-linear cryptanalysis:

And this is the article I'm reading:

Q1) [Note that the differential probability p' is the probability for the expected difference in the required subset of bits,
which is usually different (higher) than the probability of the differential characteristic with the full block output difference,
so the best characteristic for our purposes may be different than the best ordinary characteristic.]

What is the difference between the expected difference in the required subset of bits and the full block output difference? Because I didn't get it,  I didn't understand the best ordinary characteristic. as well. At first, I thought the expected difference in the required subset of bits means that $\lambda_P$'s concerned bit. But at that time, what is the  the full block output difference? This is so confusing.

Q2) [This assumption is not necessarily accurate, for example, there might be other high probability differential characteristics with the same plaintext difference, but with different (or same) parity of the subset of bits of the difference. Thus, this approximated probability should be verified by the designer of an attack, and if possible, he should perform a more accurate computation of the probability, or check it experimentally.]

I didn't get the detail in this sentence. Does this sentence mean that this attack is not practical? Can you give me the meaning of this sentence?


texts: Protocol to identify zone of potential agreement without revealing reservation prices and having to trust third parties?

texts:
A wants to buy a company from B. Before A and B enter negotiations, they want to make sure that there actually is a zone of potential agreement. Obviously, they don't want to communicate their reservation prices to the other party (A only buys for less than 100m, B only sells for at least 90m). So they both communicate their reservation price to a trusted mediator who then tells them whether or not negotiations makes sense.

Is there a protocol that A and B can use to find out the same thing without having to trust the other and any third parties?


texts: When do we need composite order groups for bilinear maps and when prime order?

texts: Why we need bilinear groups of composite order? What's the special security property of the composite order group in comparison with one of prime order? To put it in another way when do we need composite order groups for bilinear maps and when prime order?


texts: Why k-lists generalized birthday problem when $k=2$ is classical birthday problem?

texts:
David Wagner in his article A Generalized Birthday Problem in CRYPTO 2002 says that in k-dimensional (also k-lists) generalization of birthday problem (GBP), when $k=2$ "this is just the extremely well-known birthday problem." Why is that so? As I understand it, in classical birthday problem we search for collisions in one list $L$, where $x_1$ and $x_2$ is supposed to be $\in L$), but, in k-lists GBP we have k number of lists, when $k=2$ it's $L_1, L_2$, we find $x_1 \in L_1$ and $x_2 \in L_2$ such that $x_1 \oplus x_2 = 0$.

So, how does k-lists GBP converges to classical birthday problem when $k=2$? Or I'm missing something?


texts: Cryptographically secure PRBGs and the previous-bit test

texts:
I am reading Junod's paper about the Blum-Blum-Shub PRBG (BBS) and I am having trouble following his reasoning at on page 15, where he argues that the next-bit test can also be peformed for the previous bit in the bit sequence $b_0b_1 \ldots b_k$ , i.e. an attacker can also try to predict $b_{-1}$. If I understand him correctly he deems this obvious as the next-bit test is equivalent to the polynomial-time statistical tests, the latter one being obviously indifferent to a reversal of the given bit sequence.
But I do not understand how this should be applicable, since (in my eyes) random number generators can in any case only build sequences that "extend in one direction infinitely" as they have to have some kind of starting point and the previous bit test can not be applied at the starting bit $b_0$, since there is no previous bit. So wgat is $b_{-1}$ supposed to mean?
Can you explain this to me?


texts:
In this paper I found the statement "We reduce the fairness problem in MPC to the problem of fair decryption [...] Fair decryption was shown to be a complete functionality for fair MPC in [GIM+10]".

How is decryption considered to be complete functionality for fair multiparty computation? What do you mean by complete functionality?


texts: Not Using RSA In OT1/2 Oblivious Transfer?

texts:
I was reading Oblivious Transfer (Wikipedia) and the 1-2 oblivious transfer. I was confused why RSA was needed. Why wouldn't this work?:

A:m1, m0

A:x1, x2 -> B

B:k, b

B:Xb+k -> v -> A

A:Xb+k-X1, Xb+k-X2 -> k1, k2

A:m0+k0, m1+k1 -> m'1, m'2 -> B

B:m'b-k -> mb


texts: Highest prime factor that is Safe for a particular scheme

texts:
My question is how many bits of prime number is secure so that it cannot be factored from very large number? Until today how large prime factor is found in large number?

Quantum computing find highest factor of size of 16 bits only( 56,153) until today  and I studied that rsa-768 in which 384 bits prime number  is factored from large number. Why different schemes takes very large prime, when even two 1000  bits prime number cannot be factored from 2000 bit large number  until today?
Thanks.


texts: Why does the TLS spec for TLS-PSK say not to derive the shared secret from a password?

texts:
According to a note at the end of section 2.2 of the TLS 1.3 spec (RFC 8446),

When using an out-of-band provisioned pre-shared secret, a
critical consideration is using sufficient entropy during the key
generation, as discussed in [RFC4086].  Deriving a shared secret
from a password or other low-entropy sources is not secure.  A
low-entropy secret, or password, is subject to dictionary attacks
based on the PSK binder.  The specified PSK authentication is not
a strong password-based authenticated key exchange even when used
with Diffie-Hellman key establishment.  Specifically, it does not
prevent an attacker that can observe the handshake from performing
a brute-force attack on the password/pre-shared key.

Is the vulnerability of concern here that observing a handshake would allow an attacker to brute force the shared secret offline based on the PSK binder?
And, if an attacker could recover the shared secret, is confidentiality of the previously-observed TLS-PSK stream compromised? Or would this only allow the attacker to compromise future streams (e.g. by spoofing the server and/or client as a man-in-the-middle?)


texts: Looking for an algorithm to encrypt with a single key and decrypt with a lot of keys without consuming too much space

texts:
Is it possible to have an encryption scheme that could be encrypted with a particular key, then decrypted with a large amount of keys without massively inflating the size of the final result?
I am looking for an encryption scheme that would allow me to encrypt a block of data, then be able to decrypt it with a highly specific set of variables. As an example, take two integers, where the first one must be in a particular range (say, within 1000-3000) while the second one is an 8 bit int and must have its 4th and 6th byte set to 1 (i.e. 00101000-00101111, 00111000-00111111). Both integers must fall within these predefined ranges, which themselves may not be public information, to produce a key that will be able to decrypt the data.
I have researched single encryption key - multiple decryption key schemes before posting this question. I have learned that GPG accomplishes this by encrypting the actual key with every single private key, then inserting this information into the header. This is unviable for my intended use case, as it would require me to include every single permutation of the variables that are supposed to make up the keys and thus does not scale (if my math is correct, the conditions above alone would result in over 30 thousand copies of the key encrypted with each permutation).
Another approach I've investigated is the Shamir's Secret Sharing algorithm. It would allow me to encrypt a symmetric key (for, say, AES-256) and receive from it a number of shares that I could then split between the different variables (k=2 in the example case above). I could then map valid shares (n>=2) to entries that match the desired ranges/conditions and reconstruct the same key with a variety of combinations. This does mean that I am no longer limited by permutations. While I would still have to store every single share (plus junk random data) in a binary blob to access based on these values, I would be able to store variable 1 and variable 2 in the example above as separate blobs, thus adding the number of values for each instead of multiplying them. I'm however unsure of the cryptographic implications of mapping SSS shares in this fashion.
I'm unsure if what I'm asking for is simply impossible, if I am missing something very obvious or if the above long-winded method of using Shamir's Secret Sharing is the best I can get.


texts: Digital Signature Algorithm signature creation?

texts:
I was studying DSS from "Cryptography and Network Security" by William Stallings. What puzzled me was the DSS approach figure described in the text. It says it uses Public and Private Keys for creating signature.

But the algorithm for creating signature in DSA doesn't use it.

$$r = (g^{k}\mod p)\mod q$$
$$s = (k^{-1}(H(M)+ x\cdot r)) \mod q$$

Someone please tell me the importance of public key here. Is it needed in verification only?


texts:
I'm just read this article from Atmel corporation in comparing RSA with ECC cryptography algorithms.

First of all please read these two paragraphs quoted from the article:

P1: Strength of an algorithm

  The level of security in systems is becoming a primary concern as you
  would expect. Most cryptographic experts recommend that current
  systems offer at least 128 bits of security, but what does that really
  mean? Note that this is not the same thing as key length as many may
  think. Security comes from the combination of the specific algorithm
  and its key length. For example, it is generally thought that 128 bits
  of security can be achieved with 128-bit AES keys, 256-bit Elliptic
  Curve keys, and 3072-bit RSA keys. If implementation issues are
  ignored, then these algorithms with those specified key lengths will
  generally have the same level of security.

