texts: Comparing Files: Is it better to use multiple hash algorithms or just one?

texts:
I'm looking to compare (for byte-for-byte equality) two binary files.

I already have the process down:

Check for existence etc.
Compare file lengths
Use a hash or CRC of a sort (right now I use MD5) to look for an obvious inequality
Finally, byte-for-byte compare them (I have a way of doing this in chunks to speed it up).

Note: the last bullet means I am fully aware of, and prepared for, collisions. I am aware that two identical hashes does not imply equality, but two different hashes confirms inequality.

Here are my thoughts on this so far:

The MD5 function I'm using just takes a file stream and gives me the results. I'm a crypto noob so I don't know much about this algorithm, but if there are random reads and writes (totalling a fraction of the file size) this would likely be much faster than reading in the whole file, or using its ComputeHash(byte[]) overload. That means it would be much faster than reading the file for the byte-for-byte comparison
On the other hand, to make a hash that's based very strongly on the file's contents so that one small change has a good chance of changing the hash, I would think it would need to read a good chunk of the file, so maybe this isn't much faster.
The point with the thoughts above is this: if the hash computations for (weak) comparison are significantly faster than the raw comparison, then it appears it would be worth using multiple different hash algorithms before the raw comparison may be necessary. But is this true?

My particular application: These are small (a few KB) binary files I have a user upload to an app we host on our network. If it's different than our network copy I want to force them to update our network before they can do things with it. However, I don't want to limit my function to this application, but learn how far it may go with others.

Now all I'm wondering is this: Is it better to use multiple hash algorithms to do such a comparison?

Bonus Points: If you think I could be using different algorithms for speed, feel free to recommend.


texts:
In the section 3 (page 44) of the book "Post Quantum Cryptography", it says:

  Then each one-time signature key must be generated twice, once for the MSS public key generation and once during the signing phase.

Also defined $\text{PRNG}$: $\text{Seed}_{\text{in}} \rightarrow (RAND, SEED_{\text{out}})$, where $\text{RAND}$ is a random number.

Finally, it describes an example of MSS + W-OTS. Here, $\text{SEEDOTS}_j$ is used to generate signature key $X_j = (x_{t-1},...,x_0)$ where $x_i$ are generated on $(x_i, \text{SEEDOTS}_j)=PRNG(\text{SEEDOTS}_j)$.

My question: How is possible generate  the same key for public key generation and during the signing phase, for each one-time signature key, if $x_i$ is random (by definition of $\text{PRNG}$)?


texts:
I have a question about mutual agreement to decode a file

How could you choose to decode a file only if more than half the people present (let's say 6 out of 10 ) say Yes.

And there is only one key, in what form should the key be stored.


texts:
I have a third-party point-of-sale API (Speedflow Pay-N-Get) that I am trying to communicate with over HTTP, but I have a problem with it.

In a nutshell, a request is encrypted using RSA, and the response is encrypted using RSA followed by Rijndael/AES-128.  The RSA keys are provided by the vendor, the AES IV is a vendor-provided guid, and the AES key is the vendor-provided guid and a random requester-generated guid combined using "serial concatenation".  The random guid is included as a parameter of the request.

I am using OpenSSL to handle the encryption/decryption.

I have everything working except the AES portion.  I have no clue what "serial concatenation" is, online searches do not find any useful info about it, and the vendor has not replied yet.  Does anyone know what this is?

Update: Here is what the API doc says about the AES portion of the encryption:

  The server response — EDATA data in the body of the HTTP response.

  Formula: EDATA = Base64(Rj(RSA1(DATA)))

  Rj — symmetric algorithm Rijandel-128

  IV — Guid # 1 value, converted to a byte array

  Key — value Guid # 1 and Guid # 2 (serial concatenation)

  mode spacing — Zeroes

Also:

  -----Decryption.-----

  RSA (AES ( BASE64( response ) ) ),

  where RSA - RSA- private-key encryption

  AES - Symmetric key encryption

  response – server response

  -----AES-----

  use bouncyCastle: cipher= PaddedBufferedBlockCipher ( CBCBlockCipher ( RijndaelEngine(128)),
  ZeroBytePadding() );

  cipher.init (false, ParametersWithIV ( KeyParameter ( mykey ), iv )
  );

  where mykey- coding in hex string guid3

  iv- concatenation coding in hex string guid3 and coding in hex string guid2

  Encoding is performed on this algorithm by taking two character of a string is converted to hex and added to an array of bytes.

Guid#1 is the vendor-provided Guid, Guid#2 is the randomly generated Guid.  Both are included in a request.  I suspect the second paragraph actually meant the IV is Guid3 and the key is the concatenation of Guid3 and Guid2.  Guid3 is just Guid1 with its first 3 fields converted to big endian.

Since an AES-128 key is only 16 bytes in size, and a Guid is also 16 bytes in size, I suspect that "serial concatenation" would be somehow hashing them together, rather then simply appending them to each other, which would produce a 32-byte key instead.


texts: What is the purpose of the finite state machine in SNOW?

texts: I do not know about SNOW 1.0, but SNOW 2.0 and SNOW 3G have a finite state machine that is used in generating the cipher's keystream output. Why use a finite state machine instead of some kind of filter function?


texts: Security of RSA for padding $\texttt{0x00|message|random_bytes}$

texts:
I've read this and this but I'm not understanding why padding a message with a simple random is not secure.

For example, consider a 256 bytes modulus. We can agree that the first byte from the message is 0x00, the next $n$ bytes are the message itself and the next $m$ bytes are random bytes. We have that $1+n+m=256$. The message is then encrypted with RSA. When decrypted, one can remove the first byte and the last $m$ bytes.

The first bytes 0x00 ensures that the message is less than the modulus and the last $m$ bytes will guarantee a probabilistic encryption.

Why isn't this secure?


texts: Dan Boneh's explanation of why Davies-Meyer requires the final step of XOR with the previous Hash

texts:
This is from this video
https://www.coursera.org/learn/crypto/lecture/XZt5V/constructing-compression-functions
At 2:44, Dan Boneh explains why the XOR is required.
This is his explanation
m - message to be hashed
H - output of previous hash (chaining input)
h - hash function
E - Encryption function
D - Decryption function
h(H, m) = E(m, H)
(instead of h(H, m) = E(m, H) XOR H )
You can choose a random H, m & m' & construct a
H' = D(m', E(m, H))
which will give you a collision for m & m'
He says that the Decryption will cancel out the Encryption which will result in the collision.

Can someone explain how?
Why is he allowed to choose H'? Shouldn't you be allowed only to choose m' for an attack? Why do you get to choose H' also?

IMP: I have read other explanations for why the XOR is needed & I am convinced also.
However, here I am trying to understand Dan Boneh's explanation.


texts:
I'm designing a small personal journal web application for my wife. I'm a crypto newb, but I want her to feel secure knowing only she will have access to her journal entries. I am thinking of the following scheme to achieve this using the Web Crypto API:

User registers. A masterKey is generated and wrapped (using AES-KW) using a PBKDF2 derived key (masterKeyWrapKey) from the user's password and a random salt, masterKeyWrapSalt. We now have wrappedMasterKey. wrappedMasterKey along with masterKeyWrapSalt is sent the server for storage. When changing passwords, we simply perform the previous steps with the new password, re-using masterKey instead of generating a new one.
User logs in. Their password is hashed (yet to determine which hash to use) on the client side and sent to the server, so that the server doesn't get to use it to derive the masterKeyWrapKey. The hash used here must be different than the one used to generate masterKeyWrapKey, otherwise we'll just be sending the key to unwrap wrappedMasterKey to the server on each log in.
Upon successful logging in, the server sends the user's wrappedMasterKey and masterKeyWrapSalt. We use PBKDF2 against password and masterKeyWrapSalt to derive unwrapKey and use that to unwrap wrappedMasterKey, getting back our masterKey.
The user can now encrypt and decrypt their journal entries using their masterKey. I am planning on using AES-256-GCM with a 96 bit random IV produced from Crypto.getRandomValues(). Given the amount of posts there's likely to be, I don't think I need to worry about an IV collision.

It sounds pretty safe to me I'd love to hear what people in the know think. I've read that one should never implement their own encryption ANYTHING, but the temptation is strong.. especially on such a small project.
Edit to add information:
PBKDF2 was chosen as it is the only password based key derivation function available in the Web Crypto API - I want to avoid dependence on any external crypto libraries.


texts: ECDSA signature verifiable 1-way transformations

texts:
Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$).

I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$) is.

Is there a transformation I can apply to ($r$,$s$) to yield a new signature ($r'$,$s'$), such that someone who knows the original message and Alice's public key can see that it was derived from an original signature (without being able to reconstruct it)?

I'm thinking multiplying both the public key and signature components by some large number mod $n$. Am I on the right track or is this a fool's errand?


texts: How is the security of a plaintext of Ring-LWE without an error term?

texts:
I think until public key $\mathsf{pk}=(b=-[as + e]_q,a) $ is broken, Ring-LWE is secure where $a$ is uniformaly random polynomial, $e$ is an error sampled from gaussian distribution with std=$\sigma$ and mean $\mu$=0, and $s$ is a secret key of hamming weight $h$.

$\mathbf{Question }$

Why is error needed for encryption?

A some Ring-LWE based homomorphic encryption schemes encrypts a message $m$ as  $\mathsf{ct}=([m+e_0+bv]_q,[av+e_1]_q)$ where

$q$: ciphertext space

$v$: uniformly random small polynomial

I wonder why $m+e_0+bv$ part needs $e_0$.
I think m+$bv$ is already uniform because $bv$ looks uniform.
So gaussian elimination cannot work here, isnt't it correct?


texts:
we have learned Diffie-Hellman, RSA and DSA (Digital Signature Algorithm) in university.

Because DH is vulnerable of Man-in-the-Middle we had the task to program the DH combined with RSA to protect it against MitM. Now I have seen an earlier exam, in which the prof asked to construct a procedure with DSA to protect DH against MitM.

How is this possible? I have really no idea how I can use DSA to protect DH against MitM. Anyone of you can help me?


texts:
I have this question which gives me q=71(my prime number) , a=7(generator), Yb=3(public key), m=30(message), c1=59(first cipher text) and he wants me to find c2 (second cipher text)
I know  that c2 = rM (r:one time key) , which means I have to find r=Y^k or r=c1^x but I dont have k nor x. The only solution is to solve the DLP is there any solution beside this?


texts:
Is it feasible to build a cipher (or hash) out of GPU or DSP primitives (e.g. big matrix multiplication, Fast Fourier Transform, big block SIMD, or hardware H.264/AVC codec)? Preferably those are slow to run on conventional CPU but a lot faster on GPUs and DSPs.

So if such a GPU or DSP-based cipher or hash is feasible, is there any examples or learning resources for a beginner?


texts:
Is the TLS protocol secure against VM reset attacks?

Background: Imagine running cryptographic software inside a virtual machine (VM).  A VM reset attack is one where the the state of the software is checkpointed (snapshot) at one point in time, allowed to run forward, and then reset (rolled back) to the previous snapshot and run forward some more.  In some cases, this allows powerful attacks.  There exist protocols that are secure in the standard model, but not secure against VM reset attacks.

