texts: With DES, is ECB encryption mode equivalent to CBC with null IV for short data blocks?

texts: I got to this by experimentation, but can someone maybe provide an explanation for this?


texts:
please let me know if there's any digital signature scheme for the following problem. Thanks in advance!

I want to have a token that's somehow signed (or granted) by multiple
3rd parties for a certain document. The token then can be used to
access resources managed by the parties.
3rd parties just need to use their private keys to validate the token

I find the Wiki article about Multisignature, but really I don't know how to apply it into my case.


texts: How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

texts: Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this scheme is not IND-CCA-2 secure?


texts: Why don't homophones hide multiple-letter patterns?

texts:
I am reading about mono-alphabetic ciphers, which are prone to letter frequency analysis. To counter this, we can provide multiple substitutions, known has homophones for a single letter e.g. e could be assigned 17, 74, 35, 21. Each homophone could be assigned in rotation or randomly.

This is where I am confused:

  Even with homophones, each element of plaintext affects only one element of ciphertext, and multiple-letter patterns (e.g. diagram frequencies) still survive in the ciphertext, making cryptanalysis relatively straight forward.

How do multiple-letter patterns survive? For example if for h we have homophones 17, 74, 35, 21 and for t we have 11, 69, 27, 24, th could be 11 17 or 11 74 or 11 35 or 69 21 etc.


texts: Is 1D Perlin noise cryptographically secure

texts:
As the title, if I have:

A stream of 1D noise

And I know:

The noise is generated using the Perlin method with a known number of octaves > 1. (as implemented here)
The random numbers used in each call to the Perlin noise method are generated using the Mersenne twister.
The Mersenne twister is initialised with the same seed in every call.

Is it possible to attack the state of the random number generator and therefore predict future noise?

I know that some steps in this process are vulnerable. But when combined, can this still be attacked?


texts: Cryptanalysis not based on method used to encrypt?

texts:
When doing cryptanalysis on RSA or something number theory based, there are various attacks that all seem to involve number theory (Wikipedia: RSA_(algorithm) ~ Attacks_against_plain_RSA).
Similarly, attacks on ECC seem to involve something from ECC (Elliptic curve cryptography related key attacks).

What I'm wondering about is matrix-based (perhaps someone can correct me to the proper term for this) cryptography and cryptanalysis. I'm especially wondering if I'm just stating the obvious by associating the attacks with their original crypto-systems or if there are methods that work for different kinds of systems based on different math theory (an example of this would really be helpful). Particularly the matrix-based (which seems to involve multiple points orthogonal in $R^n$).

Can cryptanalysis based on that be used on other crypto-systems?


texts: Should layered use of crypto always have a cryptographic binding between the layers?

texts:
Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of cryptographic bindings between messages and layers.

I wonder if there is some general rule in all of this.  For example if data is encrypted inside an encrypted channel, should for example the key material for the two be bound somehow?


texts: Altering file for to create partial matching MD5

texts:
Is it possible to produce a file(zip) where the first $n$ bits match a given value in optimal time?

Let us say we have a folder $f_1$ with hash $h_1$. After I change some contents in folder and the new folder this becomes $f_2$ with a rather different hash $h_2$.

Can I change (the) hidden contents in $f_2$ say $f_2'$ to get a hash $h_2'$ with where the first $n$ bits are identical to hash $h_1$?

If we can make such file can someone explain how?

note: hash is for zip of folder


texts: Why cant we use AES to hash a password, instead of a hash function?

texts:
AES needs a key in order to work, hashing-algorithms do not. Suppose we have a fixed key for AES, why don't we simply hash our keys with that?
As with hash functions, AES has arbitrary input size, fixed output size and reasonable computation time. And if the fixed key can be kept safe, it is computationally infeasible to get the original key. So why do we need hash functions at all, then?


texts: What is meant by the term “hostile environment”?

texts:
I come across many time a term called ”hostile environment” in cryptographic literature. What does “hostile” mean exactly?

Is it unknown third parties which are responsible for handling and routing our data?

Suppose that we create a connection from node A to node B. Does hostile imply that packets could traverse to untrusted machines C, D, and E in between?

Is it related to physical tampering of devices?


texts: Why there isn't a consistent key transform function of HMAC?

texts:
I am currently learning, the internal working of HMAC. There exists a key transformation process in the beginning, which works as follows:-

Make the length of $K$ (Key) equal to  $B$ (number of bits in each block):-

1) If Length of $K$ < $B$:- Pad 0 bits to the beginning of the message, to the point the the above condition is satisfied.

2) If Length of $K$ = $B$:- Do nothing (or proceed to the further step)

3) If Length of $K$ > $B$:- Pass $K$ with a Message Digest algorithm, which will return a key trimmed down i.e. it satisfy the condition len($K$) = len($B$)

QUESTIONS:-

Why can't we simply pass the $K$ via a Message Digest Algorithm,
whether the key size is less or more? Because the output will be of
the same size (the size that we expect), then why bother doing
padding in one process and passing via a Message Digest Algorithm in
other?
Or why not choose a consistent trimming/padding scheme instead of
using a Message Digest Algorithm. By that I mean, if the $K$ > $B$,
then do trimming of bits to a particular size which is predefined
(not the best option, but seems like a way to achieve the result
too).


texts: Should I authenticate memory data which was loaded from authenticated disk file?

texts:
Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to be displayed to the user (cipher is initialized on process start). The system also allows user to add new data which will be encrypted to memory and later saved to disk. CBC mode is used.

Besides file's HMAC, does adding HMAC to each encrypted field and validating it before decryption makes sense? Or in other words, should I authenticate memory data which was loaded from authenticated disk file? The goal is to make make the app as secure as possible and minimize possibilities of tampering.


texts: Decrypting a message without the private key using CRT

texts:
I am given 5 different encryption modulus, $N$, each ranging from 78 to 88 numbers long. Then for the encryption exponent, each has the same which is 5. Then I am given 5 different encrypted messages, $E$, which also ranges from 76 to 88 numbers long. I am trying to decrypt the message without having to discover the private key.

One way is to use the Chinese Remainder Theorem where we follow the procedure as follows: $x=E_i \mod R_i$ for $i=1,2,3,4,5$. So for $x$, I took all the combination for i and tried to decrypt it by taking the 5-th root of the solution I get for all the $x^\prime$s. However, this is not really working for me as for every solution I get for $x$, it is not possible to take the 5-th root without having decimal fraction.

Anyone who is familiar with the procedure I am taking about, could you tell me what I am doing wrong and possibly help me through this? Thanks in advance. The method I am using by the way is known as the common encryption exponent.


texts: Are there any NIST curves with pairings?

texts: NIST FIPS.186-4 has standardized 5 ECC curves on field  (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. None of them seem to have pairings. Are there any standard curves which support pairings?   Are there any libraries which support those curves?


texts: PAKE PSF with very trivial/leaky passwords

texts:
I want Alice to symmetrically encrypt a large file, transmit it over a public network and have Bob decrypt it. The shared secret of the two is a password, potentially very simple and may be reused often. The password is shared offline, potentially insecurely (by Alice shouting it across the room or whispering it into Bob's ears or even being a preshared key like Alice asking "the same password as always?"). I am envisioning an AES-CTR + HMAC-SHA256 + SPAKE2 implementation.

The way I understand the perfect forward secrecy PAKE gives me (by not sharing its internal state but only a derived state) means that even if an eavesdropper could listen to both

Alice shouting the password to Bob
Intercepting the entire transmission

they would not be able to find the exchanged key and thus be able to decipher the message. Is that correct?

The way I understand it, the only situation in which a third party could successfully interfere is after Alice shouted the password but before Bobs SPAKE2 message reached Alice. Is that correct?


texts:
This is probably a silly question, and similar question was asked before; but  I can not figure out what actually is PRP/PRF. For example, it is commented that:

  A Pseudo Random Function is a function that is indistinguishable from a function selected at random from the set of all functions with the same domain and value set.

Now, does that mean, everytime we speak of a PRF; we randomly choose a new function from all such possible functions? Or, after we have chosen the function, we use it for sometime?


texts: Challenge Response Authentication - Client Generating Challenge

texts:
Let's say we have a client (the not trusted party) and the server(wants to verify that the client is who he claims to be.

The client has access to both the private key and the public key, whereas the server only knows the public key.

Question
Instead of the server being responsible for generating the challenge, would it be as safe if the the client himself generated a random challenge and later signed it (so that the server could later verify this). Is there a weakness in RSA that would make this scenario bad?

NOTE
The public/private key pair will only be used once, and will be re-generated each time.


texts:
I was reading how AES can be used for 64 bit data. Than i came to this answer :Is it possible to implement AES with a 64-bit I/O block size?

The answer here is given that by running AES in counter stream mode 64 bit plain text produce the 64 bit cipher text. But i can't under this point when 128 bit cipher text produced by AES block cipher is XOR with 64 bit plain text. How it produce 64 bit output?


texts: Why is NON DISCRETE logarithm problem not hard as the DISCRETE logarithm problem (so computationally hard)?

texts:
I've already read this question about the difference between discrete and non discrete logarithms.
But I still have problems to clarify my mind about why the Discrete Logarithm Problem is computationally hard while the NON Discrete Logarithm Problem is not, as I read in my Cryptography and Security book.

What are the computation differences? Why can I, for example, easily break a non discrete logarithm cipher but not a discrete one?


texts: What are the pros and cons of SIP media encryption types SRTP, ZRTP, and DTLS?

texts: I'm just getting used to SIP for my first time using Linphone. Which encryption is better and why? My Settings > Network > Media Encryption has the options of SRTP, ZRTP, and DTLS.


texts: How an ID based encryption system simplified certificate management in e-mail systems?

texts:
I was reading a paper on Identity Based Signature. A line in it reads:

The original motivation to build an encryption system based on ID was
to simplify certificate management in e-mail systems.

Can someone please explain how an ID based encryption system simplified certificate management in e-mail systems?
Thanks and Regards.


texts: Implementing Boneh & Durfee attack on RSA with low private exponent

texts:
I am trying to understand various attacks on RSA and I believe that the only way to fully understand an algorithm is to implement it. I am trying to implement the code in this paper: Dan Boneh and Gleen Durfee, Cryptanalysis of RSA with private key $d$ less than $N^{0.292}$, in proceedings of Eurocrypt 1999. But after spending hours I am having problem writing the algorithm needed to implement the code. A small hint to help me implement the code would be appreciated.

I am familiar with LLL (lattice reduction) and how RSA works, so just small hint would be really helpful.

I understand that we want to solve the polynomial $f(x,y)=x(A+y)-1=0\pmod N$, with $x=k$, $y=-p-q$ and $A=N+1$, but I don't understand the shifting part and construction of lattice basis to be used in LLL, and finding $x$ and $y$ to recover the private key.


texts: How to compare one time pad security and efficiency with AES?

texts:
It seems that the minimal size of Pseudorandom permutation (PRP) output is $128$ bits. In general, I'd like to see if there's any minimal size of the output of pseudorandom function (PRF) as well? for instance can we set the output size of PRF to 32 or 40 bits.

