texts:
I'm wondering if the algorithm 1.2.840.113549.1.1.1 (rsaEncryption) is still secure to use for S/MIME encryption. I'm afraid that the scheme is vulnerable against attacks against raw/textbook RSA.

I'm considering to change to 1.2.840.113549.1.1.7 (id-RSAES-OAEP) but with no insecurity of 1.2.840.113549.1.1.1 (rsaEncryption), I cannot push the change.

BTW, the ciphertext of the mail messages are also signed with RSASSA-PSS.

Thanks for any links and/or suggestions.


texts: AES multiple devices to server communication

texts:
I have multiple devices connecting to a server, whose communication needs to be encrypted. At the moment I have an AES library doing the job (possibly inadequately): I am using a database of keys on the server, that corresponds to the keys stored on the devices (one per device).

Each message from the device to the server is preceded by an unencrypted ID identifying that message as coming from that particular device and thereby showing the server which key to use to decrypt the rest of the message.

As this is sent unencrypted, I think this is somewhat insufficient to identify the device so I placed a device specific "secret" in the bit of the message that is encrypted which, if absent or incorrect will lead to the server discarding the message.

<device ID>"<device secret><device status>"

Where the "" mark the encrypted part. The device secret is the same every time and the device status is constantly changing.

My question is: Will the presence of this "secret" (presuming it is the same in every message coming from that device, and in the same location within the message) cause repeating patterns in the ciphertext making some form of attack possible? If this is the case, then how could this be avoided?

I can think of one way using a random message, sent from the server, that is then "mixed in" with the message before it is encrypted so the message is different every time, but this significantly increases the traffic. So I wanted to check to see if this was necessary or if there is a better way of doing this!


texts:
Could any kind of encryption method (AES, etc.) lead to data loss like in lossy compression? I'm interested if data (lossy compressed, lossless compressed, uncompressed) that is encrypted and decrypted will always come back in the same state as before the encryption process, no matter what encryption method is used.

Regards,
Neil


texts: Any concrete examples of the use of NIST Special Publication 800-90B?

texts:
This question relates   to NIST Special Publication 800-90B, Recommendation for the Entropy Sources used for Random Bit Generation. A copy is available here.

Can anyone supply a pointer to any publication that has used the entropy assessment techniques of sections 5 and 6?  These relate to the characterisation and entropy measurement of non independently & identically distributed data generated by the entropy source of a true random number generator.

By publication I mean some work that is associated with a real TRNG, either DIY, commercial or experimental.  I'm not looking for theoretical papers on theoretical TRNGs.  The TRNG has to be made of wires and capacitors, not just formulae. I hope that the publication will contain a numerical entropy measurement, most probably << 8 bits per byte or sample.


texts: can a weak cipher in a cascade weaken the result?

texts:
So i am a real beginner .
And I use AES(TWOFISH(Serpent))) for my veracrypt file .
So I asked myselfe a Question :

When a Cascade is made the Key is split in parts for each algorythm .
So if We have AES(Twofish)) with the key : Test-password123 The "Test-pass" Part would be used for AES and the "word123" part gor twofish right ?
So if you would use something like rc4(AES)) cascade , The rc4 would weaken the AES cipher right ?


texts: AES and DES - reusing the same round keys

texts: Both DES and AES use key expansion to generate the round keys (for Feistel network or for the AddRoundKey operation). Each round uses a different key. Why do we need that? Why we cannot use the same key in each round?


texts: Can I truncate a CSPRNG psuedorandom number?

texts:
This might be too broad to apply for all CSPRNG, but it might apply for the general case, I'm not sure. I need this specifically for python os.urandom() and SystemRandom() which get a seed  from /dev/urandom, and on Windows CryptGenRandom(),

Is it possible to truncate or even modify the random number but still retains its randomness. The reason I need to do this is because the OS has nanosleep and the overflowing digits I will need to cut off.


texts: Key Handling in Multi Platform Applications

texts:
I'm working on a mobile application with which a signed in user can send encrypted data to a serverside backend. Also, the user may log in to some website on his laptop and view his encrypted data then decrypted.
My plan is to use AES for encryption but I can not figure out a good solution how to handle the AES key. As a user's password is often not >= 128 bit strong, I don't won't to use the user's password for encryption. Also, generating a key and storing it somewhere in a remote database is a bad idea in my opinion as the key would be accessible for any intruder.
So, is there a best practice to handle such situations?


texts: How can the Schmidt–Samoa cryptosystem uniquely decrypt large messages?

texts:
Suppose I choose $p=7$ and $q=11$.

This gives a public key of $p^2·q = 539$.

However, decryption occurs using a modulus of $p·q=77$.

If a person chooses to encrypt $500$ using my public key, how do I recover this value if the decryption modulus is so much smaller?

Is this a limitation of the Schmidt-Samoa scheme?

Is there a maximum message size for this scheme? How can this size be securely provided to the user without leaking information about the private key?


texts: FIPS 140-2 compliance across symmetric and asymmetric primitives

texts:
I'm looking to learn more about FIPS compliance.
I noted that it seems FIPS 140-2, is a holistic article, that then cites sub articles like FIPS 197...
It's tricky to ascertain the full picture. Is there a document anyone knows of that will specify:

Approved symmetric ciphers
Approved elliptic curves
Approved signature algos
Approved hashing functions

If not is there any resource you know of that can simplify interpretation of the regulation?


texts:
can we reuse same ECC key on TLS for long terms or it must be used just once? (i mean can we use ECC like RSA?)

is there patent free ECC implementation ?


texts: Does make sense utilize TLS and Noise Protocol in the same application?

texts:
Nowadays I work maintaining an web application written in Node.js and we use HTTPS with TLS 1.2. We have to implement a new feature related to security on this application, all HTTP messages must be encrypted, and we will have all messages encrypted two times ultimately, one time using TLS and another through the new feature. We are studing the Noise Protocol to know if makes sense use it on this new feature, but from what I understand so far, the Noise Protocol would be an alternative to TLS. I'd like to know if makes sense use both protocols together, or if they are
mutually exclusive.

We don't know how to utilize the Noise Protocol yet, if we simply pick up an implementation and include on the project or if the Node.js should offer an implementation like TLS. I found this implementation on GitHub: Noise-c.

Any clarification or help is welcome, thanks.


texts:
Let's assume that attacker knows the verifier so now the attacker can commit a Man-in-the-Middle (MitM) attack:

Client sends A to server;
MitM takes it and sends B to client.

As the MitM knows the verifier it is also possible compute the secret key. So every message from client encrypted by that key is not safe. How to deal with this situation?


texts: Is openssl rand command cryptographically secure?

texts:
I'm wondering if the openssl rand command produces cryptographically secure random bytes. For example when in need for a random password or token:

openssl rand -hex 32

The man page unfortunately does neither state it's cryptographically secure, nor that it's not.

On the one hand, I think this is openssl, its sole purpose is to do cryptography. On the other hand, the man page states something about reading and writing seed data instead of directly querying a CSPRNG.

So it is somewhat unclear for the end user. Does someone know?


texts: Performing HMAC with random key before MAC comparison

texts:
In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the calculated MAC and the received MAC value, using this randomized key.

Does this just supply a method of performing a "constant time" compare? Or does it add other security properties to the MAC calculation. I presume the former, but I want to be sure. Is this a known technique for performing MAC comparisons?


texts: How to recover secret $x$ from Elgamal signatures with repeated $k$?

texts:
Set generator $g \equiv 5 \pmod p$ where $p=647$ and $p$ is prime.

With the same $g$, $p$ and secret signing key $x$, Alice sends two messages, $428$ and $129$, with signatures $(433, 239)$ and $(433, 100)$ respectively. She uses the same ephemeral key twice.

The question says without using a discrete logarithm algorithm, determine
both her secret signing key $x$ and her ephemeral key $k$.

Could anybody help me in what direction I need to go to solve this?  I'm not sure what to do without the use of discrete logs.


texts:
In Bulletproofs range proof, Pedersen commitments look like $C=aG+bH$

If I need to proof several values' range proof and keep G as constant, do I need to change H everytime?

I have found it doesn't change in Grin and dalek-cryptography.


texts: What is the meaning of probabilistic polynomial time adversary?

texts:
I learned about probabilistic polynomial time adversary, but I have some doubt.

Is probabilistic polynomial time adversary referred to those who attack in polynomial time with the form of probabilistic?


texts: Draw/Lottery with hidden but provable outcome?

texts:
I have a scenario in which one of n participants is to be assigned a positive value and all other participants a negative value.

The outcome of the draw is to be known only by the respective participant. Additionally, each participant has to have the possibility to disclose and proof their bitness (selected/not selected) at will.

One of the participants should be able to perform the drawing unbeknownst the outcome. That participant is not a trusted third party nor is one available. There can be put some trust into the participant to not peek into the memory of a program that performs the drawing, e.g. not actively trying to break the secrecy of the outcome.

Is there any established protocol or scheme that can accomplish this or can be made to accomplish this? If there isn't, what could be a cryptographically sound way to accomplish this?


texts:
In the real world, it's best to use at least two or more algorithms to encrypt data.

From what I know, RSA acts as a wrapper to transfer data safely across web systems or API(s), or acts as a wrapper for symmetric keys such as AES.

If computational power and time are not the main factor (it has reached the secure standard), why is there (from what I know), no one using RSA to really encrypt data instead of just wrapping them up (as stated by the two usages)?

What I meant was really using it alongside other encryption algorithms such as AES.

Wouldn't the stored data be safer in this way (considering that the network is secure from both outsider and insider attack)?


texts: Can any one explain why circuit privacy is needed on homomorphic encryption?

texts:
I know some works have been done in the context of cirrcuit privacy on homomorphic encryption, where from an output ciphertext it does not allow
 someone to distinguish what function is computed.

I wonder the need of this functionality. If we use a cloud server to delegate some tasks over encrypted data, then the cloud can know what kinds of function is being evaluated (possibly from binary code or cpu behavior).

And, if some specific company delegates task to the cloud server. Then the server can infer what's going on and what types of data is being processed.

In this case, circuit privacy does not make sense for me.


texts: GHASH with a finite field multiplication algorithm in reverse order

texts:
NIST SP 800-38D § 6.4 GHASH Function describes the GHASH algorithm thusly:

  Prerequisites: block $H$, the hash subkey.

  Input: bit string $X$ such that len($X$) = $128m$ for some positive integer m.

  Output: block $GHASH_H$ ($X$).