So, is TLS (as a protocol) secure against this kind of attack?  Are there are any attacks?  Are any of the TLS ciphersuites vulnerable to VM reset attacks?

Prior work:  Ristenpart et al. showed that some TLS implementations are vulnerable to VM reset attacks, in the following paper:

Thomas Ristenpart and Scott Yilek.  When Good Randomness Goes Bad: Virtual Machine Reset Vulnerabilities and Hedging Deployed Cryptography.  NDSS 2010.

However, their attacks are all against particular implementations of TLS, and exploit failure to reseed the RNG.  In other words, they seem to represent a failure of the implementation rather than of the protocol itself.  It appears that a sufficiently careful implementation can shield against those attacks by adding additional entropy to the PRNG at appropriate points.

My question is: are there any protocol-level VM reset vulnerabilities in TLS?

Threat model: Here is a more detailed threat model.  The software runs inside a VM.  The attacker can freely interact with the software over the network, as usual.  Also, the attacker gains two additional powers: at any point, the attacker can save a snapshot of the current state of the VM; and at any point, the attacker can roll the VM back to some prior snapshot and then cause it to continue execution from there.

It is easy invent protocols that would be secure in the standard model but insecure in this model.  For instance, imagine a protocol that generates an ephemeral keypair $K_A,K_A^{-1}$ for a one-time signature scheme, signs the ephemeral public key $K_A$ with a long-term RSA signing key, receives some message from the attacker, and then signs some message using the ephemeral signing key.  In the standard model, this would be as secure as using a RSA signature.  But in the VM reset model, this is insecure: an attacker could snapshot the system right after it generates the ephemeral keypair, let it run forward to emit one message signed by the ephemeral private key; then roll it back to the snapshot and run it forward from there, observing a second message signed by the same ephemeral private key.  Once the attacker observes two messages signed by the same one-time private key, the attacker can forge other messages.  So that's a proof that protocol-level VM reset vulnerabilities can exist.  But is the TLS protocol vulnerable?


texts: Can AES-NI be used to accelerate asymmetric encryption?

texts: AES-NI optimized processors can be used to accelerate AES, which is a symmetric crypto. Can it also be used to accelerate asymmetric crypto?


texts: Alice has two 1GB files, and Bob wants one without Alice knowing which. Can this be done with less than 2GB (1GB for each file) of bandwidth between Alice and Bob?


texts: Can I work around these padding issue in AES 256 ECB due to Reed solomon encoding?

texts:
Disclaimer: I do NOT believe AES-ECB to be at all useful for encryption. That said, due to time and bureaucratic issues that I'm not in control of, I need to use AES-ECB.

I get packets of data that are Reed Solomon encoded. Each reed solomon encoded packet has length 255 bytes. On decoding, I get the message which is 223 bytes. (This is RS(255,223) with 8-bit symbols. Each codeword contains 255 code word bytes, of which 223 bytes are data and 32 bytes are parity).

I must now encrypt this data (223 bytes) and then RS encode it again to get back a packet of 255 bytes. However, when using AES ECB in block cipher mode, a byte of zeroes has to be padded in before encryption.

This padding yields a ciphertext that is 224 bytes long. This can't be RS encoded as the packet is required to be 223 bytes.

I realize that hoping this can be solved with a block cipher might be impossible, but any help or workarounds would be really appreciated!


texts: What does "sequential memory-hard" mean?

texts:
I found this term in Scrypt's paper.  I have several questions about its meaning, ranging from how to parse it, to theoretical bounds:
Q1: How to parse it?

Is it read (sequential memory)-hard?
Or sequential (memory-hard)?

Q2: What does it mean?

Does it mean that as space is linearly reduced, then penalty is that is exponentially increased?
Can we tell what is that exponent?  Or does suffice to simply be an exponent, regardless of which exponent?
In current practice, can we say something more specific about what that exponent for state-of-art functions beyond just "it's exponential"?  I think it is within reach to make more specific claims.
Ideally, is there any theorem that shows an upper bound for this exponent?  E.g. can we say, for every reduced single unit of memory, amount of computation performed doubles?  Tripples? Quadruples? ...?

Q3: Any better name?

Is the name used in Scrypt's paper still the most accurate name?
Is there a better name for it that the cool kids like to use nowadays more?  In Argon2's paper, as well as Here, it seems to be called memory-hard.  Does it mean that memory-hard is the better name to adopt?  E.g. what do the coolest gurus in top cryptographic journals tend to use?
Optional: any reason the Scrypt paper didn't call it memory-hard?  Or was it just the randomness of life?

Appendix
I did look at previous related answers, and I found these:

This only asks about such functions in relation to another function.  Thus doesn't dig deep into what such functions are in themselves.
This only asks about the motivations of such functions.
This asks whether his function is a good one among such functions.


texts: Help defining a shift cipher mathematically

texts:
For an assignment question, I am trying to prove formally that double encryption with two keys by the shift-cipher encryption function results in a shift cipher as well.
If the Shift-cipher encryption function is defined as:

$E_K(M)= (M + K) mod 26$

and suppose that we let $M = (x_1, ... , x_{m-1}, x_m)$ = an arbitrary but particular message of length m, where each element of M is a is an integer element of $Z_{26}$, and we pass M into the encryption function, resulting in:
$(x_1 + K_1, ... , x_{m-1} + K_1, x_m + K_1) mod 26 = (y_{1}, ... y_{m})$ , where  $1 \leq i \leq m,  y_i \in Z_{26}$ .

Then my question is: what is it that makes $(y_{1}, ... y_{m})$ a shift cipher? And how is this generally expressed formally? When I know this I will be able to show that encrypting $(y_{1}, ... y_{m})$ also results in a shift cipher.

Right now all I can think of is that it is a shift cipher if it is a string where the index of each element is a number from 0-1, that was acquired by adding the index of each paintext element to the index of the key. Can anyone help clarify things for me?


texts:
I’m curious if there’s a zero-knowledge protocol for the following. Suppose a Passer-by is stopped by a Vigilante who has a list of wanted criminals. Can the Passer-by prove he has a valid ID and he’s not on the list without disclosing his identity?

Assume the ID is a bunch of data signed by an authority in some way, anticipating just such a situation (this authority values liberty very much). Vigilantes must do no better than chance to distinguish between non-wanted Passers-by after arbitrarily many rounds of the protocol.

It’s also interesting if this is possible without the Passer-by learning the contents of the list.


texts: TLS 1.3 Secure Renegotiation not supported

texts: I get the message "Secure Renegotiation IS NOT supported" if a TLS 1.3 cipher will be chosen at a TLS handshake with openssl s_client. Since TLS 1.3 does not support renegotiation at all I assume that this message can be ignored. Is my assumption correct?


texts:
I am wondering if there is any reason to regularly update cryptographic keys, that are used for authentication purposes in a real-time system.

A key should be updated if it is weak, broken, compromised, or leaked. Another valid reason would be a weak authentication scheme. For instance, CBS-MAC is prone to message forgery in case messages of different length are authenticated using the same key. AES-GCM with the same IV is careless if the same key is used.

As Swashbuckler pointed out, block ciphers leak information and therefore, encryption keys should be updated. With regard to authentication, I do not see such a reason, because there is no confidential data and even if the adversary observed a collision, he could not learn the key (in most cases).

Key updates, hence, do not give any benefit from a pure security point of view if a strong cryptosystem is deployed. Do I oversee something?


texts: Difference between second pre-image resistance attack and collision attack

texts:
According to my understanding of hashing algorithms -:

Collision attack is an attack wherein we have a hash(x) and we try to find hash(y) such that x!=y while hash(x)=hash(y).

Second pre-image resistance is where we have a message x and a hash(x) and try to find another message y such that hash(x)=hash(y).

According to me the collision attack and second pre-image resistance attack seems similar as in the case of both, we need to find two different hashes which are same while the message associated with the hash is completely different.


texts: How far into the future is AES considered secure?

texts:
I've looked at NIST documents and done many Google searches, but I can't find an answer to this seemingly simple question.

I am storing data on harddrives, encrypted with AES-XTS 256 bit. Some of this data has a long lifetime, i.e. will still be valuable to an attacker and not good to lose into the future.

My scenario is that a harddrive could be lost today, and while the AES encryption is unbreakable today, how about in 20 years? 30 years? An attacker could keep it or find it in the future and use an not-yet-known attack to break it. Of course this is guesswork, my question is if there is an "official guess" from the NIST or someone else that I can quote and that says "we consider AES-256 secure until at least 2030" or some such.


texts: Elliptic curve ed25519 vs ed448 - Differences

texts: Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?


texts:
Alice and Bob are playing Rock-paper-scissors.

Alice chooses $a \leftarrow\{stone, paper, scissors\}$ and a nonce $R_A$ used as symmetric key for encryption

$$A → B : A, R_A(a)$$

Bob chooses $b \leftarrow\{stone,paper, scissors\}$ and nonce $R_B$

$$B → A : B, R_B(b)$$

$$A → B : A, R_A$$

Now Bob decodes $R_A(a)$ and knows a and so he knows who is the winner

$$B → A : B, R_B$$

Now Alice decodes $R_B(b)$ and knows $b$ and so he knows who is the winner

What are the possible fraudulent behaviours the players could engage in?


texts:
I'm trying to understand the construction of the division polynomials used in Schoof's algorithm. I firstly followed this report of Charlap and Robbins.

I stuck with the definition of the leading term p11.

I'm also reading this book, which does the construction also in characteristic 2. However I have the same problem here.

I'm not able to use the definition in order to computer the leading coefficient of a rational function. However the construction of division polynomials needs me to compute the leading coefficients of the rational function which multiplies a point by m.

Can anybody give me an explicit example of how to compute the leading coefficient?


texts: How can non-nothing-up-my-sleeve numbers be used to exploit an algorithm?

texts:
I was watching Computerphile's "Magic 'Nothing Up My Sleeve' Numbers" video where Dr. Mike Pound reasons that the numbers used to create cryptographic functions should not arouse suspicion or contain hidden properties, because doing otherwise would introduce vulnerabilities into the algorithm.

I'm having difficulty conceptualizing how a nefarious agent, N, would exploit numbers that fail to satisfy the nothing-up-my-sleeve criteria.

The scenario I have in mind goes something like this: N proposes numbers for the basis of a cryptographic function, numbers that contain hidden properties that only N knows about. N goes away on vacation and when he returns to the lab, he finds his team has created a cipher in his absence; he wasn't there for the processes that followed, but what he does know is that his numbers laid the foundation. (I realize the case is probably naive, but hopefully it shows the bridge that I'm trying to build between non-nothing-up-my-sleeve numbers and exploitation.)

How would N's knowledge of what's hidden in these numbers allow him to attack the cipher? How would such an attack play out?


texts: Is there an application of fully homomorphic encryption scheme such that encryption key and evaluation key are different?

texts:
I want know if there is an application of FHE contains three kinds of users such that:

$A$ is the data owner and she has the secret key.
$B$ only has the permissions to encrypt (just like a general user).
$C$ has the permissions to both encrypt and evaluate (just like the cloud or other servers)

Dose this kind of application of FHE make sense? And it is under the condition that encryption key and evaluation key are different. However, I haven't seen the application like this.


texts: Going through the wiki for modes of operation I see that the section error propagation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. If the second plaintext block is decrypted wrong, then why would it not impact the third block?


texts: How can I prove that the plaintext of an elgamal ciphertext is the discrete log of an element?

texts:
Is there any (efficient) method to prove that the plaintext of an ElGamal ciphertext is the discrete log of an element?

