texts: Sakumoto 3-pass MQ IDS Zero-Knowledge proof

texts:
In this paper: Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials
it is explained in Theorem 2 that the 3-pass protocol is statistically zero knowledge when the commitment scheme Com is statistically hiding.
Then, there is a proof Proof sketch. The fact is that after that it is explained that:

"The details of the proof are given in the full paper, where we
formally construct a blackbox simulator S which has oracle access to a
cheating verifier CV,and outputs a successful transcript with
probability 2/3. Furthermore, the distribution of the output of S is
shown to be statistically close to the distribution of the real
transcript."

Does anybody know where this full paper is?


texts: Why is the Pedersen commitment perfectly hiding?

texts:
I learned today about the Pedersen commitment scheme.

A quick reminder (I know there are some variants of this scheme, so I will present the one I learned about):

Public parameters - 2 primes $p,q$ such that $p=2q+1$, and 2 elements $g_1, g_2 \in \mathbb{Z}_p^*$ of order $q$ (i.e $g_1,g_2$ are generators of a q-ordered sub-group of $\mathbb{Z}_p^*$).
Secret parameter - $s \in \mathbb{Z}_q$
The scheme - $P$ chooses $r \in \mathbb{Z}_q$ at random and sends the commitment $C = g_1^s g_2^r \pmod p$. Then $P$ reveals $s',r'$ and $V$ accepts iff $C = g_1^{s'} g_2^{r'} \pmod p$.

I read that the scheme is perfectly hiding (i.e - even an unbounded adversary cannot reveal $s$ given only the commitment $C$). Why is that true?

When I was asked if even an unbounded adversary can learn anything, I thought that such adversary can iteratively try possible values of $r,s$ until he finds such values that satisfy $C = g_1^s g_2^r$ (I was apparently wrong of course). Why isn't that correct?


texts:
Two or three years ago, I was reading something interesting, but then I lost the paper. The paper described building secure and fast P2P networks (not like tor or I2P).
Unfortunately, I only remember some parts of the protocol/algorithm:

Peer logical address not equal to physical address, actually logical address is public encryption key.
When sending message through peer tunnel we encrypt by all public keys of peers in tunnel consequentially $(key_0(key_1(...key_N(data))))$
Unable to detect actual sender and receiver by analysing packet data.
Also, sender cannot find receiver and receiver cannot find sender of message.
Unable to detect if next peer is last or previous is first in peer sequence.

What paper was this?


texts: Multi-party decryption, no central decrypter

texts:
Recently a bank had a costly mistake that resulted in their master private key being exposed.
Through this thread, I learned about multi-party key storage with Adi Shamir's secret sharing scheme as the basis, very cool.
In the naive setup, there's still a person/machine that must do the final decryption which knows the full key.
What scheme(s) allows no central decrypter?
A guess I have is two or more 'groups/keys' separately encrypt/decrypt the message so no one group can ever have the keys to the kingdom.
Or is there a way for the final decrypter to decrypt w/o actually knowing the master key such that only one Adi Shamir scheme is necessary?
Thanks!


texts:
How would you prove that Huffman coding $C$ is a prefix code, i.e $$\forall x,y \in C,\  \forall z \in \lbrace 0,1\rbrace^*,\ x\not=y||z$$

Using induction according to the number of items to code? The base step would be easy, but I don't know how to prove the inductive step.


texts: Supersingular isogeny Diffie–Hellman key exchange (SIDH) Library Support AES-256?

texts:
In the version 3.0 of the SIDH library, it implements SIDH/SIKEp503 (AES-128) and SIDH/SIKEp751 (AES-192) only.

Are there plans to incorporate AES-256?

Nathan Aw


texts:
Consider the NMAC construction:

This is a proposed exercise in my notes:

  Assume F is a PRP with $n = l(n)$. Is it secure to replace $k_0$ by $F_{0^n}(k_0)$ and $k_i$ by $F_{0^n}(k_i)$?

In principle, I think I should prove it is not secure. My second guess is that probably I should find some non-prefix free query. However, I didn't find a solution. Any hints?