  Steps:

  Let $X_1$, $X_2$, ... , $X_{m-1}$, $X_m$ denote the unique sequence of blocks such that $X$ = $X_1$ || $X_2$ || ... || $X_{m-1}$
  || $X_m$.
  Let $Y_0$ be the "zero block," $0^{128}$.
  For $i$ = $1$, ..., $m$, let $Y_i$ = ($Y_{i-1}$ ⊕ $X_i$) • $H$.
  Return $Y_m$.

The multiplication algorithm works in "little endian" order. Quoting NIST SP 800-38D § 6.3 Multiplication Operation on Blocks, "The convention for interpreting strings as polynomials is "little endian": i.e., if $u$ is the variable of the polynomial, then the block $x_0x_1...x_{127}$ corresponds to the polynomial $x_0 + x_1u + x_2u^2 + ... + x_{127}u^{127}$" (emphasis mine).

So let's say I have an existant multiplication method that operates in big endian order instead of little endian order and that this existant method is significantly faster than the method proposed in NIST SP 800-38D. My question is...  what's the most effective way to utilize this existant method?

The best that I've been able to come up with thus far is this:

  $Y_i$ = reverseEndianness(reverseEndianness($Y_{i-1}$ ⊕ $X_i$) • reverseEndianness($H$))

reverseEndianness($H$) can be precomputed but idk it just seems like there has to be a better way that doesn't require so many endianness reversals idk. I mean, even with the endian reversal (which can be done surprisingly quickly) it's still a lot faster than the method proposed in NIST SP 800-38D but I'd still like to minimize how many are performed.

The reason I have an existant multiplication method operating in big endian order is because that's the order you're supposed to do it in for elliptic curves in $F_{2^m}$. Per SEC 1 § 2.3.5 Field-Element-to-Octet-String Conversion, where elliptic curves are concerned, one should "view the coefficients of the polynomial as a bit string with the highest degree term on the left and convert the bit string to an octet string".


texts:
Say user Bob sends an encrypted message to a server. People can download the message from this server and later get the key directly from Bob.

Is it possible for the server to somehow verify that users are able to decrypt the message later on with Bob's key without letting the server be capable of decrypting the message itself?  So the server knows the message is being opened but itself can’t “see” the contents? Is it – at least theoretically – feasible to have an implementation which allows for this situation?


texts: Who verifies the trust of certificate authorities?

texts:
Background

I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack.

To mitigate this threat, people came up with certificate authorities that essentially "vouches" for the trust of 3rd parties by supplying you their respective public keys signed with the CA's own private keys.

Question

Here is where I am getting confused.

Can't we just use the same logic to intercept and compromise the transfer of information between the user and the CA (certificate authority)?

If the Certificate authority vouches for the Generic Website to ensure trust and safety, who vouches for the Certificate authority?


texts: Is there a tangible benefit in keeping the number of PBKDF iterations secret and not storing them with the ciphertext?

texts:
Suppose I have a local file and it is encrypted with a symmetric key derived from a strong passphrase, unique salt and $x$ number of PBKDF (e.g. Scrypt) iterations. I am interested in keeping this file a secret for a very long time.

Suppose the user specifies the number of iterations themselves e.g. a random number between the lowest safe number e.g. 1000 to the highest feasible number e.g. 100,000 when they first encrypt the file. The number of iterations would not be hard coded into the program or stored alongside the salt and encrypted data. It would be remembered only by the user and entered as a separate parameter along with the passphrase when it comes time to decrypt the file.

If an attacker were to gain a hold of the storage device to perform an offline attack on the file's encryption, my thoughts are that this makes their job much harder:

They still need to try all the possible permutations of each
passphrase
Each brute force attempt takes ~200ms due to the slow
PBKDF
They also do not know the exact number of iterations to try
either and have to try each passphrase permutation and repeat the
process for every iteration count.

The use case is that for day-to-day use the user stores the number of iterations alongside the salt and encrypyted data for ease of use and fast access. But when they are travelling and need to cross country borders where there is a possibility of their phone/laptop/device being confiscated, then they can choose to not store the number of iterations as an additional precaution.

The difficulty for the user is remembering the number of iterations to use as well as the passphrase. However this is just a small additional number to remember e.g. similar to a 4-5 digit PIN number. For some examples it could easily be written down on a random piece of paper, or added as a phone number to an entry in your address book. In other words, very easy to hide in plain sight and not likely confiscated along with the digital devices.

Another advantage is if the encryption uses a cascade of PBKDFs to produce a final derived key e.g. 7328 iterations of PBKDF2-SHA2 then feed the result of that into Scrypt with 4755 iterations. Now the user remembers the two numbers (or stores them in the address book) but it has a multiplier effect on the cracking difficulty for the attacker.

Do you concur that this is a reasonable feature to have in an encryption program?
Can you quantify how much additional security is gained from keeping the number of iterations secret from an attacker as well e.g. $n$ bits?


texts: Do any Identity-based Encryption Systems support messaging between domains?

texts:
Identity Based Encryption is covered under RFC 5091 (specifying the algorithm), 5408 (specifying data structures), and 5409 (using IBE with Cryptographic Message Syntax). However, every IBE implementation that I've seen and used are nothing more than glorified web-mail systems.

Do any existing IBE systems allow secure messages to be sent from one domain/realm to another? Is there any compatibility between vendors?


texts:
I'm reading the SSL specs here.

The interesting thing seems to be that RC4 is not re-keyed with a new IV for each message. The stream cipher state is simply carried over to the next record. Why is this secure? Shouldn't messages be encrypted with different IVs? Honestly, this is one part I don't fully understand about IVs: each message needs a different IV, but what counts as a message? A full stream of records? One record?

The CBC modes do have different IVs for each block.

My question is, how about a stream ciphery mode of operation, like OFB or CTR? Do I need new IVs for each smallish record, or can I do what SSL does with RC4 and just carry over the cipher state? Is that in any way insecure? WEP seems to do the new-IV-per-packet thing, and that seems to have caused its downfall. Why?


texts:
I am trying the Blind signature attack against an RSA crypto system (we have the value of N and e).

The system is defined as:

class RSA:
    def __init__(self, e, d, n):
        self.e = e
        self.d = d
        self.n = n

    def sign(self, msg):
        msg = int(msg.encode('hex'), 16)
        return pow(msg, self.d, self.n)

    def verify(self, msg, sig):
        msg = int(msg.encode('hex'), 16)
        verify = pow(sig, self.e, self.n)
        return msg == verify

This system allows me to do the following:

Sign a message (other than the desired message)
Verify the message

To sign the message, the code interprets my input message as shown below:

m = base64.b64decode(m)
m = int(m.encode("hex"), 16)

The desired message which I want to sign is: "check this"

So, I decided to use the Blind Attack as shown below:

Chose a random value of 'r' such that 'r' is relatively prime to 'n' (gcd(r, n) = 1)
Calculated the blinded message as shown below:

M = "check this"

M = int(M.encode("hex"), 16)

M = 469440048988568330725747

r = 3

So, M' = M * r^e mod N

I got M' = 23197755639757063616251098896030929296620390502715479513148568685304900389950103581065892241031729644711286485127332671201824316337367085311388408882287463092871368604873199283728291840921486779532441684227161682803605783877395206374452279642370838342344078339859990917350469230030211065087702649725450845840496395823640212936132815100326836805829209891510238692029283719097643211255749411742768146971730579472485865485182974850559517457334368981656730791912298827394135772525085384096283147715147158921374800971030021813145161866835151076051818566789845851064713174040021840255625914702552338381580735541362965413692

Then, I sent the above message base64 encoded to the crypto system so that it signs it for me:

base64.b64encode(M') = "MjMxOTc3NTU2Mzk3NTcwNjM2MTYyNTEwOTg4OTYwMzA5MjkyOTY2MjAzOTA1MDI3MTU0Nzk1MTMxNDg1Njg2ODUzMDQ5MDAzODk5NTAxMDM1ODEwNjU4OTIyNDEwMzE3Mjk2NDQ3MTEyODY0ODUxMjczMzI2NzEyMDE4MjQzMTYzMzczNjcwODUzMTEzODg0MDg4ODIyODc0NjMwOTI4NzEzNjg2MDQ4NzMxOTkyODM3MjgyOTE4NDA5MjE0ODY3Nzk1MzI0NDE2ODQyMjcxNjE2ODI4MDM2MDU3ODM4NzczOTUyMDYzNzQ0NTIyNzk2NDIzNzA4MzgzNDIzNDQwNzgzMzk4NTk5OTA5MTczNTA0NjkyMzAwMzAyMTEwNjUwODc3MDI2NDk3MjU0NTA4NDU4NDA0OTYzOTU4MjM2NDAyMTI5MzYxMzI4MTUxMDAzMjY4MzY4MDU4MjkyMDk4OTE1MTAyMzg2OTIwMjkyODM3MTkwOTc2NDMyMTEyNTU3NDk0MTE3NDI3NjgxNDY5NzE3MzA1Nzk0NzI0ODU4NjU0ODUxODI5NzQ4NTA1NTk1MTc0NTczMzQzNjg5ODE2NTY3MzA3OTE5MTIyOTg4MjczOTQxMzU3NzI1MjUwODUzODQwOTYyODMxNDc3MTUxNDcxNTg5MjEzNzQ4MDA5NzEwMzAwMjE4MTMxNDUxNjE4NjY4MzUxNTEwNzYwNTE4MTg1NjY3ODk4NDU4NTEwNjQ3MTMxNzQwNDAwMjE4NDAyNTU2MjU5MTQ3MDI1NTIzMzgzODE1ODA3MzU1NDEzNjI5NjU0MTM2OTI="

Then the system returns me the blinded signature, S'

so, S = (S' / r) % N

24818914914910373440924495286483732355034193918009758466268010322182571967031502513659086048658916042028823976943003185617946970036963881199841837196441552911705581109341260054593328566162456841895142950218979750677266736949402372670566292112370217099902986474876478008060410181643482927728261550661880472137789429832725542464999274462836317230085457545621451042531445414310707428331233889365772556917427615047373474133265125316113512167796060915505971722864776035325707620199263636430413757299372893302287102120461140519757246629337547966487338931336250142558314387457650036181961012203870138191022307166022035263943

So, I have the signature, S corresponding to M.

Now, I can send the message, M to the system along with its signature, S.

However, this is not working and I suspect that this might be due to the fact that M = integer representation of the message. When I send the integer representation of the message, the crypto system again applies (int(message.encode("hex"), 16) on it.

In which format must I send my message for signing?

Note: The attack I am using is similar to the one described here: http://the2702.com/2015/09/07/RSA-Blinding-Attack.html

Thanks.


texts: Using Lattice-based cryptography for TLS\SSL

texts:
Given the general benefits of Lattice-based cryptography, such as:

Post quantum Security
Security from worst case scenario
Efficiency

What could the outlook of shifting from RSA \ ECC-based cryptography to the Lattice one (say NTRU) be?