In the scenario I concerned, I have an El Gamal key pair $(pk, sk) = (g^y, y)$. How can I prove that $m$ in the ciphertext $c = (g^x, mg^{yx})$ is the discrete log of $g^m$ (could be other bases like $h$, $h^m$) to other people who only have $pk$ without revealing m (i.e., in zero-knowledge proof of knowledge)?

Note that other people (verifier) already have the element $c = (g^x, mg^{yx})$ and $g^m$ (or $h$ and $h^m$).


texts:
Unfortunately I have to implement some naive homemade symmetric crypto, since ordinary AES CTR is not implemented in available API on target platform.

What I’m going to do is, given encryption password and plaintext bytes, generate “encryption key” from password via PBKDF2/RFC 2898 with length of plaintext, and then XOR this “gamma” against plaintext bytes.

Could you please criticize this approach and enumerate vulnerabilities and issues?


texts:
I encountered today the following equation:

$x = 2^n + x'$, where $0 \le x' < 2^k < 2^n$, $2|k$ and $n, k$ is known.

There seems to be a meet in the middle attack for this, with runtime $O(2^{\frac{k}{2}})$ but I don't see it.

$x$ is known and we want to recover $x'$.

Could anyone give me a hint?

Thanks.


texts: Can quantum computers put computer security in jeopardy?

texts:
There are many articles about quantum computers describing how powerful they are in computing and that they can solve very complicated equations in a short time.
One of the biggest security measures that provide safety for computer security is that sometimes it takes years to break a piece of encrypted data.  Will this safety remain after a quantum computing revolution?
The question is:

Can they do such complicated computing?
Is it possible quantum computers put computer security in jeopardy?


texts: Why is "semantically secure" important for cryptosystems?

texts:
The first question: what is the exact definition of semantically secure?
Basically, a cryptosystem is semantically secure if given the public key and the ciphertext, an adversary cannot learn any partial information of the plaintext.

However, the above statement is quite vague to me. For example, what does it mean by "partial information"? And how to prove that a cryptosystem is semantically secure by showing that no partial information can be learned?

I came across some security definitions (such as IND-CPA) that imply semantic security. Then how to show that the above notion of security (e.g. IND-CPA) implies semantic security?

Then the second question: why is semantic security important?

I came across many cryptosystems ( mostly homomorphic encryption schemes) requiring semantic security. So, why is it important?

A counter example is RSA, which is not semantically secure. But it is so widely used.


texts: Can you give me an example of any PKC encrytion algorithm with coins?

texts:
I'm reading a Definition of Public Key Encryption and here say:

  ...
  Enc is a (possibly) probabilistic polynomial time encryption algorithm which takes as input a public key $pk$, a $m\in M$ and random coins $r$, and outputs a ciphertext $c\in C$.

But in other papers, there is no mention of coins $r$.

Can you give me examples of PKC  encrytion algorithms with coins?


texts: How to reverse this simple xor encryption function?

texts:
this code decrypts encrypted rom code from an arcade game pcb (it is from source code of Mame emulator)

for each byte in rom...

int src, dst;
src = 0xd7;    // example value
dst = 0;
if (( src & 0x01) == 0x01) dst ^= 0x04;
if (( src & 0x02) == 0x02) dst ^= 0x21;
if (( src & 0x04) == 0x04) dst ^= 0x01;
if ((~src & 0x08) == 0x08) dst ^= 0x50;
if (( src & 0x10) == 0x10) dst ^= 0x40;
if (( src & 0x20) == 0x20) dst ^= 0x06;
if (( src & 0x40) == 0x40) dst ^= 0x08;
if ((~src & 0x80) == 0x80) dst ^= 0x88;

result (dst) = 0x3c

how do I reverse this scheme, such that I can get back to 0xd7 from 0x3c?


texts: Converting a number to a member of a multiplicative cyclic group

texts:
I am currently trying to make an implementation of the ElGamal encryption for educational purposes. As I understand it, when using the encryption with multiplicative cyclic groups, one generates a cyclic group for a safe private key as follows:

Find a safe prime number $p$ (of the form $p = 2*q + 1$ where $q$ is prime)
Find the generator of a cyclic group with order $q$ and modulo $p$ (i.e. a number $g$ less than $p$ such that $g^q \mod p = 1$ and $g^2 \mod p \neq 1$)

For example, for $p = 11$, we'd have $q = 5$, $g = 3, 4, 5$ or $9$, and the cyclic group would have the elements {$1, 3, 9, 5, 4$}.

Then, during the encryption stage, the one performing the encryption should convert $m$, the number representation of the message, into $m_1$, a member of this group. How is this done if $m$ doesn't belong to our group (for example, if it is $2, 6, 7, 8$ or $10$)?

If I am missing something, please tell me what did I get wrong!


texts: What can a master password also be called?

texts:
When having a company computer that is full disk encrypted, it is common that the boss have a master password / backdoor, so the data always can be decrypted.

I have heard some call this for "scrow" or something similar.

Does anyone know the correct name?


texts: Isomorphic curve vs isomorphic curve group

texts:
It is said that if two elliptic curves $E_1, E_2$ defined over a finite field $K$ are isomorphic, then $E_1(K), E_2(K)$ groups are also isomorphic. But the converse is not true. Now,

By definition, when $E_1, E_2$ are isomorphic over $K$ then $E_1$ can be transformed to $E_2$ by admissible change of variables. If I am not wrong, this implies that a point $P$ on $E_1$ is transformed to a point $P'$ on $E_2$.
If $E_1(K), E_2(K)$ groups are isomorphic implies that there exist a bijective map between the two groups where the elements are points. So, the points are mapped again.

Since we are interested in the curve groups so, does it matter whether one take isomorphic curve or isomorphic group? Similarly, I don't understand what are the advantages of 1. over 2.?


texts: Why hash the message before signing it with RSA?

texts:
The diagram below illustrates the process of digitally signing a message with RSA:

As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the full message.

Why hash the data before signing it? Why not sign the whole message? Of course, it'll save time if you sign just the hash value, but I've heard there are also security issues with directly signing the full message. If so, what are they?


texts: Symmetric cipher speed (AES vs Camellia vs Twofish)

texts:
If I have understood correctly, Twofish is more secure (harder to break) than AES and Camellia, but it's slower than both.

How can I measure the speed difference between AES vs Twofish and Camellia vs Twofish? Does Twofish use twice as much time? Half as much time? Or does it just take a few percent longer to encrypt/decrypt than AES/Camellia?

I'm in the starting/planning phase of software development: the local stored data will be encrypted, and the data to be transmitted over a network will be encrypted/signed. I would like to use Twofish as the symmetric cipher, but if it uses twice the resources of AES/Camellia, then it's not a good idea.


texts: Two different approaches for Key Expansion using the AES-256 algorithm?

texts:
I am implementing AES 256-bit Algorithm from the Theory given in the book, "Cryptography and Network Security" by Behrouz A. Forouzan.

The Algorithm described in the Book in relation to Key Expansion, defines AddRoundKey like this:

From the given 32-Bytes Cipher Key, I am supposed to generate 4 * (Nr + 1) words. Nr being the number of rounds which is equal to 14 in 256bit AES and each word is equal to 4-Bytes.

So, according to the equation, 4 * (Nr + 1), We have total 4*(15) = 60 Words to be generated. Those 60 words are w[0],w[1],w[2],w[3],…,w[59]. The first 8 words would be generated directly from the given 32bytes cipher key:

w[0] = First 4Bytes of Cipher key
w[1] = Next 4bytes of Cipher Key
w[2] = Next 4 bytes of Cipher.
…
w[7] = last 4-bytes of Cipher key.

The remaining words (w[8] to w[59]) would be generated according to the following Formula:

If, i mod 8 is not equals to 0 and i is the word number from 8 to 59

    W[i] = W[i-1] ^ W[i-8]
    ; ^ = XOR Operation

else

  W[i] = t + w[i-8]

where t equals to, SubWord(RotateWord(W[i-1])) ^ RCon(i/4). If i mod 4 = 0, but imod8 is not equals to 0 then, W[i] would be W[i] = SubWord(W[i-1]) + W[i-8] After the above algorithm is implemented, It is quite easy to calculate AddRoundKey.

But Wikipedia's "Rijndael key schedule" article has a totally different method of calculation which I am unable to understand. They use different techniques, and there are few Constants like n and b, which weren't mentioned in the book, nor are they mentioned anywhere else. Yet, Wikipedia's Algorithm is using them.

I would like to know the difference between the AES256 algorithm presented in the book and the AES256 article on Wikipedia. Can you explain and/or help me understand why there are two different approaches for Key Expansion in relation to the AES-256 algorithm?


texts: Doubt about the possible attacks on HMAC

texts:
I have a question about the security of HMAC:

If I know the value of the seed and the value of the HMAC but I don't know the key then I can't do the birthday attack because I can't generate an authentic message. I must see at least $2^{\frac{n}{2}+1}$ messages to have 50% of probability to find a collision.
But what happens if I have the seed, the value of HMAC, and the key?


texts: How to implement GSW13 using Helib or SEAL?

texts: I want to implement the homomorphic encryption scheme proposed in GSW13, and make some changes to it, but seems that there is no library that has already been implemented it. Since this is a homomorphic encryption scheme based on LWE, both Helib and SEAL have implemented some other LWE-based homomorphic encryption algorithms. I want to ask if I can use one of these two libraries to generate the public and private keys in the form required in the GSW13? And would tell me based on these two libraries, how to implement the of GSW13？


texts: What do we gain from hashing the length in Merkle–Damgård?

texts: Assuming our fixed compression function $h$ works for inputs of length $i(n)$ and output strings of length $o(n)$, if $2o(n) < i(n)$, why do we need to calculate $h(z_B||L)$ where L is the input's length instead of just concatenating $z_B ||L$? What do we gain from hashing the length?


texts: Hill cipher. Any way around the not invertible matrices

texts:
Question: The plaintext JULY is encrypted using Hill Cipher with m = 2, to give the ciphertext DELW, then determine the encryption and decryption matrix

My approach: We will form a 2x2 matrix of plaintext and ciphertext elements after converting them to decimals with mod 26. And then we will try to find the key by inverting the plaintext matrix and multiplying it to ciphertext as shown below
\begin{gather}
Plaintext [P] = \begin{bmatrix}9&20\\11&24\end{bmatrix}
\end{gather}
\begin{gather}
Ciphertext [C]= \begin{bmatrix}3&4\\11&22\end{bmatrix}
\end{gather}

\begin{equation} \label{3.1}
[P] [K]= [C] \\
[K] = {[P]}^{-1}[C]
\end{equation}

Here (|P|) % 26 is equal to 22. And because gcd(22,26) $\neq$ 1, the value of $\frac{1}{22}$ cannot be determined in $\bmod 26$. Which makes me unable to find the key $[K]$. So my question is there any way around to solve this problem. Or have I committed any mistakes or overlooked anything?


texts: How to deliver an encrypted message to multiple recipients without revealing keys

texts:
Let's say I have generated a private and a public key. I create a message and encrypt it with the public key. I deliver this encrypted message and a private key to multiple recipients.