Below, I'm trying to explain the question with an example.

Let $k_i$ be secure random key. I've a message $m$ of 32-bit. I want to encrypt it in two different ways:

Using output of a pseudorandom function (PRF) as a one time pad: I do the following:

a) $PRF_{k_1}(0)=a$,

b) $c_1=a \cdot m$.
Using a Pseudorandom permutation (PRP):

a) $c_2=PRP_{k_2}(m)$

Question 1: What is the minimal size of $c_1$? Can we set the output size of PRF to 32 bits, so the size of $c_1$ would be the same?

Question 2: what is the minimal size of $c_2$? Am I right it is at least 128 bits?

Question 3: If the answer to both questions is positive, then how can we compare the security and efficiency of the above two schemes with each other?

Please kindly let me know if my question is not clear, etc instead of down voting it; and I'll address your comments.


texts: How does one go about implementing a range proof?

texts:
I've attempted to find a solution to this problem, but for the life of me I am unable to. I am attempting to solve whether a point an elliptic curve of prime order is between 2 points, given a specific generator point, similar to the question posted here: Proving that two points on elliptic curve are within range
I would like to include it in my existing ECC python script. However, I've never actually seen anyone implement it with code, or even explain the process step-by-step. There are a bunch of papers and sites explaining how great and efficient it is, yet I am unable to find a resource to help me code it. Does anyone have a resource that would be able to help me accomplish this task?


texts:
If I want to encrypt structured data composed of key-value pairs of strings, would it be an advantage to use an encoding that stores keys, values and their lengths, and is padded with random numbers, rather than JSON that always starts with {", ends with "} and predictably contains strings enclosed in "..." separated by ,?
I'm thinking of encoding the data like this:
R1
LK1 K1
LV1 V1
LK2 K2
LV2 V2
R2

(where Rn are random numbers of fixed size obtained from a CSPRNG and L.. are the lengths of the data that follow)
instead of:
{ "K1": "V1", "K2": "V2" }


texts:
Are there any requirements for the additional data to be used in the GCM block cipher mode?
And are there any "classic" used informations worthwile to be used? Can for example a username or the name and surname of a person be suitable to encrypt a message with AES GCM?


texts:
We know that for a real full-ranked lattice $\Lambda$, with real square matrix $\mathbf{B}$, the dual lattice $\Lambda^{\vee}$ has matrix $(\mathbf{B}^{-1})^T$.
Now If we have a complex lattice with $N \times N$ complex matrix $\mathbf{C}$, what would be the matrix of its dual lattice? Would it be the same? Or we need to put complex conjugation?
Thank you!


texts: Of what use is my code for finding prime numbers of a certain size?

texts:
I've developed a bit of Mathematica code that can find primes within a range of numbers. For example, if I wanted all the primes between one million and two million, it could do that. Of what use is this code I invented ?

The only thing I could think of was that if one wanted to find two primes of a certain size for cryptography keys.

And the code could be used to test a specific number for primality, quickly.

And with the addition of code, it could be made to search for primes of a certain format, like safe primes.

I just invented this last week

Copy the following into Mathematica, select all, right-click on Convert To, choose StandardForm.

N[Sum[2/10^((n*(Floor[c/n] + 1) - c)*s), {n, 1, Floor[Sqrt[ c]]}] + Sum[ 2/(10^((n*(Floor[c/n] + 1) - c)*s)* (10^(ns) - 1)), {n, 1, Floor[Sqrt[ c]]}] + Sum[2/(10^((o^2 - o - c) s)*(10^(o*s) - 1)), {o, Floor[Sqrt[c]] + 1, max}], ((max + 1)^2 - c)*s]; AbsoluteTiming[Flatten[ Position[Partition[ RealDigits[%][[1]], s, s, -1], {(0) .., 2}]]] + c
-end
c=crossover s=spacing

The crossover is the number which you want to surpass. The spacing is difficult to determine, so I'll say that in general, if you use a number which is equal to the number of digits of the max^2, you should be safe. So for all primes up to $100^2 = 10000$, that is five digits, so use a 5 for the spacing. Follow this rule and you should be safe.

For those who are wondering, the code is based on a bigger structure of numbers formed by the Sieve of Eratosthenes.


texts: I read ECB is bad because the same plaintext outputs the same ciphertext. Isn't that a requirement of a cipher?

texts:
In the Wikipedia article on Block Ciphers, it says about the Electronic Code Block mode:

  The disadvantage of this method is that identical plaintext blocks are
  encrypted into identical ciphertext blocks; thus, it does not hide
  data patterns well. In some senses, it doesn't provide serious message
  confidentiality, and it is not recommended for use in cryptographic
  protocols at all.

How is that a disadvantage? Isn't it a requirement of a cipher that identical input produce the same output? Otherwise, how could you decipher the ciphertext if it could have been created by many different inputs?


texts: Subkey generation in OMAC1/CMAC with XTEA?

texts:
All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key.
If E_XTEA(key,block) is the encipher function and k is my main key, CMAC produces a temporary key k0 from an all-zero block:

k0 = E_XTEA(k,0)

CMAC derives two other keys from k0 with the same length as k0, k1 and k2.
This derivation uses a constant C which is "completely determined by the number of bits in a block"

There are two problems:

k is 128 bit long, but k0,k1 and k2 are only 64 bit long because they depend on the output of the 64 bit encipher function.
Is C really determined by the block size instead of the key size?

My assumption is that E_XTEA(k,0) is used to generate a pseudo-random block, and I can use k0 = concat(E_XTEA(k,0),E_XTEA(k,1)) to generate a pseudo-random block of the right size. But I don't know if this is correct  or which C to choose.


texts: How much information do I leak if I upload multiple ciphertexts with cleartext overlaps?

texts:
Suppose that $t_1, t_2, \ldots, t_n$ are my clear texts.  Suppose that for any $(i,j) \in \{1,2,\ldots,n\}^2$, $t_i$ and $t_j$ only differ in, say, the 1st $m$-many characters. Finally, suppose that I got an encryption function $\texttt{enc} : t_i \mapsto c_i$.  By function I mean a programming function, not necessarily mathematically.
To make it clearer, from the point of the adversary, the following is known:

The encryption algorithm is $\texttt{enc}$.
He knows all ciphers $c_1, c_2, \ldots, c_n$.  E.g. he sniffed them over the network.
While he does not know the clear texts $t_1, t_2, \ldots, t_n$, he does know the fact that they only differ in their 1st $m$-many characters (without actually knowing the 1st $m$-many characters, nor the other $m+1, m+2, \ldots$ characters).

My question is:  how much information would the adversary gain, given that he learned that the original clear texts are mostly identical and only vary in their 1st $m$-many characters, for these algorithms:

AES for various modes of operation,
RSA and its variations,
and scrypt?

Just to rephrase the question: suppose that $H(\{c_1,c_2,\ldots,c_n\}|\texttt{enc})$ is total number of information bits that the adversary managed to gain about the ciphertexts by simply knowing their encryption algorithm, the question is:

How bigger is $H(\{c_1,c_2,\ldots,c_n\}|\texttt{enc}, m)$ (information gain after also knowing that the original clear texts are mostly identical except for their 1st $m$-many letters)?

I don't know much about encryption, and I don't know how easy or hard this question is.  Any guidance is also highly appreciated.
The reason I'm concerned about this is due to me having multiple backups of my encrypted files, which their cleartexts have differed only slightly.  I'm concerned that I'm leaking information by keeping multiple encrypted copies of my slightly-modified cleartexts.


texts: Proof for the SHA3 claim that 256 bit security is "post-quantum sufficient"?

texts:
On page 14 of "Keccak and the SHA-3 Standardization" (February 6, 2013) it says:

  Instantiation of a sponge function

  the permutation KECCAK-f
  7 permutations: b → {25,50,100,200,400,800,1600}
  Security-speed trade-offs using the same permutation, e.g.,

  SHA-3 instance: r = 1088 and c = 512
  permutation width: 1600
  security strength 256: post-quantum sufficient
  Lightweight instance: r = 40 and c = 160
  permutation width: 200
  security strength 80: same as SHA-1

(note: emphasis mine)

Since I regard quantum cryptography to be currently walking in it's child-shoes, with a high potential of evolving substantially during the upcoming years, I just have to ask: What exactly is the base for the KECCAK claim that a security strength of 256 bits is "post-quantum sufficient"?


texts: Proof in "New Multi-Signatures in the Plain Public-key Model and a General Forking lemma"

texts: Reading here,I was confused in the proof of "A Multi-Signature Scheme based on Discrete Logarithms" proposed by authors.I felt strange to the technique(using array $T_0[]$、$T_1[]$、$T_2[]$ and state $alert$、$bad$)，can someone give me a straightforward explain of this proof(or some similar proofs of other schemes)?


texts: Enabling Oblivious Access Control via Function Encryption

texts:
Abstract

With Functional Encryption, would access control between two parties be possible without revealing the entirety of one party's policy to the other? E.g. such that a server would be incapable of discerning anything more about a client's policy (aside from weather the client's requested action is permissible via single Boolean output), and vice versa for the client when checking that the server is first allowed to receive the action request before transmitting it.

Problem Statement

A distributed set on nodes (subjects) within a computation graph communicate peer-to-peer (P2P), exchanging messages, services, etc (objects) via an common API. Subjects exchange identities to authenticate each other with some common source of trust, e.g. a Certificate Authority (CA), thereafter establishing a forward secured channel, e.g. via Transport Layer Security (TLS). Through this channel, the two participants should conduct a form of trust negotiation with respect to validating the other participant is authorized to receive or request a given object respectively.

Ideally, in the interest of preventing any information about the computation graph from being leaked, one may wish that policy definitions be obfuscated from the public. For a large dynamic P2P systems, it is perhaps best participants store only their own provisioned policy, as opposed to all policies for whom they are expected to interact with. To be fully decentralized as well, no connection to a third party broker at run time for access arbitration should be used.

Given these requirements, middle ware standards such as DDS Security from OMG fallow a familiar pattern above where participants exchange signed permission documents that prescribe the policy to enforce upon the owner. In essence, a participant's entire hand of cards is revealed to all recipients. To introspect the topology of the inner data bus and its resources, a malicious actor needs only to annex a single identity in order to connect and aggregate policy documents.

  I was thinking this relates to Oblivious Transfer (OT), but instead where the verifier gets exactly one policy decision result without without knowing anything about the rest of the policy that was not pertinent to the inquiry.