Would that be feasible?

Are there any drawbacks?


texts: What is the format of the TLS extension field?

texts:
In the TLS 1.2 protocol, the client may send extensions. My question is: what is the format of this field? is it a list?

In TLS 1.2 client hello, the standard says:

  extensions
        Clients MAY request extended functionality from servers by sending
        data in the extensions field.  The actual "Extension" format is
        defined in Section 7.4.1.4.

At the server hello, the standard explicitly says it is a list. But I am not sure if this implies that the client also sends the extensions as a list:

  extensions A list of extensions.  Note that only extensions offered by
  the client can appear in the server's list.

I assume the same format is used in tLS 1.3 as well.


texts:
I am currently working on an anonymous P2P file sharing application and I am elaborating some already existing solutions. Some of them allegedly provide point-to-point encryption using RSA public/private keys to exchange a symmetric secret key, which is then used to encrypt a stream of data.

But I wonder how is it possible for two peers to safely exchange their public keys with each other without any third party (without any Certificate authority providing those public keys) and at the same time without being able to become attacked with "Man-in-the-middle" technique? (Actually some of them allow exporting generated public keys and exchange them in a "secure" way like personal meeting, phone, e-mail. But most of these P2P solutions communicate only over the wire. )

By point-to-point I mean connection between two peers, who are directly connected nodes in an P2P overlay, but can be more than one hops away from each other in a physical network.


texts: Which cipher text is easiest to guess the plaintext?

texts:
I know that there are approximately 2^88 different permutations of 26 characters. The stream cipher A5/1, which generates a binary keystream using three irregularly clocked LFSR, and has a 64-bit key.

  If we consider 1 000 characters of English text encrypted using either
  a substitution cipher or encoded in ASCII and encrypted using A5/1.
  From which ciphertext is it easiest to guess the plaintext?

In my opinion, the Substitution cipher is easy to guess. In the substitution cipher, it has repeated characters in the cipher-text make easier to figure out the text. Also, the substitution cipher has 26! possibilities. Can someone explain it to me in a more detail way?


texts:
New to cryptographic, weak in math.

I have designed a PRG which consist of 33 LFSR's, each 32 bits wide.

I use one of the LFSR's as "selector", using the 5 LSB from this register to select one of the other 32 registers, from which I grab one byte and use as output. So each requested byte will thus come from one of 32 "randomly" selected registers.

My gut-feeling is that such a scheme will:

Hide the selector register from the outside world (rendering Berlekamp-Massey useless)
Expose an attacker to a very fast growing tree of possible combinations.
(If trying to sort out from which LFSR the last byte might emerge)

As it seems to me as this is an obvious way of creating a truly messy output, it surprises me that I haven't seen it described somewhere (with a name like "Rose-Morris-Nyqvist-Yang-Goldstein-scrambler"), so my conclusion is that it must be a bad solution. (Even beside the obvious hassle of seeding 33 registers and select feedback masks).

So my question is: Why not?

/Hans


texts: Existing dictionaries of popular words to help solve a random substitution cipher?

texts:
I'm trying to find faster ways to solve this:
http://cryptogram.org/solve_cipher.html

Actually lists of common words are good, but they are often limited to 1000 words.

I found this, but I'm not sure which one to use, but the word list still seems too large.

Do you know lists of 10k, 20k, 30k words, or tools that sorts words by popularity?


texts: What is so special about elliptic curves?

texts:
There seems to be sources like this, this also, and some introductions that discuss elliptic curves in general and how they're used.  But what I'd like to know is why these particular curves are so important in cryptography as opposed to, let's say, any other polynomial degree $\gt$ 2 which you can then mod over some group.  It seems like once a modulus is applied then other function types should be acceptable as well.

It seems even less intuitive when just looking at the bubble vs curve as here:

Since there are other curves (let's say anything from a sin wave to the $x^3 + x$ or even just some unusually shaped contour) that could do the job.  It seems like they would provide much more surface area to get a larger space in $\mathbb{Z}_p$ or really just more possible combinations of connecting lines from some arbitrary $P$ and $Q$ to get $R$ as opposed to something as restrictive (on the graph) as beginning from some bubble (which would seem to unnecessarily reduce the possible combinations) and then use a modulus to implement the discrete logarithm problem.

Sorry if this seems a little naive of a question, I'm trying to write an implementation right now and just to understand it fully even if that means asking something that is taken for granted.  Perhaps just walking through a simple example (most of the ones I've searched are anything but), just a few sentences, would be rather helpful, from "A wants to talk to B" all the way up to "now E can't listen in between A and B".

EDIT:

So it seems like this is the version of elliptic curves over a finite field:

Yes that looks pretty random.  But I'm still not really seeing why they are the only equations that have cryptographic significance.  It's difficult to imagine that if you simply took some other higher degree equation and applied modulus (to place within a group), then it seems like it would make sense that you'd get something that's also comparatively random.


texts: Encrypt-then-MAC: Do I need to authenticate the IV?

texts: In the setting of Encrypt-then-MAC, do I need to include the IV in what I'm HMACing, or is authenticating just the AES-encrypted data sufficient?


texts:
I'm taking up a cryptography class and this is for an assignment. We're asked to find the differences between AES/RSA in the different modes of operation vs the one timepad method.

From wiki, I can see that in all the different modes of operation(Eg CBC), the ek(encryption) is done. However, not much is said about what kind of encryption is used. What difference will it make if I use AES or DES in the encryption part in the process? I get that RSA is better than DES/AES dues to assymetricity. Apart from this difference, I can't figure out how the using just AES instead of DES would make AES with CBC would make it better than DES with CBC.
So, I read up and found this which says that the main reason why AES is better that DES is because of the key size. Is this the only difference?


texts:
I'm reading about SRP from this page and came accross the line that says a party computes

  v = g^x

I am unfamiliar with reading cryptography texts. Does this mean gx, or g ⊕ x?


texts:
I have not seen much about algebraic attacks against ARX ciphers.

How would ARX ciphers compare in algebraic security to AES or Present or Simon?


texts: Can the hash of one message be used to make it easier to find the hash of a very similar message?

texts:
Background:

I am trying to get an understanding of using a hash of a passphrase as a secret.

Example:

sha256("EasyToRememberPassphrase") -> secret.

I am assuming a properly designed hash function used this way above will yield a secret with the same or fairly similar entropy as the input passphrase (or the size of the hash, whatever is smaller), thus as far as being used as a secret goes, the passphrase and secret are equally hard to guess.

On to the question:

Say I generate two secrets, secretA and secretB in the following way:

passphrase = "EasyToRememberPassphrase"
sha256(passphrase + "a") -> secretA
sha256(passphrase + "b") -> secretB

Assuming an attacker gets access to two pieces of information:

secretA
the fact that secretB was hashed from data very similar to secretA

Does this give the attacker an easier time figuring out secretB? And if so, to what degree? Or are good hash functions immune/sufficiently resistant to an attack using this particular set of information?


texts: XOR cipher with three different ciphertexts and repeated key, key length known. How do I find the plaintexts?

texts:
Let us say we have three different plaintexts (all alphabets, A-Z): $x$, $y$ and $z$, each of length $21$. Let the key, $a$, be also of length $21$.

Now, what we have is $x \oplus a$, $y \oplus a$ and $z \oplus a$. How can we find out $x$, $y$ and $z$ from this?

I have looked around the web and found that the usual way to break this is to do statistical analysis and dictionary attack on the values of type $x \oplus y$ which we can get from ${(x \oplus a)} \oplus {(y \oplus a)}$. I used xortool for this and the key which I got from it gave random garbage for the plaintexts and so, that didn't work.

I cannot help but think that since we have three different ciphertexts (as opposed to just two which are used in most dictionary attacks), we must have some extra constraint that  we can impose on the possible set of keys but I'm coming up short. Any help is appreciated. If you can provide links to any tools, that would be great as well.


texts: Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?

texts:
By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN:

It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've recommended DH group 20-24 (we don't have DH group 24).

Should we use these groups? I don't understand how the ID of the DH group could be higher - using the same elliptical curve primitive - but use a 224-bit algorithm compared to our current 521-bit algorithm for DH group 21.

DH group 21 is also "only" a 512 bit algorithm compared to DH group 14, which is a 2048 bit algorithm. However I read that DH group 21 is still better than 14, because it uses elliptical curve.

EDIT: I've had a technical response vs a mathematical one below. It's appreciated, but a technical one helps me understand more given that we're configuring firewalls. The response is

"This group number is decided or is given by the IANA (Internet Assigned Numbers Authority).

The reason for these lower bit ECP groups to have the higher DH group number is that, the practical implementation (using a software code or a hardware chip) of the key creation and exchange mechanism was only available (or working) for 256, 384, 521 bit sizes. and that's why they were implemented  first (in-order group 19, 20 and 21).

with improvements in technology and the methods with which we write the software code or create hardware chips, it allowed us to have working models for 192 and 224 bit  Random ECP DH group and hence these were assigned a DH group number later.

Security wise, the 521 bit Random ECP group (DH Group-21) would still be on a higher side compared to 192 or 224 bit ECP group."


texts: Using RSA signature as a secret material

texts:
Can an RSA signature of a randomly generated seed be used as a secret material (for further protection of some data)?

That sounds like some sort of KDF - but here built on top of the RSA signature operation, instead of the encryption/decryption operation, that is typically used by KDFs. (Or are there some known KDFs that work that way?)

Such usage of signatures is unusual, as conceptually the signature is intended to be a non-secret information to be shared with other parties. But are there any known cryptographic concerns here, or maybe some cross-protocol pitfalls?

Note that the question assumes the PKCS#1 v1.5, as the PSS signature includes randomness and therefore can't be directly used for deriving a stable secret.


texts: Why is public key cryptography (RSA) used in sites like Google or Facebook?

texts:
The RSA algorithm is used for encryption (plain text to cipher text) and decryption (cipher text to plain text) of data. What is the need for using public keys in these sites; why is data is encrypted as everything is viewed by everyone?

Why do we need to use public key cryptography in Google; how does it provide security?


texts: The solution of insert MAC in a ciphertext without Authenticated Encryption supported

texts:
From Should we MAC-then-encrypt or encrypt-then-MAC?, I understand I should do Encrypt-than-MAC, which the MAC included all the information such as IV and cipher text.

After reading Why choose an authenticated encryption mode instead of a separate MAC?, I know reusing key in Encryption and MAC may trigger unwanted weaknesses. So I got a question, if the language I used don't have authenticated encryption supported, how should I insert a MAC? The author of the answer suggest to use KDF to solve the problem, but KDF need a salt otherwise it won't work. If I place the salt like salt||hmac||IV||ciphertext, since the salt is not protected form the MAC, will it be meaningless to use EtM and/or trigger another weakness?