Here is my definition of PRP:


texts: Is this scheme to derive multiple keys secure?

texts:
I need a cryptographic scheme to generate a deterministic chain of private keys that look random to outside observer but can always be reconstructed from a single root key, also:

Neither private keys nor their corresponding public keys should contain any information about each other.
In case of some private key leaking it should be impossible to reconstruct the subsequent keys (except for the root private key of course)

Here is my solution:

val privateKey0 = HMAC-SHA256(key: rootPrivateKey, data: "Chain")
val privateKey1 = HMAC-SHA256(key: rootPrivateKey ⊕ privateKey0, data: "Chain" || SHA256(privateKey0))
val privateKey2 = HMAC-SHA256(key: rootPrivateKey ⊕ privateKey1, data: "Chain" || SHA256(privateKey1))
...

Public key is computed as curve point multiplication on EC secp256k1:

val publicKey0 = privateKey0 * G(secp256k1)

Now I'm not a trained cryptographer so I want to ask if this scheme is viable? Are there any obvious flaws? If yes, how can it be improved?


texts:
I read from here that,
https://tools.ietf.org/html/rfc7296
it mentioned,
2.15.  Authentication of the IKE SA
the initiator
signs the first message (IKE_SA_INIT request), starting with the
first octet of the first SPI in the header and ending with the last
octet of the last payload.  Appended to this (for purposes of
computing the signature) are the responder's nonce Nr, and the value
prf(SK_pi, IDi').  It is critical to the security of the exchange
that each side sign the other side's nonce.
from part one(IKE_SA_INIT request), we have Ni, then we append Nr,
why we need to append the third part: prf(SK_pi, IDi') and then sign the msg?
why just signing Ni and Nr is not enough?


texts:
This is for a challenge at followthewhiterabbit.trustpilot.com:

  Knowns:

  The algorithm is AES (Rijndael)
  Blocksize: 128
  Keysize: 256
  You only need to find the first 6 bytes of the key, the rest are 0’s, so:
  [?,?,?,?,?,?,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
  All bytes in the key has an integer value between 0 and 16.
  The initialization vector is (base64 encoded): "DkBbcmQo1QH+ed1wTyBynA=="
  The text is just plain ASCII english

  The encrypted text (base64 encoded):

  [base 64 block follows]

Can I crack an AES string if I have all these parameters? If so, how should I do it?


texts: What Cipher Suite in this list is the worst to use

texts:
I have a list of cipher suites I captured using Wireshark. Which one of these cipher suites would possibly be the worst to use. Here is the list.

In my opinion, I choose the:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

to be the worst because it uses a 128 bit key and uses CBC instead of GCM cipher mode. Is there any cipher suite that would be less secure here compared to others in the list?


texts: Cryptography that lets you conceal a secret, but also alerts others of the exposure of the concealed secret?

texts:
Is there such a cryptography where I can prove that someone decrypted an encrypted string? Say I wanted to attach a Bitcoin private key in some type of digital container, but in order to open this digital container, I would need to break a digital seal.
I'm basically trying to find a digital equivalent of how a security wax seal works to make a letter tamperproof:

What is the digital equivalent of this? I can write down a bitcoin private key in the envelope and have a wax seal on it. But how do I do this via email?


texts: Privacy-Preserving relational databases: checking the existence of a record (or multiple records)

texts:
I would like to know if there exists a protocol which performs the following operation in a privacy-preserving fashion:

User $U$ wants to know whether a record is stored in the database. The primary key of the record is an id which is known by the user.
User $U$ sends a "private" query containing the record id.
The database server receives the private query, runs it in a privacy-preserving fashion and returns the "encrypted" result to user $U$.
User $U$ "decrypts" the result and learns whether the record is stored.

PIR for relational databases may work but I don't need to actually retrieve the record. I only need to know whether the record is there or not (0 or 1).

Does there exist such a protocol?