Related

What are the current limitations (and capabilities) of Functional Encryption used for access control?
What paradigm does ABE, KP-ABE and CP-ABE fall into
Certificate based Access Control for Pub Sub messaging

Side Note & Motivation

I'd like to create a Mandatory Access Control (MAC) plug in for robotic and Industrial IoT (IIoT) middle wares. I've written one before that leverages regular expressions in clear text extensions within a subject's identity certificate. OMG's DDS Security default plugin does this better by decoupling identity and permission documents for handshaking. However, I think we could do even better than its v1.0 plugin by not sharing entire participant policies. Of course one could just provision the permission document into multiple minimalistic documents for each use niche use case, but my thoughts were that perhaps functional encryption could help avoid such quantized bookkeeping.


texts:
Let's say we got a one way function (OWF). Such a function takes 512-bit input and gives 256-bit output. And let's say we can easly invert some specific inputs. There is exactly $2^{256}$ such blocks which can be easily invert. It is still very small number if we consider $2^{512}$ possible inputs. And as wikipedia wrote: one-way function is a function that is easy to compute on every input, but hard to invert given the image of a random input. So there is practically no chance that we will draw such input.
My question is - is it still secure function or should we consider such a function as broken?


texts: What is the exact algorithm for encryption and decryption with hummingbird-1 cryptography?

texts:
I have really googled the entire internet but could not find a clear algorithm for hummingbird-1 cryptography.The problem emerges in the decryption module:

What is the initial value of state register $RS_1$, $RS_2$, $RS_3$, $RS_4$.
What is the initial value of LFSR?
Having known the encryption block cipher $Ek_1$, $Ek_2$, $Ek_3$, $Ek_4$,how can we get to $Dk_1$, $Dk_2$, $Dk_3$, $Dk_4$?

Here is a link to the Encryption and Decryption Structure:  Encryption and Decryption Structure


texts: Good pre-image resistance value for hash visualization

texts:
I want to do "hash visualization", i.e. derive a human-meaningful information from a hash, like a phrase or an avatar. But the current techniques usually don't use many bits, for example tripphrases by Bret Victor only use roughly 43 bits. This is a problem because all the hash isn't used, so using a "big" hash function with many bits wouldn't help.

What is the minimum number of bits in the output of an "ideal" hash function that would guarantee preimage resistance by modern standards (i.e. with the biggest computing power that we can gather today)? This doesn't need collision resistance.


texts: Modular Addition in RC5 is linear or not?

texts:
So, far my understanding was Modular addition is non linear function which is mainly used in ARX based ciphers.
While I was glancing through RC5 paper (https://link.springer.com/content/pdf/10.1007/3-540-60590-8_7.pdf) the author has mentioned that the only non-linear operation is "data dependent left-rotation", even though it has modulo 2^n addition.
In the given paper, the author, has not mentioned about finite field details, so it is assumed that the addition operation is happening on n-bit register.
I am attaching the image for the reference and also note the last 3 lines.


texts: Are the first 4 bytes of a Ed25519 public key random?

texts:
We are using the Ed25519 signature scheme (which uses Curve25519). A key pair is generated by generating the secret key from random data and then computing the 32-byte (256-bit) public key from said secret key.

The question is about the entropy (randomness) of the public key. We currently use the first 4 bytes of the public key as a "reasonably unique" ID of the public key. We have very limited space and cannot afford more than 4 bytes. Would we improve the uniqueness of the ID if we generate it differently? For example, the ID could be generated by XOR between Bytes 0-3 and Bytes 4-7 of the public key? Or using the first 4 bytes of sha-512 of the public key. Or what?


texts: ECDH and ECDSA in PGP with known public key

texts:
How are used ECDH and ECDSA in combination with public key ? Usually these methods are used for establish a secret themselves, so why (and how) are used combined with public and private key couple in OpenPGP?

The proposed internet standard RFC-6637: Elliptic Curve Cryptography (ECC) in OpenPGP says in section 8:

  The method is a combination of an ECC Diffie-Hellman method to establish a shared secret, a key derivation method to process the shared secret into a derived key, and a key wrapping method that uses the derived key to protect a session key used to encrypt a message.   The One-Pass Diffie-Hellman method C(1, 1, ECC CDH) [NIST-SP800-56A] MUST be implemented with the following restrictions: the ECC CDH primitive employed by this method is modified to always assume the cofactor as 1, the KDF specified in Section 7 is used, and the KDF parameters specified below are used.

…but there is no word about public key receiver's use, it might be used to protect confidentiality.


texts:
Is there any idea about calculating the exact Voronoi regions of lattices with dimensions $\leq 16$?
Thank you!


texts: Signing dynamic data on an embedded system

texts:
I have built a GPS based on the AVR microcontroller. The GPS is used to log flight data for competitions. The log file is updated 10 times per second. What I'd like to do is to associate a signature with this file so that anyone can confirm that the file was written by the GPS.

This suggests that the GPS should have a private key of some sort internally, and that verification should occur through a public key. However, there are a couple of significant hardware limitations:

The AVR is an 8-bit processor running at 8 MHz. I can keep a running MD5 hash of the file, but there is not enough time between samples to calculate, e.g., an ECDSA signature.
The hardware does not know when it will shut down. When the user turns off the switch, it just shuts down. This means it is not possible to perform the hash/signature once just before shutdown. The signature would have to be updated every time a new row is added to the log file, i.e., 10 times per second.

Something like an HMAC would fit the processor limitations, but not the necessity of public verification. Is there some variant of an HMAC which can be computed using a private key and then verified using a public counterpart?

Thanks for your help!


texts: How to encrypt sensitive files in a business application? Is it needed?

texts:
I'm currently working on a business Java application, and we store sensitive files related to our users. What is the appropriate approach to store them securely?

Is it viable to encrypt/decrypt all the files in the business logic, and then store them in the filesystem? Then what the key could be? If I derive a key from the file uploader's password, other, authorized people won't be able to decrypt the file.

Or it would be better if we would concentrate on the infrastructure's security, because it is not frequent to encrypt files for a business application?


texts: For CFB, if the IV is corrupted, can the system re-synchronise?

texts: How does CFB (Cipher feedback mode) self correction work? And if the initialization vector (IV) is corrupted during transmission, how will it affect encryption or decryption?


texts: What is the largest key size that could be carried by a shuffled deck of playing cards?

texts:
If you are carrying a standard 52 card pack of cards (no jokers) what is the largest key size, or the amount of data the cards can hold?
Without the cards being marked or distinguishable from an identical pack, but some cards may be placed in the deck upside down.


texts: A modular approach to the design and analysis of authentication and key exchange protocols

texts:
I am studying  modular approach to the design and analysis of authentication and  of the key exchange protocols. One of them are proposed by bellare et al. On page number 11, I do not understand the proof of theorem 3 which states that

Theorem 3: Let $\lambda$ be an MT-authenticator (i.e. $\lambda$ emulates MT in unauthenticated networks), and let $C_{\lambda}$ be a compiler constructed based on $\lambda$ as described above. Then $C_{\lambda}$ is an authenticator.

The proof uses the $A_{\pi}$ adversary in authenticated model and $U_{\pi^{'}}$ adversary in unauthenticated model.

  I do not understand how these two adversaries interact using $\lambda$ protocol  and $C_{\lambda}$ compiler?
  How the whole interaction of the protocol is done under the simulated environment?


texts: What's a proper window size in RSA exponentiation?

texts:
I want to use the window method for RSA modular exponentiation.
Because of Side Channel Attacks (SCA).
But I don`t know what a proper window size is.


texts:
I need to create a nested message in OpenPGP (my understanding is that the protocol itself should support it).

Let's say I have Payload ("Time in Lordran is convoluted").

I do the usual PGP encryption routine with a public key PK1, and as a result I get encrypted session key SK1 and encrypted payload EncPY1. I can combine this output OUT1 as a single PGP message.

Now, I want to do the same thing again: encrypt OUT1 but with public key PK2 to get OUT2. The problem here is that OUT1 is going to generate a Literal data packet instead of Symmetrically Encrypted Data Packet.

It means that to retrieve the Payload, the decryption of OUT2 by GnuPG will happen in two passes (gpg -d OUT2.gpg | gpg -d) instead of one (gpg -d OUT2.gpg).

Excerpt from the RFC that confirms theoretical possibility:

   The Symmetrically Encrypted Data packet contains data encrypted with
   a symmetric-key algorithm.  When it has been decrypted, it contains
   other packets (usually a literal data packet or compressed data
   packet, but in theory other Symmetrically Encrypted Data packets or
   sequences of packets that form whole OpenPGP messages).

I have tried OpenPGP implementation in Go and there is no API to facilitate what I need. I would like to know if there is a library in Java, Python or any other language that fits my use case.

So far I haven't seen anyone in the libraries that I looked at that has tested creation of nested messages (except for compression).


texts:
Does FIPS 140-2 require specific key sizes, or does it have specific requirements for the data?
In other words, if I encrypt a file, how I can check whether it is FIPS-compliant or not? Does only the key need to be checked, or does the encrypted file have to be checked too? If yes, is it possible to elaborate on how to check an encrypted file for FIPS compliance?


texts: Does the size of a ECDSA key determine the hash algorithm?

texts: I am a bit lost in understanding what I read on authentication, signature, etc. For instance, is the size of the ECDSA keys produced by ssh-keygen -t ecdsa -b 256 linked to the hash used (SHA256) when computing the signature?


texts: Which TLS features are vulnerable to chosen-prefixes collision on SHA-1?

texts:
Gaëtan Leurent and Thomas Peyrin's preprint From Collisions to Chosen-Prefix Collisions - Application to Full SHA-1 (in volume 1 of proceedings of the forthcoming Eurocrypt 2019) shows a feasible chosen-prefixes collision attack on SHA-1. Given distinct prefixes $P_A$ and $P_B$ of equal length, the attack produces suffixes $S_A$ and $S_B$ with $\operatorname{SHA-1}(P_A\mathbin\|S_A)=\operatorname{SHA-1}(P_B\mathbin\|S_B)$. The attack has feasible cost: a few times that for shattered, which given prefix $P$ produces distinct suffixes $S_A$ and $S_B$ with $\operatorname{SHA-1}(P\mathbin\|S_A)=\operatorname{SHA-1}(P\mathbin\|S_B)$.

Which TLS features (ciphersuites, certificates, etc..) are vulnerable to such chosen-prefixes collision attack?


texts: Are there any algorithms for which generating any zero-knowledge proofs is not practical?

texts:
It is related to my earlier question:

Can zkSNARK or other zero-knowledge proofs be used to proof message authenticity without revealing private key?

Are there any algorithms for which generating zero-knowledge proof is so computationally complicated that they cannot be generated in any practical time, by mainstream devices (PCs, smartphones)?