P2: Performance of an algorithm

  When it comes to performance at 128-bit security levels, RSA is
  generally reported to be 10-times slower than ECC for private key
  operations such as signature generation or key management. The
  performance disparity expands dramatically at 256-bit security levels,
  where RSA is 50- to 100-times slower. RSA’s key generation is also
  very slow compared to ECC key generation, with the RSA’s being 100- to
  1000-times slower. However, this may or may not be a significant
  consideration in systems that generate keys infrequently. It does
  matter for certain protocols or policies that require more frequent
  key generation. Public key signature validation is generally faster
  with RSA compared to ECC, which can provide a benefi

Well, I feel conflicts between these paragraphs. As far as I know, Required time to break an algorithm (An empty of bug one!) is the only thing that determine strength of that algorithm.

And what is this Required-Time depends on?

NK -->  Number of forms of key that is 2^(key-length).
NI --> Number of instruction required to check a single key.

In the other words, algorithm A is stronger than algorithm B, only if NK*NI for algorithm A was greater than NK*NI for algorithm B. Am I right?

If so, why ECC-160 is stronger than RSA-1024? I mean, okay, based on the performance paragraph, RSA is only 10 times slower than ECC in this security level, but in return the attacker must check 2^1024 different keys in RSA instead of 2^160 keys of ECC!


texts:
Are key bag keys rotated between backups?
Or if I have keys from an old backup, am I able to use then with a later backup?
Short of it, have a friend w/ an incomplete backup and attempting to leverage keys from a previous backup to decrypt


texts: Why do curve25519 implementations only have ge_frombytes_negate_vartime, and not a regular ge_frombytes method?

texts:
In every implementation I can find, there is ge_frombytes_negate_vartime but not a regular ge_frombytes method.

I'm assuming there is a deep mathematical reason for things being this way that I'm hoping to uncover.

And since there are no ge_neg methods either, what's the most efficient way to negate the point that is read, in order for it to have the correct sign? Do I need to convert to any particular coordinate space and then manipulate one of the coordinates?


texts:
I'm studing the basics of elliptic curve from various resource some more mathematical someone more practical.
I know that the equation where the elliptic curves come from is the Weistraß equation
$$y^2+a_1xy+a_3y=x^3+a_2x^2+a_4x+a_6$$
After the trasformation
$y\rightarrow y-(a_1x+a_3)/2$ I get the isomorphic curve : $$y^2=x^3+\frac{b_2}{4}x^2+\frac{b_4}{2}x+\frac{b_6}{4}$$
(the coefficent $b_2,b_4,b_6$ are a combination of the previous one).
After defining the equation I've started reading the group law and proceeding further I found out other kind of curves with different group laws(the formulas for calculating the addition and the double of a point are different).
In the end now I know that there exists three kind of curves:

Supersingular curves
$y^2+cy=x^3+ax+b$

Non supersingular curves
$y^2+xy=x^3+ax+b$

Ordinary curves
$y^2=x^3+ax+b$

Questions

What are the difference between this curves?
Why are EC defined only on ordinary curves? What is their advantage?
What is the correct elliptic curve representation?

Reading online seems that supersingular curves require more bit (to avoid this) so that's why they are not used. Is this true? What about non supersingular curves?


texts:
Sorry if this is asked a lot, I just don't know if there's a specific word for it.

I'm at uni and have a codebreaking exam in a few days, I don't have to do well in it but I want to do as well as I can, but this is really making me struggle.

Here is my work so far, everything's going alright:

Obviously when I try to do the bottom part, any calculator I use says it's invalid or infinite, I understand it's a crazy big number, but I have no idea how to work it out otherwise.


texts: Advanced Composition (Differential Privacy)

texts:
I have a problem understanding the proof of the corollary of Advanced Composition
Theorem Advanced Composition:
For all $\varepsilon,\delta,\delta' \geq 0$ the class of $(\varepsilon,\delta)$-differentially private mechanisms satisfies $(\varepsilon',k\delta+\delta')$-differential privacy under $k $-fold adaptive composition for:
\begin{equation*}
    \varepsilon'= \sqrt{2k\ln(1/\delta')}\varepsilon+k\varepsilon(e^\varepsilon-1)
\end{equation*}
Corollary
Given target privacy parameters $0<\varepsilon'<1$ and $\delta'>0$, to ensure $(\varepsilon',k\delta+\delta')$ cumulative privacy loss over $k$ mechanisms, it suffices that each mechanism is $(\varepsilon,\delta)$-differentially private, where
\begin{equation*}
    \varepsilon=\frac{\varepsilon'}{2\sqrt{2k \ ln(1/\delta')}}
\end{equation*}
Proof:
The theorem of Advanced Composition tells us the composition will be $(\varepsilon^*,k\delta+\delta')$ for all $\delta'$, where $\varepsilon^*=\sqrt{2k \ln(1/\delta')}\cdot \varepsilon+k\varepsilon^2$. When $\varepsilon'<1$ we have that $\varepsilon^*<\varepsilon'$.

I don't see clearly the connections between the proof and the corollary. I tried using the quadratic formula. I think it, and don't see how they get the $\varepsilon$ from the corollary.


texts: Does this ECIES scheme make MAC redundant?

texts:
I've implemented ECIES (see the below pseudo-Python).

r = urandom(32)
p_r = x25519(r, BASE_POINT)
shared_secret = x25519(r, x25519_public)
iv = urandom(12)
key = sha256(p_r + x25519_public + shared_secret +
iv)
plaintext_sig = ed25519_sign(eddsa_secret, plaintext)
ciphertext, tag = chacha20_poly1305_encrypt(key, iv, plaintext) # as per RFC
output(p_r, iv, plaintext_sig, ciphertext, tag)

As you can see, the plaintext is signed to provide authentication.
Does this signature make the Poly1305 MAC redundant?


texts: Alternative AES key expansion for CTR based random number generator

texts:
Daniel J. Bernstein proposes an alternative to NIST AES-CTR based deterministic random number generator (AES-CTR-DRBG). Instead of a less performant complex construction, he uses an standard AES-CRT with a fast key erasure method.

I am asking myself, is AES key expansion overhead really necessary for this application?

Instead of using the the first 2 blocks of each 48 to generate a new key using the standard key expansion to generate the needed 15 round keys, use directly the first 15 blocks as round keys, bypassing completely the key expansion step.

Is this scheme less secure than the initial proposal of Daniel J. Bernstein?


texts: Reversing a hash of known hashing algorithm

texts:
I am sure this is a very easy thing to do but I am not sure how to go about solving a problem like this,
So there is this hash function which operates on a message which is in the form of a byte array (each element is 8 bits long):

digest [i] = ( (129 * message[i]) XOR message[i-1]) % 256

The value of message[-1] is 0.

Now, I have a few samples :

message = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]
digest = [0, 129, 3, 129, 7, 129, 3, 129, 15, 129, 3, 129, 7, 129, 3, 129]

Now I have noticed a few things, $129_{10} = 1000\;0001_2 $
and multiplying it with a number greater than 128, does not change the lower 8 bits at all, except 255 and multiplying it with a number less than 128 does not change the lower 8 bits if it is even, and for odd, the $8^{th}$ bit is one rest is same. First, is this observation correct?

Second, how can one go about reverse engineering a hash function like this, so that given a digest, you can find out the message? Don't give me a direct solution, I am looking for an explanation and algorithmic way of doing it.

Thanks.

EDIT Another piece of information is that the length of message and digest is always 16 (bytes).


texts: identify if the functions are pseudorandom generator?

texts:
Given a pseudorandom generator (PRG) with $G(x) = y_{1} || y_{2}$, where $y_{1}$ and $y_{2}$ are n-bit strings. $G'(x) := G(y_{1}) || G(y_{2})$. Is $G'(.)$ still a PRG?
I am guessing it's a No because $G'(x) := G(y_{1}) || G(y_{2})$ always outputs the concatenation of $G(x)$ with previously generated outputs as inputs. But I am not sure what's the formal way of explaining this.

In addition. $G''(x) = G(y_{1}) ||G(y_{1})\oplus G(y_{2})|| G(y_{2})$, is $G''(x)$ still a PRG? I would say No again in this case because the pattern is again the concatenation of $G'(x)$ with the $\oplus $ in the middle?

I think I might be entirely wrong on this. A pointer or two would be appreciated.


texts: A confusion about linear span of modified de Bruijn sequence

texts:
Recently i'm reading "Cryptographically Strong de Bruijn Sequences
with Large Periods" . In the section 2 2.1 Basic Definitions and Properties , property 1 says that $$2n<LS_s\leq2^n-2$$ for a span $n$ sequence. The author claims that this bound comes from "Characterizations of Generators for Modified de Bruijn Sequences". I go through it, but i never find  this bound in it.