Why would I do this?

I want to be able to deliver a message that can only be decrypted. I don't want anyone to be able to encrypt a dummy message and deliver this to all recipients with them assuming it was from me.

I think I am on the right track using RSA - but somehow I need it all in reverse.

Also, if I give people the private key, and I keep the public key safe, am I right in believing that it's possible to generate a new public key just using the private key itself?

Let's take an example of my problem.

I create an encrypted message using my public key:

ajjfjdksdjkdfjfjdjfd (made up example).

The end user decrypts it using the private key to:

green:1234:table

All good so far. The above message and be authenticated very basically checked for the three strings within a ":".

However, as these encrypted messages could be from untrusted sources, I want it impossible for any untrusted source to be able to create these messages since they know the simple format. I don't want the key I provide be enough for them to reverse engineer the public key.

I am finding it hard to explain, I am hoping that this can be answered.


texts: What is the "Random Oracle Model" and why is it controversial?

texts:
What is the "Random Oracle Model"?  Is it an "assumption" akin to the hardness of factoring and discrete log?  Or something else?

And why do some researchers have a strong distrust of this model?


texts: Proof that Alternating Step Generator and modifed ASG' have equivalent security?

texts:
The Alternating Step Generator (ASG) is a PRNG combining 3 LFSRs. Output of the ASG is the XOR of the output of two clock-gated LFSRs. At each step, a single one of these LFSRs is clocked, according to the output of the control LFSR.

The best (AFAIK) claimed attack on the ASG is Reduced Complexity Attacks on the ASG (Slides). However it attacks a variant ASG', which output is the output of the clock-gated LFSR that was clocked.

Justification given in that paper is: It is known [13, 8, 12] that instead of working with the original definition of ASG we can consider a slightly different description (..).
[13] only states It is not hard to show that ASG and ASG’ are equivalent (..) with no argument. I fail to find a discussion about ASG' in [8]. [12] has a constructive proof, but I fail to get it (unless I assume that one of the LFSR is known/enumerated).

Any clue on a proof/sketch/argument that an attack on ASG' reconstructing the initial states of the LFSRs can be turned into an equally efficient attack on ASG?


texts: CBC-MAC length extension attack with IV simulation

texts:
I'm doing the Cryptopals challenges (formerly the Matasano challenges) and struggling with second part of the 49th problem where I'm asked to do the length extension attack with CBC-MAC without IV manipulation. There is a hint that I can simulate an IV somehow to do this but I don't understand. Can someone drop me some hint at least? I did the part with forging the first block of the message with changing the IV.

In particular there is a message format like this

  from=#{from_id}&tx_list=#{transactions}

With the transaction list formatted like:

  to:amount(;to:amount)*

The task is: capture a valid message from target user. Use
length extension to add a transaction paying the attacker's account 1M
spacebucks.

EDIT
Alright, as I failed to explain it properly with my own words, here is the original problem

49. CBC-MAC Message Forgery

Let's talk about CBC-MAC.

CBC-MAC is like this:

  1. Take the plaintext P.
  2. Encrypt P under CBC with key K, yielding ciphertext C.
  3. Chuck all of C but the last block C[n].
  4. C[n] is the MAC.

Suppose there's an online banking application, and it carries out user
requests by talking to an API server over the network. Each request
looks like this:

  message || IV || MAC

The message looks like this:

  from=#{from_id}&to=#{to_id}&amount=#{amount}

Now, write an API server and a web frontend for it. (NOTE: No need to
get ambitious and write actual servers and web apps. Totally fine to
go lo-fi on this one.) The client and server should share a secret key
K to sign and verify messages.

The API server should accept messages, verify signatures, and carry
out each transaction if the MAC is valid. It's also publicly exposed -
the attacker can submit messages freely assuming he can forge the
right MAC.

The web client should allow the attacker to generate valid messages
for accounts he controls. (Feel free to sanitize params if you're
feeling anal-retentive.) Assume the attacker is in a position to
capture and inspect messages from the client to the API server.

One thing we haven't discussed is the IV. Assume the client generates
a per-message IV and sends it along with the MAC. That's how CBC
works, right?

Wrong.

For messages signed under CBC-MAC, an attacker-controlled IV is a
liability. Why? Because it yields full control over the first block of
the message.

Use this fact to generate a message transferring 1M spacebucks from a
target victim's account into your account.

I'll wait. Just let me know when you're done.

~ waiting ~

~ waiting ~

~ waiting ~

All done? Great - I knew you could do it!

Now let's tune up that protocol a little bit.

As we now know, you're supposed to use a fixed IV with CBC-MAC, so
let's do that. We'll set ours at 0 for simplicity. This means the IV
comes out of the protocol:

  message || MAC

Pretty simple, but we'll also adjust the message. For the purposes of
efficiency, the bank wants to be able to process multiple transactions
in a single request. So the message now looks like this:

  from=#{from_id}&tx_list=#{transactions}

With the transaction list formatted like:

  to:amount(;to:amount)*

There's still a weakness here: the MAC is vulnerable to length
extension attacks. How?

Well, the output of CBC-MAC is a valid IV for a new message.

"But we don't control the IV anymore!"

With sufficient mastery of CBC, we can fake it.

Your mission: capture a valid message from your target user. Use
length extension to add a transaction paying the attacker's account 1M
spacebucks.

HINT:

  This would be a lot easier if you had full control over the first
  block of your message, huh? Maybe you can simulate that.

Food for thought:

  How would you modify the protocol to prevent this?


texts: Dining-Cryptographer Net (DC-Net) Scheme that Handles Collisions?

texts:
[Question edited at the request of Mods]

I recently became fascinated with the elegant and simple solution that Chaum proposed for the Dining Cryptographers problem. If you are unfamiliar, please checkout Wikipedia for a summary and solution.

What is interesting is that DC-Nets allow for participants in a group to share messages to the rest of the group anonymously. Wow! But there is a clear issue - two participants in a DC-Net cannot publish messages at the same time (what we call a collision).

So now I am trying to figure out a protocol that alleges to solve this problem by doing the following alterations to the original DC-net:

Let Alice, Bob and Carol be three participants in this DC-net A,B,C
Suppose that each participant has a shared secret to the right and to the left, such that |shared secret| = |message|
Alice hides her message by XORing with her two shared secrets. Call this encrypted message m_a. Bob and Carol do this same with m_b and m_c
All participants publish their respective messages in three slots. In the first slot they publish m, in the second $m^2$, and so forth (in the third $m^3$). These messages are interpreted as elements in a finite field and thus multiplication is done in this field.
These (encrypted) messages are then interpreted as finite field elements (not an extension field, but a prime field, to be specific) and they are added together according to the arithmetic operators defined by the finite field.
Once the three rounds are done, we are left with three power sums $S_1,S_2,S_3$. ($\sum_{i\in{1,2,3}}{m_i} = S_1, \sum_{i\in{1,2,3}}{m_i^2}= S_2, \sum_{i\in{1,2,3}}{m^3_i}= S_3, in \space \mathbb{F}$)

Here is where I get completely lost - the author claims that given these power sums and newtons identities, we can construct a polynomial and we are able to extract the un-encrypted messages! This is really baffling and would be incredible if true.

We construct a polynomial of the form: $a_3x^3+a_2x^2+a_1x^1+a_0$

$a_3 = 1 $

$a_2 = S_1$

$a_1 = \frac{(a_2S_1 - S_2)}{2}$

$a_0 = \frac{(a_1S_1 - a_2S_2 +S_3)}{2}$

Is anyone able to shed light on how powersum of encrypted messages over a finite field can be decrypted using polynomials and newtons identities, I am all ears. If this is too broad of a question, it can be closed.

(Solution is described on page 4)
Paper


texts: Can the original message be retrieved from a public/private key signature?

texts:
When I sign a message (which has potentialy low entropy) using a private key and I send it without the original message, can the original message be retrieved from the signature(s)?

I want to prove – over an unsecure channel – that I know a secret password without revealing it.

Could a man-in-the-middle (who does not know the original message) create a signature using a different private key which would look like he knew the original message? That would give him the oppertunity to claim to also know the message without really knowing it.


texts: Can we implement Encryption Algorithms like RC4,AES and DES in Verilog? if no what are the limitations?


texts: Is Wiener's attack on RSA extendable to larger keys with low hamming weight?

texts:
Using small private exponents with RSA improves performance.

However, it has been shown (Wiener, 1990) that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the public key $(N,e)$.

Smart, Inc. uses special private keys designed such that they are:

Larger than the minimum bound recommended by Wiener, and
Still very efficient because of their low Hamming weight

Are such keys safe to use?
How could one reconstruct the private keys from the public?

I did some research and think that Wiener's attack might be on the right track.


texts:
Here is a hypothetical application of AES-CTR encryption.

Encryption:

Step 1: Generate random key and IV for new object;
Step 2: Use said key and iv to encrypt some data, which is then
stored on a content server;
Step 3: Encrypt key and IV using some secret master key, and store
the wrapped keys in a database table.

Important: For each new object that we want to encrypt, a new key and IV are randomly generated.

Decryption:

Step 1: Retrieve encrypted key and IV relevant to object that we want
to decrypt
Step 2: Decrypt key and IV using master key
Step 3: Use decrypted key and IV to decrypt object

I would like to know if this is an acceptable way to proceed with AES-CTR (assuming the master key is handled securely, and we are also hashing content to ensure integrity)?

If not, could you please suggest a more secure way to manage key and iv for a given object?


texts: What are the benefits of algebraic eraser key exchange?

texts:
Since this question hast just been updated I am wondering what the benefits of this scheme are. The only motivation I could find with a quick search are speed and power efficiency.

Am I missing anything?


texts: What is proper use of a True Random Number Generator?

texts:
Let's say I have a true random number generator TRNG. Random numbers are generated on demand from a HW-entropy source, resulting in a 32-bit random value each time it is called.

I have to fill an array of 10 Bytes (=10*8 bits= 80 bits) with random numbers. Can I make a first call to TRNG, take the fist byte, the second, the third and the fourth to fill my array, and then call again...

Or should I call a new random number for each byte and throw away the non used bytes?

I would say the first approach is correct, but there is a slight issue with random number quality in my project and I want to be sure - maybe I'm completely wrong...


texts: Hill Cipher if the length of the string is not divisible by the Key Dimensions

texts: For a project, I want to encode the word "MEMBRANOPHONES" with the key "MULTITONE". I try spliting "MEMBRANOPHONES" into groups of 3, but then I get "MEM", "BRA", "NOP", "HON", leaving me with a 2 letter "ES". I can't multiply a 3 by 3 matrix by a 2 by 1 matrix, so what do I do in this case?


texts: Security of SecretKey addition and PublicKey multiplication in secp256k1

texts:
I understand that:
$[a+b]G = [a]G + [b]G$
where $a$ and $b$ are secret keys.  (See: Is there a relationship between the secp256k1 public key of the sum of two private keys, and the public keys of those original two private keys?)
If, under the circumstances:

ECDSA is the signing algorithm.
Alice publishes the public key as $[a]G$ where $a$ is her secret key.
Bob creates a one-use secret key $x\_secret = hash(\text{"Bob chose this"})$.
Bob publishes $x\_secret$.