Articles I have read also:

Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme


texts: Are there any signature schemes that protect against collusion by multiple parties?

texts: Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. using her private key?


texts: I was reading http://blog.zorinaq.com/?e=74 which is about a Windows kernel developer. The developer proves that he is an actual developer by posting the SHA1 hash of a particular revision of a file. The actual hash values have been redacted, but I would like to know how knowledge of the hash would prove this.


texts: Questions regarding static Diffie-Hellman (ephemeral-static) usage in TLS

texts:
It looks to me that there 3 main variants of Diffie-Hellman in SSL/TLS.

Anonymous mode;
Static mode;
Ephemeral mode.

In case of static DH the server owns an X.509 certificate with a DH public key embedded in it and there’s a corresponding DH private key on the server.

Assume that the client is not using certificate authentication and trying to establish a connection with the server using a static DH cipher suite e.g. TLS_DH_RSA….  we would have  ephemeral-static DH variant (I would map that to client-server respectively).

And now my questions:

It is said that Alice and Bob publicly agree to use a modulus $p$ and base $g$.  As it turns out $p$ and $g$ are values in the certificate, so is it safe to say that $p$ and $g$ is  always dictated by the server? What if client certificate is used ?
Continuing if the server sends its public component (is that really the server’s public DH key) and uses its private component (is that really the server’s private DH key?)  what does the client do? Does it generate an ephemeral pub/private DH key pair on the fly  and sends / uses its public key and private key in the same way as the server?
Continuing on the last question, does such a setup not provide PFS because the server uses static values ? If I record a 100 of TLS conversation in such a scenario, would the private DH key from the server allow me to decrypt all of them?


texts: Is stretching hash several times basically the same as bcrypt?

texts:
As I understand it, the main advantage of bcrypt is stretching so it becomes slower to crack overtime. But, is using a "good enough" algorithm (e.g., SHA-2 family) then stretching until it's slow enough for your liking is pretty much the same as bcrypt?

Note: I understand scrypt is superior but let's assume bcrypt is the best for now.


texts: Is RC4 a problem for password-based authentication?

texts:
This is a follow-up question to Does TLS use RC4-drop[n]?.

As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that originate from different keys, and regardless of the distance from the start of the keystream. Doesn't that make an attack on schemes that send user passwords in RC4 protected connections?

I'm thinking about protocols that always send the password at a well known offset, e.g. TLS protected IMAP and SMTP.

Theoretically, it should even be possible with an HTML authentication form, but the position of the password in the response might not be as obvious in that case.

Has anybody ever tried to recover a password from a number of RC4 protected IMAP or (authenticated) SMTP connections? Because of the BEAST attack, many mail services now default to RC4 for encrypting user connections (which always include the credentials at a fixed offset), and depending on the mail client used, authentication might happen frequently (especially IMAP clients often keep a number of IMAP connections open, which might be forced to reconnect even more frequently by an active attacker).


texts: What are the advantages of  Poly1305-AES  over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons of Poly1305-AES vs  AES-GCM


texts: Hashing a message with a length that isn't a multiple of 8 bits

texts:
NIST FIPS 180-4. “5.1. Padding the Message.”

  Suppose that the length of the message, $M$, is $l$ bits.

Is there any library that can receive a message of length (in bits) which is not a multiple of $2^3$?


texts: chaining multiple key derivation functions together

texts:
I was looking at PBKDF2, bcrypt and scrypt as options for key derivation; and would like to try using them all together in order to get the cryptographic strength of the strongest one (which seems to be scrypt so far unless something novel is discovered).
My first thought was to apply the first kdf to the password, then apply the second kdf to the obtained key (using it as the second password), and then the third. Is there something inherently wrong with this?

I saw a different approach posted by user perseids here:

http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html

I quote:
"Derive p_1 = HMAC(Salt1+"PBKDF2") with key sha256(p), p_2 = HMAC(Salt2+"bcrypt") with key sha1(p) and p_3 = HMAC(Salt3+ "scrypt") with key sha1(p). Derive key k1, k2 and k3 by using the key derivation function PBKDF2, bcrypt and scrypt respectively, each of them using 1/30 seconds CPU time with input p_1, p_2 and p_3 respectively. Compute the key (or database reference entry) as sha256(k1+k2+k3). Here "+" designates the concatenation of byte arrays. "

So basically the 3 kdfs are applied in parallel, and the resulting keys are concatenated and then hashed together. What do you guys think about this one? Is this obviously superior to just applying the multiple kdf "in series"?

Also, what are considered the most reliable and well scrutinized C or C++ implementations of bcrypt and scrypt (I found pbkdf2 in crypto++ and botan).
Edit: I guess if they produce the right results, then they are reliable, so one point would be that they are well tested, but also what would be important is that they are implemented reasonably efficiently, so they don't give you a false sense of security (e.g. taking long time to compute, when in fact an attacker could take much less time to compute the same with a better algorithm, even without specialized hardware).


texts:
I'd like to encrypt work-related data backups stored on an external drive. The backups contain proprietary company information and trade secrets.
My current backup program, Comodo Backup, allows me to encrypt backup files with AES, Serpent, XOR, and other schemes. However, I've read about vulnerabilities in encryption tools (such as TrueCrypt failing an audit by Google's Project Zero team).
It would be more convenient for me to let CB create encrypted containers, but if necessary, I can have it make uncompressed/unencrypted backups, then encrypt them manually after the fact. Thanks for your help - obviously, my knowledge of security and cryptography is very limited.
Here is the only information I can find regarding their encryption method:

Encryption Algorithms:
3DES - 168-bit/ strong
AES - 128bit / strongest
Blowfish - 64-bit block / strong
DES
Serpent - 128,192 or 256 bit / very strong
Twofish - 128-bit block/ strong
Xor - Variable block size / weak
CBU generates a 32 byte key by applying a SHA256 hash algorithm to the password entered by you. If the encryption algorithm chosen by you requires a key of smaller bit length, the 32 byte key is truncated to the required length. CBU encrypts the backup file with the chosen algorithm using this key. During the restoration the backup file, CBU receives the password entered by you, generates a key by applying the same hash algorithm and uses this key to decrypt the backup file. If a wrong password is entered by someone maliciously, the key required to decrypt the backup could not be generated and the backup could not be restored, ensuring additional level of safety to the backup of your confidential information.

Rather than rely on Comodo Backup to handle the archive encryption, should I use a more specialized tool such as VeraCrypt?


texts: When is an RNG a CSPRNG, a CSRNG, or a TRNG?

texts:
In a recent answer to a question about CSPRNGs, it was stated that…

Nondeterministic algorithms where there is no such requirement, and ideally could be replaced by a true random generator. Example: operating system random generators, where the practical solution has been to compose a deterministic pseudorandom generator with a physical noise source, to yield output that is both nondeterministic and pseudorandom.

This got me thinking that this could potentially lead to further confusion due the terminologies used, so I decided to wrap this into a question to have a place to point people to…

Can an RNG which relies — among other things — on a non-deterministic physical noise source still be called "pseudo" random?
If, where do we draw the line between a CSPRNG and a CSRNG?
And where do we place a TRNG in this picture? Or is a CSRNG always a TRNG and vice versa, making every other (cryptographically secure) RNG a CSPRNG even when non-deterministic physical sources are part of the RNG?

EDIT
It would be nice if your answer would include some pointers to according references that underline your explanation(s). After all, a trustworthy reference can replace a thousand opinions and related discussions.


texts: If $\mathrm{P}=\mathrm{NP}$ were efficiently solvable, how would Internet security work?

texts:
Suppose $\mathrm{P}=\mathrm{NP}$ were proven and a practical low-degree (2 or 3) polynomial algorithm was found before widespread quantum key distribution was available. How would internet security work? Presumably, there would be eventually fewer bugs because of formal verification, but everyone would need to use one-time pads. Major platforms could mail USBs or hard drives with keys to everyone and people could be taught to use one-time pads to talk securely with friends and family or could an alternative system work?
Would the internet would be down for several months while major security bugs were found and fixed and the one-time pad distribution system was set up? Wouldn't internet security would be a hassle for years afterward?
Edit: I am specifically asking about practical policy implications. If we knew that all the major cryptographic primitives would be unsalvageably tomorrow (other than one-time pads), what would we need to do to get the internet working and what would be the future limitations we would have to live with.


texts:
For all PRNGs (including CSPRNGs) lets say there is a sequence x, y, z, then when the PRNG cycles back to x, then the sequence following it will be exactly the same as before. Is this true for all PRNGs?
Are there any rules about minimum cycle length for CSPRNGs used for Stream Cipher? Because if a cycle happens, then the One Time Pad is no longer a One Time Pad and becomes insecure, right?
What are the average cycle lengths for commonly used Stream Cipher algorithms?
Is it not possible to prevent cycling by making the algorithm dependent on what it is encrypting - i.e. something like

The stream cipher is used for encrypting communication between Alice and Bob. Alice's key is K1 & Bob's is K2.
This is the conversation

Alice: Hello, Bob
Bob: Hello, Alice
Alice: How are you?

So

K1 is used to generate the stream for encrypting "Hello, Bob" and it's sent.
The next stream generated not only depends on state of the PRNG after generating the stream for "Hello, Bob" but "Hello, Bob" is also used as input for this stream. And this will be used for encryption "How are you?" and so on.


texts:
good evening guys,  let us suppose that elliptic curve is given by the following equation

$y^2=x^3-x+1  \pmod {127}$
on the following table  message  $9$ is converted   to the point on curve

if i insert directly   into equation , we  will get

$9^3-9+1=721$ and  $721$ mod  $127$ gives me 86, so how 91  is  given? what is relation between  $91$ and  $9$ ? please help me


texts: Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

texts:
FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks:

  it is possible to use an XOF as a hash function by
  selecting a fixed output length. However, XOFs have the potential for generating related
  outputs—a property that designers of security applications/protocols/systems may not expect of
  hash functions

Later it describes a theoretical use case (and explicitly discourage such uses):

  For example, a naïve (and non-approved) way
  for two parties to agree to derive a 112-bit Triple DES key from a message designated as keymaterial would be to compute SHAKE128(keymaterial, keylength), where keylength is 112.
  However, if an attacker is able to induce one of the parties to use a different value for keylength, say 168 bits, but the same value for keymaterial

So what is the use case for these functions? Is there any reasonable use case where these functions should be used instead of standard (fixed-size output functions) SHA-3 functions?


texts:
I have 2 end points where I would like to derive the same AES key.