I wonder how this bound comes?  Can someone prove it? Or does someone know some related paper about it?  thanks ..


texts: Why does openssl BN_generate_prime return only a fraction of the safe primes within the given bit range?

texts:
I went into prime generation issues the last week and eventually calculated 10^7 primes using erik tews safeprimegen python wrapper for openssl.
(https://github.com/eriktews/gensafeprime) (System: MacOS 10.8.4 / openSSL 0.9.8x)

10^7 openssl BN_generate_prime(32) -> 32bit safe primes
-> safeprimes.txt

Then i used R to get some information on this data:

  1343370 (13.4%) unique primes (within the 10^7 gathered numbers)

  2^32 < 3221226167 < 1343370 safe primes < 4294967087 <
  2^32

  (range of p is roughly : 2^31 *1.5 < s-p < 2^32 -209 (second half of the 32bit range)

For comparison i did generate all 32bit primes using a prime sieve algorithm.

2*31 < p < 2*32

  total 98182656 primes thereof 3059799 safe primes

  safe primes in range of openssl output:
  3221226167 < 1506677 safe primes < 4294967087

  openssl safe primes  /   safe primes in range:
  1343370 / 1506677  -> ~ 89.1 % of safe primes in range

(I did repeat this for 31bit safe prime generation and got almost the same proportions.)

Findings:

the openSSL output covered only about half of all safe primes in the given
range (2^32 -> 3059799)
also within the range of the returns only 90% of the safe primes available where reported

I would be interested to understand why openSSL safe prime return is restricted in such way and if this is considered an optimal result having in mind the crypto functions included in the library that rely on the safe prime generator.


texts: AES256-GCM - can someone explain how to use it securely (ruby)

texts:
I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly stored alongside the ciphertext (ie, it can be public).

I started to read about GCM, but I don't quite understand some things. On this Stackexchange Thread, it is stated that:

GCM does not need an IV supplied.
Associated Tag is not necessary, but may improve security (example they gave is using a database id)

But Wikipedia states about GCM:

  GCM has been proven secure in the concrete security model.[13] It is secure when it is used with a block cipher mode of operation that is indistinguishable from a random permutation; however security depends on choosing a unique initialization vector for every encryption performed with the same key (see stream cipher attack).

Which implies that the IV still needs to be randomly generated and supplied for each encrypt with GCM, so why does the user in the stackexchange answer post say that we are not required to provide the IV?

Wikipedia also states:

  The authentication strength depends on the length of the authentication tag, as with all symmetric message authentication codes. However, the use of shorter authentication tags with GCM is discouraged. The bit-length of the tag, denoted t, is a security parameter. In general, it may be any one of the following five values: 128, 120, 112, 104, or 96.

In OP's post in that stackexchange thread, OP uses tag = cipher.auth_tag. Is this by default 96? If so, is there a way to change it? Are there significant performance issues in using 128 than 96?
Does both the Associated Tag (cipher.auth_data) and the Authentication Tag (cipher.auth_tag) need to be kept secret? Or can they be kept open like the IV?
Finally, can someone explain further what is meant by the Associated Tag? The example in the answer that was given in OP's thread was that we can use a database id to ensure that the data belongs to a certain database user. Let's say that a user has the following database fields:

User
- primary_id
- encrypted_email

And we want to encrypt the User's email before insertion. With User primary_id==10 (modifying OP's ruby code):

cipher = OpenSSL::Cipher::AES.new(128, :GCM)
cipher.encrypt
key = cipher.random_key
iv = cipher.random_iv
cipher.auth_data = "10"    # Using DB user's id!

encrypted = cipher.update(data) + cipher.final
tag = cipher.auth_tag

I replaced cipher.auth_data with the database user's primary_id. Is this correct?


texts:
I know this question seems too general, not specific. Our professor asked this question today, and I have no idea how to answer it.

Maybe it's the key size, maybe another thing? Any idea?


texts:
I just check all the questions with scrypt tag about that and usually it's said that scrypt is nice in theory and theoretically better than bcrypt and PKDF2, but it's too young to be "completely safe".

I understant bcrypt is very old and yet unbroken, but since it uses relatively little amounts of RAM crackers can get around it with specialized hardware. On the other hand, scrypt uses a "lot" more ram (configurable, to a degree) and tries to solve bcrypt's issue of using so little RAM.

So the main question is, if script isn’t "old enough to be safe" – when will scrypt be old enough to be safe for proper use? Maybe even more important: which factors influence “old enough” so that I can tell if and/or when something like scrypt has aged enough to be safe for practical, cryptographic use?


texts: Is this scheme a provably fair random number generation?

texts:
I have thought up a method for generating random numbers between a client and a server which I hope is fair:

The client and server decide on a range in advance, $0$ trough $n-1$.
The server generates a $256$ bit random number $m$ (in the range $0$ to $\operatorname{floor}(\frac{2^{256} }{ n}) · n$) and hashes it with SHA-256 to give $m'$. $m'$ is then sent to the client.
The client generates a $256$ bit random number $o$ (as above) and sends it to the server.
The server can now calculate a fair random number $p = m + o \pmod n$.
The server sends $m$ and $p$ to the client.
The client can now check $\operatorname{SHA256}(m) = m'$ and $p = o + m \pmod n$.

Am I overlooking anything?


texts:
Consider a scenario in which a group of people use a common modulus $n$ in the textbook RSA crypto system,
where $n=pq$, $p$ and $q$ are large distinct prime numbers.

Is there any chance for an attacker outside the group to view the original message?

Let me explain my solution. Assume the group members receive the same message. So $c_1= m^{e_1} \bmod n$ and $c_2= m^{e_2} \bmod n$. Assume $e_1$ and $e_2$ are co-prime. So if we can find $x, y$ satisfying $e_1x+ e_2y=1$ then an attacker can view the original message. Am I correct?


texts: Determining susceptibility to frequency analysis

texts:
I'm looking to create some tokens using a keyed hash mechanism to represent our individual customers.  I was planning on using combinations of the customer's personal information (e.g. H(Firstname,Surname,DOB)) in the token to prevent frequency analysis, but is there some way I can quantify this?

For example, qualitatively I assume that using:

H(Firstname,Surname,DOB,FirstPurchaseDate)

will be more secure than using just:

H(Firstname)

as the latter will render some values of the first name identifiable by frequency analysis given a large enough sample (I will have to open source the protocol for this, so I'm assuming that attacker knows which variables the tokens consist of).  I would like know what combinations of variables will render frequency analysis impractical - are there any established techniques for this?


texts: Is pairing based cryptography ready for productive use?

texts:
I'm currently testing one among those many interesting cryptographic protocols based on bilinear maps.
It's quite hard to understand the underlying fundamentals, especially since there are several types of pairing and different underlying algorithms like Weil, Tate and Ate (again with subtypes?). Although I understand the properties

So I started with Ben Lynn's "On The Implementation of pairing based cryptosystems", which is relatively old. There he distinguishes between Type A-G curves and notes that Type3 curves are "susceptible to certain discrete log attacks". On the other hand, Steven Galbraith talks about "the death of Type 1 pairings" in his quite new blog entry and states that "Type 3 pairings are usally the most efficient" and Type 4 is rarly used. (Ben Lynn however seemed to have a little preference for the Type 4 pairing)  Are those the same pairings as mentioned by Ben Lynn?

Can some of them been seen als secure enough for productive use? Are some of them seen to be more secure than others? What about the Ate-pairing which seems to be surprisingly fast?


texts: Find the key to a Vigenère cipher, given known ciphertext and plaintext

texts: I have the ciphertext and the plaintext. Is it possible to know the key? If not, what do I need to find it?


texts:
Pseudorandom number generators often use hash functions for the generation. Some applications allow the users to choose this hash function, for example OpenVPN.

From the OpenVPN manual:

  --prng alg [nsl]
      (Advanced) For PRNG (Pseudo-random number generator), use digest algorithm alg (default=sha1), and set nsl (default=16) to the size in
  bytes of the nonce secret length (between 16 and 64).

Set alg=none to disable the PRNG and use the OpenSSL RAND_bytes function instead for all of OpenVPN's pseudo-random number needs.

What impact does the hash function have on the randomness of the resulting pseudorandom number?

For example, SHA1 suffers from proven hash collisions. Does that impact the pseudorandom number?

Would SHA2 be considered more secure or is the impact of the hash function not that crucial on the randomness?


texts: What is the high level procedure to use ECDSA?

texts:
I want to make a computer program to sign and verify some message using ECDSA.

There are some computer libraries but I'm having trouble using them, as I don't understand ECDSA.

What do I need theoretically?

Is ECDSA the same as other digital signing that I calculate hash of message, encrypt the hash and append it to the original message?
In ECDSA can I choose hashing function and some encrypting parameters? What I need to know about generating pair of keys? What else do I need to specify.

NOTE: I don't need to implement ECDSA algorithm, there are libraries for that, but what I need to know what are the variable parameters in the algorithm.

EDIT: Here is a note from the library:

sign = crypto.createSign('SHA256');

privateKey = getPrivateKeySomehow();

sign.write('some data to sign');
sign.end();

sign.sign(privateKey);
// Prints: the calculated signature using the specified private key and
// SHA-256. For RSA keys, the algorithm is RSASSA-PKCS1-v1_5 (see padding
// parameter below for RSASSA-PSS). For EC keys, the algorithm is ECDSA.