Do the following conditions hold?

Only Alice can sign messages with the secret key $(a + x\_secret)$, as no-one else knows both secret keys.
Anyone can verify such a message's signature using the public key pubkey(alice_secret).combine(pubkey(x_secret)), as anyone can calculate pubkey(x_secret) from the previously published x_secret.


texts: Is there any trapdoor that can solve elliptic curve subgroup membership problem?

texts: Given an elliptic curve $E$ over a finite field q(q is a prime), and $<G>$, the cyclic subgroup of $E$, where G is the generator. Is there any trapdoor $T$, that given a random group element $P\in E$, we can decide if $P\in <G>$ in probabilistic polynomial time with the help of $T$?


texts: openssl command line equivalent of AESWrap? (defined in RFC3394; use in AmazonS3 Client Side Encryption of datakey wrapping)

texts:
when dealing with S3 Client Side Encryption, it's using "AESWrap" (defined in rfc3394) algorithm to encrypt the data-key; I'm trying to play with openssl command line to see if it's possible decrypt it "AESWrap",
does anyone know how to use call openssl decrypt AESWrap encrpyted content?

https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/s3/package-summary.html

from Java programming, I can program by Cipher.getInstance("AESWrap") to do ENCRYPT_MODE or DECRYPT_MODE, wonder if openssl command line has an equivalent?

Cipher cipher = Cipher.getInstance("AESWrap");
cipher.init(Cipher.ENCRYPYT_MODE, kek);
byte[] encrypted = cipher.doFinal(datakeybytes);

@dave_thompson_085 seems know more on this? (from your https://crypto.stackexchange.com/a/28960 )

from this openssl wiki I'm not seeing how
https://wiki.openssl.org/index.php/Command_Line_Utilities

BTW: by listing all available cipher algorithms, I found the "id-aes256-wrap", does anyone know this has any relation to AESWrap defined in RFC3394 ?

$ openssl list-cipher-algorithms | grep -i wrap
id-aes128-wrap
id-aes192-wrap
id-aes256-wrap

$ openssl version
OpenSSL 1.0.2g  1 Mar 2016
    <= this is from a default installed openssl from a Ubuntu 17.10


texts: Adaptive Hash Functions: How to tell how many iterations were used?

texts:
If an adaptive hash function like bcrypt or PBKDF2 is used in hashing passwords, the number of iterations used in the hashing process can be configured.

For a penetration tester or a malicious hacker, what are the ways to determine how many iterations were used in hashing passwords, assuming that they do not have access to source codes, only a database dump of the password hashes.


texts:
I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication Tag) was successful.
I am asking myself whether AES-GCM also can provide this (from a security perspective quite important) property. However, when looking at the mode diagram of GCM, it seems like the Authentication Tag is calculated successively using information from each ciphertext block. Therefore, the cipher must be decrypted in order to verify its integrity?


texts: Is hybrid encryption required to use Attribute based Encryption to encrypt messages?

texts:
Does the mechanism behind Attribute Based Encryption require us to first encrypt the message by using a symmetric cipher, e.g. AES, and then encrypt the AES key by using Attribute Based Encryption?

Or if I encrypt the message directly using Attribute Based Encryption, would the message still be considered encrypted and the plaintext hidden?


texts:
Is the file just read bit by bit to calculate the hash with those values or is there more to it?

Are there any resources to read a bit more about file hashing?


texts: Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?

texts:
In the proof of the Cramer-Shoup public key scheme [1], I understand that the adversary's view can be seen as equations such as $\log c = x_1 + w x_2, \log d = y_1 + w y_2$ and so on (equation 1 and 2 in [1]), where $\log = \log_{g_1}$ and $w = \log g_2$. Does this mean the adversary knows how to solve discrete log? If that's the case, why is it a reasonable assumption? Otherwise, how does the adversary know $\log c$, $\log d$ and $w$?

[1] https://link.springer.com/content/pdf/10.1007%2FBFb0055717.pdf


texts: How can we create the AES S-box using a different irreducible polynomial?

texts:
The substitution-value of input byte $\mathtt{C2}$ is $S[\mathtt{C2}]=\mathtt{2F}$. This comes from applying the Euclidean algorithm to $A(x)A^{-1}(x)\equiv 1\pmod{p(x)}$, where $A(x) = x^7+x^6+x$ (from $\mathtt{C2}$) and $p(x) = x^8+x^4+x^3+x+1$ (the $AES$ irreducible polynomial). On finding remainder $r=1$ we apply the extended Euclidean algorithm to find $A(x)^{-1}=x^5+x^3+x^2+x+1$ or $\mathtt{2F}$ as expected.

However, this is a lot of work by hand. I am not a programmer but I have managed to write $AES$ in Excel. I would like to change the irreducible polynomial for another suitable one, but I would then need to create a corresponding $S-box$ and doing this by hand is a lot of work. So my questions are:

Is there an online program that can do these calculations?
Is there a quick way to do it in Excel?
Since the irreducible polynomial will be different from the original, how do I find the matrix for the corresponding affine transform?

Thank you for any help or advice.


texts: How to solve the Diffie-Hellman problem if $g$ is unknown?

texts:
I am trying to solve the Diffie-Hellman problem modulo a composite number $N$, which I have factored. In this question, it was answered how to deal with such a situation. But how can I solve the problem if I don't know $g$?
$$y = g^x \pmod{N}$$

The exact numbers are:
$$N=442101689710611$$
$$g^a = 421049228295820 \pmod{N}$$
$$g^b  = 105262307073955\pmod{N}$$

And I need to find $g^{ab}\bmod N$.


texts: Cost of attack on DSA with attack on DLP

texts:
Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm.

Are there any optimized implementations of Pollard's rho algorithm that can be used to estimate such costs?


texts:
I have some questions about the paper Bounded CCA2-Secure Encryption (pdf).

On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then he says he can prove that result in 6 games (page 8 to page 10).

I do not understand the explanations of each game exactly. I lack an overview of the whole thing. I also cannot understand all the notation in the games. Could anyone explain me these games in simpler terms?


texts: why $e(g,g)^N=1$ in bilinear pairings holds?

texts: I can't get the point of prime order bilinear pairings:$\mathbb{G}\times\mathbb{G}\rightarrow\mathbb{G}_T$,$g=$ generator of $\mathbb{G}$ , $N=p*q$, $p$ and $q$ primes and $e(g,g)^N=1$. why $e(g,g)^N=1$ holds? Why is it 1?


texts:
So, I've generated my GPG key pair. Created a subkey for signing and a subkey for encryption. Exported the whole thing, removed my master key pair to a secure place, re-imported only the subkeys. Now, I take my fingerprint and passport to a signing party and folks verify my identity and go pull my key off a keyserver, sign it, and upload it back to the key server.

After refreshing my keys I now have their signature on my private subkey?

Does that mean upon receiving a signature from someone else I need to go get my master key pair and sign it with my private subkey or?

If I lose my laptop before transferring signatures to my main keypair they are lost forever?


texts:
I'm confused by the wording of the PKCS#11 v2.40 specification in terms of when CKA_TRUSTED can be set to true on a public key certificate object:

  The CKA_TRUSTED attribute cannot be set to CK_TRUE by an application. It MUST be set by a token
  initialization application or by the token’s SO. Trusted certificates cannot be modified.

I'm trying to reconcile "cannot be set to CK_TRUE by an application" and "It MUST be set [...] by the token's SO".  Does this mean a R/W SO session can create (or update) a Public Key Certificate Object (e.g. CKC_WTLS) with CKA_TRUSTED set to CK_TRUE?  I feel this doesn't jive well with "cannot be set [...] by an application".


texts:
We have a system where two devices communicate. Due to restrictions on one of them, we can only use AES-128 (so no AES-256) for encrypting the communication. However, new requirements on these kinds of systems have recently come up where > 200 bits encryption is required for the data communicated between the devices. So we need to adhere to it. So to my question.
Does triple encrypting using AES-128 with two different keys, using K1, K2, K1 (similar to 3DES) make the complexity (for a bruteforce MITM) go from ~2^127 to ~2^255, or are there differences between how DES and AES work that makes it not function like that for AES? If so, what would be the best suggestion for achieving this requirement with only AES-128 at hand.
EDIT
Our current implementation with double encryption is as:
C = ENCk2(ENCk1(P)) and P = DECk1(DECk2(C)). Both ENC and DEC uses aes128 and takes k1/k2, IV and C/P as input. Using MITM we can get DECk2(C) = ENCk1(P) and thus they can brute force in more or less the same time as regular aes128.
Our idea now is to use k1, k2 and IV and generate two session keys: k'1 and k'2. Could use them all as input to sha256 and use the first half of the result as k'1 and the second as k'2. This way the MITM approach would give DECk'2(C) = ENCk'1(P). What an attacker then can do is to start guessing k'1 and k'2 and eventually if the have enought C/P pairs they can figure them out. However, these session keys will be useless for any future communication. So to get the actual keys k1 and k2 they would simply have to guess for all the combinations, making it effectually ~2^2*128. Is this a reasonable line of thought?
And to clarify, perhaps it sounds stupid to use two 16-byte keys + IV in a sha256 to create two new 16-byte keys and then run aes128 twice with those two. However, our hardware limits us to aes128 so that is the reason we have to use it. We do have access to sha256 so then we can do that combination.


texts: Password-based chosen-basis computational Diffie-Hellman assumption

texts:
In Simple Password-Based Encrypted Key Exchange Protocols, the authors proposed a hard assumption as follows.

Experiment $Exp^{pccdh}_{\mathbb{G}, n}(\mathcal{A}, M, N, X^{'}, \mathcal{P})$

$(Y^{'}, st)\leftarrow \mathcal{A}(find, M, N, X^{'}, \mathcal{P})$

$k \stackrel{R}{\leftarrow} \{1, \cdot\cdot\cdot, n\}$; $r \leftarrow \mathcal{P}(k)$

$(K)\leftarrow \mathcal{A}(guess, st, k)$

$X \leftarrow X^{'}/M^{r}$; $Y \leftarrow Y^{'}/N^{r}$

if $K=CDH(X, Y)$ then $b\leftarrow 1$ else $b\leftarrow 0$

return $b$

Question：I do not know why this question is hard since the $Y^{'}$ is chosen by the adversary, the adversary can compute $K$ himself.


texts:
I have identified a password hashing algorithm that uses a truncated MD5 hash to compare user passwords.

This means that any password whose hash matches the same first 23 hex chars (11.5 bytes or 92 bits) will authenticate the user.

How big is this keyspace? I believe it is 2^92 which is still quite a large key space to bruteforce a valid password for.


texts: AES - CCM, why not use CMAC inside instead of CBC-MAC?

texts:
I was reading up on AES-CMAC when I learned that this basically is an improved and more robust version of CBC-MAC, with the ability to safely have variable-length messages.

Difference between CBC-MAC and CMAC

The AES-CCM uses AES in counter-mode, and thus turns AES it into a stream cipher. It therefore needs message authentication at the end to ensure message integrity as far as I have understood. Here it uses CBC-MAC. But if CMAC is more robust, why not just use this one?