If so, is it extensible to queries containing a list of record ids?


texts: Explain mixing bijection with an example

texts:
I am reading whitebox AES. "Mixing Bijection" is one of the important definition. For example, I copy one paragraph here:

The look-up tables that incorporate bytes of round keys can be considered miniature block ciphers. The application of concatenated input and output encodings help these components achieve confusion, as defined by Shannon. To help
them achieve diffusion, linear transformations are also composed at their input and output (these compositions are done before the application of the concatenated input and output encodings). An invertible linear transformation is
referred to as a mixing bijection.

I have read the definition of bijection online, which is easy to understand. What means mixing bijection? Explain in "simple" English, better with an example.


texts: OpenSSL aes-128-cfb does not produce expected size

texts:
I try to implement aes-128-cfb myself for learning. To confirm whether my implementation is correct, I want to verify it with a well-known library such as OpenSSL. But then I noticed something strange when I try to use OpenSSL to encrypt.
I have file cleartext.txt with the following content:
This is cleartext that will be used to encrypt with OpenSSL.

Then I execute this command
openssl enc -aes-128-cfb -in cleartext.txt -K 48656c6c6f20576f726c642041455321 -iv 72616e646f6d20313662797465206976 -out output.txt

The strange thing is that the output file contains only 60 bytes. AES block is 16 bytes. The expected output size in byte should be multiple of 16. 60 is not multiple of 16.
Did I miss something important here?


texts: For SHA3-512, SHA512, and Whirlpool, which algorithm has least probability for collision and preimage collision?

texts: For comparing these 3 hash functions SHA3-512, SHA512, and Whirlpool. Which one is strongest against collision and preimage attacks. Are they fundamentally the same because of the same size output? Please disregard all other characteristics of the algorithms.


texts: Is an attacker of an cryptographic algorithm allowed to change order of sub-keys but not changing their number in attack? Would it be called an attack on broken algorithm of cipher?


texts: RSA like trapdoor permutations in Discrete logarithm

texts:
In RSA, given only $(n,e)$, where $n =pq$ and $e$ is the public exponent, it is hard to find $p$ and $q$. It also seems hard to find $d$. So we came up the RSA conjecture that is RSA defines a trapdoor one-way permutation. Namely, given,  $N,e$ defining $f,x \mapsto f(x)$ is easy; $y \mapsto f^{-1}(y)$ is hard; but $f^{-1}$ is easy given $p,q$ (or $d$).
In their lecture notes Goldwasser and Bellare, claims that;

Note that this trapdoor is a property the discrete logarithm problem did not have.

They have a trapdoor ( actually backdoor), at least since 92' the Gordon's work;
Designing and Detecting Trapdoors for Discrete Log Cryptosystems. The abstract;

Using a number field sieve, discrete logarithms modulo primes of special forms can be found faster than standard primes. This has raised concerns about trapdoors in discrete log cryptosystems, such as the Digital Signature Standard. This paper discusses the practical impact of these trapdoors, and how to avoid them.

and many, some listed in Is it possible to generate backdoored DH parameters?
So the question is

Is there proof of Goldwasser and Bellare's claim that discrete logarithms cannot have trapdoor permutations?
if not, the lecture notes are written in 2008, is there any advancement on this?


texts: Is it possible to securely combine multiple hashes without hashing them?

texts: Let's say we have 1000 files and 1000 already computed cryptographic hashes for those files. Now we want to derive a single hash that authenticates all of them. Is there a more efficient way to do this than just hashing the concatenation of all those hashes (and thereby presumably calling the hash round function about 1000 times), without sacrificing security? What about also verifying the sequence?


texts:
For one-way function $f$ I understand that $g(x)=0^{n}\mathbin\|f(x)$ is a one- way function with respect to $2n$, where there is $n$ bits of $0$ in the beginning and the output of $f$ in the second half.