Does this mean I have to specify a hashing algorithm and also generate a pair of EC keys?


texts: Self-correcting encryption. What are the essential elements?

texts:
Optical discs are prone to damage, and for this reason, they usually store data encoded with an error correcting code.
While day-to-day use for optical storage media has diminished in recent years, they continue to be used for distribution of movies and TV shows, given they have special value to collectors. In such applications disc content is usually encrypted to protect copyright, which begs the question, what are the requirements for their decryption to be successful?
Now let me formulate a scheme, with layers consisting of error-correcting codes and ciphers.
Before data is burned onto a disc, it goes through 3 layers:

Inner-layer error correcting code,

Encryption,

Outer-layer error correcting code.

The tricky part is encryption. It seems that only a stream cipher can be used, otherwise the inner-layer error correcting code will be meaningless when the decryption fails. As such, deterministic authenticated encryption and key-wrapping ciphers cannot be used here. So a stream cipher must be used, and nonce must receive extra protection against potential errors in the outer-layer error correcting code.
My question is: if there's an inner-layer error correcting code, will it be able to work without an encryption algorithm based on a stream cipher? How do DRM-protected discs usually protect its contents from theft and physical damages?


texts:
I would like to know whether it is possible to determine whether a value of for example 256 bit length is a SHA-256 hash or a random, equally distributed value. Is there any research related to common hash functions? Can this property be derived from the avalanche effect?

I would like to know because I would like to include plain text hash values in a steganographic medium, where the stegosystem bases on white noise to be turned into sentences, with number of words per sentences, that have the same distribution of length as usual in this language. Encryption of the hash values is not possible, because at that point of the designed protocol, no key exchange has been performed, yet.

Thank you for all answers or questions related to this problem.


texts: Must a line hitting two points on the elliptic curve over a finite field hit another point by continuation?

texts:
The Arstechnica article title as "A (relatively easy to understand) primer on elliptic curve cryptography" claims this;

In fact, you can still play the billiards game on this curve and dot points together. The equation for a line on the curve still has the same properties. Moreover, the dot operation can be efficiently computed. You can visualize the line between two points as a line that wraps around at the borders until it hits a point. It's like, in our bizarro billiards game, when a ball hits the edge of the board (the max) and then is magically transported to the opposite side of the table and continues on its path until reaching a point, kind of like the game

and provides an animation (It is a GIF see on the page, can't link here).
And I've made a similar test that achieved the same;

The simple curve is $E\colon y^2=x^3+4x+20$ over $\mathbb{F}_{29}$ and $P=(1,5), Q=(5,7)$ and $R = P+Q = (16,2)$ is drawn on the figure.
I've followed the same step, draw a line passing through $P$ and $Q$, and continue from the opposite edge when an edge is hit!
The green lines are the borders+1 of the possible elements, the blue lines have used for (visual) check the continuation.
Now enough experience;
If the claim on the Arstechnica is theoretically correct then what is the theory?


texts: Why does spiped use both nonces and ephemeral keys?

texts:
Colin Percival's spiped utility uses a pre-shared key and Diffie-Hellman with ephemeral keys to provide forward secrecy.  The protocol is summarized in the project's README under the section "Encrypted Protocol".

What is the purpose of the nonces (nonce_C and nonce_S)?  How are they useful when x_C and x_S are already chosen at random?


texts: What makes adaptive memory attack difficult for the adversary?

texts:
On page 11, definition 2 of "Simultaneous Hardcore Bits and
Cryptography Against Memory Attacks", the paper outlines the following steps

(PK,SK) public key and secret key are generated by defender using Gen($1^n$).
Adversary $A1$ generates $m_0$ and $m_1$ and a $state$ using PK.
Defender randomly selects $b$ and encrypts $m_b$ invoking $ENC_{PK}(m_b) = y$, and given to $A2$.
Using challenge $y$ and $state$ generated by $A1$, adversary $A2$ guesses if $m_0$ or $m_1$ was encrypted in step 3.
The adversaries win if the guess is right.

My question:

In step 2, the $A1$ generates the two messages $m_0$ $m_1$ using the public key PK, but doesn't this make the game trivial for the adversary to win after seeing the challenge ciphertext in step 3?  Couldn't the adversary just use PK to encrypt $m_0$ and $m_1$, and see which one matches the challenge ciphertext?
I feel like I'm a key point and would appreciate if someone could clarify what the paper is saying.


texts: Why doesn't the JOSE suite/JWA include ECIES?

texts:
The JOSE suite specifics use of RSA-OAEP (for when one party has an RSA key) and ECDH (for when two parties have EC keys) in JWA.

Why doesn't it include ECIES? It seems like a way to derive a key when only one party has an EC key would be a common need.


texts: Why HAIFA and sponge constructions are not prone to length extension attacks?

texts: I was writing in a document about the flaws of the MD construction which pushed cryptographers to create different and more robust constructions. However, I don't know why HAIFA and Sponge constructions don't suffer from this attack.


texts:
Let $\mathcal S=\{0,1\}^n$ be the set of bitstrinsg of $n$ bits (for security parameter $n$). Let $P$ be a public Pseudo-Random Permutation of $\mathcal S$, efficiently computable in both directions.
Construct a block cipher $E$ with message and key domains $\mathcal S$ as
$$\begin{align}
E:\mathcal S\times\mathcal S\to\;&\mathcal S\\
(k,m)\mapsto\;&E(k,m)\underset{\text{def}}=P(k\oplus m)\oplus k\\
\end{align}$$
What can we prove about the security (under Chosen Ciphertext Attack, or orther) of that block cipher?
Update: that's known as the single-key variant of the Even-Mansour scheme. The original scheme has two independent input and output keys. The reference article is Shimon Even and Yishay Mansour's A construction of a cipher from a single pseudorandom permutation, in Journal of Cryptology, 1997, originally in proceedings of Asiacrypt 1991.
Note: I still welcome a reference, or better a proof, for the single key variant.

Can one break (find a practical distinguisher of) $E$ for the following candidate instantiation of $P$?
Restrict to $n$ with $p=2^n+3$ prime (see A057732 for values, some multiple of $8$ and even $16$). Let $e$ be $3$ (resp. $5$) for odd (resp. even) $n$, which insures $\gcd(e,p-1)=1$. Assimilate elements of $\mathcal S$ to integers. Define
$$\begin{align}
Q:S\to\;&\mathcal S\\
m\mapsto\;&Q(m)\underset{\text{def}}=((m+2)^e\bmod p)-2
\end{align}$$
That's a permutation of $\mathcal S$, but not a good enough PRP for the application (that makes an interesting exercise. Hint: What's $Q(m)+Q(2^n-1-m)$ ?)
Let $a$ and $b$ be two $n$-bit nothing-up-my-sleeves constants, e.g. $a=\left\lfloor\pi\,2^{n-2}\right\rfloor$ and $b=\left\lfloor2^{n-1/2}\right\rfloor$. Define
$$\begin{align}
P:\mathcal S\to\;&\mathcal S\\
m\mapsto\;&P(m)\underset{\text{def}}=Q((Q(m)+a\bmod 2^n)\oplus b)\\
\end{align}$$
Vague rationale: insert the non-linear $x\mapsto (x+a\bmod 2^n)\oplus b$ between two instances of $Q$ providing the diffusion. $a\ne0$ is necessary for security, but so far I have no break for $(a,b)=(1,0)$.
Note: I only created a security system so clever that I can't imagine a way of breaking it. The most clueless amateur can, as observed by Bruce Schneier. That second part of the question if thus off-topic, and I'd understand downvotes!


texts:
I've been working on a project that will require secure communication over the internet, so I've been thinking of TLS 1.2. After looking around I chose Botan but then I thought about using a more common one, OpenSSL. But since Heartbleed I've been reading quite a bit about problems with OpenSSL, and it seems to be rather poorly documented. I'm a decent programmer, but I don't know nearly enough about cryptography to evaluate a library on anything else than ease of use.

My question is this: Is there any way for me to evaluate the cryptographic strength and solidness of a library without paying a code review firm to go through the entire library?

Or do I just pick one that appear solid? My current alternatives are Botan and PolarSSL, both appear easier to use than OpenSSL.


texts: Are there any historic examples of breaking the one-time pad because of a careless key re-use? i.e simple attack on a multiple-time pad?

texts: It doesn't have be using a truly random key, (it could be the Enigma) but the attack must be based on XORing two parts of ciphertext.


texts: Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?

texts:
I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information.

Basically I have a table like this

username varchar(50),
password varchar(255)

In the password field I'm storing passwords with Argon2i. Users login and it verifies their password in the database (this is all done with Symfony login).  After that users are presented with another screen to enter a passphrase. They enter the second password (this password is shared among all employees of the company).