I am working with Bluetooth Low Energy, and this algorithm is the backbone in the encryption of LE Secure Connections.

Grateful for any clarification.


texts: Hashing a counter to prevent distinguishers in CTR mode

texts:
Because a block cipher is a PRP and thus bijective, the fact that the input in CTR mode never repeats means that each block of keystream will be unique. This creates a distinguisher from random data following the birthday bound if enough data is encrypted even before the counter repeats, especially if the block size is too small. Stream ciphers like ChaCha20 avoid this issue by feeding a counter into a PRF instead of a PRP, meaning blocks of keystream will repeat according to the birthday bound.

Is it feasible to mitigate this problem with a PRP by feeding the nonce and counter through a very fast and deterministic hashing function first? Because the input to the block cipher is not secret in CTR mode, it would not need to be a secure hash function. All it would need to do is admit collisions due to the birthday bound, allowing for a repeating block in the keystream after roughly $2^{n/2}$ blocks.

Is this correct? If so, what is the fastest hash function which has the required properties?


texts: Identification of Confusion Component in a Cipher

texts:
Confusion is a necessary component of any encryption algorithm. S-boxes play an important role in ensuring confusion.
If an encryption algorithm does not use any S-box (rather some other Operations/technique to provide confusion), then by looking at Cipher Algorithm,  how can we identify which component is providing confusion.


texts: The equivalence of SIS and ISIS(Inhomogeneous SIS)

texts:
I would like to know whether these two problems are equivalent or not, namely:
$SIS_\alpha$: Given $A \in \mathbb{Z}_q^{n\times m}$ find $ e \in  \mathbb{Z}_q^{m}$ such that $ Ae = 0$ and and $\|e\| \le \alpha$.
$ISIS_\alpha$: Given $A \in \mathbb{Z}_q^{n\times m}, y \in \mathbb{Z}_q^{n}$ find $ e \in  \mathbb{Z}_q^{m}$ such that $ Ae = y$ and $\|e\| \le \alpha$.
I did some research and found the following Lemma 10 at second page of the document claiming that an efficient solution to $ISIS_\alpha$ implies an efficient solution to $SIS_\alpha$ but the proof is incorrect since it is not showing that $e' \neq e$.


texts: RSA: How close d should be to n, given default public exponent e = 65537

texts:
For small public exponent e, private exponent d should be less than but close to modulus n.
Is there any particular test, applied in common implementations, to verify that? If so, what would be the threshold?
I have noticed that using Python's Crypto.Util.number.getStrongPrime (docs):
key_size = 2048
prime_size = int(key_size / 2)
e = 65537
p = getStrongPrime(prime_size, e)
q = getStrongPrime(prime_size, e)

the bit length difference between d and n is never bigger than 6.


texts: In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can  prove they don't have a backdoor. This seems rather magical to me, so I'm looking for some more information. I'm assuming they're referring to something more substantial than "nothing up my sleeve", which is hardly "proof". Do Safe curves or Koblitz curves have this property?


texts: Mechanisms for masking identifying unique IDs with non-identifying unique IDs to protect privacy?

texts:
I need to suggest mechanisms for masking unique codes in a database with different unique codes that are not derived from the original unique codes, but are equivalently unique in that they could still be used to show the relationships of rows across multiple tables in the database.
And I need to show that there are multiple, simple mechanisms for doing this. Which mechanisms can I suggest?
Again, the new unique code or ID cannot be derived from the original and I can not know what mechanism is ultimately used to generate the non-identifying unique code. I just need to argue that it's easily done.
EDIT: I don't need to convince them to use a specific mechanism. I just need to convince a judge that there are standard mechanisms to choose from.
Any help is appreciated.
Here is the context for why I'm asking:
I have requested data from a government agency. The agency says it can give me most of the data I want, except for the unique IDs that show the relationships between the tables because these IDs could be used to identify individual people. The data are in multiple tables and are linked by these unique IDs.
These data are covered by HIPAA. And under HIPAA’s “safe harbor” de-identification method, any unique identifying number, characteristic, or code needs to be removed except as permitted by paragraph (c) of a section of the law titled “Re-identification.”
This is the "re-identification" section ,which says I can't be aware of the mechanism. And the new ID can't be derived from the old one:

The implementation specifications further provide direction with
respect to re-identification, specifically the assignment of a unique
code to the set of de-identified health information to permit
re-identification by the covered entity.
If a covered entity or business associate successfully undertook an
effort to identify the subject of de-identified information it
maintained, the health information now related to a specific
individual would again be protected by the Privacy Rule, as it would
meet the definition of PHI.  Disclosure of a code or other means of
record identification designed to enable coded or otherwise
de-identified information to be re-identified is also considered a
disclosure of PHI.
(c) Implementation specifications: re-identification. A covered entity
may assign a code or other means of record identification to allow
information de-identified under this section to be re-identified by
the covered entity, provided that:
(1) Derivation. The code or other
means of record identification is not derived from or related to
information about the individual and is not otherwise capable of being
translated so as to identify the individual; and
(2) Security. The covered entity does not use or disclose the code or other means of
record identification for any other purpose, and does not disclose the
mechanism for re-identification.


texts:
I've got a theorical question from an exercise.
Here it is:

--- Exercise beginning ---

There are ways to convert a block cypher onto an FPE. One of them is the following:

Let $E_{k}$ a cryptographic primitive with size n.

$FPE_k(x)$ a cryptographic primitive with $P = C = {0,1,..., m-1} $ with $m < 2^n$

The pseudo-code looks like this

fpe = x
do {
     x = fpe
     fpe = Ek(x)
} while(fpe >= m)

It could be interesting to use this functions to create cupon codes.
For example, if we consider cupons as numbers of 20 digits, we could generate 10000 cupons encoding numbers from 0 to 9999.

--- Exercise ending ---

Now my questions are:

1) I do get that encoding numbers from 0 to 9999 you get 10000 possible encodings, what I don't get is that how to you get 20 digit encodings?
As far as I understand with FPE you always get the same length so if you encode numbers from 0 to 9999 you'd get ciphers between the same values.

2) The exercise asks what is the probability of an attacker to generate a valid cupon?


texts: RC6-like key schedule with 16-bit S-boxes

texts:
I am trying to figure out an encryption algorithm whose key schedule function seems to be similar to RC6. However, it seems to be creating S-Boxes using 16-bit integers instead of 32-bit ones. I have posted some pseudocode below which is filling the S-Box, S is an array of 16-bit values and so is S_, except S_ is 27 * sizeof(WORD) away from S (I'm guessing it's a "2D" S-box, sorry if my terminology is wrong).
The value of delta is 0x79B9.

for (int i{ SBOX_ROUNDS }; i > 0; i--)
{
    S[0] = S_[0] = ST_[-1] + DELTA;
    S_[0] = x;
    S++; S_++;
}

Does anyone know of an algorithm that could use this? I've been trying to find it for literally months now, but no success.
Thank you for taking the time to read!


texts: Does the key schedule function need to be a one-way function?

texts:
For some key schedule $e_n(e_{n-1}(k))$ (where $e_{n-1}(k)$ is the result of the previous round) , does $e$ need to be a one-way function?

In the case of DES or Rijndael the key schedule doesn't really look like one, as the adversary only has to reverse the operations to get the input.

My question is this:

In the case of the well-studied Rijndael,

What are the implications of replacing the iterated schedule $e_n()$ with a one-way function $f$?

My guess is it would increase linearity, leading to a weak cipher. So,

What if we added a one-way component to $e$ such that

$$e(x) \leftarrow s( r (f (x))) $$

where $s()$ and $r()$ are the s-box and bit-shift functions respectively.

Note: I ask about Rijndael where I really mean any block cipher that is secure, eg. Rijndael but I'm not exactly sure how to phrase that.


texts: Multiplicative inverse in $\operatorname{GF}(2^8)$?

texts:
I know how to do multiplication over ${\rm GF}(2^8)$:

uint8_t  gmul(uint8_t  a, uint8_t  b)
{
    uint8_t p=0;
    uint8_t carry;
    int i;
    for(i=0;i<8;i++)
    {
        if(b & 1)
            p ^=a;
        carry = a & 0x80;
        a = a<<1;
        if(carry)
            a^=0x1b;
        b = b>>1;
    }
    return p;
}

So, I tried to create a ${\rm GF}(2^8)$ multiplication table using this code.
I've given below the values in the 3rd row of the table, but I don't think they're correct:

    0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
0
1
2   0  2  4  6  8  A  C  E  10 12 14 16 18 1A 1C 1E
3
.
.
E
F

I don't know what went wrong. I built the table by multiplying the values in the first row with those in the first column.
E.g. in the third row, I multiplied 2 × 0, 2 × 1, …, 2 × E, 2 × F.

How can I create a multiplication table for arithmetic in ${\rm GF}(2^8)$?

Also, how can I find the multiplicative inverse of a number in ${\rm GF}(2^8)$?

For example, how can I determine that the inverse of 95 is 8A?  I tried to do this using the multiplication table above, but when I took 9th row and the 5th column in the multiplication table I got 2D, not 8A.


texts: I have generated an AES key on HSM and I need to calculate the CMAC between this key with an input value. Is it possible to do this on HSM? What is the mechanism to invoke?


texts: ECDSA non random k - Retrieve private key

texts:
At the moment I'm playing around with ECDSA. I know that I can retrieve the private key if the same K is used to sign two messages.

I tried to use this script: Ruby Script to crack the private key. But I'm always getting an error:

  signature_der_string.rb:14:in `decode': null is wrong length (OpenSSL::ASN1::ASN1Error)

My signatures start with a leading 0. If I leave out the 0 I get a different error

  `decode': too long (OpenSSL::ASN1::ASN1Error)

Can you help me what I'm doing wrong?

msghash1_hex = '4992c90022d12b85555493d3dcca55671b4047c1'

msghash2_hex = 'fced62bb70b5af004e8720342d036da02009e5e8'

sig1_hex = '436c79af2252b161af0b74e3eeb4064af334c483e8708fe709c46b1aa480fa49b017fb020fbc9717c6bf50ada23a820'

sig2_hex = '436c79af2252b161af0b74e3eeb4064af334c483e8708fe734065fe380b95c601f118c047976b3007831690806e10f4'


texts: Help understanding basic Franklin-Reiter related message attack

texts:
I am trying to understand this attack at the most basic level. I set up the following basic scenario:
Let the public encryption exponent, e = 3.
Let p, be some arbitrary but known (to the eavesdropper) padding of a couple characters.
Suppose an eavesdropper has intercepted two encrypted messages $C_1$ and $C_2$ from Bob to Alice, where,

$C_1 \equiv M_1^3$ (mod n); and,
$C_2 \equiv (M_1 + p)^3$ (mod n)

In the answer to this question, if I am understanding it correctly, that to find M, we must determine $gcd(M_1^3 - C_1, (M_1 + p)^3-C_2)$.
Do I have this right? If so how would I go about using the Euclidean Algorithm to do this? These look like polynomials to me and I am somewhat familiar with finding the gcd of two polynomials using the EA, but I just can't seem to figure out how to apply that here.


texts: Convert old and busted password encryption to something sensible

texts:
Given a TOTALLY HYPOTHETICAL scenario in which passwords for over a million accounts in over 200 databases have been stored using 3DES, a key derived from a (single) MD5 hash of a customer-controlled (rarely changed from the default) pass-phrase, a hard-coded IV (same for every account in every database), and a ciphermode of CFB...