However, is this also a pseudorandom generator? My first guess was that, because it is easy to find a number that could be an output from $g$, that it isn't pseudorandom. My understanding of pseudorandom generator isn't quite clear, but it seems based on the definition of computational indistinguishability that the distribution of $g$ indistinguishable from uniform, so does that make it a PRG?


texts:
My apologies if this is obvious, but the truth is that I am confused about this.
I am looking into RFC 8032 for test vectors for Ed25519, and I have some doubts concerning the information presented in section 7.1 in that document. At the top of this section one can find the following data:
SECRET KEY:
   9d61b19deffd5a60ba844af492ec2cc4
   4449c5697b326919703bac031cae7f60

PUBLIC KEY:
   d75a980182b10ab7d54bfed3c964073a
   0ee172f3daa62325af021a68f707511a

My understanding is that the secret key is a randomly generated string of 64 bytes, the first 32 bytes of which are then further manipulated. The resulting string is interpreted as an integer, according to some rules described in that RFC, and then used to obtain the public key by adding the selected base point to itself the number of times specified by the secret key.
My questions are the following:

As displayed in the RFC, is the secret key meant to be interpreted as an integer? If so, is the integer already displayed in left-to-right form - that is, with 9 being its most significant hexadecimal digit, and 0 its least significant one?

Regardless of whether it is displayed as an integer or a string, is this supposed to be after the bit manipulations that the RFC specifies that should be applied to the 64 bytes obtained by hashing 32 randomly generated bytes?

To put the two questions above in a different way, is the public key obtained by adding the base point 0x9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60 times to itself?

As for the public key, my guess is that what is displayed is the point in the curve obtained by adding the base point to itself as mentioned above, but subjected to the compression technique described in the document. Is this correct?


texts: Is "hash-then-XOR" a good way of incrementally hashing an unordered set?

texts:
Is hashing the individual items, and then XOR-ing the results together, a good way of uniquely hashing an arbitrary unordered set of items?

I am thinking of using hash-then-XOR since I want some sort of function that can compute the hash of a set incrementally: given the $H(S)$, I want to be able to calculate $H(S \cup \{x\})$ and $H(S \setminus \{x\})$ without knowing the elements of $S$. In my particular application it's assured that already existing elements will not be added to sets, and nonexisting elements will not be deleted from sets.

With hash-then-XOR, whenever an element is inserted or removed, its hash can simply be XORed onto the set hash, allowing identical sets formed by arbitrarily different series of insertions and removals to arrive at the same hash. This is due to XOR being commutative, associative, and its own inverse.

Is this sort of set hashing scheme secure, in the sense of preimage, collision, and second-preimage security? If not, can some other more secure scheme (perhaps hash-then-modular-addition?) have the same sort of incremental properties as hash-then-XOR? I am specifically asking for an incremental set hashing algorithm, where the hash can be updated as elements are removed and added to the set, without knowing the whole set. Schemes such as hashing a lexicographically sorted set won't work in this case.


texts:
This might be a dumb question but I will go for it.

Let's say we have a data set $D$ consisting of sensitive data, and we want to be able to match if a new piece of data $S$ already exists in $D$ ($S\stackrel{?}{\in} D$) or not, and we want to be able to know which of the entries matches $S$ in $D$.

Our approach consisted of a 1-way cryptographic hash such as SHA256. However, since the dataset is relatively small (about 4 million rows) we can easily reproduce the full dataset and in effect "decode" the original meaning of the hash.

So I was wondering if it exists and algorithm that takes two parameters

$d,b$: is a pair of some sensitive data and
$s_i$: a random salt $i$

a cryptographic algorithm $C$ and a comparator $M$ such that

$M(C(d, s_1), C(b, s_2)) = \text{true}$, if $d == b$,

and

$M(C(d, s_1), C(b, s_2)) = \text{false}$, if $d != b$

So does such an algorithm or anything similar exist?


texts:
I have read everywhere that base64 encoding of unique binary/hex values results in unique output.  The following two string encode to virtually the same output.

{"alg":"SHA1","typ":"JWT","iat": "Sep  8 2018  8:51AM", "exp": "Sep  8 2018  9:11AM"}

gives output:

eyJhbGciOiJTSEExIiwidHlwIjoiSldUIiwiaWF0IjogIlNlcCAgOCAyMDE4ICA4OjUxQU0iLCAiZXhwIjogIlNlcCAgOCAyMDE4ICA5OjExQU0ifQ==

while

{"alg":"SHA1","typ":"JWT","iat": "Sep  8 2018  9:10AM", "exp": "Sep  8 2018  9:30AM"}

gives output:

eyJhbGciOiJTSEExIiwidHlwIjoiSldUIiwiaWF0IjogIlNlcCAgOCAyMDE4ICA5OjEwQU0iLCAiZXhwIjogIlNlcCAgOCAyMDE4ICA5OjMwQU0ifQ==

The only the difference between the two is: ExQU0ifQ== and MwQU0ifQ== at the end of the output.