I have another table like

key_pass varchar(255),
salt varchar(50)

the second password is used with password_verify against the value of key_pass which is a password stored with Argon2i.  If it's successful, then I use Halite (aka scrypt provided by libsodium in this scenario) to derive a key using the value of salt.  Basically the whole thing looks like this:

if (password_verify($view->getPassword(), $encryption->getKeyPass())) {
   $encryption_key = EncryptionKey::deriveFromPassword(
      $view->getPassword(),
      $encryption->getSalt()
   );
}

This key would be used to decrypt the rest of the data in the db.

So three questions:

1) Is this form of double authentication even helping security?  I mean basically in the end if the attacker gets the second passphrase they don't even need the first login (assuming they have direct access to the data).  I suppose it just makes the web site more secure since they can't even attack the second passphrase without having the first via the web site?

2) Is using the second passphrase to derive the key safe?

3) Assuming #2 is "yes", in the event I want to change the second passphrase (i.e. - employee leaves company), is this possible without re-encrypting all of the data using the new derived key? If no, what possible implementations/alternatives could allow for that? Perhaps storing another key encrypted in the database and using the above derived key to decrypt that and then that key is the real key that decrypts other data in the db? If that works would Halites Symmetric::encrypt be secure enough for the second key?

Thanks for any help!  I've been researching this stuff for months but I'm no security expert - would REALLY appreciate somebody just validating all this that I came up with


texts: How to perform AES MixColumns as matrix multiplication in GF(2) (boolean values)?

texts:
AES MixColumns is done by multiplying a $4 \times 4$ matrix and a column of the AES state (a vector). Addition and multiplication are done in $\operatorname{GF}(2^8)$.

In the paper White-box AES, the authors use $32 \times 32$ matrix $\mathit{MC}$ times a $32 \times 1$ vector over $\operatorname{GF}(2)$.

My question is how this $32 \times 32$ matrix is constructed? Or more generally, how matrix multiplication in $\operatorname{GF}(2^8)$ is mapped to multiplication in $\operatorname{GF}(2)$?


texts: Practicality of dangerous/unsafe content safety proof as follows

texts:
Suppose I am building a cloud storage with client side encryption. My policy is that I would not allow anyone to store pornographic, violent or otherwise unsafe content but must ensure full privacy. We also have a machine learning algorithm that can be run on client side with server provided internal states which the server is confident is very reliable in terms of detection of harmful content. Say, an algorithm which outputs unsafe with high probability if there is pornographic or violent content in a picture. The client now has to prove to the server that the content it is uploading is safe using the same machine learning algorithm and the internal state that the server expects it to be. My question is how practical current ZK proof schemes (SNARK, STARK, bulletproofs) are for this kind of problem in terms of time taken and proof size. See, my problem has a short secret witness, (the encryption key alone will be enough) but has large public input (the entire encrypted file + the entire internal state of ML algorithm) and very expensive calculation.
An alternative:
The client transforms the image/(or audio video) up to some level. It then homomorphically encrypts the features using a different homomorphic encryption key and sends to server. The server now processes it the sends back encrypted result. The client then proves to the server the entire job is well constructed, i.e. the transformed and homomorphically encrypted file is the same as the encrypted file to be uploaded and that the encrypted result says "SAFE". The witness now consists of both keys and the public input consists of the encrypted file, homomorphically encrypted transformed content and the homomorphically encrypted result. This may be less expensive in terms of client work and requires more rounds of interaction.
I am not looking to build something like this right away but I want to know whether my approach is practical. I know FHE is still not satisfactorily achieved but let's just pretend otherwise.
EDIT:
I just remembered what my problem with second approach was. It requires that the server be trusted, otherwise the server will have to prove that it did the calculations honestly. Can the client verify the authenticity of calculation with significantly less resources than it would use to calculate it itself and generating proof.


texts:
Ever since the SHA-3 competition, I've been wondering if it is possible to create a hash algorithm that is easier to parallelize. The current algorithms all seem to require building a tree of hashes. This has however rather serious drawbacks:

as they requires a tree with certain parameters (such as the size of nodes and branches), it needs to be explicitly defined what the tree looks like
communicating parties should be programmed explicitly to allow hash trees
the tree is likely to be optimized for certain configurations, and not all parties will have the same configuration (e.g. an 8 or 16 bit processor checking the hash created by a 64 bit server machine with GPU acceleration)
if the leaves are too big, you need a whole lot of information before you could start with the next leaf
with the exception of Skein, none of the remaining candidates seem to define how the hash tree should even be constructed

Now I am wondering if you could construct a hash algorithm using a PRF that has a counter as input. In this construct, you would have a relatively strong PRF that is fed both the counter and a block plain text, resulting in an output of a known size (step1). This output would then be compressed together with the other transformed blocks in (step 2). Finally, as usual for a hash, you would have a finalization step which avoids length extension attacks (step3).

To allow for easy parallelism, I think that step 2 should be associative. In other words, it should not matter in which order the output of step 1 is given to the function in step 2. If it is associative, it would even be possible to distribute step 2 between the processes as well. In that case, step 2 may even be relatively heavy (sponge like?). The trick, obviously, is to create collision resistance for the combination of step 1 and step 2. This is where my perfect scheme begins to crumble, and I am wondering if it is even possible to create a solution for the problem.

The advantages of such a scheme are obvious: it would have none of the drawbacks of the tree hash scheme. Anybody could generate a hash using as many threads or computing blocks as they want. Only the block size, the output size of step 1 and the state of step2 would be restraining implementations.

The algorithm would of course not be able to use the Merkle–Damgård construction, as it assumes that each block is processed in a sequential fashion - which introduces the problem in the first place. It seems that Merkle–Damgård and variations on Merkle–Damgård  still rule supreme in the SHA-3 competition (at least with most of the final candidates).

[EDIT: By now Keccak has been chosen as winner of the SHA-3 competition, and one of the reasons is that it was the candidate within the 5 remaining candidates that was using a sponge instead of a Merkle–Damgård construction, so I guess that this paragraph is out of date by now]

Unfortunately, I'm not introduced to mathematics enough to see the correct solution, I cannot find if it has been tried, and I'm certainly not able to prove that my scheme would be impossible. Hopefully, this is where you can give me some hints.


texts: Why is Bcrypt called a Key Derivation Function?

texts:
I am trying to understand why is bcrypt called a Key Derivation Function?

I looked up the details of Ekfblowfish on Usenix article.

After reading it, I understood that:

The password is the encryption key. The length of the password can vary and so the length of the encryption key can vary (max is 56 bytes or 448 bits).
128 bit salt, it does not provide the details about how this salt is generated? It only says, that the 128 bit salt along with the variable length encryption key is used to modify the S Boxes and the P Array.
When it says, Key Schedule, it refers to both, S Boxes and P Arrays. The Key Schedule keeps changing using the bits of 128 bit salt and the encryption key.

Now, what key are we deriving here? It is not clear, why is bcrypt called a Key Derivation Function?

So, does it mean that at the end of Expensive Key Schedule, we have a unique value for S boxes and P array contents which are further used to encrypt "OrpheanBeholderScryDoubt" using ECB mode.

So, aren't we deriving the Key Schedule (S boxes + P Arrays) instead of the Encryption Key (which is the same as the password that was supplied as an argument in the starting)?

Which key has been derived using Eksblowfish?


texts: Differences between hash- and encryption algorithms?

texts:
There is a lot of confusion between hash- and encryption algorithms; I would like to understand:

When do we use a hash algorithm and when do we use an encryption algorithm (a cipher)?
How difficult it is to reverse hash- and encryption algorithms?
From the theoretical/mathematical perspective, what differentiates a hash- and encryption algorithm?


texts: Is it possible to generate a hash function that produces similar output to SHA-256?

texts:
Is it possible to create a hash function that generates a correlated to SHA-256 when given the same input?
In other words, given a fixed input X:
SHA-256(X)=A
SHA-256'(X)=B

where he outputs A and B are similar, or correlated.
I was thinking about remodeling a few parts of the SHA-256 function without changing the underlying construction too much. Can someone offer more insight or suggestions on whether it is possible to do this?

EDIT: I was thinking of creating a hash function with a *built-in "backdoor" that allows for preimage attacks. Sort of creating a breakable version of SHA-256.


texts: Second preimage attack complexity when the digest is malleable

texts:
An attacker has a hash $h$ and a message $m$. He wants to find $m^\prime$ with the same length as $m$ which hashes to $h^\prime$. However, $m^\prime$ can only differ from $m$ in the 1 bits (i.e. binary 1 can be changed binary 0, but not the other way around). Additionally, $h$ is malleable, and $h^\prime$ differs from $h$ in the same way.

In other words, the attacker has a message and a hash and can convert any 1 bit to a 0 bit in both the message and the hash. What is the complexity of a generic second preimage attack in this scenario?