I am interested mostly in encryption algorithms, but any examples would be great.


texts: Probabilistic polynomial time algorithms in MAC's

texts:
According to the Wiki article, a MAC is a triple of probabilistic polynomial time algorithms $(G, S, V)$ such that:

G gives the key k on input 1^n, where n is the security parameter
S outputs a tag on the key k and the input string x
V outputs 'accepted' or 'rejected' on inputs: the key k, the string x and the tag t.

From my understanding, a probabilistic polynomial time algorithm is one that runs in polynomial time, and returns a probability.

I don't really see how the outputs of G, S and V count as 'probabilities'. What are they measuring the probability of?


texts:
I am currently completing a dissertation concerning the encryption of data through a variety of cryptographic algorithms.

I have spent much time reading journals and papers but as yet have been unable to find any record of their performance complexity.

Would anyone have an idea of the Big-O complexity of the following algorithms?

RSA
DES
Triple DES (Which I would expect to be of the same order as DES)
AES
Blowfish

Thank you in advance; if you could provide a link to a reputable and citable source if would be very much appreciated.


texts:
I'm trying to learn how to go about cracking RC4 ciphers (nothing illegal, its an old, i.e., not active challenge for a job application, so no cheating).
I have nine md5 hashes with their own ciphers.
One cipher is significantly shorter than the rest.
Two "ciphers" are blanks with only MD5 hashes.
Six ciphers are of the same length.
They hint that the key is very long, and my assumption is that brute forcing the key is out of the question. In the python code that they provided, I can see that the same key has been used for each cipher.
Any guidance on how to do this? I've been at it for the past week, learning quite a bit, but not enough.
edit:
There is one class in their code that says it's a test and will be removed later. That could be a possible hint and potentially be plaintext I suppose.


texts: Is the following aggregation scheme private?

texts:
Is the following scheme private?
By private i mean an untrusted aggregator (UA) cannot reveal anything other then an aggregate function output on plaintext data

Each party holds a secret key $k_i$ and data $d_i$. It sends to the aggregator $d_i H(r)^{k_i}$. $H$ is a hash function that maps elements to a group $N$ in which  $H(r)^S \equiv 1 mod {N}$ Lets say a trusted dealer(TD) for two parties sends to the untrusted aggregator $H(r)^{S-k_1}$ and $H(r)^{S-k_2}$ and UA wants to learn the multiplication of the data of those parties. Then UA computes

$$d_1 H(r)^{k_1}d_2 H(r)^{k_2}H(r)^{S-k_1}H(r)^{S-k_2} =d_1d_2H(r)^{2S}=d_1d_2H(r)^{S^2}=d_1d_2$$


texts: Padding methods for block ciphers - PKCS7 vs ANSI X.923

texts:
I was looking through block cipher padding methods, and found two good candidates:

ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. 00 00 00 04.
PKCS7 - pad with bytes that each show the number of padding bytes, e.g. 04 04 04 04.

Is there any benefit to using PKCS7 over ANSI X.923 padding, or vice versa?


texts: Cryptanalysis and Copying encrypted volumes

texts:
I just recently concerned myself with cryptography due to Snowden's revelations and there are a few things I cannot really wrap my head around but maybe you can help me with that. I am not a mathematican or a programmer and most of the stuff I know about cryptography comes straigt from The Imitation Game, so pleas excuse my ignorance.

First off: Isn't encryption of data completely pointless if the attacker knows what he is looking for? In the movie, Turing encrypted the German codes because he knew how their weather broadcast started every morning. So, if an attacker knows the exact specifics of a file that is likely tucked away in an encrypted container, couldn't he just modify portions of the file to match the unencrypted file to find out the encryption key? If for example a whistleblower gets hold of a set of documents and his employer wants to proof it but only finds an encrypted disc at his workplace. Would it be easy for this employer to decrypt the encrypted data if he had a cleartext copy of the files he is looking for?

And my second burning question: Truecrypt's documentation says that one shouldn't copy an existing volume because working with two copies of the same container "may aid cryptanalysis". Why exactly is that? As far as I understand those two containers would share a master key but how does that aid cryptanalysis? Let's bring up a few situations here: Copying a halfway full container and working on the data of each individually, adding the same or different data to both containers of cloning an empty container and filling it with completely different data. How does any of that enable cryptanalysis?


texts: I have been trying this for a while. But I couldn't get it. How can I determine the point of intersection of the tangent line at (0, 0) on the   curve  $y^2  + y = x^3 + x^2$ ?


texts: Encryption technique performance evaluation

texts:
I've come up with a light weight bit wise encryption algorithm and seems good. Ive tried it with text and image input. But I've the following questions I would like to ask

What do you think of bit wise encryption schemes. Pros and cons (performance and security wise)
How could I compare the security level and the performance of my encryption with well known encryption methods.

I mean visually the text and the image look encrypted. Totally unrecognized. But is there any way that I can mathematically or analytically measure the security level. And also the performance how can I say this encryption has a better performance than the other.


texts: Question about terminology of public key encryption in practice

texts:
I am asking myself the following question:

  Say Alice sets all things up so that she is the reciever in an RSA-system. What do you call this "network" now?

I hope it is clear what I mean. I sincerely do not know the correct word for that. I could think of something like:

RSA-channel
RSA-network

Could you please tell me. (English is not my mother tongue)


texts: Are there any hash-based multisignature schemes?

texts:
Are there any hash-based signature schemes which would let two (or more) people sign the same message without increasing the size of the signature linearly?

For my purposes, it is fine if the scheme supports only one-time signatures.

I think PORS scheme can probably be adjusted to support a small (i.e. < 16) number of signers without growing the size of the signature linearly - but not sure if there are other schemes that can do that.


texts: Is this approach able to protect against padding oracle attacks?

texts:
I know that a protection against the padding oracle attack is to encrypt-then-mac. This is to avoid trying to decrypt a modified ciphertext, and leak information about padding errors.

Suppose that we have a content which is signed, and then encrypted. For decryption and signature control, this content is processed in the following manner:

decrypt the content without telling if the padding is correct on not.
check the signature on the decrypted content and return an error if it is incorrect, which should be the case if the ciphertext was modified.

Is this treatment correct when wanting to avoid PO attacks (or any other chosen ciphertext attacks)?

To be more precise, the scenario would be:

the content is signed with an asymetric key (say a RSA-PSS signature),
it's then encrypted with a symetric algo (say AES-256-CBC), with a random
key and a random IV,
the symetric key is encrypted with another asymetric key (say a RSA-OAEP encryption),
the ciphertext, the encrypted symetric key and the IV are then transmited to a receiver process.
the receiver process decrypts the symetric key without telling if there is a padding error (OAEP padding)
it then decrypts the ciphertext with the (possibly badly decrypted) symmetric key without telling if there is a padding error (AES-256-CBC padding)
it then checks the signature on the (possibly badly decrypted, but good sized) content and returns an error if it is incorrect, rejecting the received content.


texts: Proving knowledge of a value and computation that uses it

texts:
Alice picks random points P and Q in a group where DLP w.r.t. a base point G is hard (I am thinking an eliptic curve, but it doesn't have to be). Alice doesn't know the DLP of those two points.

Alice sends (P,Q) to Bob.

Bob is to pick a random scalar r, and return (r*P,r*Q) to Alice, while keeping r secret.

Is there a way for Bob to prove to Alice that he knows that r, and that the pair of points that he sent her are what she is expecting, but without revealing r?


texts: What can we recover with an invalid curve attack

texts:
According to the "Guide to Elliptic Curve Cryptography" (page 182), it's possible to recover $d$ with an invalid curve attack.
How can this value be used once recovered?
For example, with Elliptic Curve Diffie Hellman (in TLS for example), what can we do with $d$?


texts:
How much is it possibile to devide $E(m_1+m_2)$ by $E (m_1)$ to obtain $E (m_2)$ based on the fully Homomorphic-encryption property which says;

$$E (m_1) * E (m_2) = E (m_1 + m_2)$$. And if yes what are the the requirements to apply this property?


texts:
The NTRU public-key cryptosystem has a lot of interesting properties (being resistant to quantum computer attacks, being standardized by several important bodies), but it also has a pretty unique property:

  The decryption algorithm does not always work.  Sometimes it just gives wrong answers.

Has this been fixed?  Is it really a cryptosystem if having the private key is insufficient to decrypt the encrypted messages?

For instance, from Howgrave-Graham et al. (2003) one reads,

  “First, we notice that decryption failures cannot be ignored, as they happen much more frequently than one would have expected. If one strictly follows the recommendations of the EESS standard [3], decryption failures happen as often as every 212 messages with N = 139, and every 225 messages with N = 251. It turns out that the probability is somewhat lower (around 2−40) with NTRU products, as the key generation implemented in NTRU products surprisingly differs from the one recommended in [3]. In any case, decryption failures happen sufficiently often that one cannot dismiss them, even in NTRU products.”

Nick Howgrave-Graham, Phong Q. Nguyen, David Pointcheval, John Proos, Joseph H. Silverman, Ari Singer, and William Whyte. "The Impact of Decryption Failures on the Security of NTRU Encryption", Advances in Cryptology - CRYPTO 2003, 23rd Annual International Cryptology Conference, Santa Barbara, California, USA, August 17-21, 2003, Proceedings,
Lecture Notes in Computer Science, 2003, Volume 2729/2003, 226-246,
DOI:10.1007/978-3-540-45146-4_14


texts: RSA Optimal Asymmetric Encryption Padding Beginner

texts:
I'm new to the OAEP scheme.
I learn it from the Wikipedia page. Link
The page does not explain a proper setup for of the system.
So I'm not sure if the output of the padding scheme which contains two components X and Y (X||Y) is going to be the input of the RSA encryption? Or is there something that I'm missing?
Many thanks.


texts: Break RSA given $N, e$ and lower half of $d$

texts:
I have full bits of public key $(n,e=65537)$ but from the private key, I have the lower half bits of $d$.

Can I restore the whole RSA private key from that data and use it for decryption?


texts: Do both client and server need to implement OpenSSL protections to protect from CBC attacks

texts:
In regards to the protections implemented in OpenSSL 0.9.6d (described in section 2. http://www.openssl.org/~bodo/tls-cbc.txt). My understanding is that the mechanism prepends an empty record when sending data in order to make the IV unpredictable. however the client->server and server->client maintain separate IV data.

If relying on this mechanism to protect against CBC vulnerabilities (such as BEAST) is it required that both client and server have this mechanism enabled?


texts: In RSA, is it possible to compute the private key if one knows one of the primes used to generate n?

texts:
Within RSA the private key can be derived if one knows both $p$ and $q$. Is it possible to derive the RSA private key or decrypt / learn something about encrypted messages if you only know one of the prime numbers and not the modulus $n=pq$? The only available knowledge of the crypto-system is the ciphertext of a single encrypted message and the exponent ($e$) used.