Only the times are different in the two strings; is that why the difference is so minute?


texts: How can I make sure non-open source programs are really using end-to-end encryption?

texts: Without going deep into math, is there a way to make sure that non-open source programs like WhatsApp, FaceTime, Zoom, etc. are really using end-to-end encryption instead of just 'regular encryption' (i.e. the server has the cryptographic keys)?


texts:
I don't want openssl to log my keys and passwords... but I don't use gpg as I need more manual control for my purpose. I also don't like gpg  and would like to use openssl without logging.

Does openssl too engaging in logging when I open the interpreter

  Openssl

My main question revolves around linux logging when others have access to my offline pc?


texts: What followed findings of A. Lenstra et al. concerning shared factors of practical RSA moduli?

texts: A. Lenstra et al. had a paper in 2012 "Ron was wrong, Whit is right", in which one reads: "What surprised us most is that many thousands of 1024-bit RSA moduli, including thousands that are contained in still-valid X.509 certificates, offer no security at all." Has that surprise been satisfactorily explained in the meantime? I'll be particularly interested in cases where the moduli had shared factors. I mean that seems to indicate a fairly high probability that back doors could have been involved in the software that generated such moduli.


texts: Pseudorandomness based on homomorphic multiplication property of Paillier cryptosystem

texts:
Given the instance $(n, g, \lambda)$ of Paillier cryptosystem with $\text{ord}(g) = n \lambda$ (symbols have their usual meaning), and $c = g^{na}$, is it possible to distinguish (computationally) $c' = g^{nab}$ from a random element in $\mathbb{Z}_{n^2}^*$, where $b \in_{R} \mathbb{Z}_{n\lambda}$?
I believe that given $g^{na}$ and $g^{nab}$, it is hard to find $b$ because that would imply security considerations against the homomorphic multiplication property of the Paillier scheme. Does the above mentioned pseudorandomness property also hold?

Could this property depend on the kind of primes chosen in $n = p \cdot q$?


texts: BB84 Why does Bob generate a random key?

texts:
I am quite new to this stuff so this question might be trivial. I was reading about bb84 and, as I understood it, after Alice sends $\psi$ Bob chooses a random sequence $b'$ and makes a measurement in either $X$ or $Z$ according to $b'$. After Bob does this he announces that he has received $\psi$ and both him and Alice compare the sequences $b$ and $b'$ discarding the terms for which $b \neq b'$.

What I don't understand: what would be the problem if, after Bob receives $\psi$, he simply announces this fact without choosing $b'$ and making measurements. In this case Alice communicates $b$ to Bob over a public channel and there are no bits to discard.

It seems that Alice has to communicate $b$ to Bob over a public channel in BB84, so why not do it after Bob claims to have received $\psi$?


texts: What is the difference between synchronous stream ciphers and asynchronous stream ciphers?

texts: What are the benefits and drawbacks of each?


texts: Is it possible to recover key used for blowfish encryption, if I have encoded and decoded string as well as initialization vector tables (bfp and ks0-3)? I don't know the length of the key.


texts: I have a Java card, which I like to learn more about by installing my own TPM on it. One, which I can kind of "kick the tires", install root keys, send different command to, and ... without fear of breaking anything or making it unresponsive. Does anyone know of a TPM implementation I can put on this card? when I put the card in the reader, my Windows 7 Device Manager lists it as NIST 800-73 PIV. I read some of the Bitlocker content, and it sounds like what I want but I am not sure how open it is as far as interfacing with it. What I mean is would I be able to freely implement my own functions inside the TPM at that point or not? That is basically my goal to implement my own functions/apps inside a TPM.


texts: How does one practically calculate the non-linearity of a multi-output boolean function like the AES s-box?

texts:
I am working on multi-output boolean function i.e. a function that takes an $n$-bit input and gives an $m$-bit output for all possible inputs (i.e. $2^n$ inputs).