Would it be safe enough (and not totally asinine) to wrap a separate hash mechanism (and salt) around the old encrypted value to introduce some concept of security? If so, would it then be possible to determine if the resulting stored-password is the new type or the old type?

My end goal is better password security and the ability to, on a per-user basis, update their password to the new model immediately after they authenticate.


texts: Can you explain what the AES paper means by "sharing active S-boxes"?

texts: I am reading the "Biclique cryptanalysis of the full AES" paper. What do they mean by "sharing active S-boxes"? How can this concept can be advantageous to make a bicycle? If there is someone who reads this paper, please explain it to me.


texts: If a probabilistic encryption algorithm is used, how does decryption return the correct message?

texts:
Given a key $k$ and a plaintext $p$, a deterministic encryption algorithm will return a ciphertext $c_1$. In a second trial, I run the same key and plaintext $p$ through the encryption algorithm and get ciphertext $c_2$ from the first trial. $c_1$ and $c_2$ are equivalent, so running the decryption algorithm on $c_1$ and $c_2$ both return $p$.

However, if a probabilistic encryption is used instead to encrypt $p$, the algorithm will run twice and return two different ciphertexts $c_1$ and $c_2$.

How does $Dec(c_1) = p$ and $Dec(c_2) = p$?? If $c_1$ and $c_2$ are different, should decryption return different results?


texts:
Is there an encryption decryption scheme in which a group of people are all given different keys, and of which each key can decrypt a file. (I’m not talking about a scenario where a file is encrypted with a single symmetric key, and then the symmetric key is separately encrypted with each individuals public key.)

I’ve read articles about broadcast encryption and multi-trapdoors but I'm unsure if any of these would match the correct scheme so I’m looking for.


texts: How do AES and DES ensure data integrity?

texts:
I have been trying to study for cryptographic symmetric algorithms (AES,DES) and came up with a question whether these two on their own ensure integrity (i.e data has not been altered). Do these two need message digests in order to ensure it?

I have also seen this paper, but it does not show 'how' these two algorithms ensure integrity.


texts: Design properties of the Rijndael finite field?

texts:
So we've already had a question on replacing the Rijndael S-Box. My question is - can we use a different finite field other than the one given by $x^8 + x^4 + x^3 + x + 1$ in $GF(2^8)$. In other words, would any irreducible polynomial over this field do the trick or are the special considerations and properties of that particular reducing polynomial?

If a more general discussion on appropriate fields for cryptographic operations, such as those used in ECC, is necessary, then I'd be happy to hear it. What I'm trying to get to is an understanding of whether there are any important properties in terms of the "randomness" of the operation - for example, are there weak fields to operate over? For example, $x^8 + x^3 + x + 1$ ought to also be irreducible - so would it be suitable? I ask partly because of the Galois/Counter Mode issue with short tags which lead me to think not all fields might hold equal strength. Right? Wrong? Inconsequential?


texts:
I have client connecting a server over HTTPS to send and retrieve data.

The client always connects through HTTPS
The certificate is known to the client beforehand (hard coded into the software)
The password is auto-generated, so not chosen by the client

For authentication, is there any reason I should do anything more complicated than sending username + password in plaintext over the HTTPS connection for every request?

The data is encrypted by the HTTPS layer, so I am not vulnerable, right?


texts: Performing EdDSA/Ed448 employing Montgomery ladder

texts:
EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and the $y$-coordinate is required to recover. Eventually, the achieved point should be converted to twisted Edwards space.
I design a scheme to work in twisted Edward space, and all results are verified by the given test vector in RFC 8032.
Now I am trying to work over Montgomery space. The first three mentioned steps, i.e., convert the base point to Mont., Mont. ladder execution, and y-coordinate recovery can be performed simply. However, the back transformation has a problem. Based on the equation described in RFC 7748, the map between Mont. space and Ed space are as follows:
\begin{multline}
(x, y) = \frac{(4*v*(u^2 - 1)}{(u^4 - 2*u^2 + 4*v^2 + 1)},- \frac{(u^5 - 2*u^3 - 4*u*v^2 + u)}{(u^5 - 2*u^2*v^2 - 2*u^3 - 2*v^2 + u)}
\end{multline}
I have used (5 , 355293926785568175264127502063783334808976399387714271831880898435169088786967410002932673765864550910142774147268105838985595290606362) as the base point over Curve448. Furthermore, in $y$-coordinate recovery, I suppose $A=156326$, and $B=1$. After $y$-coordinate recovery, the $(u,v)$ coordinates in Mont. space is represented in projective coordinates, i.e., $(X,Y,Z)$. Now this point is required to converet to Edward space, i.e. $(x,y)$.
This is my attempt (in sage) to achieve the point in Ed448-Goldilocks:
#P_projective=y_recovery(R0,R1,P_base) where R0=k*P_base
x2=R0[0]
z2=R0[1]
x3=R1[0]
z3=R1[1]
x1=P_base[0]
y1=P_base[1]

t1 = mod(x1*z2,p)
t2 = mod(x2+t1,p)
t3 = mod(x2-t1,p)
t3 = mod(t3^2, p)
t3 = mod(t3 * x3,p)
t1 = mod(312652 * z2,p) #2A = 2*156326
t2 = mod(t2 + t1,p)
t4 = mod(x1 * x2,p)
t4 = mod(t4 + z2,p)
t2 = mod(t2 * t4,p)
t1 = mod(t1 * z2,p)
t2 = mod(t2-t1,p)
t2 = mod(t2 * z3,p)
t1 = mod(y1 + y1,p)
t1 = mod(t1 * z2,p)
t1 = mod(t1 * z3,p)
X = mod(t2-t3,p)
Y = mod(t1 * x2,p)
Z = mod(t1 * z2,p)

# convert from Mont. space to Edwards space where x=a1/a2 y=b1/b2
a1 = mod(4*Y*Z*(X^2-Z^2),p)
a2 = mod(X^4-2*X^2*Z^2+4*Y^2*Z^2+Z^4,p)
b1 = mod(-(X^5-2*X^3*Z^2-4*X*Y^2*Z^2+X*Z^4),p)
b2 = mod(X^5-2*X^2*Y^2*Z-2*X^3*Z^2-2*Y^2*Z^3+X*Z^4,p)

a2_inv = Integer(inverse_mod(Integer(a2),p))
x = mod(a1*a2_inv,p)

b2_inv = Integer(inverse_mod(Integer(b2),p))
y = mod(b1*b2_inv,p)

The results are not correct. what mistake I did? Should I do any other step to get the same point in the Ed448 curve?


texts: Hashing - Digital Signing and Trivial Stretching

texts:
Two very basic questions:

1. Digital Signing

Why is it not possible to just simply replace the hash value from the request?

Examples:

 - Mallory creates two different documents A and B, that have an
   identical hash value (collision).
 - Mallory then sends document A to Alice, who agrees to what the
   document says, signs its hash and sends it back to Mallory.
 - Mallory copies the signature sent by Alice from document A to
   document B. Then she sends document B to Bob, claiming that Alice
   signed the other document (document B).
 - Because the digital signature matches the document hash, Bob's
   software is unable to detect the modification.

Reference: http://en.wikipedia.org/wiki/Collision_attack

It's not transmitted, a secret and at the same time you just send the hash eventually? How does this work out?

  Hash functions are also great for signing data. For example, if you're
  using HMAC, you sign a piece of data by taking a hash of the data
  concatenated with a known but not transmitted value (a secret value).
  So you send the plain-text and the hmac hash. Then, the receiver
  simply hashes the submitted data with the known value and checks to
  see if it matches the transmitted hmac. If it's the same, you know it
  wasn't tampered with by a party without the secret value. This is
  commonly used in secure cookie systems by HTTP frameworks, as well as
  in message transmission of data over HTTP where you want some validity
  to the data.

Reference : https://stackoverflow.com/questions/4948322/fundamental-difference-between-hashing-and-encryption-algorithms

2. Digital Signing

I can't see why this code produces less colitions than the second one
As soon as you have a conflict with two inputs, how does it help to append the same two values for the next recursive loops?

Not recommended:

hash = sha512(password + salt);
for (i = 0; i < 1000; i++) {
    hash = sha512(hash); // <-- Do NOT do this!
}

Recommended:

hash = sha512(password + salt);
for (i = 0; i < 1000; i++) {
    hash = sha512(hash + password + salt);
}

I was reading that part five times and although it kind of makes sense I am having a hard time fully comprehending it.

  Now, hash1 has a probability of collision of 0.001%. But when we do
  the next hash2 = sha1(hash1);, all collisions of hash1 automatically
  become collisions of hash2. So now, we have hash1's rate at 0.001%,
  and the 2nd sha1 call adds to that.

Reference : https://stackoverflow.com/questions/4948322/fundamental-difference-between-hashing-and-encryption-algorithms


texts:
I am not sure if I missed some subtlety in the definition of Attribute Hiding found in this paper on Predicate Encryption, but isn't it possible to construct a scheme for Predicate Encryption supporting disjunctions that is both a lot less convoluted, and still supports Attribute Hiding?

(I realize that "convoluted" is a matter of opinion, but I think this falls within the scope of admissible subjective questions as laid out in the FAQ.)

Let $\mathbb G$ be a multiplicative group of prime order $q$ and with generator $g$ such that Computational Diffie-Hellman is hard in $\mathbb G$. Let $F$ be a set of $n$ predicates and let $\Sigma$ be the corresponding set of attributes (which is the power set of $F$).

$KeyGen:$ A trusted party performs the following operation: For each predicate $f_i \in F$, select two uniform values $x_{f_i},s_{f_i} \in \mathbb Z_q$. Let $w_{f_i} = g^{s_{f_i}}$. Let the Public Key $PK_i$ corresponding to predicate $f_i$ be $(x_{f_i},w_{f_i})$ and the private key be $(s_{f_i})$.

$KeyDist:$ Each entity $k$ is assigned a set of predicates $F_k \subset F$. For each $f \in F_k$, the trusted party distributes the corresponding private key $(s_f)$ to $k$.

$Enc:$ Generate a secret value $w \in \mathbb G$ (which might be used for deriving a symmetric key for authenticated key encryption) for the attribute $I \in \Sigma$ as follows:

Select $s \leftarrow_{uniform} \mathbb Z_q$.
For $i = 1$ to $n$:

If $f_i \in I$ then $u_i = x_{f_i}$ and $v_i = w_{f_i}^s$, else $u_i \leftarrow_{uniform} \mathbb Z_q$ and $v_i \leftarrow_{uniform} \mathbb G$.

Let $(l_i(x))_{i=1}^n$ be the Lagrange basis polynomials corresponding to the ordered set $(u_i)_{i=1}^n$.
Let $p(x) = \Pi_{i=1}^nv_i^{l_i(x)}$.
Calculate $w = p(0)$, $t = g^s$, and for each $1 \le i \le n-1, r_i = p(i)$.
Output $(r_i)_{i=1}^{n-1}, t$, the key encrypted key and the payload cipher text.