EDIT: In actuality what I want to do is to retrieve the original message $m$ that was encrypted with the private key resulting from $p$ and $q$. I assumed that finding the original message would be equal in difficulty to calculating the private key.


texts: (Side channel) attack on a PIC18 micro controller

texts:
I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about:

Preset

I have physical access and I own/wrote the software, that will be run on that device. It is for academic purpose.

Attacking vectors

(no side channel) Adressing special secure memory. If there is a function/protocol on that µC, which is able to edit those information (say on a eeprom) and, therefore, can read such stored information (like keys), then I may be able to abuse that function/protocol. I thought about manipulating the firmware in such a manner, that I define the operating address and call the function.
Sending multibyte characters. Do such stuff has any effect? I will read some information from a smardcard, which sends a string of defined length (3mb). If there is an information set, like a multibyte character, could I enforce a restart while reading or displaying those? (Like iPhone..)
Starting with reduced power. (WDT is active..)
Starting with increased energy.
Typical errors? (I'm out of that for 6 month now, I do not know many specs of the PIC18 currently, while writing this post)

Question

Could someone point out attacking vectors, I have missed, or which probably will fail or have no relevance? What do I have to check, if I want to ensure, that some Information, that are loaded through the smartcard, will have to effect?

The loaded information are a "string", those will be stored on memory, encrypted. If I want to display those, I need to decrypt first.

I hope, I'm not that much confusing right now and you get my issue.


texts: Why is ISAAC not a pseudo random number generator?

texts:
I have been accused of confusion over the nature of the ISAAC algorithm.  The bulk of evidence suggests that it is a cryptographically strong pseudo random number generator.  By bulk I mean the number of authoritative references pointed to by a Google search of "isaac prng cipher".  I offer:-

Bob, the guy who wrote it

Apache Commons random number generator

The Aumasson paper assessing it as a generator

CCAN random number module

Yuen, Practical Cryptology and Web Security

In fact, the only place that describes ISAAC as definitely a cipher is crypto.SE and the Wikipedia article and we all know the authority that can be attributed to Wikipedia.

Yuen's book is perhaps the most telling. It clearly categorises ISAAC as a PRNG but then goes onto construct a cipher system using it as a key stream generator.  Yuen goes into great detail how to create a seeding mechanism as there is no official key entry, and codes an XOR mechanism for enciphering.  This approach is repeated in the Rosetta Code entry for ISAAC, as is the description of ISAAC as a PRNG.

It appears to be the case that ISAAC is a PRNG.  As such, and as any PRNG can, that qualifies it to be a building block of a cipher. In that respect, so can the middle square method be used as a construct within a cipher system if you add some XOR code onto the end.   I suggest that is the basis of all of the confusion.  But ISAAC is first and foremost a PRNG, isn't it?


texts: Security of Half-Key Key Management Scheme

texts:
I am interested in algorithms that consume as less space available on a memory, for low consuming power devices such as wireless nodes. From a search I have found this article here:

https://dl.acm.org/doi/pdf/10.1145/2103380.2103433?download=true

I have read it but I cannot understand where it is based in order to provide security. It is not the common discrete logarithm problem, elliptic curves etc. Can this scheme, as it is described in the paper, work in other circumstances?


texts: How to break this PRNG encryption scheme?

texts:
Suppose we have the following symmetric algorithm:

key = random bits
G = PRNG(seed: key)
input = [0,1,1,0,1,0,0,0, 0,1,1,0,1,0,0,1] // "hi" in ascii

The key can be thought of as a sufficiently large bit string (say 256 bits).

encrypted = []
for each decrypted_bit in input
    random = G.generate()
    encrypted_bit = first_bit_of(random) XOR decrypted_bit
    first_bit_of(random) = first_bit_of(random) XOR decrypted_bit
    append_to(encrypted, encrypted_bit)
    G.seed(random)

The decryption algorithm seeds the PRNG with the same key, and performs the following actions:

decrypted = []
for each encrypted_bit in encrypted
    random = G.generate()
    decrypted_bit = first_bit_of(random) XOR encrypted_bit
    first_bit_of(random) = first_bit_of(random) XOR decrypted_bit
    append_to(decrypted, decrypted_bit)
    G.seed(random)

Suppose each message sent is prepended with a randomly generated 512 bit string, causing the random generator to output different ciphertexts for the same input.

How do I break this scheme? Can I find a pattern in the PRNG using a known-plaintext attack? The current PRNG is the Mersenne Twister "MT19937", generating 64 bits. What PRNGs are vulnerable to this? Which aren't?

Some additional information:
For a key with the value 9145160492174859451, "hi" is encrypted to

[0,0,1,0,0,0,0,0,
1,1,0,0,0,1,0,1]

The message

4Glx2[153b(9.#}PY$G~r.sI4s-?"HiQid6Em\q&8M?#P^sQX&-oJ4UJ-_c4U<1?hi

Encrypts the last two characters as

[1,0,0,1,0,1,0,1
0,0,0,1,1,1,1,1]


texts: Matsui's paper on Linear Cryptanalysis of DES

texts:
I am trying to derive the best linear approximation for one round DES.

I read the question and answer

Regarding matsui's Paper on Linear Cryptanalysis of DES

several times but still could not figure out the part

"
y_3y_2y_1y_0 can be propagated to bits 7, 18, 24 and 29 of the output of the round function, this time taking into account the effect of the bit permutation P(.)
"

The output of S box #5 is Y[13], Y[14], Y[15] and Y[16] (when counting from right). And after permutation these bits would be Y[26], Y[20], Y[10] and Y[1] respectively. I could not find the desired bit number i.e. F(X,K)_7, F(X,K)_18, ...


texts: Format Preserving Encryption for 32 or 64 bit plaintext values

texts:
I am looking for a Format Preserving Encryption implementation to apply to either a 32-bit or a 64-bit integer.  It looks like AES/FFX mode is just what I need in terms of established security properties.  However, it looks like it is patented, and it seems like there might be something equally solid in the public domain for the special case of 32 or 64 bit data, ideally with C source code.  I have seen SkipJack or 3DES for the 64-bit case, but I would prefer longer key sizes, as these will be statically configured.

The application is to compartmentalize/anonymize information in a database.  I have different kinds of information about users that is not terribly privacy invasive as long as it is kept separate from other kinds of information that is also not invasive on it's own.  However, there may be rare cases when I need to connect this data together.  So, I was thinking each database would identify users with its own ID, and the key to connect them could be stored separately.  The actual application is a little more complicated, but that's the general idea.


texts:
So I heard that Twofish is much more secure than AES, because it is not vulnerable to bruteforce and only supports 256 bit.
Also I heard that is not vulnerable to most side channel attacks.
And Twofish might be much more secure because there is no known attack to it, while in AES there is a known theoretical attack.
From what I have heard twofish is not the encryption standard because it is too slow, but has a much higher security index.
So are those claims true? Is twofish really more secure? Everybody says different things. Would it be the better choice for classified top secret data?


texts: Why computation of $u*v^3*(u*v^7)^{(p-5)/8}$ is suggested instead of $(u/v)^{(p+3)/8}$

texts:
Working with Curve25519 I've faced with suggested form of computation square root candidate as: $uv^3(uv^7)^{\frac{p-5}{8}}$ instead of $\left(\frac{u}{v}\right)^{\frac{p+3}{8}}$. Why it is so? Or why is it less expensive?

Edwards-Curve Digital Signature Algorithm (EdDSA) https://tools.ietf.org/html/rfc8032#section-5.1.3
High-speed high-security signatures https://eprint.iacr.org/2011/368.pdf


texts: Stream cipher with Diffie-Hellman and Cryptographic Hash Function?

texts:
I know: Never do your own crypto. But this question is just theoretical.

Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash function like SHA3 to generate a pseudorandom bitstream like this:

$$p_i = \operatorname{SHA3}(x||p_{i-1}).$$

To encrypt $i$th packet of data, labelled $m_i$, compute

$$c_i = m_i \oplus p_i.$$

I realize that the key stream for a OTP must be completely random to ensure perfect secrecy, but would this scheme at least be as hard to break as the underlying hash function or Diffie-Hellman?

In my opinion, it should be, but I'm new to cryptography.

Since the shared secret is only used for one session, assuming the hash function is a random oracle, no keystream is ever used twice. By including $x$ in every $p_i$ an attacker has to break (not only find a collision) the first sent packet in order to decrypt the rest of the session, breaking any other packet will most likely be a collision and not give away the needed $x$, only the content of this packet. Also, breaking any packet requires at least plaintext knowledge but it gives you only this particular hash, not the previous/next hashes.


texts: Is the risk of a collision for OCB mode mitigated by upping the block size of the cipher?

texts:
A paper published by Niels Furguson Collision attacks on OCB indicates that processing large amounts of data (somewhere on the order of $2^{32}$ 128 bit blocks) with a single encryption operation (same key and nonce) makes it probable that an attacker could create a modified cipher text that would generate the same tag as a the original cipher text (pass authentication) and decrypt to a different plain text.

The probability of the necessary X collision occurring

$$(m−1)^2 2^{−128}$$

appears to be related to the block size of the cipher. In the paper a 128 bit cipher (the size originally recommended in the OCB specification) was used for all the probabilities cited.

Another surprising property observed is that using larger tag lengths increases the probability of a collision occurring.

My primary question is: does using a larger bit size cipher (say 512 bits) with a small tag size (say 64 bits) decrease the probability of this collision occurring? And if so does it decrease it enough that more than $2^{32}$ blocks of data can be written with less then a $2^{-64}$ chance of message forgery?

Niels advises against the widespread use of OCB; is this the consensus throughout the cryptographic community?


texts: Why is GCM not vulnerable at the birthday bound for 128 bit IV?

texts:
According to this article, which looks at attacks on Caesar candidates beyond what they claim, they include an attack on page 6 for nonce-respecting adversaries for AES-GCM which allows IVs longer than 128-bits at the birthday bound (i.e., $2^{64}$).