To be more exact: I am trying to do a cryptanalysis of the AES 8x8 s-box, with the goal to learn the whole procedure of finding/calculating non-linearity.

Doing some research, I learned that I need to find the minimum hamming distance from all $n$ variable affine functions. Sadly enough, I don't  really grasp all of the math which would be required to find the non-linearity.

In the end, I’ld like to be able to calculate the Linear Approximation Table of the AES s-box. Can someone please explain how to build a LAT of the AES Sbox. How can I practically calculate the non-linearity of a multi-output boolean function like the AES s-box?


texts:
I want to create a smart house project, and in that I bought some simple
RF modules. Those modules don't support crypto out of the box  but I want to connect them to a device that I would program to use crypto (for example AES).

Now the question is since I would be sending a lot of same messages (digital I/O Pins) encrypted with the same password the output encrypted message would be the same. So if someone is sniffing the traffic he/she would be able to transmit that encrypted message and my C&C (command and control) device would think that the message is coming from the inside and do certain actions depending on that message. 4 Way handshake doesn't cut it since even without the knowledge what the message is it can be broadcast to achieve certain results.

Question: What is the best practice/crypto to use in this situation? Should I add a random string appended to my original message and on the other side parse that message and just pull out the info that I need?

Keep in mind that devices on all ends all low computing devices with low memory (some kind of Arduino if you will). So, I need a safe cryptographic solution where – even if the user can sniff the data – the user wouldn't be able to use it.


texts: Could eVoting on the bitcoin blockchain be done?

texts:
I'm basically a crypto noob (and not an english native), so please be indulgent :)

I thought about if you could realize an eVoting system with bitcoin.

I see 2 major requirements:

each citizen can only vote once
votes musn't be traceable

I imagined the government could give each citizen a private key (with their passport for example) and make the actual voting a multisig procedure, where you need to provide the government provided signature plus your own to sign your vote.

Now for my actual question (thx for your patience so far):

Is there some kind of math magic, that makes sure those 2 requirements are met? In other words: Could you, cryptographically use two private keys to sign a transaction, ensuring that one key was issued by a certain CA (= the government) without being able to trace this to the actual user (keeping the vote anonymous).


texts: How does blockmix in scrypt work? What is the meaning of the H function in scrypt?

texts:
I am trying to understand how scrypt works. I am referring to the Algorithm section of scrypt's Wikipedia page. There I find this BlockMix function:

Function BlockMix(B):
    (B0, ... , B2r-1) ← B
    X ← B2r−1
    for i = 0 to 2r − 1 do
        X ← H(X ⊕ Bi)
        Yi ← X
    end for
    Output ← (Y0, Y2, ... , Y2r−2, Y1, Y3, ... , Y2r−1)

Now, as far as my understanding goes, this means: expand an r-bytes block into its single bytes, namely, B0, ..., B2r-1. Set X to the last byte, and propagate some perturbation by updating X with H(X ⊕ Bi). Finally return the output bytes, somehow shuffled (first the even, then the odds).

What I don't understand is the meaning of that H function. It's nowhere specified what it is. I guess it is a function that inputs one byte and outputs one byte. Is that a commonly known function? H usually stands for hash. Should I just pick any random bijection between the numbers in [0, 255]?

Anyone answering my question might as well consider to add this information to the Wikipedia page, to help the next reader.


texts: HMAC tag to verify the key (verification in the reverse direction)

texts:
A quick question. Are there any problems with the following HMAC use-case:

We have two entities ($A$ and $B$), both of them have a secret ($A$ has $S_0$ and $B$ has $S_1$)

$A$ generates a random value $r$ and calculates the following tag: $t=HMAC(S_0,r)$
$A$ then sends $(r,t)$ to $B$.
$B$ calculates $t' = HMAC(r,S_1)$.

If the comparison $t' = t$ is true, does that imply that $S_0 = S_1$?