Every end point has its own RSA key pair and RSA public key from the other end point, and I would like to combine them somehow on both sides to derive the same symmetric key. How it can be used to derive AES key with the same value on both sides?

I am looking for something like ECIES-KEM but for RSA.

EDIT:

From the RSA-KEM as suggested from Wiki:
I have on endpoint A private key SK_A and public key PK_B. On the end point B I have private key SK_B and public key PK_A. As I understand the end point A should generate random m, where 1 < m < n. Then the m should be encrypted on end point A with PK_B and sent to end point B.

After that, both end point would be able to derive the same AES key using m and KDF. Is that correct?


texts: Are there order-insensitive, constant-space MAC constructions?

texts:
Are there well-studied MAC or PRF constructions that can authenticate a sequence of strings in a way that:

Is sensitive to the count of each string in the sequence but not their order;
Uses constant space independent of sequence length and string length;
Uses time proportional to the sum of the lengths of the strings in the sequences?

Something like a keyed function $F_k(M) : \{0,1\}^n \times \{0,1\}^{**} \to \{0,1\}^t$, such that if $M$ is any permutation of $[m_1, ..., m_n]$, then $F_k(M) = F_k([m_1, ..., m_n])$.

The most naïve thing I can think of is to XOR of the outputs of a PRF over the individual strings, but that clearly won't do because $F_k([m]) = F_k([m, m, m])$ for any $m$.


texts: Security considerations for partially shared password databases

texts:
Programs like KeyPass and 1Password store password database files encrypted by a single password. If someone knows the protecting password ("Vault Key"), they can read the entire database ("secrets").

Being part of a family, I sometimes share passwords with my wife and others for bank accounts or Netflix which we manage jointly or personal accounts which another might need access to if one were incapacitated.

With a software like DropBox, password databases might be synchronized among family members. For different permutations of sharing, different databases might be used each with different Vault Keys. But as particiation or sharing complexity increases, the number of databases and keys grows more quickly (1 user => 1 database, 2 users => 3 databases, 3 users => 12 databases!). Even if multiple Vault Keys are supported in a single database, concurrent edits among users could cause problems for DropBox and similar.

I envision a scheme whereby each user has their own single database file, protected by a private Vault Key. Part of the database file format allows publication of selected secrets from the private list to be shared with other members. I could, for example, share my Netflix password with my wife by including it in the shared list of my database.

To enable the scheme, a private key which rarely changes would be protected by my Vault Key, which can change often. My public key is available in the clear. Each secret record in the database gets its own symmetric key which is encrypted and signed by the keys of the owner, and the secret record key is also encrypted once each by the visible public keys of anyone (any other member's database file's public key) with whom the owner chooses to share the secret record.

If my wife wants to see my Netflix password, she reads my database from our shared dropbox folder and gets the list of records and encrypted record keys. She decrypts any record shared with her using her own Vault Key-protected private key. She can't change the record because I've signed it.

So, I write to my database my own secrets. I have a list of trusted targets (each family member's public key read from /their/ database file). Each of my secrets' keys are encrypted using my own public key, but also (separately) by the public keys of each share target that I have chosen. They can read from this file and decrypt the shared secrets' keys with their private key.

She or anyone else could mangle the file, but the version control in DropBox protects against that. The encrypted database files are to be considered semi-public, since any user with access to it might have a breach.

Are there any implementations of this concept?
What are the security problems with this scheme?
What security gotchas await in a more complete description of this scheme?
Is it terrible, for example, to keep a pk/PK pair even when changing the Vault Key?  Or must it change every time?  Changing the public key would invalidate the shares from others' databases.  I guess we can keep a history of our key pairs until the others have had a chance to update their own databases for my latest key.

(Yes, Passpack allows such sharing perhaps with a different scheme, but frankly, it frightens me.)

Update: I appreciate the answers so far, but they were from a forum with a different lean.  I'm more interested in the security-implementation critique of the scheme rather than getting recommendations of products that approximate it.


texts:
RFC4493 describes the generation of AES-CMAC and padding for messages with length > sizeof(aes128_key). However I need to generate the CMAC for a series of messages shorter than 16 byte.

So I'd like to ask if it is viable to:

Pad M0 with 0 up to 16 bytes
Pad M_last with the proposed padding (first bit 1, others 0)

As the message always will be M0 || M1 with a fixed size, is the subkey generation still required? Or can it be replaced by a fixed value?

Kind regards


texts: Selectively opening only a few commitments

texts:
I have k messages $m_1,m_2...m_k$ and I want to commit to all of them but open only a few of them -- as asked by Bob. Each message is of $n$ bits. Show how one can commit to all the $k$ messages and then later open only the messages that Bob asks her to such that the total communication is less than $O(nk)$.

I am stuck at the very beginning. I am not able to find what kind of a cryptographic object is suitable for this. Any clue will be appreciated.


texts:
I would like to know what is the real purpose of using a modulus in the equivalent of a Vernam cipher:

Data $d$, large number $M$.
Assume the key length is $\lambda$ bits. Then $M$ could be $2^\lambda$.
$k$ is picked from $\{0,1\}^\lambda$ using a pseudo random function (PRF)

Encryption: $C = k + d \pmod{M}$
Decryption: $d = C - k \pmod{M}$

What's the purpose of using $M$?


texts: Do I pronounce it as a word or do I make it sound like "R-I-P-E-M-D" like by pronouncing each individual letter.


texts: Demonstrating Diffie-Hellman key exchange using only p, A, B;

texts:
I'm trying to figure out how to demonstrate DH key exchange using what is given to me. I'm unsure of how to tackle the problem.

Question:

Demonstrate Diffie-Hellman key exchange.

Given p=104933, A=324, B=5832. Prime factors for p-1 {2,37,709}

A and B are Alice and Bob secret keys respectively.

What is the value of the shared key?

Process to solve:

So there are 5 steps to DH key exchange.

Alice and Bob share prime p and generator g
Alice sends g^a mod p to Bob
Bob sends g^b mod p to Alice
Alice computes the shared key
Bob computes the shared key

I get stuck at step 1 though because I'm unsure of how I'm supposed to find the generator given this information.


texts: FIPS 202/SHAKE: insecure 3DES key derivation example

texts:
I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some protocols.  The example they give is this (appendix A.2, "Additional Consideration for Extendable-Output Functions," p. 25):

  [A] naïve (and non-approved) way for two parties to agree to derive a 112-bit Triple DES key from a message designated as $keymaterial$ would be to compute $SHAKE128(keymaterial, keylength)$, where $keylength$ is 112. However, if an attacker is able to induce one of the parties to use a different value for $keylength$, say 168 bits, but the same value for $keymaterial$, then the two parties will end up with the following keys:

  $SHAKE128(keymaterial, 112) = \mathbf{fg}$
  $SHAKE128(keymaterial, 168) = \mathbf{fgh}$,

  where the bolded letters of the digest represent 56-bit strings, e.g., the parts of a Triple DES key.

  Because of the structure of Triple DES, these keys are vulnerable to attack.

I'm trying to understand this example more concretely.  So far what I can make out is this scenario:

Alice and Bob have established a shared secret $keymaterial$, and are now supposed to both compute $SHAKE128(keymaterial, 112) = fg$, and instantiate 3DES with keys $f, g, f$.
Eve however tricks Alice into computing $SHAKE128(keymaterial, 168)$.  So now:

Alice's encryption function is $E^{3DES}_{f, g, h} = E^{DES}_f \circ D^{DES}_g \circ E^{DES}_h$;
Bob's decryption function is $D^{3DES}_{f, g, f} = D^{DES}_f \circ E^{DES}_g \circ D^{DES}_f$.

The composition of Alice's encryption and Bob's decryption functions is $D^{3DES}_{f, g, f} \circ E^{3DES}_{f, g, h} = (D^{DES}_f \circ E^{DES}_g \circ D^{DES}_f) \circ (E^{DES}_f \circ D^{DES}_g \circ E^{DES}_h)$.
Simplifying adjacent inverses in that equation, we get $D^{3DES}_{f, g, f} \circ E^{3DES}_{f, g, h} = D^{DES}_f \circ E^{DES}_h$.
This function is vulnerable to a meet-in-the-middle attack.

If I'm on the right track here at all, where I'm getting stuck is: what larger scenario allows Eve to take advantage of this?  I can picture this scenario:

Eve has these powers:

Trick Alice and Bob into misderiving their 3DES keys as described;
Choose messages for Alice to encrypt and observe Bob's decryptions of them.

Eve uses these to mount a meet-in-the-middle attack that recovers $f$ and $h$ in $2^{57}$ time.

So now Eve knows that $SHAKE128(keymaterial, 168) = fgh$ for some unknown $g \in \{0, 1\}^{56}$.  This certainly allows Eve to bruteforce $g$ within an additional $2^{56}$ tries, but if $SHAKE128$ is preimage-resistant it should still be difficult for Eve to recover $keymaterial$.  So are the dangerous scenarios those where $keymaterial$ is a long-term key, so that Alice and Bob will communicate many times with the same derived $f$ and $g$?

(I worry this might be a bit of a yes/no question, but I figure I must have something wrong above...)


texts: Implementation of a decryption mixnet, and problems with the size of the key

texts:
I've been studying decryption mixnets, in the context of e-voting and stealth networks. Let's describe it in a very simplified way. The concept is pretty simple. A message M is forwarded through several servers, A,B,C. The user encrypts the message with the public key of C, then encrypts that output with B's key, and then encrypts it with A's key. Each server removes a layer, and the last server knows the plaintext.
My two questions are...
How is it possible to implement this in software? I'm using Python, and every single library uses padding. After two or three layers of encription, the output is so, so large. For security purposes,  asymmetric encryption needs a random padding. But I think that this case needs just one layer of random padding, at the beginning (C layer), instead of adding PKCS in every layer. Is there a library implementing mixnets, or a low-level module that allows you to encrypt with RSA or ECC without padding?
And, what about the lengths? Public-key encryption has a length limitation for the plaintext, depending on the size of the key. How does this apply to mixnets? Is the only solution to this problem a hybrid scheme, encrypting a symmetric key?


texts: Is there a checksum that gives the same checksum when in a text file?

texts:
Let's say I have a text file (crypto.txt). Let's assume the checksum function can be any type of function (MD5, SHA-1, anything else). Is there a way that the checksum value IN the file (crypto.txt contains a string that could be a possible checksum), when put through a checksum program, outputs the exact same value as the content inside the text file?

In case I lost you, here's a quick breakdown:

crypto.txt contains a viable checksum value (said value = x)
checksum of crypto.txt = x

Is this even possible? Is there math that proves it wrong/right?


texts: Factoring $n$ in RSA knowing $e$ and $d$

texts:
I know that if $(n,e)$ is the public key in RSA and we also know $d$ the private key, then there is a probabilistic algorithm to factor $n$.
I'm reading the proof from Fact 1 on here.