My question is why is GCM not susceptible to this attack for 128-bit IVs? I could understand this if the GHASH calculation for a 128 bit IV acts as a permutation (and if so, could someone please prove this)?


texts: See the RSA's $n = p q, e \text{ and } d$ from ssh-keygen

texts:
For learning purposes, how to get the RSA's parameters  (I use standard notation):

$n = p q $, where $p$ and $q$ are prime and $e$, $d$, such that $ed = 1 \ (mod\ \varphi (n)) $ when doing

ssh-keygen -t rsa -b 2048

i.e. how to get those parameters from the output:

----BEGIN PRIVATE KEY----
F2847XAPM...
...
----END PRIVATE KEY----

Note: this question is the reverse of What data is saved in RSA private key?: how to recover these parameters from the keys produced by ssh-keygen -t rsa -b 2048 (and not how to ask sshkeygen or openssl to output them from the start).


texts: substract points on secp256k - result as moved to N-1

texts:
I must perform calculate of substract two points:
Let $G$ be the generator point and;
$P_1 =[1]G = (x_1,y_1)$
$P_2 = [2]G = (x_2,y_2)$,
When I will subtract $P_1 - P_2$ -> I will move Point to N-1 with negative $y_1$ of $P_1$
second:
Let $G$ be the generator point and;
$P_5 =[5]G = (x_1,y_1)$
$P_2 = [2]G = (x_2,y_2)$,
$P_3 = [3]G = (x_3,y_3)$,
When I will subtract $P_2 - P_5$ -> I will take result $P_3$ with  negative $y_3$ of $P_3$
it looks like $P_2 - P_5$  it "similiar" to integer 2 minus integer 5 = we get minus 3 - and in this example -3 it is N-3 .
How to check that substract points cross the order of curve n? without checking  y is negative?
how to check that substract point is crossed by Point of Infinity and order of the curve?
Ps. N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141
order of curve -> maximum points.


texts: AES-- Brute force attack versus Known plain text attack

texts:
I am taking a codes and cryptography course and the following is a questions on a past exam that I could not and still can't solve:

Suppose that $E_k$ denotes the function that encrypts a message $M$ with AES where $K$ is the 128-bit key. Suppose that a cryptographer discovers a function $F$
so that $E_k(M) = F_{k_1}(F_{k_2}(M))$, where $k_1$ and $k_2$ are each 64-bits, and $K$
is easily computable from $k_1$ and $k_2$.

Explain how one would use this to mount a known
plain text attack on AES that is faster than brute-forcing the 128-bit key.

If someone could provide a step by step explanation of how to do this, it would be greatly appreciate! Thanks in advance!


texts: Encrypting multiple groups of data with separate keys in a single encrypted column

texts:
I will write this question using a database example, but please note this detail may be irrelevant.
Let's say I have data belonging to N clients stored in a single column of a database table. Each client has their own AES key used to encrypt/decrypt their own data.
In this setting, I have the understanding that if someone gets a copy of all values in the database, then brute-force attacks would actually become easier than if I had used just one single key to encrypt the entire column instead of this one-key-per-client approach.
If I had used just a single key for the entire data, the attacker would need to find that one key that would correctly decrypt all of the data. However, if one different key has been used to encrypt each of those N partitions, then time for finding at least one key that would decrypt at least one of these partitions would be reduced by a factor of N, since each candidate key being tested during a brute-force attack could match any of the N keys instead of having to match just one.
In this situation, it seems all that I have done was to reduce the search surface for finding a valid key from X to X/N.
Edited for clarification -
All the above mentioned, my question is: Is having a single column with data encrypted according to different keys could possibly make brute-forcing the data easier?
If yes, what would be a suitable approach to overcome this, i.e., for encrypting different groups of data using separate keys without reducing the difficulty of brute-forcing individual keys?


texts: Which cipher is used in the new 5G network?

texts: I think that the stream ciphers SNOW 3G and AES are used in 4G (LTE). But I can't find which cipher is used in 5G networks and how encryption is done. Is there any official documentation?


texts: Explain: An NTRU key for a lattice of dimension $d$ has size only $O(d\log{d})$

texts:
The associated NTRU lattice is of dimension $d=2N$.
The public and private key sizes are both of length $O(N)=O(d/2)=O(d)$.

So where does the $d\log(d)$ appear?

Thanks in advance.


texts: Basic encryption question: Why does 128/256 bit encryption have set length keys?

texts:
I've read about 128 and 256 bit encryption (I obvioulsy haven't read enough). I believe 128 and 256 refer to the size (in bits) of the keys used to encrypt.

Why are these of set length? Surely an encryption key can be any length you want to encrypt with? What part of encryption am I misunderstanding here? Or am I confusing encryption with hashing?


texts:
I am new to here, I was having some problems with a problem I am working on:

  "For each of the following variants of the definition of security for signatures, state whether textbook RSA is secure and prove your answer:

  (a) In this first variant, the experiment is as follows: the adversary is given the public key $pk=(N,e)$ and a random message $m$. The adversary is then allowed to query the signing oracle once on a single message that does not equal $m$. Following this, the adversary outputs a signature $\sigma$ and succeeds if $\operatorname{Vrfy}_{pk}(m,\sigma)=1$. As usual, security is said to hold if the adversary can succeed in this experiment with at most negligible probability.

  (b) The second variant is as above, except that the adversary is not allowed to query the signing oracle at all."

The construction for $\sigma$ is:

$$\sigma=m^d \mod N,$$ where $(N, d)$ is the secret key.

And the $\operatorname{Vrfy}$ function is as follows: $$\operatorname{Vrfy}_{(N,e)}(m,\sigma)= \begin{cases}1 & \text{if }m=\sigma^e \mod N \\ 0 & \text{otherwise}.\end{cases}$$

Since the known attacks on textbook-RSA signature forgery arise from two things:

A no-message attack: if the adversary has access to a signing oracle and a public key, he can sign an arbitrary message.
If the adversary has two signatures on two different messages, he can get a third message that is the product of those two messages and sign it with the product of the two signatures and it would be valid.

Would this be a good proof to show how a.) is secure:

The adversary uses the signing oracle to get a signature on $m_1$, so he gets $\sigma=m_1^d \mod N$, where $d$ is the secret key. Now he should be able to take the discrete logarithm of $\sigma$ to find $d$, but that is a hard problem, so the algorithm to forge this signature by finding the secret key is at least as hard as the DL problem, so the probability is negligible.

And my intuition is that b) is also secure, but I don't yet know how to go on about proving it formally.


texts:
Consider a RSA group $Z_N$ for $N=pq$, where $p,q$ are large prime numbers. Under strong RSA assumption, can an adversary efficiently compute the inverse of a random element $z$ from $Z_N$ without access to $p,q, \phi(N)$? Mathematically does there exists efficient algorithm $\mathcal{A}$ s.t

$$
\mathbb{P}\left( z.u=1,\quad z \leftarrow Z_N,\; u=\mathcal{A}(x,N) \right) \geq \text{neglible}?
$$

PS: I am learning cryptography so my notations are quite shaky.


texts: If you use an AES key just once, do you need to use IV, and/or pad the message?

texts:
I am developing an application that is going to use AES encryption.

Since it is going to use a different key for every message encrypted...

Would it be secure to use a constant IV? (i.e null bytes)
Would it be secure to not pad the encrypted message?


texts: Formal definition of (perfect) forward security/secrecy

texts:
In recent weeks the concept of (perfect) forward security/secrecy has
been mentioned a lot, primarily in the context of the shocking
revelations about NSA eavesdropping. As far as I'm aware, this concept
was introduced by C. G. Günther in [1].  Unfortunately [1] only sketches
the concept but does not give a security definition.  The survey [2]
gives a formal security definition only for forward secure
pseudo-random generators. The textbooks [3, 4, 5, 6] all don't even
mention the concept, and the relevant Wikipedia article is near
unreadable.

Could somebody please point me towards a formal definition of
(perfect) forward security/secrecy?

C. G. Günther, "An Identity-based Key-exchange Protocol".
G. Itkis, "Forward Security: Adaptive Cryptography: Time Evolution".
J. Katz, Y.   Lindell, "Introductin to Modern Cryptography".
O. Goldreich, "Foundations of Cryptography".
J. Hoffstein, J. Pipher, J.   H. Silverma, "An Introduction to Mathematical Cryptography".
D. R. Stinson, "Cryptography: Theory and Practise".


texts: Perfectly secure cryptosystem as many keys as plaintexts

texts:
Is a cryptosystem perfectly secure if there are at least as many keys as there are plaintexts?

My guess is yes but I am not sure, new to cyptosystems


texts: An Elliptic curve cryptography implementation which can be terminated

texts:
I'd like to have an implementation of elliptic curve cryptography along the lines of secp256k1 which is secure until some information is published after which it is broken.

One idea would be to use elliptic curves over a ring $Z_n$ where $n=pq$ or perhaps $n=pqr$ where $p$, $q$ and $r$ are primes of similar size and the order of the curve over each factor is also prime. The factors would be small enough that discrete logarithms on curves over individual factors would be very practical but factoring $n$ would still be hard.

With the above construction the "order" of the ring would be a large composite which would be hard to factor so there wouldn't be a problem publishing that and the chances of happening across points for which the addition operation is undefined (hence leading to a factorization of n) is small.

These parameters could be used to implement a scheme which would be secure until the factorization of $n$ is published whereupon it is broken. Are there any problems with this scheme?

ByteCoin


texts: Is it safe to generate GCM/GMAC intermediate tags?

texts:
I would like to use GCM/GMAC in next manner:

abcd|Tag0|efgh|Tag1|ijkl|Tag2| ... |wxyz|TagN

The nuance is each tag I gonna generate is not from its last block but the all previous plain- or cipher text preceding last tag. Otherwise speaking, last tag let authenticate the whole received stream, for example:

Tag0 authentifies 'abcd'
Tag1 authentifies 'abcdefgh'
Tag2 authentifies 'abcdefghijkl'
TagN authentifies 'abcdefghijkl...wxyz'

I know that xor`ing of two tags together discards H and gives you some info about the internal cipher context.

So, my questions are:

Can xor`ed tags info be useful for any kind of attack?
What weakness does this scheme have?

Update. The full scheme of how I want to use GCM/GMAC

I have one randomly generated key
I have one randomly IV
I gonna encrypt and authenticate a bytestream of unknown length divided into blocks
After each block I gonna produce an intermediate tag that should authenticate all previous bytes of the stream
After intermediate tag generation, I gonna continue encryption flow further

Scheme from above with the single encryption function call may be considered as a scheme with separate calls but with the same Key, IV, and partially data.

Call 0:
'abcd'|Tag0

Call 1:
'abcdefgh'|Tag1

Call 2:
'abcdefghijkl'|Tag2

Call N:
'abcdefghijkl...wxyz'|TagN


texts: A situation where security by obscurity might be the best solution - or am I wrong?

texts:
Imagine the following situation. There is an application for a microcontroller-driven system. The profits are made from manufacturing and selling the device itself. However, it is expected, that the users can later download software-updates from a public website, and install it (using a USB-connection, for example).

Now, the problem is, if the updates were released as raw compiled binaries, anyone could just copy the hardware, and spare themselves the costs of a long software development.

Now, let the update be encrypted in some way, and the bootloader in the microcontroller (which is of course not part of the update, and will never be changed) The whole program sits in the internal flash which is protected against reading.

The problem is, there is so little space (measured in a few dozens of words or in best case up to maybe a hundred or so) in the bootloader that no cryptographically secure decryption algorithm can be implemented there.

So, let's release an update which has valid but random and nonsensical instructions inserted at random but pre-determined places. The bootloader knows it, and will remove them. The idea is, that even if an attacker knew this method (but did not knew the positions where these instructions are inserted), it would be near impossible to get the real program, as you cannot know you got the right one until you tested it (and even then, some hidden bugs might be still lurking if the "cracking" was not perfect).