The variables in this case are the length of the message, the hamming weight of the message, and the size of the digest (assumed to have a hamming weight half that of its length in bits, on average).

Background: I am working on a project where I have hardware write-protected data (holding firmware) that I wish to modify to bypass security controls. The write-protected medium holds both the data that I wish to modify, as well as a cryptographic hash over the data. Although the medium is ostensibly read-only, I can reliably change 1s to 0s using special hardware, but not the other way around (0s to 1s).

I can modify a portion of the firmware image and the hash itself. I need to modify a few relevant bits in the firmware image to "backdoor" it without a mismatch between the stored hash and the computed hash. If it weren't for the fact that I can partially modify the stored hash, doing this would be impossible.


texts:
Given $plaintext$ and its respective authentication $tag$ which is generated from HMAC-MD5 so that $|tag| = 128$ bits.

If the application is constrained and can send only $64$ bits.
Is it ok, if we xor the first $8$ bytes and second $8$ bytes of the $tag$ in order to generate a total $64$ bit $tag$?

I believe the strengthen is really in the key size not really the output size for somebody to do a brute force. What worse can happen is two different inputs could have same signature if we are doing the above ?

Or does this weaken the strengthen in any way?


texts: Attack RSA knowing the public key and brute forcing all possible message

texts:
Alice want to send a message $m$ to Bob, and encrypt it with Bob public key $K_B$.

$A \rightarrow B : \{m\}K_B$

Lets assume I have intercepted $\{m\}K_B$, I know $K_B$ and I know that $m \in D$ (Alice message belong to a relative small dictionary called $D$ )

By brute force attack, can I got through all  $x \in D$ so that I find $\{x\}K_B = \{m\}K_B$ ?


texts:
As I like to make my tin-foil hat using only the finest quality metal, I was overjoyed to see that Firefox/NSS (I'm using Arch Linux) has recently added support for the P-521 ECDH group in compatibility with TLS 1.3 (albeit not part of suite B).
It has supported ECDSA public keys using the secp521r1 named curve for a long time and AES256 (in some form) for a very long time.
For the first time in a very long time (or possibly ever) it seems to me that it is now possible to actually achieve 256 bits of effective symmetric security taking into account the weaknesses in other components of the crypto stack.
I am basing this assumption on an oft cited academic paper [did not see the need to dig it up for this question but it was put together by top men] that set out the corresponding public key length in RSA and EC terms for a given symmetric key length. This paper effectively says 2048RSA is roughly equivalent to 112bits and that EC key lengths are roughly half the strength of symmetric keys (i.e. secp256k1 == 128bits).
Now, TLS 1.3 has a maximum SHA2 level of 384bits and Firefox does not exceed the standard in this respect. The specific cipher suite am deploying is ECDH-AES256-GCM-SHA384 (w/ P-521).
My question to crypto.SE is- what am I losing in terms of encryption security by having client browsers supporting a max of SHA384?
My question has two supporting addenda/subqueries:
Firstly, the checksum would seem irrelevant to me given I'm using an AEAD (AES256GCM) cipher. What am I missing here?
Secondly, in case somehow I'm missing the point and (speculating) the SHA384 somehow refers to authentication with respect to the ECDH component of the stack- is my risk here (assuming my attacker can find collisions for SHA384 but NOT for SHA512) that my attacker can inject false messages into my communications or could it (very remotely) strengthen my attacker's ability to decrypt my communications?
Finally, I'm well aware that the weakest link in my attack surface area is in so many other easier places than the cryptographic primitives, however, for the sake of good tin foil and for my OCD, it would be really lovely to get some guidance.
Finally- oh how it would be nice for every browser and every crypto library in the world to support AES, Threefish, quantum resistant algos, Ed448 (Big one that I would trade the others for), SHA3, Twofish, etc. Add all this bloat in and leave it to implementers to configure and choose wisely.


texts: What does it mean to be simultaneously hardcore?

texts:
In this paper the term "simultaneously hardcore" is defined as:

  "We say that a block of bits of $x$ are simultaneously hard-core for a one-way function $f(x)$, if given $f(x)$ they cannot be distinguished from a random string of the same length."

Could somebody give me an example of something that is simultaneously hardcore and something that is not?

Also, what does it mean to be hardcore vs. simultaneously hardcore ?  Is it possible to be hardcore but not at the same time?

This terminology is quite confusing and I would really appreciate it if somebody could break it down to concrete, simple examples.


texts: Is this a secure method of encrypting with authentication?

texts:
My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd like to stress that this is purely for fun and to learn elliptic curve concepts. This will not be used in a serious environment. That being said, here's the protocol design:

Generate a random ECIES value using a random private number and the reciever's public key. Call the resulting key "Key" and the public ECIES value "ECIESPub".
Calculate the sha256 hash of "Key + filecontents" where + is concatenation and sign it with your ECDSA key. Call the result "Sig".
Encrypt the file contents with Key using AES-256-CFB. Call the result "Encrypted" and the IV of the algorithm "IV".
Create a new file with the original file name with ".enc" appended. (dual extensions is acceptable) Write "ECDSAPublicKey + ECIESPub + IV + Encrypted + Sig".
Send this file to the recipient. eg. through skype or email.

On the reciever's end:

Calculate "Key" using "ECIESPub" and your own private ECDSA key.
Decrypt "Encrypted" with "Key" and "IV". Write the result to a new file with the filename of the received file with ".enc" simply removed.
Calculate the sha256 hash of "Key + DecryptedFileContents" and verify it with "Sig" and the sender's ECDSA public key.
If the signature is valid, display a fingerprint derived from the sender's public key for the reciever to compare with their record of fingerprints. If the signature is not valid, display a warning to the reciever. In neither case will the sender gain any information about the success or failure of verification.

Note: I include the key in the generation of the signature to prevent an attack where an attacker can switch out the public key and signature with their own without changing or knowing the secret shared key, on the condition that they know the plaintext. I don't know how practical this attack is, but I thought it was best to combat it.

Are there any glaring holes in this construction that I'm missing?

Quick edit: I realize I'm reusing a key for signing and encryption, however, the main concern about this is the occasional legal requirement to give up an encryption key. If that happens, the reciever can recalculate the key from the public ECIES value and give that up instead. The sender, however, simply won't have the key anymore as it is randomly generated, used once, then forgotten.


texts: Does collision resistance stay when extending a hash function to a set domain?

texts:
Given a Cryptographic hash function $h$ for element $x$, let's extend it to sets via $H(S)=\prod_{x\in{S}}{h(x)}$. I am asking if the new hash $H$ (in domain of set) is still collision resistant?

To be more specific, is it the same difficult to compute $S$ for given $H(S)$, comparing to that of computing $x$ from given $h(x)$?

Also how hard it is to find another $S'$ so that $H(S')=H(S)$? Is it at the same level of difficulty comparing to finding another $x'$ s.t. $h(x)=h(x')$.


texts: First block as initialization vector in the CBC-MAC

texts:
A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block.

i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$

My question is, if the first block is used as IV, then is it secure (unforgeable), and why?
(not for encryption/confidentiality, and just for authentication)

i.e. tag $t$ = $F(m_x \oplus ... F(m_4 \oplus F(m_3 \oplus F(m_1 \oplus m_2)))...)$

Thank you.


texts:
I tried to rewrite the Schnorr signature algorithm for elliptic curves but I wanted to be sure to have not done any errors. So I would be very happy if someone could look over this algorithm and tell me if I have done anything wrong, or not precise enough:

Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$ (first question, is it here as in the ECDSA, that either $q=p$ an odd prime or $q=2^m$?) with parameters such that $E$ is a cryptographically safe curve.

Key Generation:

Choose $P\in E(\mathbb{F}_q)$ of prime order $l$, where $l$ is a large prime.

Choose $1 < a < l$ random and calculate $Q = a*P$. Then the public information is $E, \mathbb{F}_q, Q, P$ and the private signature key is $a$.

Signature Scheme:

Choose a random $1 \leq k < l$
Compute $S_0 = kP = (x_0,y_0)$
Compute $s_1 = H(m||x_0)$, where $H$ is a hash function, $x_0$ is the integer value of $x_0$ and $m$ is the message.
Compute $s_2 \equiv k + a*s_1 \text{ (mod }l)$

The digital signature is $(S_0,s_2)$ and Alice sends $(m, (S_0,s_2))$ to Bob.

Verification

Bob verifies if $s_2*P=S_0+H(m||x_0)*Q$.

This works since: $$s_2*P=S_0+H(m||x_0)*Q$$ $$\Leftrightarrow s_2*P-H(m||x_0)*Q = S_0$$ $$\Leftrightarrow (k+a*s_1)-H(m||x_0)*a*P = S_0$$ $$\Leftrightarrow kP + a*H(m||x_0)*P-a*H(m||x_0)P=S_0=k*P$$


texts:
I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining the plain text finally.