$Dec:$

For each $f \in F_k$ do:

Let $(l_i^\prime(x))_{i=1}^n$ be the Lagrange basis polynomials corresponding to $(1,..,n-1,x_f)$.
Let $r_n = t^{s_f}$.
Let $p^\prime(x) = \Pi_{i=1}^nr_i^{l_i^\prime(x)}$.
Calculate $w_f = p^\prime(0)$. If $w_f$ decrypts the key encrypted key, let $w = w_f$.

Use $w$ for decrypting the key encrypted key and payload cipher text.

Now, the difference between the above scheme and the one in the referenced paper, is that in the latter the decrypting entities get secret keys that are blinded with respect to which predicates that are included in the secret key. However, from what I can tell the definition of Attribute Hiding (Definition 2 on page 5) does not require such blinding. The adversary chooses two attributes $I_0, I_1$ and adaptively requests secret keys for any predicates $f_i$ subject to the restriction that $f_i(I_0) = f_i(I_1)$ for all $i$. Let $f_j$ be such that $f_j(I_0) \ne f_j(I_1)$. Clearly, an adversary $A$, attacking the scheme above, can't tell from $(r_i)_{i=1}^{n-1}, t$ if the encryptor used $v_j = w_{f_j}^s$ or $v_j \leftarrow_{uniform} \mathbb G$ without at least solving DDH in $\mathbb G$. Am I missing something?


texts: Question about proof of pseudo-random random generators being one way functions

texts:
I've been looking over this proposition and proof in the book "Introduction to modern cryptography" and am a little confused. Picture is attached at the bottom).

Why is it that we do not multiply the $2^{-n}$ by $\varepsilon$.

It is true that the probability of being in the generator range is $2^{-n}$ but even once we're there the chances of A giving the correct inverse are not $1$.

Should the equation not be $\leq  \varepsilon ~ 2^{-n}$ instead?


texts: Break HMAC-SHA256 of PAN with known hash?

texts:
Imagine a database containing hashed (HMAC) Primary Account Numbers (PANs ) and associated identifiable information (e.g. transactions).
Consider a data breach. Prior to the breach, an attacker made specific transactions to make it easy to identify one or more hashed PANs. Could the attacker then work out the SHA256 key and easily brute force all the PANs?


texts: Can the same One-Time-Pad be re-used with some tricks

texts:
Let’s say I have a message $m$ of $n$ bits. And a predetermined pad of $k*n$ bits. And for every bit $b$ of this message $m$, I’m creating random sequence $s$ of $k$ bits.

I also have a predetermined boolean random function $f$ (imagine something like this: $f(s) = hash(s)\ mod\ 2$).

For each bit $b_i$, I choose a random value for $s_i$, so that $f(s_i)=b_i$.

So, I can construct a padded version of $m$ like this: $m_p= s_0 || s_1 || ... || s_n$, removing the padding is trivial.

The encryption is also straightforward XOR of the $m_p$ value with the predetermined pad of the same length ($k * n$)

Can this protocol justify/enable reusing of the same pad over and over again providing OTP-Like security?

Equivalent text-based formulation of the scheme:
One comes up with a fresh, random hash pre-image for each message bit that when hashed yields the message bit as the LSB. You then transmit the pre-images and encrypt them with the re-used OTP.


texts: How is it possible that these two encryption functions yield the same result?

texts:
I opened this post in stackoverflow some time ago where I explained a problem I had about not finding a way that would allow to successfully get the result of a string encrypted with a "aes-256-cbc-hmac-sha256" algorithm.
As seen in the answer, the encrypted string is exactly the same as it had been encrypted with just a "aes-256-cbc" algorithm, I could get advantage of that to successfully do a proper decryption.
Out of curiosity, I'd like to know how something like that is possible. I don't know much about criptography, but, on general terms, I know how all the functions involved in the algorithm work... And, by no means, I see that they could offer the same result, as it happens.
Why are these two different functions yielding exactly the same result?


texts: What are the pros/cons of using symmetric crypto vs. hash in a commitment scheme?

texts:
In a commitment scheme, are there any differences on using a symmetric cipher versus using a hash?

If at the "opening", I have to reveal $r$ (a random number concatenated with the messaged at the time of hashing) and $m$ (the message),  why not reveal the key used for encryption for everybody to decipher the message and so confirm it?

It seems to me that both binding and hiding properties of the commitment would be preserved? Is this so?

Any pros/cons of using one over the other that I'm unable to see?


texts:
I was looking at Time Capsule cryptography? and came up wth this idea.
Question:
Is there a way to store a secret such that the creator must update it or the secret will be decrypted and anyone can access it?
Example:
I use this algorithm to encrypt the message, $enc(M)$, now if I don't update, $update(enc(M))$, then $M$ will be publicly known with high probability after some given time $t$
One idea was to use the Time Capsule cryptography to encrypt a (URL, key) pair that points to my data, and the update function would be me moving the data to another URL.  I feel that this is kind of cheating though, since I could just as easily write a script to give public access to the computer if I don't log in (for example) for a fixed period of time.
So, for this problem let's say that we don't have access to a server and $enc(M)$ must be publicly known and contain the message $M$.  i.e. this should become a Time Capsule crypto algorithm if I never perform an update.
I have a feeling this may be impossible, if so could you give a high level proof of why?


texts: The computational complexity of discrete log

texts:
I am trying to find out what the asymptotic computational  complexity, in terms of big $O()$ notation,  is for discrete log.  Specifically, consider an element of the field $x \in \mathbb{F}_{q}$, what is:

The worst case rigorously provable complexity of computing the discrete log of $x$ if a) $q$ is a prime or b) if $q = 2^k$?
The best known heuristic complexity of computing the discrete log of $x$ if a) $q$ is a prime or b) if $q = 2^k$?

This looks like a standard question and I have searched the web but I can't find clear answers to these questions (including on the wiki).

As a side note, are there particular fields for which discrete logs are easier than others?

An example of information from which I am not able to glean the answers to my questions is  the paper The Past, evolving Present and Future of Discrete
Logarithm.  Section 4 lists a number of relevant methods but no clear statement of their asymptotic complexity in terms of the number of bits needed to represent  the field element and $q$ (or $k$) that I can find.  It's possible I am just not interpreting the paper well of course.


texts: When is an asymmetric scheme considered broken?

texts:
Does the following quote imply that valid encrypted data can be created and decrypted by someone other than the owner of a private key:

  An asymmetric encryption scheme is considered to be broken if an
  attacker can decrypt a given ciphertext, even if he can convince you
  to decrypt arbitrary other ciphertexts

What conditions must exist for this to occur?  (Specifics would be appreciated)


texts:
I'm using brainpoolP512r1 elliptic curve for DSA and DH in my application. Recently I've found out on this website that brainpoolP256t1 and brainpoolP384t1 aren't secure. Unfortunately my curve wasn't mentioned.

When I'm using brainpool, my public keys encoded in base64 have around 210 chars, but for curve25519, they expand into 410 chars which causes a few problems. How can I verify if brainpoolP512r1 is safe?


texts: What quality would an interactive proof executed many times sequentially have that makes it zero knowledge that one executed in parallel would not?

texts:
The first protocol can be proved ZK, but the second is not believed to be so? What quality of the parallelization makes it such that an identical protocol executed in parallel, as opposed to sequentially, would remove its ZK properties?

EDIT#1: The source of the IP's was asked for so I shall say, they are from some course notes of a graduate cryptography course at UCLA, from a few years ago, and given to be based off of the book "Foundations of Crypto" by Goldreich.


texts: AES: Guess Password using the unencrypted text?

texts: I am using the same password for some encrypted files currently (I know this is bad practice, though), and I wonder whether an attacker could decrypt if one decrypted file fell into his hands.


texts: Are there any advantages in using proprietary encryption?

texts:
Proprietary software generally relies on the fact that in keeping the encryption algorithm private, it gets an extra layer of security implying "Security through Obscurity." Obviously this phrase has been hotly debated and surely is only acceptable if discovering the mechanics of a proprietary algorithm doesn't actually reduce it's security.

Is there any other reason you would use a proprietary encryption since my research has proven there to be many more disadvantages than advantages!


texts:
What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation?
Round 1 - NTRU Encrypt, NTRU-HRSS-KEM, NTRU Prime
Round 2 - NTRU (Merger of NTRU Encrypt and NTRU-HRSS-KEM), NTRU Prime
For example, NTRU Encrypt in round 1 uses NAEP padding as compared to HPS98.
Paper by Schnack on "Comparison of NTRU Variants" talks more about the size/security rather than implementation itself. What other differences are there between HPS98 and the different NTRU Candidates?


texts: Time complexity of birthday attack type problem

texts:
I have two sorted lists: $A=\{a_1, \ldots, a_n\}$ and $B=\{b_1, \ldots, b_m\}$.
I know that the probability of $a_i=b_j$ is $c$ for $1 \leq i \leq n$ and $1\leq j \leq m$.

The time complexity of finding all $a_i=b_j$ is
$mnc$. Why?


texts:
Is there any relation between two strings with the same MD5 hash?

For example these two strings:

0e306561559aa787d00bc6f70bbdfe3404cf03659e704f8534c00ffb659c4c8740cc942feb2da115a3f4155cbb8607497386656d7d1f34a42059d78f5a8dd1ef

and

e306561559aa787d00bc6f70bbdfe3404cf03659e744f8534c00ffb659c4c8740cc942feb2da115a3f415dcbb8607497386656d7d1f34a42059d78f5a8dd1ef

have the MD5 hash:

cee9a457e790cf20d4bdaa6d69f01e41

Does any regular relation between these two strings or any strings with the same MD5 exist?


texts: Homomorphic encryption poll for multiple people

texts:
I understand for homomorphic encryption, you can perform operations on the ciphertext such that:
$E(x_1)+E(x_2)=E(x_1+x_2)$ which can allow you to work out the sum of the plaintext  encryption

I have two questions:

How does homomorphic encryption work for choosing A, B and C. I know to vote for A or B, you can use 1s or 0s then sum up the ciphertext to see how many voted for A. Does homomorphic encryption not work here. If so, what other method could you use then?
What stops someone from submitting a vote of 50 e.g. E(50). As the votes are encrypted, is there a way to check the computation was indeed correct?


texts:
Schnorr's identification protocol is said to be a honest verifier zero knowledge protocol. Does it imply it will not work if the verifier is dishonest?
I'm wondering if this is the case, it would mean that a honest prover will always be denied authorization by the misbehaved verifier.


texts: Generating a secure random number in javascript

texts:
What I am trying to do is generate a large (4096bit) random number in JavaScript that is cryptographically safe to use.

My approach is the following:

I am creating a Uint8Array with the desired length.
I am using Math.random() to prefill it.
I am showing a a 256x256pixel box, and show a message asking for moving the mouse around in it. For every onmousemove event, I am selecting a random byte in the array (using Math.random again), and doing a bitwise XOR with the relative X position of the mouse cursor, and doing the same to another random byte, with the Y position.
I keep processing onmousemove events until N events have been processed. (N >= a lot)

So what I have in the end is an array that was prefilled by an insecure random number generator, but whose output was mixed around with a lot of user-generated entropy.

My question is: Would the resulting number be safe to use? Or am I missing some glaring insecurity in this approach?