The main objective in this scenario would be, to make it more time-consuming for the attacker to steal the software, than it would be to develop it on its own.

Is there an obvious flaw in this way of thinking?


texts:
I have two secret values $a$ and $b$ (i.e. they are arbitrary values). I mask them as follow:

$v_1=r_1a+r_2$

$v_2=r_1(b-a)$

where $r_1$ and $r_2$ are uniformly random values. I send $v_1$ and $v_2$ to a malicious server, and ask him to compute $v_1+v_2=r_1b+r_2$

Question: Given $v_1$ and $v_2$, can the server learn anything about $a$ and $b$?

Note: We know that if the server learns $r_1$ or $r_2$ it can figure out the values $a$ and $b$ too.

Edit: I consider modular operations, so they are done mod $p$ where $p$ is a large prime number. So $r_i$ is picked uniformly at random from the field $\mathbb{F}_p$


texts:
Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme.
I was wondering if there is somewhere a formal proof of IND-CCA security of Cramer-Shoup Lite encryption scheme.
Any help would be appreciated.


texts: Schnorr protocol: how does malicious verifier win?

texts:
My question is about the challenge space size in Schnorr protocol. To be precise, I feel I've read all the Internet (twice) and I still don't understand why is it bad to allow challenge space to be large (say, why one shouldn't let $\text{Challenge} \in \mathbb{Z}_q$)

I'm interested only in situation of honest prover $P$ and malicious verifier $\tilde{V}$.

To settle the notation, recall that (one round of) Schnorr protocol has the following form:

Prover generates random $r \in \mathbb{Z}_q$, calculates $\text{Commit}=g^r \pmod p$, then sends $\text{Commit}$ to verifier.
Verifier generates $m$ random bits and forms the number $\text{Challenge}$ from them (thus $\text{Challenge}$ is the random number ranging from $0$ to $2^{m} - 1$), then sends $\text{Challenge}$ to prover.
Prover calculates $\text{Response} = r+s \cdot \text{Challenge} \pmod q$, then sends $\text{Response}$ to verifier.
Verifier checks that $g^{\text{Response}} = \text{Commit} \cdot y^{\text{Challenge}} \pmod p$

where $y = g^s \pmod p$ and $s$ is the prover's secret.

The simulator for this protocol is as follows.

The algorithm generates random $\text{Response} \in \mathbb{Z}_p$.
The algorithm asks verifier for the number $\text{Challenge}$ and receives it.
The algorithm sets $\text{Commit} = g^{\text{Response}} \cdot y^{-\text{Challenge}} \pmod p$
The algorithm appends $(\text{Commit}, \text{Challenge}, \text{Response})$ to the transcript.

The standard answer to my question is: if $\text{Challenge}$ is pseudorandom -- namely, depends on $\text{Commit}$, say, is equal to $\text{hash} (\text{Commit} || M)$ -- this simulator protocol cannot work, since at step 2 it requires the knowledge of parameter generated at step 3. There are no other simulators known for this protocol, so in the case of malicious verifier there's just no simulator. And since any ZK-protocol has simulator, the conclusion follows that malicious verifier case is not ZK.

Question 1. However, I still don't get how exactly can malicious verifier extract some information. Okay, there's no known simulator for malicious verifier case -- well, how does it help him?

Question 2. What about the challenge space size? Mao, Wenbo in their "Modern Cryptography" state that, thus, because of this simulator argument, $\text{Challenge}$ space size should NOT be large (don't get the logic again) ($\text{Challenge} \in \mathbb{Z}_q$ is prohibited)  and state that the best choice is $\text{Challenge} \in [0, \log_2 p)$ (or, equivalently, $m = \log_2 \log_2 p$). Why such an odd and strange value?


texts: Is there a library that output LFSR images given parameters?

texts:
I'm looking for a library that given parameters; feedback polynomial, initial values then it will produce $\LaTeX$ / Tikz codes to include in Latex documents or LFSR images. Is there such a library?

This Question and answer are provided to test the limits of this Meta question.


texts: How are the points in an elliptic curve over the finite field calculated?

texts:
For the elliptic curve with equation $y^2 = x^3 + x + 0 \pmod{13}$ in the finite field, how are all the points in this curve calculated. See the image below for an example created via https://graui.de/code/elliptic2/.

The above images shows 20 points. How are the coordinates of these points calculated?


texts:
Writing my last question, I saw the hash-signature tag.

I tried to research it best I could, but I'm simply overwhelmed in this field.  I don't think it means to simply hash data before signing, but any detail beyond that is beyond me.

Is ed25519 a hash signature with respect to the tag?  If so, is it believed to be resistant to quantum computers?


texts: Unconditionally secure block cipher for a finite number of blocks

texts:
I am wondering if someone can point me toward a block cipher that provides unconditional security for only a bounded number of encryptions.  For example, you can encrypt $h > 1$ length $n>1$ blocks with unconditional proof of security, but encrypting more than $h$ blocks will break the security of the whole system (or perhaps it can continue to remain secure, this matters less).
Does such a block cipher exist, and if so can you point me toward the relevant literature or implementations?  In particular, I am assuming that if the secret key can be represented with $d$ bits, then $hn > d$, so the cipher can encrypt more bits (with unconditional security) than was required for storing the key.


texts: Generating shared secret random permutation

texts:
There are three blind card game players. Each player does not trust any other, even prejudicing other two players may not be blind, or there may be others in the room, peeking at their cards.

In order to protect from glimpsing their hands, each player puts each of his cards into separate locked box, each box having its own key. Owners know which box holds which card, while others don't. In other words, players make a HMAC-SHA256 hashes of strings in form 'card_value:commonly_agreed_public_salt' with random key for each card, and then announce each other list of the hashes they posess.

When player makes a move, he moves one of locked box he owns to the middle of table and discloses the key, so everyone sees what card is inside. In other words, when making a move, player discloses HMAC key used to hash card value, and card value itself. This way other players can verify that this card was really owned by him.

I hope this approach makes it impossible for all the observers in the room, if any, to get any information, other than count of cards in posession of each player, am I missing something?

Now I'm stuck in how should I design retrieval of additional or initial cards from deck. I guess I should make use of preseeded PRNG similar to Mersenne Twister, to avoid duplicates, but how to make seed both secret, so one cannot simply traverse all the deck to know all the cards in the future, or to know which cards were picked by other players, and shared, so everyone will get same results while grabbing cards from deck.

Any ideas on this?


texts:
Do any methods exist whereby a "hash" can be embedded in the "document" it hashes?

What I mean is this. Say I have a given plaintext T. I wonder if there is a method to craft (i.e. not discover as a fluke) a "document" D being some combination  (e.g. a concatenation) of T and a hashvalue h, where h is H(D), H being some hash function.

Perhaps a simpler way of phrasing this is: Is there any way to make a document contain its own hash, under the constraint that the document must, apart from its own hash, contain a given plaintext?

Is this possible in theory? In practice?

This question is somewhat different from this one, in that I am assuming a given plaintext T, whereas that question asks if any T can be crafted (or found).


texts: Lower bound for the size of prime factors?

texts:
We all know classic RSA and that we should pick moduli of at least 2048-bit length to get decent (112 bit) security.

Now there's also multi-prime RSA, which can yield significant speed-ups using the Chinese Remainder Theorem (CRT).

However, the security considerations for this aren't well-known to most people, so I'm asking here:
Given a security level of n-bits, what's the minimal size the factors of a modulus need to have in order to achieve that level?

Please note, that side-channel attacks and similar attacks on bad choices of the primes should not be exploited here.

If it's not possible to give a generic strategy for all security levels, concrete numbers for $n\in\{112,128,192,256\}$ should be included.

As for my own research, I realize that the ECM is the best method at factoring and that it has a similar run-time behavior to the quadratic sieve, but actual numbers and security estimates are sparse and that's what I'm interested in.


texts: Is there a concept of embedding degree for non-pairing based elliptic curves?

texts: From this post, I learned the concept of embedding degree. Intuitively, if embedding degree of an elliptic curve $E(F_p)$ is $k$, it means there is a way to transform points in $E(F_p)$ to $F_{p^k}$. Is the concept of embedding degree only valid for pairing-based elliptic curves, or does the same hold even for non-pairing based elliptic curves?


texts:
Read the Reference for Simplified AES ( S-AES )

  Q1 Explain how the S- box is constructed  taking example $b_0b_1b_2b_3=1010$

What I did

$\begin{bmatrix}
1 &0  &1  &1 \\
1 &  1&  0&1 \\
 1&  1& 1 & 0\\
0 &1  &  1& 1
\end{bmatrix}
*\begin{bmatrix}
b_0\\
b_1\\
b_2\\
b_3
\end{bmatrix}+\begin{bmatrix}
1\\
0\\
0\\
1
\end{bmatrix}$

$= \begin{bmatrix}
1 &0  &1  &1 \\
1 &  1&  0&1 \\
 1&  1& 1 & 0\\
0 &1  &  1& 1
\end{bmatrix}
*\begin{bmatrix}
1\\
0\\
1\\
0
\end{bmatrix}+\begin{bmatrix}
1\\
0\\
0\\
1
\end{bmatrix}$

$= \begin{bmatrix}
(1011\times1) \bigoplus (1011\times0)\bigoplus (1011\times1)\bigoplus (1011\times0) \\
(1101\times1) \bigoplus (1101\times0)\bigoplus (1101\times1)\bigoplus (1101\times0)\\
(1110\times1) \bigoplus (1110\times0)\bigoplus (1110\times1)\bigoplus (1110\times0)\\
(0111\times1) \bigoplus (0111\times0)\bigoplus (0111\times1)\bigoplus (0111\times0)
\end{bmatrix}+\begin{bmatrix}
1\\
0\\
0\\
1
\end{bmatrix}$

$=\begin{bmatrix}
1011 \bigoplus 0\bigoplus 1011\bigoplus 0 \\
1101 \bigoplus 0\bigoplus 1101\bigoplus 0\\
1110 \bigoplus 0\bigoplus 1110\bigoplus 0\\
0111 \bigoplus 0\bigoplus 0111\bigoplus 0
\end{bmatrix}+\begin{bmatrix}
1\\
0\\
0\\
1
\end{bmatrix}$

$=
\begin{bmatrix}
1011 \bigoplus1011 \\
1101 \bigoplus1101\\
1110 \bigoplus 1110\\
0111\bigoplus 0111
\end{bmatrix}+\begin{bmatrix}
1\\
0\\
0\\
1
\end{bmatrix}$

$=\begin{bmatrix}
0 \\
0\\
0\\
0
\end{bmatrix}\bigoplus\begin{bmatrix}
1\\
0\\
0\\
1
\end{bmatrix}$

Im getting S-box transformation of $1010$ as $1001$ . Where am i doing wrong ?