I understand the proof until it says

"A straightforward argument shows that if $g$ is chosen at random from $\mathbb{Z}^*_N$ then with probability at least $1/2$ (over the choice of g) one of the elements in the sequence $g^{k/2}, g^{k/4}, \cdots ,g^{k/2^t} \mod N$ is a square root of unity that reveals the factorization of N."

Why is that last paragraph true?


texts: Use of Lamport's Signature as a primitive

texts: Is Lamport's One Time Signature used as a primitive to construct any other cryptographic protocols?


texts: What is the most practical fully homomorphic cryptosystem?

texts:
Craig Gentry recently gave the first fully homomorphic cryptosystem. Quite a bit of work has been done since extending his work. It seems, however, that no system is practical for real world use.

What are the current roadblocks making FHE impractical?
Which proposed system would you say is currently the most practical?


texts: Given an AES-CBC encrypted string, IV, and plain text, how can I compute the key?

texts: If I have the AES-CBC encrypted string along with the IV and the plain text before encryption, how can I compute the key which was used for encryption?


texts: Can Bitcoin HD public keys be used for symmetric encryption?

texts:
I asked this at bitcoin.stackexchange.com first, but it seems that this is more of a crypto-question anyway.

I'm interested in using a Hierarchical Deterministic Bitcoin wallet branch as a "shared secret" between two parties. Basically one party could send an index (in plain text) to the other party, along with some sensitive information encrypted (symmetrically!) with the public key along that HD branch.

The recipient could then derive the public key at the sent index, and decrypt (symmetrically!) the sensitive information with that public key. These keys would not be used as addresses or in any bitcoin transactions, nor would any addresses along that HD branch. The HD branch itself is not known outside of the two parties.

Is this (cryptographically) secure?
Would it be better to hash the public keys before using them as an encryption key?
Are there any resources about doing something similar I can use for research?
Anything blindingly obvious that I'm missing?

Thanks!


texts:
Assuming that $K_{n}$, $P_{n}$, and $C_{n}$ are individual bytes of the key, plaintext, and ciphertext respectively.

The first byte of ciphertext is computed like this:

$C_{1} = K_{1} \oplus P_{1}$

And the rest of the bytes are computed like this:

$C_{i} = K_{i} \oplus P_{i} \oplus P_{i-1}$

Is this a good way of encrypting data, or is there some loophole that I've overlooked?


texts: Why are some x-coordinates unsuitable for an ECDSA generator point?

texts:
For Bitcoin's ECDSA curve (secp256k1, where $a=0$, $b=7$), why can't the generator point's first coordinate be $x=0$?
That is, the point on the curve would be $(0,y)$ where $y$ satisfies $y^2 = 0^3 + 7=7$.

Are there any elements other than $0$ which can't be used as a generator point's $x$ coordinate?


texts: Does a partial preimage attack imply a preimage attack?

texts:
Let's assume we have an $n$-bit hash function and a $b$-bit partial preimage attack that is faster than brute force. Does this imply a faster than brute force preimage attack on the whole hash?

It seems that it does, because if you run the $t<2^b$ time partial preimage attack on an input you have a $2^{b-n}$ chance of finding a full preimage, which is better than the chance with a brute force attack in that time.

On the other hand, if you run it on $2^{n-b}$ inputs you expect one of them to find a full preimage and this takes $t \cdot 2^{n-b} < 2^n$ time. However, with that many inputs a brute force attack would find one of them in just $2^b$ time, which is better unless $b>\frac{n}{2}$ and the partial preimage attack is very fast. (Complicating matters further, some of the inputs may have the same partial hash, not sure how to take that into account.)

I am trying to figure out what assumptions can be made about preimage attacks when considering the truncation of an arbitrary $n$-bit secure $n$-bit hash.


texts: Determining if a ciphertext can be decrypted

texts:
I want to know what the state of the art in the following
cryptographic problem is.

Assume a public channel on which encrypted messages are exchanged,
using symmetric key encryption.  I hold a couple of secret keys.
For each ciphertext message on the shared channel, I need to determine if
I can decrypt the ciphertext. If not, I ignore the message, otherwise
I produce   the plaintext as usual. (In my use-case, authentication and message integrity are not relevant.)

What is the industry standard way of doing this, what are the pitfalls? I'd be interested in both, Dolev-Yao formal crypto modes, as well as concrete algorithms. I have no concrete adversary model in mind, what are good adversary models for this question?


texts: How do ZK-STARKs, ZK-SNARKs, and Bulletproofs compare in size and speed for range proofs?

texts: How do ZK-STARKs, ZK-SNARKs and Bulletproofs compare in size and speed for range proofs? The general behavior is depicted in this chart. But do those numbers scale linearly to the proof and verification times listed on dalek-cryptography's bulletproofs page, that has a 64-bit range proof taking 7.3ms and verification taking 1ms?  That is, would generating and verifying a ZK-STARK of a 64-bit range proof take microseconds?


texts: What's a good hash algorithm for hashing a short length (e.g. 256 bytes) buffer, which must be fast and very collision resistant?

texts:
It doesn't need to be cryptographically secure.

Would CRC64 be a good choice?
What's the minimum hash length that can be considered cryptographically secure these days?


texts:
Background.

I'm trying to make a local command-line based password manager. So far, I've managed to make the output look dizzy on tty, and I plan to encode user credentials in individual 512-byte blocks.

To encrypt these blocks, I thought about using XTS, but the overhead of "tweaks" just makes it less favorable compared to the key wrapping modes in NIST.SP.800-38F.

But the key-wrapping in NIST.SP.800-38F involves splitting blocks in halves into "semi-blocks", which is a bit off-putting, and implementing it in full would mean the complication of various working variables.

So instead I made an ad-hoc design.

 The Double-CBC.

In 2CBC mode, the plaintext goes through two rounds of encryption.

In the first round, AES-CBC is applied to the data with an all-zero IV, and because the chaining of cipher output, we can be sure that the result of the last block depends on all previous blocks.

In the second round, AES-CBC is applied again, but this time, with the last block from first round as IV, and because IV is the output of a cipher, we can be sure that it's suitably random, and because it's the output of chain of cipher, we can be sure it'd depend on all parts of the input.

I feel it'd be easier to implement 2CBC than AES-KW.

 On Integrity and Semantic Security.

Because the block is large enough for the type of data it holds, it is possible to have dedicated area in the content of the 512-byte block for randomization vector and integrity check value.

Specifically, the last 128 bits will have 1.) a 96-bit randomization value, 2.) a CRC32 checksum of all previous 508 bytes.

 However, I do not see a reason why message authentication is needed, as it's data at rest mostly.

However, I'm not sure if this is sufficient for the use case here. Specifically, what kind of adversary do I need to prevent tempering of the records from, and how.

 The Questions.

Are my arguments enough to claim that 2CBC is secure for just confidentiality? Or I've made a terrible mistake and missed something important?
If I want to add integrity, can I do it the same way as extending KW from W?
Does the randomization value have to be unpredictable? Can I have meaningful information such as modification time on it? (Probably not, since if attacker checks mod time of the file, he/she will know there's some known plaintext in the file).
How should the need for authenticating the records be satisfied?


texts:
I recently came across an article outlining a framework for a hypothetical cryptocurrency, the article is here if you care to read the whole thing. The relevant section is the "Digital Cash" section. The main primitive seems to be the enforcement of a single owner of a private key through the use of secure enclave hardware as follows:

Signed "sending" application $A$ generates and encrypts a private key $S$ using an attested hardware key.

Upon request from $A$, another "receiver" application $B$ sends $A$ its public key.

$A$ encrypts $S$ with $B$'s public key and then deletes its copy of $S$.

$A$ sends over this ciphertext to $B$, and now $B$ effectively has ownership of $S$ since there is some unspecified way of verifying that $A$ has really deleted its copy of $S$.

My question is how does the attestation of $A$'s deletion of its copy of $S$ work, and why can $B$ trust it? Additionally, how could this same scheme be replicated without the use of secure enclave hardware?


texts:
Reading some papers on security amplification of weak-PRP written by Stefano Tessaro, I noticed the use of notion "epsilon-PRP" and the notion of "security amplification". These notions, in conjunction with the statement

  We consequently call a primitive satisfying this assumption an epsilon-PRP: Clearly, AES is much more likely to be a 0.99-PRP, rather than a fully-secure PRP.

from Tesaro-Security Amplification for the Cascade of Arbitrarily Weak PRPs:
Tight Bounds via the Interactive Hardcore Lemma confused me.

Can anybody explain when security of PRP is higher, for epsilon very close to 1? Security amplification of cascade of PRP's occur when resulting epsilon is greater than every epsilon of basic PRP?


texts: Difference between lightweight, online and low memory Authenticated Encryption schemes

texts:
What is the basic difference between the following types of Authenticated Encryption (AE) schemes?

Lightweight Authenticated encryption
Online Authenticated Encryption
Authenticated Encryption for low memory devices

Are they all the same or is there a specific difference between them?


texts:
Assume it takes 512 clock cycles to check if a 64 cryptographic bit key is correct. Given a 64 bit plain text and its ciphertext, how long does it take to check all keys using a single core of a 4 GHz processor?

What is the time taken if it is done using a cluster of 1024 servers, each with a quad core processor?

I need help to understand if my approach is correct.

Number of keys tested in 1 second (using a single core): $\quad 2^2 \cdot 2^{30} / 2^9 = 2^{23}$ keys are tested.

Amount of time taken for a 64 bit key: $\quad 2^{64} / 2^{23} = 2^{41}$.

Using a cluster of 1024 servers:

Number of keys tested in 1 second: $\quad 2^2 \cdot 2^2 \cdot 2^{30} \cdot 2^{10} / 2^9 = 2^{35}$.

Total time taken: $\quad2^{64}/2^{35} = 2^{29}$


texts:
It is written in the HMAC paper that the ipad=0x36 and opad=0x5C were chosen such that it maximize the Hamming-Distance of the part of the key used in the inner and outer part of the HMAC process.

Since 0x36=0b0110110 and 0x5c=0b1011100, it seems that the Hamming distance is 4, but I would expect that ipad and opad with Hamming distance of 8 would have been used.

Do you know how does those exact ipad and opad values make the scheme stronger?


texts: why do files downloaded with http and https have the same size?

texts:
while working with Encryption mostly cipher text is always larger the plain text, why isn't that the case when downloading a file using https ? even that compression isn't much used anymore because if the CRIME and BREACH exploits the file still has the exact same size as a http download.