So I would like to know about why padding is used in this CBC method?
Why is it not used in the ECB method? Should we pass padding for the decryption process?

Below are the cipher text and IV which I have used in my testing:

cipher text(hex) - 6d 25 1e 90 44 b0 51 e0 4e aa 6f b4 db f7 84 65

Initialization Vector(hex) - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Expected Plain text(hex) -  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Could someone try this ciphertext and IV and share the results?

Key size: 16;

Key used in hex: 10a58869 d74be5a3 74cf867c fb473859


texts: Shamir Secret sharing - Can share generator keep x values secret?

texts: I'm wondering, in Shamir secret sharing, can generator of the shares, keep the x values which are used in evaluating the polynomial to obtain y values (i.e., the shares) secret, and whenever the original secret is needed, he retrieves the t shares and reconstructs the secret? In this setting the share holders should not be able to construct the secret even all of them collude. Is there any secure way of doing so?


texts: How does AEAD guarantee authenticated encryption and plain AES does not?

texts:
This is a follow up to my earlier question. This is more out of curiosity in how AEAD (like CCM or GCM) works compared to encryption in other modes (like CBC or ECB).

Suppose you have AES-256-CBC encrypted blocks of data, each encrypted with a proper nonce (no collisions). How is it less safe and non-authenticated compared to the same blocks of data, but encrypted with AES-256-GCM? What sort of an adversary attack does AEAD prevent that no other mode can prevent?

I understand that if the adversary replaces the entire ciphertext block with another valid ciphertext, this will go undetected in non-AEAD capable mode, but will be detected with AEAD.

However, if data is encoded with a nonce that's clearly visible (one common implementation prepends the ciphertext with a nonce), then it is possible to replace the entire ciphertext with a previously valid ciphertext (since the nonce is known).

Do I understand correctly that a proper implementation requires that you store all previously used nonces and never reuse them?


texts: If I know the hash function that produced a hash key, how easily can I generate an input to hash to the same key?

texts:
The title is pretty descriptive of my question. As an example, say I use the MD5 hash function to create a hash key of the word "hello": 5d41402abc4b2a76b9719d911017c592.

There are two questions I would like to have answered:

How difficult would it be to calculate any new string that would hash to the same key as "hello"?

and

How difficult would it be to calculate a particular new string that would hash to the same key as "hello"?


texts: DSA, RSA, ECDSA etc - which one is cheapest for signing?

texts:
For a protocol where the server presents its signature to prove authenticity (e.g. IKE/SIGMA/STS with only one party authenticated), it's essential that the signing is extremely cheap, while verification can be almost arbitrarily expensive.

RSA appears to be the worst alternative, but what about DSA vs. ECDSA? Is there some other signing algorithm that could be even better (i.e. consume even less CPU to calculate)?


texts: What is the correct way to implement PBKDF2 + AES CBC + HMAC?

texts:
I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with code) on all steps including key derivation, encryption, and decryption. My application uses PBKDF2 for key derivation. Here is what I have so far:

Derive Keys

Generate 256 bits of "key material" with KDF

key_material = pbkdf2(user_password, salt, iterations, size:256, alg:sha256)

Split key material in half yielding x2 128 bit keys for encryption and signing

enc_key = key_material.split(0, 127)
mac_key = key_material.split(128, 255)

Encrypt

Generate 128 bit initialization vector

iv = secureRandomBits(128)

Do AES encrypt

cipher = aesEncrypt(plaintext, iv, mode:cbc, key:enc_key)

Compute MAC with concatenated IV and cipher bits

mac = hmac(iv + cipher, alg:sha256, key:mac_key)

Store resulting values to server (considered unsecure storage)

storeValuesToServer(cipher, iv, mac)

Decrypt

Fetch data from storage

cipher, iv, mac = getValuesFromServer()

Recompute mac

new_mac = hmac(iv + cipher, alg:sha256, key:mac_key)

Compare macs

if(mac != new_mac)
  throw 'Failed MAC check!'

Do AES decrypt

plaintext = aesDecrypt(cipher, iv, mode:cbc, key:enc_key)

Questions

Does this look correct? Main concerns here are:

Have I derived the keys correctly, splitting them in half based on the output of the KDF?
Am I computing the HMAC correctly by combining the iv + cipher. Does it matter if I had done cipher + iv instead?


texts: What pairings are used in PBC and charm-crypto with the proposed elliptic curves?

texts:
I'm implementing a pairing-based signature scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings themselves.

As I understand it, I can choose between various curves (e.g. I would like to use TypeD curves).

I know that there are different pairings such as the Weil, Tate, Eta and Ate pairing. I also read something about a classification in pairing types. So, MNT (TypeD) curves are useful for Type 3 pairings - or do they define Type 3 pairings? What is the relation to Tate / Ate / Eta pairings? And knowing that, how do I find which specific pairings are used with TypeD curves in Charm?


texts: Is it possible to apply a pseudo-random permutation (a keyed permutation) to construct a sponge function?

texts:
The description of the sponge function on Crypto.Stackexchange contains the following text (source):

  The cryptographic sponge is a construction scheme for hash functions (and other symmetric primitives) based on an unkeyed permutation.

But is it possible to make use of a keyed permutation $f_k(x)$ to construct the sponge function? All constructions described in the “One-way compression function” article on Wikipedia are based on the keyed permutation function. And section “Sponge construction” of this article contains the following information:

  The sponge construction can be used to build one-way compression functions.

But the article “Sponge function” does not mention any presence of the key in the used permutation function $f(x)$. Does this imply that we can fix any public key $K$ and always use $f_K(x)$ as $f(x)$? If yes, then how does the length of $K$ impact the security of the $n$-bit output, assuming that $n$ will be equal to the capacity divided by 2, as in SHA-3 (but if $K$ is public, then it seems that its length should not impact the security at all!)? If no, then how to apply a pseudo-random permutation (that is, a keyed permutation function) $f_k(x)$ to construct a sponge function, and how will the length of $k$ impact the security of the $n$-bit output?


texts:
What is the difference between LCG and Affine cipher?

More specific: What are they used for, and what are the structural differences between them?


texts: What is meant by a "short" vector in cryptography?

texts:
I was trying to understand Learning with Errors for Lattice-based Cryptography and I came across this.

  The learning with errors problem is: Given an $m \times n$ matrix $A$ and a vector $b \equiv As + e \pmod q$, where $e \in \mathbb{Z}^m_Q$ is a "short" error vector, to compute $s \in \mathbb{Z}^n_q$.

Can somebody explain what does a "short" vector in this context means ?


texts: CP-ABE (partially hidden access structure)

texts: Anyone aware of the implementation of paper "Lai, Junzuo, Robert H. Deng, and Yingjiu Li. 'Expressive CP-ABE with partially hidden access structures.' 2012" specially in python or Charm framework. This paper worked on partially hidden access structure.


texts: What happens if a Sha 256 input is too long?

texts: Doesn't SHA-256 only take up to 512 bits for the input block? What happens if the input is really long?


texts:
I understood Bleichenbacher & ROBOTO attack, however I have some trouble understanding Section 3.5 of ROBOT attack which discusses retrieving private keys.
https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-bock.pdf

  In order to create a signature with the server’s private key, the
  attacker first uses a proper hash function and encoding to process the
  message. For example, when creating a PKCS #1 v1.5 signature for
  message M, the encoded result will have the following format [29]:

  EM = 0x0001 || 0xFF...FF || 0x00 || ASN.1(hash(M))

  hash() denotes a cryptographic hash function.

What message M is the author talking about? Is this TLS session establishment?
Can someone shed more light on this section 3.5


texts:
I am quite confused calculating the unicity distance and I was hoping that someone can clarify some things for me.

My main issue comes from somewhat a difference of the calculation given by our teacher and the one I find in wikipedia/other topics in here
as stated in this question / answer.
$U=\frac{H(k)}{D}$
With distance $U$ (in characters), Entropy $H(k)$ of the key (in bit), and redundancy $D$ (in bit per character) (formula taken from the wikipedia article).

Now what I have given is
$UD = \frac{log_2(|K|) * log_2(|P|)}{Rl}$ ,
where $|K|$ is the number of keys, $|P|$ is the number of plaintext characters
and $Rl$ is the redundancy of the plaintext language.

Now I am having troubles calculating for example the $UD$ of AES 128 bits.

So I guess $|K| = 2^{128}, |P| = 26$, thus it gives  $38.9$

I tried computing different options but I never really got the answer from the article linked above where it is 20 characters.
What am I doing wrong?


texts: Simple designs for provable security in cryptographic primitives

texts:
We can say that a cryptographic primitive has $n$ bits security against a type of attack if it cannot break it in less than $2^n$ time (time-area product in some cases). The cryptographic primitive could be said to be $n$ bits secure if the fastest possible attack (theoretical and future attacks of the same type included) takes at least $2^n$ time.