  Q2 Also Explain the meaning of the statement and its relevance in construction of S-Box
  " The addition and multiplication in the equation above are being done modulo 2 (with XOR), but not in GF(16)


texts: Constant number of rounds in Yao's Protocol for semi honest adversaries

texts: According to me, every OT takes a constant number of rounds and since we have to do an OT for every input of one party, we'll have to do O(n) OTs which would correspond to O(n) rounds. But I have read at various places that the number of rounds in Yao's Protocol is constant. Am I missing something?


texts:
Blowfish has a large key setup penalty, except is fast once it gets rolling.  I believe that before AES optimizations became commonplace, it was faster than AES after the initial key setup.  It's top speed once it gets rolling is good for bulk encryption, except it has a 64 bit block size.  Would the following address the block size limitation in terms of bulk encryption?
You encrypt the first 64 bit block with all three keys.
You then take the first key and grab the next block starting at bit 33 to 97.  After that you encrypt blocks 98-162, 163-227, etc., progressing 64 bits at a time after the initial half-step.
You then transpose the bytes of the intermediate ciphertext 128 bits at a time across the entire hard drive, specifically mixing across the two 64-bit blocks.  You could use a static byte level transposition, odd byes in one block and even bytes in the other.  I'm looking into other ideas, such as a matrix, except for now I'm still at a static or possible key-based columnar transposition for now.
You then take the second key and grab the next block starting at bit 17 to 81.  After that you encrypt blocks 82-146, 147-211, etc.
You then transpose the bytes of the intermediate ciphertext 128 bits at a time, specifically mixing across the 2 64-bit blocks.
You then take the third key and grab the next block starting at bit 9 to 73.  After that you encrypt blocks 74-138, 139-203, etc., progress 64 bits at a time.
Does the key staggering complicate the MITM attack?  I'm trying for triple 256 Blowfish with defense against the 64 bit block size and possibly even defense against the MITM attack.


texts: Is AES ECB mode with salt and frame counter still comparatively weak?

texts:
Many advice against using AES in ECB mode as it always produces same cipher text for a given plain text.
That shortcoming can be addressed by using salt appended to original message so that the resulting cipher text is different each time , the receiver can then decyrpt the cipher text and discard the salt keeping the original message
However this is susceptible to replay attacks, but that can be mitigated further by using a frame counter in the plain text message so that the receiver knows if the message is being replayed by a unauthorized sender.
So the result would be
Encrypt[Counter + Message + Salt] ===> CipherText ==> Decrypt[CipherText] ===> Counter + Message + Salt.
That strategy seems sound to me , are there any known flaws that advise against using it ?


texts: Zero padded signatures in the Bleichenbacher attack

texts:
I'm studying this attack and i have some doubts about it; let me explain with an example.

Here is my decoded signature:

00 01 FF .. FF .. 00 ASN1 HASH

I forge a decoded signature like this:

00 01 FF .. FF .. 00 AS1 HASH GARBAGE

and than I calculate the cube root in order to obtain the RSA encoded signature.

The cube root resulted from this attack has always a number of bytes lesser than the signature key (for example, RSA1024=128bytes) though. A signature properly padded has always 128bytes.

Why does RSA accept a 0x00 padded cube root as encoded signature? Couldn't a check like this (leftmost bytes != 0x00) be used to avoid this type of attack?


texts: What if Eva knows the value of S or C in RSA?

texts:
we all know the RSA-authentication but I have some question about the security of the system if Eve knows the value of:

1) S

2) C

3) d

I think that RSA is not less secure if she know S, but it is less secure if she knows C or d. Am I right? Why?


texts: Can I Modified AES for enhaced security of WPA-2?

texts:
I have topic for my research paper is modified AES algorithm for enhaced security of WPA-2 , it posible ? what i should learn ?

thanks


texts:
I have an 8051 microcontroller with a radio that can send packets with up to 32 bytes and I want to have the messages encrypted. It is a sensor network so I really only want to send one packet per message to have the least power usage for the battery operated nodes.

I am trying to figure out how to do something useful and secure, the microcontroller in question has AES acceleration by way of a Galois field calculator so that was my first stop, however the messages are mostly not changing much so ECB mode will expose too much by not changing many times and adding an IV will essentially limit me to 16 byte messages since I'll need 16 bytes for the IV and 16 bytes for the encrypted message.

One option I thought of an believe is insecure except that I don't know by how much is to have 16 bits of a random number and a 16 bit counter in the first 16 bytes, encrypt that as ECB and then chain the output as a bastardized CBC to the second block. This means I will be transmitting 32 bytes all the time and the IV will be faked inside the packet but the internally changing 32 bits do not sound like a good enough protection.

Another option I started to consider is a stream cipher, in this case Salsa20 which seems to have a sufficiently fast and sufficiently small implementation and it only requires 8 byte nonce and I can use it with either 256 bit (32byte) key or a 128 bit (16 byte) key. This means I only lose 8 bytes to the nonce/IV, the block number will always be zero as I never need to send more than 32 bytes out of the 64 byte stream output.

The later sounds like a better compromise overall. I will "lose" the 8 byte nonce from the packet but will probably gain a better security.

I'd appreciate any thoughts on what is preferably between the two and what may be other and better options that I didn't consider.


texts: Would $\mathrm{LLL}$ give us a hint to solve the $\mathrm{SIS}$ problem?

texts:
I know that the $\mathrm{LLL}$ algorithm can find a short, not necessarily the shortest, basis in polynomial time.
My question is: if we construct a lattice from $\textbf{A}$ and then run $\mathrm{LLL}$ on the lattice, would it help in finding the solution or clue to find the solution to the $\mathrm{SIS}$ problem (especially for small dimension matrices)?

$\mathbb{Z}^{n}_{q} = n$ dimensional vectors modulo $q$ (for
simplicity say, $q$ is prime and $n = m$)
$\textbf{Goal}$: find nontrivial short vector $z \in \mathbb{Z}^m$
such that:
$\begin{pmatrix}\\ \dots \text{A} \dots \\ \\\end{pmatrix} \times
 \begin{pmatrix}\\z\\\\\end{pmatrix} = 0 \in \mathbb{Z}^{n}_{q}$
Note that $\textbf{A}$ is a $n\times m$ matrix and $z$ is a $m \times
 1$ matrix or vector.

I understand that $\mathrm{LLL}$ solves Merkle–Hellman knapsack cryptosystem. But it is different from $\mathrm{SIS}$ problem.


texts:
I am using SSHA512 to encrypt email user's passwords. Manually doing this works using doveadm from dovecot. But I can't seem to implement this in my mail client. I can, however, use SHA512.
Is SHA512 less secure than SSHA512?


texts: Properly securing a private key for remote storage

texts:
I am attempting to secure a private key for remote storage on an untrusted device. Here are the parameters and my assumptions, I'd like to confirm I'm correct with them.

The keypair that I wish to encrypt is generated with ECDSA using the P-256 curve. My understanding is that this curve has 128 bits of security.

I give the user a Diceware passphrase (using cryptographically secure entropy) consisting of 10 words. This has 129 bits of security (12.9 bits per word).

I use HKDF with SHA-256 (no salt, no "info" label) to turn this passphrase into an actual key. The WebCrypto API dictates that I also specify the algorithm I intend to use this key for. I specify AES-CTR with a key length of 128 bits. The derivation function then outputs 128 bits of data (presumably truncated from 256 bits from the SHA-256 HMAC used by HKDF). Should I use the full 256 bits here instead?

Finally, I wrap the key using AES-CTR with a new empty 16-length byte array counter and a length of 128. According to the WebCrypto docs that I could find, length is a value from 1 to 128. What does this length represent and am I using it correctly?

In conclusion, my assumptions: The passphrase has 129 bits of security, it gets fed to a key derivation function that preserves 128 bits of security, and then this 128-bit key is used with AES-CTR which I'm hoping someone can confirm preserves the 128 bits of security as well.

Therefore, can I conclude that the encrypted private key being public is as secure as the public key being public? Deriving the private key from the public is 128 bits of security hard and so is decrypting the private key.


texts:
All examples of one-way functions I have see till now are closely related to the assumption that $NP\neq P $ (or even weaker ones, such as $UP\neq P$), but why not considering the theorem $P\neq EXP$?

In particular, why not building functions that in one way are in the class $FP$ and the inverse function computable in $FEXP$ (the class of functions extending the class $EXP$)?


texts: DES: histogram differences between plaintext and ciphertext

texts:
Using CrypTool I encrypted a plaintext with "DES CBC" and I genereated the histogram of plaintext and ciphertext.
The histogram shows the relative frequency of each of the characters in the document.

When I did the same with "Caesar" cipher based on online tutorials, it was possible to find the correlation between some characters comparing their frequency that I could see in their histograms.

But that it is not possible for DES. I try to find out why this is not possible. What properties of the DES are responsible for this?


texts: How do I create a secure encryption scheme using addition?

texts:
You have a 4 number long PIN code with each number ranging from 0 to 9 which you wish to encrypt. You are then given a random 4 digit number ranging from 0 to 9999, which when added to the original PIN should give out a perfectly secure encrypted number.

Now clearly, just adding the two numbers would give an uneven distribution (a Gaussian curve), as if for example the PIN was 0000 and the random number was 0001, you can rest assured that the original PIN is either 0000 or 0001, while if both integers add up to 9999, there are 19998 possible outcomes.

So my initial thought was that applying the mod of 10000 (because there are 10000 possible combinations) to the sum should ensue an even distribution, making this encryption scheme perfectly secure. Now I honestly really don't know how to prove this, but my main question is how can you convert this somewhat meaningless number back to the original PIN? Is this actually (maybe not effective) perfectly secure? The point of this exercise is that the two users only have common knowledge of the random number, so I don't think any modulus exponent tricks are accessible.


texts: Can it be done? Securing physical badges with cryptography

texts:
I need to hand out physical access cards to a group of people. My main objective is to guarantee at every location where this cards will be checked that no information in the card has been modified. I print those cards so I have all the user information (name, lastname, ID number, etc).

My idea is to use some sort of algorithm to input all this data and generate a maximum of 15-20 digit barcode that I can print in the card.

The cards will be checked using scanners similar to those used for passport control, which means that the operator will have the ability to obtain all the information in the card by OCR.
Without distributing my input algorithm (and risking someone else being able to replicate it), is there a way to have him check that no information has been modified on the card?

I'm open to all suggestions regarding my need as nothing is implemented yet. However, I cannot connect the verification points with a central server for checking, they are remote locations with no internet. The cards should hold data on themselves that allows to verify that no data has been modified. The cards don't have chips or magnetic stripe, so I'm locked to using OCR.

Any solutions?

Thanks in advance!