UPDATE : something i may be thinking of is that the browser or whatever tool only tells you about the size after decryption ?


texts:
Informally, the Avalanche effect says that two similar, but not identical, inputs should produce radically different outputs when fed through a hash function.

I've seen, at least, two formal definitions of the effect. The first is that if we flip one bit of an input, the two respective outcomes should typically be very different and it's guaranteed that they're not the same. The other definition is that if we flip one bit of an input, the outcomes are statistically independent. I find this confusing: the two definitions are contradictory.

What is the proper definition? And practically, does modern hash functions like sha256 have this property?

To set ideas. Let $H(\cdot)$ be some hash function with $N$ possible outputs. Let $X_1$ be an (integer) random variable, uniformly distributed on some interval. (Assume that $\Pr(H(X_1) = x) = N^{-1}$ for each $x$.) Let $X_2$ be a RV such that it differs exactly in one bit with respect to the first RV (i.e., the Hamming distance between $X_1$ and $X_2$ is exactly one). What does the Avalanche effect says about $\Pr(H(X_2) = H(X_1)\,|\, H(X_1))$?

The first definition says that $\Pr(H(X_2) = H(X_1)\,|\, H(X_1)) = 0$. The second says that $\Pr(H(X_2) = H(X_1)\,|\, H(X_1)) = N^{-1}$. Obviously, both cannot be true.


texts: Why does Hasse's theorem sometimes seem to be invalid?

texts:
In order to generate secure elliptic curves, this answer recommends to

  Calculate the cardinal $|E(\mathbb{F}_p)|$
  Check this cardinal is in the hasse interval

(with $p$ prime) and to restart the process with a different $p$ if step 5 (or others) fails. This suggests that cardinality is not always bounded in the way Hasse's theorem indicates.

I understand that different generator points can lead to "different cardinalities" in $\mathbb{F}_p$ (given prime $p$ and fixed parameters $a$ and $b$ in $y^2=x^3+ax+b$), but I see various examples where cardinality is well below the lower bound of Hasse's interval no matter what generator I choose.

Is it that I just need to brute-force generators in $\mathbb{F}_p$ until I find one that leads to an acceptable cardinality? or what am I missing?


texts: ChaCha with 64bit integers as a PRNG with streams

texts: Can I use ChaCha with four rounds as a good non-cryptographic PRNG with different streams if I use 64 bit integers instead of the standard 32 bit integers? I need a bigger state and this seems the easiest way to do it.


texts: Key derivation with implicit certificates

texts:
The big advantage of implicit certificate is their small size and fast processing. This article presents a way how to compute implicit certificates.

In the end Alice is able to derive both her public and private key ($\alpha$, $Q_A$).

Does this mean that the usage of implicit certificates implies the generation of a new key pair each time such a certificate is issued? Traditional explicit certificates (e.g. X.509) can be issued unlimited often for the same public key.
How do you prevent somebody else to derive Alice's private key? I don't see any secret information that is only possessed by Alice. Initially, I thought this was $\alpha$, but apparently this random integer is send in plain text to the CA. Even if it was encrypted, the CA would know $\alpha$ and consequently Alice's private key.


texts: Limit the length of AES encoded output to certain value

texts:
First let me be clear upfront that am not Crypto expert. I'm having a problem where I will have to use NFC card. Now given the limitation of NFC cards memory sizes, I will need to constraint my system to generate encoded data up to X amount of character.

Is there a way to limit character of AES encrypted data to not exceed certain limit? It would be easy with hashes but the data have to be reversible.


texts: If Alice (sender) sends a private message embedded with public key of the Bob(recipient) through onion network, so in this key exchange, does Bob remains anonymous to Alice as Alice knows about the public key of Bob. So if we want to achieve mutual anonymity, how can we do that? Can we achieve mutual anonymity through this key exchange?


texts: Decryption : How to secure the Key in offline mode

texts:
I am new to cryptography.
I have a package to be shared with Bob which is something like below:
Package contains: data.zip and Application

where,

data.zip is encrypted
Application will have logic to decrypt the data

Bob will run Application and it will decrypt the data.zip.

Now for the decryption key, I understand that I can maintain a key store
where I can keep the key securely which my Application will access and
get the key.

But in my case Bob will execute the Application offline.
Building the Application with the decryption key doesn't make sense as Bob can easily take the key or logic to form the key from Application.
In this scenario how can I handle the decryption part? what is the ideal solution and how where should I keep the key?


texts: Why do we approximate R-1 rounds during linear or differential cryptanalysis?

texts:
I am currently looking into differential and linear cryptanalysis. I am however unsure why do we only approximate only R-1 out of R rounds - is it because we already know the output or why ?

I have read "Linear and Differential Cryptanalysis" by Howard M. Heys, but I am not able to find it there, he only takes it for granted.

Thank you for your answers


texts: What is a method for hiding RSA prime values from .exe De-Compiling?

texts:
I've just been looking into RSA encryption with C++ and am wanting to make a program that can en/decrypt files of my own custom file extension. Obviously I need to choose two primes numbers (for my p and q values) to encrypt and decrypt this file, but I am curious as to how I could stop these values being pulled out of my program via de-compiling.

Obviously, with the primes in hand, someone could easily calculate the necessary values for the private key that ONLY this executable should have.

Are there methods for somehow generating a random private key that will always unlock the public key?


texts: Can an Enigma-style cipher of sufficient complexity be considered secure today?

texts:
Regarding the German Enigma machines, if I recall correctly, the reason they were defeated was because the Allies were able to generate a massive database of possible rotor settings, and because the day key was encoded twice in the beginning of each message.

Given that computers of today can simulate an Enigma-ish machine with an arbitrary number and complexity of rotors (for example, a rotor that only shows up every tenth character, or one that goes forward a different number each time), transmission errors are low, and binary data (not plain-text, but gzipped or base64'ed text) tends to beat frequency analysis, would it be possible to use an Enigma style cipher to encrypt data today, or would it be susceptible to similar pitfalls as the original Enigma cipher?

As a more general question, can other older ciphers be "re-invented" for computers and be viable in today's world?


texts:
I'm using Wikipedia and Handbook of Applied Cryptography as references. I know that ESSIV generates an initialization vector (IV) by combining a hashed key with the sector number.

However, I only see an IV in CBC, PCBC, CFB, and OFB modes of operation e.g. chained modes. CTR and ECB are not chained modes, so where does the IV go?

Comparing two files encrypted with CTR-ESSIV versus ctr-plain with a plain unsalted key, the entire stream is different, not just the first block. This means the IV is applied to all blocks in CTR mode. However, when doing the same with ECB mode, the two files are identical. This means the IV is not used in ECB mode at all.

So, where and how exactly is the IV applied in CTR mode?


texts:
I'm working with a payment provider which uses the following algorithm for signing messages:

The merchant is securely given a secret key k, known to them and the payment provider only.
EDIT: Usually the key is quite long.
The payment is implemented by using a redirect, and the merchant later receives callbacks containing information about the success or failure of the payment operation. The merchant considers this information trustworthy. Here is an example of a successful payment callback for order no. 1234 and a merchant hosted at example.com:

example.com?orderID=1234&paymentStatus=SUCCESS&...&signature=abcd
The message m which is signed is formed in the following way:

orderid=<..>|paymentStatus=<..>|...
The signature algorithm S(m,k) is chosen to be: signature=H(m||k) (m||k means m concatenated with the secret key k) where H is a hashing function, in this case MD5.
The verification algorithm is V(signature, m, k) and returns true only if H(m||k) = signature.

As far as I understood the inner workings of MD5 if the signing algorithm was S(m,k) = H(k||m) then this would be totally insecure because if an attacker knows H(k||m) she may be able to calculate H(k||m||m') where m' is a message of her choice - this would mean that the signature is vulnerable to both existential and selective forgery. Correct? But deliberately or not the algorithm is S(m,k) = H(m||k) - the key is put last in the concatenated string.

So far I cannot think of exploitable vulnerability in this protocol (I'm not considering the problems inherent to MD5). Any ideas, is this secure enough?


texts: Suppose triple DES is performed by choosing two keys $K_1$ and $K_2$ and computing $C = T (T (T (L, K_1), K_2), K_2)$. How to attack this modified version with a meet-in-the-middle attack, in which the attacker knows at least one $(L,C)$ pair?


texts: Generating a valid signature on El-Gamal without knowing the private key

texts:
Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$.

Also suppose we know $y=g^r$ mod $p$ where $r$ is some random number and $0<r<p-1$ and is the discrete log of $y$. We also know $s=(M-xy)(r^{-1})$ mod $(p-1)$ where $M$ is a padded message.

But now, lets suppose that we do not know $x$  but rather we know $r$, the discrete log of $y$. Now we want to forge/generate a valid signature for the message, $M2.$ Given all this information, how can we do this?

I found an article about this which states it in section 3 but I did not understand the process which can be seen at: ftp://ftp.inf.ethz.ch/pub/crypto/publications/Bleich96.pdf. I was hoping if anyone knew the simpler step for it or to put it in a simpler way, that would be great.

Any input is much appreciated. Thanks a lot.


texts: Are there any (asymmetric) cryptographic primitives not relying on arithmetic over prime fields and/or finite fields?

texts:
Trying to figure out if any (asymmetric) cryptographic primitives exists, which do not rely on arithmetic over a prime field and/or arithmetic over a finite field, some people might get lost in research. Therefore, here’s the related question (inspired by this comment):

Does any asymmetric cryptographic primitive exist, that doesn’t rely on arithmetic over prime fields and/or finite fields?

If, which one(s) would that be?
If not, it would be nice if you would also explain why not?


texts: Multiplying integers modulo $2^{255}-19$ using the Curve25519 polynomial reduction algorithm

texts:
I'm reading the Curve25519 paper and I see that in page 11, under the title "Multiplying integers modulo $2^{255}-19$", it says:

  The coefficients of $x^{10}$; $x^{11}$; ...; $x^{18}$ in $uv$ are eliminated by reduction modulo $2^{255}x^{10} - 19$. For example, the coefficient of $x^{18}$ is multiplied by $19 \cdot 2^{-255}$ and added to the coefficient of $x^8$.

I don't understand why that multiplication and similar others in coefficients 17/7, 16/6, 15/5, 14/4, 13/3, 12/2, 11/1, 10/0 reduce the polynomial modulo $2^{255}-19$ as the paper says.

What is the explanation for that? Does this algorithm has a name or something so I can read its description?


texts: Generating 64 bit random values using AES-CTR

texts:
I need to generate 64 bit random values using AES-CTR.