To make such security proofs, we need to analyze our crypto primitive. If we have more complex design, we may have more security (and performance, whatever else is desired) out of the box, but we won't be able to prove it.

Examples:

Salsa20/15 according to Wikipedia is 128-bit secure against differential cryptanalysis, and uses only add, rotate, xor with nonlinearity from add
SHA3 has 24 rounds and for $n$ output bits is $\frac{n}{2}$-bit secure against collisions with some reasonable assumptions, and uses only rotate, xor, not, and with nonlinearity from and

So we could use a simpler design, and thus make it easier enough to cryptanalyze that we can make a security proof. With that, we can know exactly how many rounds are needed and use only that many. In contrast:

AES-128 was 128-bit secure against all attacks with 6 rounds at the time of creation, 4 rounds were added as a security margin, for total of 10 rounds, uses s-box, xor, shift, add  with nonlinearity mostly from s-box
SHA-256 has 64 rounds (no reason?) and is 128-bit secure against collisions for 47 rounds, uses add, rotate, xor, and (for Choose/Majority) with nonlinearity from add, and

We expect that with their more elaborate design, they are more efficient, needing less rounds for the same security and offering better performance. Their complexity makes designing an attack against them much harder.

What is better practice now, to design something simply so it can be proved secure, or design something more complex and rely on it not being broken in its lifetime?

There is always the possibility that a new attack can come up in the future and break something that was proven secure against every type of attack known at the time. But nothing can defend against that really.

Also, the comparison here is of the designs - it wouldn't be fair to put a 256-bit stream cipher up against a 128-bit block cipher, and a sponge hash against a Merkle-Damgard hash. It also happens to be that Salsa20 and SHA3 are newer than AES and SHA2.


texts: Is there a key for AES-128, 256 etc, where cleartext equals ciphertext? (regardless of modes like chaining or ctr-cbc)


texts:
Dropbox have recently published How Dropbox securely stores your passwords

Is this really more secure than using bcrypt with a complexity of 11 or 12 ?

The password "chain" is secure as its weakest part, so is there any point adding the extra 2 parts in ?

I understand that the Global "pepper" means that a DB dump protects the hashes until that pepper is found, and then each hash is still salted per user, but how much would that slow down people reversing the passwords in the event of a DB leak over simply bcrypting them ?


texts: QKD - Does BB84 Protocol rely on a prearranged code?

texts:
First of all, sorry if the title is not that clear, I'll provide an in-depth explanation behind my question.
So, basically, I was reading about quantum cryptography and came across BB84. The protocol uses photon pulses composed of polarized photons, which spin in a specified direction. That may be rectilinear spin (i.e. horizontal/vertical) or diagonal spin (i.e. left-diagonal/right-diagonal).
If performed correctly, this is in theory, unbreakable. Because quantum mechanics laws don't allow measurements to be done without damaging the photons used in the communication.
Here's how it works:

Alice sends Bob a sequence of photon pulses, each one randomly polarized in one of the four possible directions (listed above).
Bob measures the pulses by setting his polarization detector in one of the two possible spin types (rectilinear or diagonal), randomly. He cannot measure both, because quantum mechanics doesn't allow this. If the detector is not correctly set, he will get a random measurement. *(Note: Remember that the rectilinear polarization detector will detect both horizontal and vertical spinning photons, and vice versa the diagonal detector will detect both left-diagonal and right diagonal spinning photons) *.
After the measurement is done, Bob will send Alice the detector configuration he used (ex. the first photon was measured with a diagonal detector, the second was measured with a rectilinear, etc.) over a public channel.
Alice responds, in the public channel, to Bob. By saying which of the configurations were correctly set. (ex. the first was diagonal and correct, the second rectilinear and incorrect, etc.)
Bob and Alice then take the correct configurations, and they convert those to a prearranged code, which could be, as an example, that a correctly guessed diagonal detector is 0, and a correctly guessed rectilinear detector is 1. This way an encryption key will be composed.

This is how I understood the algorithm, so it may very probably be not entirely correct. Please correct me at any point if needed!
Anyway, after explaining how I see the algorithm, my question is: **does this basically rely on a shared secret? ** I mean, the prearranged code to convert the polarization measurements to bits should be, as the name says, prearranged. If Eve listens on the public channel and gets both Bob's measurements and Alice's response, which lists the correct polarizations, and she knows that a diagonal pol. converts to a 0 while a rectilinear pol. converts to a 1, she can reconstruct the key without interfering with the quantum channel.
If this is true, why would we go for quantum key distribution? If we need a secretly prearranged code to make it work? That would have to be kept secret to prevent keys from recovering right?


texts: Hash ratchets with truncating hash function

texts:
I'm working on a forward secret messaging system that relies on hash ratchet. I'm using BLAKE2b as the one-way function, which by default produces 512-bit digests. These digests are truncated by my software to 256 bits using the digest_size parameter of the Python implementation before they're used as key in XChaCha20-Poly1305. Using a simplified example, is

key = os.urandom(32)
while True:
    ct = encrypt(key, input('Message: '))
    key = blake2b(key, digest_size=32)

a secure construction, or does the key lose entropy with every ratchet step? If yes, should I use BLAKE2s instead?


texts: DTLS vs direct use of AES. What are the threats unique for direct use of AES instead of DTLS?

texts:
For regular traffic in mesh network (between Internet of Thing devices) customer decided to use one of two options:

DTLS PSK ciphersuite - DTLS based on pre-shared symmetric key
or direct use of AES - customer wants to minimize traffic between sleepy devices (battery should be alive for several months)

Questions:

What are the additional threats of second option (AES) that do not exist for first option (DTLS-PSK)?
How to mitigate these threats (say using AES in CBC or another mode and change IV, etc)? Not reinventing DTLS protocol manually and not with the same overheads as DTLS has.

There is mandatory requirement to share symmetric key between IoT devices within mesh network for regular traffic. This key fits for both options. (First joining of new device will use DTLS-PAKE - I mentioned this just in case - this is not important for this question).
Let's specify DTLS-PSK mode more exactly  - I'm going to use mbedTLS crypto library with define MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8 is specified in cipher suite. Where CCM is mode for block ciphers that provides both authentication and confidentiality.


texts: How does one scale encryption strength upwards from 256-bit?

texts:
I have seen many examples of encryption up to about 256-bit. But how does one programmatically scale the logic upwards in a language such as PHP or Java to say 1024-bit or even 4096-bit and higher?

Are there any websites that explain the workings of a very large encryption on a modern 64-bit computer? For example what kind of numbers (Long Int, Double, etc.) would one use and how can one even extend that range and still keep it computable to the computer?

Would this scaling's security be compromised by the limitations of the processing power available, i.e. 64-bit processor?

I understand that time is a factor in very large encryptions, but in this case time doesn't matter that much.


texts: In what mode does Signal applies cryptography over voice and data?

texts:
I have read all of the technical documentations provided via signal and so far I have figured out that signal intitializes a common key via X3DH key agreement and manages the keys via double rachet algorithm. Also I have figured out that uses the X25519 and X448 curves as well.

But I still have a burning question how actually encrypts the Instant messages ans especially how does encrypts real time voice and video. For real time encryption as far as I know is used either a stream cipher or a block cypher in counter mode with session keys that get renewed when counter is expired (eg. WPA2 uses RSA) when "traditional" cryptographic schemes are used.

But what about the Signal application how is able to encrypt voice and video in real time? Did actually somehow uses elliptic curve cryptography like a block cypher in counter mode. (in other words "replaces" the block cypher algorithm with eliptic curve one)?


texts: Security of stream cipher with a priori knowledge of message

texts:
I am generating a ciphertext by XORing the message bits with key stream bits of a stream cipher. But, if I know a priori that message bits contain a predefined number of 0's (say 60%) at unknown positions, then how to analyze the security of such system both mathematically and empirically.

Can we analyze using hypothesis testing (given two messages m1 and m2 with the same distribution and analyze whether ciphertext leaks any information about messages) or using entropy bounds?


texts: What is an easy method of proving that a cryptographic oracle attack is possible?

texts:
Lets say an application is using CBC mode without authentication.  The application is generating cipher text.  This cipher text can be manipulated by the attacker and then transmitted back to the application.

Without looking at the code, what is an easy method for the attacker to prove that a Padding Oracle or Decryption Oracle is present?  Is there a method more elegant than brute force manipulation of the cipher text?


texts: Relation between Claw-free permutation and Trapdoor

texts:
Can someone explain the two definitions in relation to each other?

Is a claw-free permutation a permutation without a trapdoor?

For your convenience, here's the definition of a "claw-free permutation":

  Let $f_1,f_2$ be permutations. A triple $(x,y,z)$ is called a claw iff $f_1(x)=f_2(x)=z$. A pair $f_1,f_2$ of permutations is called claw-free iff there exists no efficient algorithm that can find a claw for these permutations.

The definition of a trapdoor permutation is a bit lengthier and thus only given as a reference.