Using fixed 64 bit plain text and sequential nonces can I assume the  higher order 64 bit output values of the AES-CTR to be random with a period of $2^{64}$?


texts: Crypt-analysing modified AES algorithm with no shift-rows, and no key-expansion

texts:
I came across an answer about consequences of AES without any of its operation In the question in the given link, it is mentioned that "if Shift Row is removed, then attacker can treat input block ($128$ bits) as $4$ independent $32$ bits block. Hence, attacker can attack these $4$ blocks one by one to recover key." I did not understand this statement. I request the community to please help me understand this question.

Since AES is block cipher, we have to encrypt each 16byte block at once, but how can we divide that 16byte into blocks of 4 bytes? If I have a plaintext-ciphertext pair of 16bytes, will it be enough to recover the key? If yes, then how?


texts: How to select $g$ in Paillier Cryptosystem

texts:
For my cryptography class project in university I have selected Paillier Cryptosystem as a course project http://en.wikipedia.org/wiki/Paillier_cryptosystem#Key_generation

In key generation it says

  Choose two large prime numbers $p$ and $q$

I have selected $p$ = 11 and $q$ = 17, it also satisfies the condition

  $gcd(pq, (p-1)(q-1))=1$

which makes my $n$ = 187 and ${\lambda}$ = 80

and now in 3rd point it says

  Select random integer $g$ where $g \in (\mathbb{Z}_n^∗)^2$

now what does it mean $g \in (\mathbb{Z}_n^∗)^2$?

there is a question What does $(\mathbb{Z}_n^*)^2$ mean? but it doesn't make any sense to me

so the first question is how can I select the random integer g?

In 4th point it says

  Ensure $n$ divides the order of $g$ by checking the existence of the following modular multiplicative inverse: $\mu\ = (L(g^{\lambda}\mod n^{2}))^{-1} \mod n$

it further says

  where function $L$ is defined as $L(u) = \frac{u-1}{n}$ .

can some one please help me to find out $g$ and $\mu$?

The public (encryption) key is $(n, g)$.
The private (decryption) key is $(\lambda, \mu)$.

with any example or link that can guide me to a correct path.

Thanks


texts: Security of hash functions over input extended with a random value

texts:
Hashing a single message say $H(M)$ is vulnerable to a birthday attack.
But what if a combination is hashed, such has $H(M,R)$? Is it still vulnerable to the attack?

I think it is because $M, R$ can be assumed to be as $X$, so in essence $H(X)$ is being hashed and the birthday attack possibility still exists. Is this logic correct?


texts: In RSA, given public key $(n,e)$ and $d^e\bmod n$, can we factor $n$?

texts:
Given an RSA public key $(n,e)$ and the textbook-RSA encryption $c$ of a valid matching private exponent $d$, computed as $c\gets d^e\bmod n$:  can we factor $n$ ?
Assume $n,e,d$ are per PKCS#1v2.2. If that helps, additionally assume any common (or not overly unlikely) condition helping towards a solution, e.g.:

$n$ product of two large primes $p$ and $q$
$d=e^{-1}\bmod\varphi(n)$ where $\varphi$ is the Euler totient
$d=e^{-1}\bmod\lambda(n)$ where $\lambda$ is the Carmichael function
$e$ small, perhaps just $e=3$
$e$ prime
$\gcd(p-1,q-1)=2$
$q<p<2q$

Motivation is this question, which I could only partially answer.
Problem is, textbook RSA encryption is conjectured secure for random secret plaintext. Random secret implies independent of the key, except for public modulus magnitude. Independent of the key is not met when encrypting $d$. As rightly pointed there, we are in unsafe territory. And for some plaintexts dependent on the private key, that would be totally unsafe. Example: if we reveal the encryption of $p$, that is $c'\gets p^e\bmod n$, we can decipher that as $p\gets \gcd(c',n)$. Other examples: revealing the encryption of $9\,q$ or of $d^d\bmod n$ breaks the security.


texts: I need a pathway for studying Lattice-Based Cryptography

texts:
I realize that I need a study pathway for post-quantum cryptography.
I started to study post-quantum crypto by reading NIST PQC 3rd-round submissions of the lattice-based schemes (let's start with the most popular ones). I understood Kyber and Saber so that I could implement them. However, I want to understand the design rationales behind them. Why these errors have that length, what is the role of these parameters in practice.
Since the first lattice-based encryption schemes, there must be many improvements done considering speed or security. I need to understand these. Then, I started searching for papers about lattice-based algorithms and their attacks over the history of lattices. I found a large list here, but I could not filter these papers.
How should I start? Is there a good survey for me, or a list of readable papers covering the area?


texts: Proving existence of an encryption scheme that has indistinghuishable multiple encryptions in the presence of an eavesdropper, but is not CPA-secure

texts: I got stuck in trying to find a solution to the 3.7 exercise of the Katz-Lindell book. The exercise also assumes the existence of a pseudorandom function. The problem is that a multiple messages encryption scheme has to be non-deterministic in order to be indistinguishable. So how is it possible for such encryption scheme to be CPA vulnerable, if it's non-deterministic as we are considering a multiple messages scenario and a pseudorandom function involved in the Encryption-Decryption process?


texts:
The following questions are of pure theoretical nature. I don't have an application in mind.

Is there a key that makes AES the identity function?
Is there a key that makes AES the identity function for certain
inputs?
Is it known whether such keys might exist?
Are such keys known for other ciphers?

For example, I want to encrypt "Hello StackExchg" with AES with said key and the ciphertext should be again "Hello StackExchg".

When I encrypt "Hello StackExchg" with the perfect cipher one-time-pad, there is a possibility that the resulting ciphertext is again "Hello StackExchg". This possibility must exist (though it is unrealistically small), otherwise, the ciphertext would not be perfectly random but depending on the plaintext. The corresponding key for one-time-pad would be all zeros.


texts: Can we run a probabilistic function on ciphertext with Functional Encryption (or Attribute Based Encryption)?

texts:
In the definition of functional encryption ($FE$):

$FE.Setup(1^k)$ takes as input the security parameter $1^k$ and outputs a master public key $fmpk$ and a master secret key $fmsk$.

$FE.KeyGen(fmsk, f)$ takes as input the master secret key $fmsk$ and a function $f$ and outputs a key $sk_f$.

$FE.Enc(fmpk,x)$ takes as input the master public key $fmpk$ and an input $x$ and outputs a ciphertext $c$.

$FE.Dec(sk_f,c)$ takes as input a key $fsk_f$ and a ciphertext $c$ and outputs a value $f(x)$.

Suppose that Alice runs $FE.Setup(1^k)$ and $FE.KeyGen(fmsk, f)$ where $f$ is a probabilistic function. Then she sends $sk_f$ and $fmpk$ to Bob.

Bob runs $FE.Enc(fmk,x)$ and $FE.Dec(sk_f,c)$ to get $f(x)$.

Is this possible? I mean as $f$ is probabilistic, it has to access Bob's randomness pool.

Bob can provide a faked pool. How can one guarantee the privacy of $f$?


texts: I tried to look for a book that presents cryptographic concepts(specially PRNG) in a formal way but what I find is an intuitive approach. So my question is what is the formal definition of Psuedo-random-number-generator(PRNG) or function?


texts:
In my free time, I write an algorithm for fun (and it may be the best hobby I had so far).
Currently, the output this algorithm produces is indistinguishable. I ran multiple analysis process and asked two mathematicians to double check that part (no definite answer but pretty good so far).
But the inherent problem is that the algorithm takes two shared secrets that we obtains via two DH with 4096 bit.
If it is very solid for a high number of possibilities, I crafted a case where the two shared secrets are below 10.
And.. it is weak.
No matter if we pass that in a kdf. We can deduce it anyway (public code).
Since the rest of the algorithm depends on those two values, an attacker can access all the information by following the algorithm flow.
Question:
How could I spice it up so that even low values are as hard as a better pair?
Constraints:

no public key infrastructure

once we have the two shared secrets, we can only send one packet to the other party, and it has to be enough.(Part of the fun)

the message inside is pseudo random

Edit:
I added random values that defeats weak pair so that you don't know when to stop. but it breaks one of my constraints: now, I need 2 exchanges per side.
So, for now, I will submit my algo to my friends again and see what comes out.


texts: Factor RSA modulus given many valid encryption decryption exponent pairs?

texts: I have read Is sharing the modulus for multiple RSA key pairs secure?, which explains an algorithm for factoring an RSA modulus n given only one encryption and decryption exponent tuple. Given multiple such tuples, is there a more efficient way to compute p and q? It seems like we could set up a system of equations using the Chinese Remainder Theorem and then could solve for Euler's totient directly. Once we have Euler's totient, we could solve a system of two equations with N and totient(N) to obtain p and q.


texts: Lifting point to quadratic twisted curve

texts: How to lift point to it’s quadratic twisted curve? I use secp256k1. Is the diiscrete log still same? Thanks before


texts: Should Bob trust a certificate issued by delegated party?

texts:
Consider this scenario:

Alice sends a message signed under her public key to Bob.
Bob has never exchanged a keys with Alice.
Alice's key is signed by a certain X.
X's key is signed by Y, an entity that Bob trusts.

Is Alice's key valid or not for Bob?


texts: What is the difference between KDF based on NIST SP800-108 vs. the older one in ANSI X9.63? When should one be selected over the other? Thanks.


texts: Benefits of using SSL certificate over a raw key pair for non-browser use?

texts:
For applications not involving CA signed certificates – or web browsers for that matter – it would seem to be easier to use a raw key pair if possible, rather than deal with potential formatting issues later on. I know they contain metadata and permissions (not sure how the permissions are actually enforced).

Is there any reason to use a certificate over a key pair?


texts: Attacking historical ciphers methodology

texts:
It's more a theoretical question of how would you approach it. All you know about the ciphertext it's was generated with a historical cipher. The ciphertext appears to be random, BUT it's divided into sets of six letters. By historical ciphers I mean: mono (Ceasar), polyalphabetic (Vigenere), homophonic or polygraphic ciphers (Playfair, HillCipher).

I interested what methods would you use (Kasiski, Friedman, what else) and why and in what order to make the attack the most efficient (Friedman first?)


texts: Why is x^8 + x^4 + x^3 + x + 1 used in AES's Rcon?

texts:
I am not familiar with field theory so please bear with me if this is obvious to you.

I was wondering why this particular reducing polynomial
$x^8+x^4+x^3+x+1$ is picked for AES' Rcon. Can't it be some other polynomials?


texts: Is there a way of getting the nth random number from a particular seed run in ISAAC?  i.e. one day run a selection of 256 numbers and the next day run from the 256th number to get the next 256 random numbers?  I presume no as I haven't been able to and I've tried everything I can think of but there may be a mathematical solution.