We are flipping the HMAC use-case around, instead of checking the authenticity of our message $r$, we are implying the reverse. And because HMAC is provable bound to the pre-image properties of the underlying hash, if the hash is secure, so is this use-cause (I did not write any formal reasoning or so, but my feeling is that if this is not true, then the security of the HMAC is not true).

Note that this is not true for encryption functions (mac then encrypt). CCA2 and ciphertext indistinguishability rule this use-case out (encryption is no authentication). But HMAC is an authentication scheme.

I just thought of this, so maybe I'm looking over something trivial.

Thanks!


texts: Multiple AES Key Derivation from a master key

texts:
I need cryptography advice regarding this issue.

Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses a single key to encrypt the secrets for all apps.

Let's say I want to create from the generic key, a key that is unique per application - so that secrets that are encrypted for a specific application will not be able to decrypt with the key of another application (this is the case when using a KMS). I'm looking for an algorithm to "derive" a key from the application name (the service account name, to be accurate), something like:

f(key, name) = key

Is there an algorithm that I can use? What is the best approach here?


texts: The utility of elliptic curve cryptography

texts:
Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve cryptography [specifically] without viable substitutes?

[Edit: I came across this question which gives some information, but I'm looking for more. Specifically, I would like to know how much better elliptic curve cryptography is/(would be) than more classical encryption schemes for the applications where elliptic curve cryptography is superior.


texts: Questions about indexing a hash output to compose a final key

texts:
Recently I have watched the video Multi-Precision Arithmetic for Cryptology in C++, at Run-Time and at Compile-Time (at 21:56 seg) :

The speaker says that to use a byte from the user key as a subscript of an array allows side channel attacks. My question is what if to use this during a key crunching stage:

Do

   HashOut = DoHash()

   FinalKey += HashOut[currentKeyByte mod KeySize]

   currentKeySize += 1

While (Len(FinalKey) < WantedSized);

Let's forget for a minute the widely known KDFs, okay? The idea behind the pseudo-code above would interfere in constant-time aspects?

If it does. What if to use the bytes from hashed key instead of the original bytes of the key?

Thanks in advance!


texts: Fiat Shamir transformation of zero knowledge proof

texts:
Consider the following three stage interactive zero knowledge proof

The prover sends some information $a$ to the verifier.
The verifier picks a challenge $c\in \{0 ,1\}$
Depending on the challenge, the prover responds with $r(c)$ that convinces the verifier of his knowledge.

Each round can be won with probability $\frac{1}{2}$ by a malicious prover and so we must play this for $k$ rounds till $\frac{1}{2^k}$ is sufficiently small.

The Fiat Shamir transformation replaces the challenge generation with a random oracle that generates $c$ instead. Let $i$ be the round number (we play $k$ rounds). Typically, one can use a hash function $c_i = H(p_{i-1}, a_{i-1})$ for this purpose, where $p_{i-1}$ is some input generated from prior rounds and $a_{i-1}$ is the previous round's commitment. The prover then generates a transcript of the following form after many rounds

$$T = \{a_i, c_i = H(p_{i-1}, a_{i-1}), r_i\}$$

It is not clear to me why this is secure. In each round, the dishonest prover can simply keep trying different $a_{i-1}$ until $H(p_{i-1}, a_{i-1})$ is the challenge he is prepared to meet. Since $c\in\{0,1\}$ (i.e. the range of $H$ is just $\{0,1\}$), this does not take him many tries. The prover will only include such challanges (which he is prepared to meet) in the transcript.

What exactly is the correct Fiat Shamir transformation that prevents this attack by a dishonest prover?


texts: Collision resistant hash function implies one-way function

texts:
I'm struggling to give a formal proof that $CRH \implies OWF$ using the definition below.

Intuitively, I see why a $CRH$ would be "hard to predict" and might be used as a $PRF$, but I'm unable to give a formal proof.

$\mathcal{H} = \{\mathcal{H}_n = \{h:\{0,1\}^* \rightarrow \{0,1\}^n \}\}$ is a $CRH$ if it can be efficiently sampled and
$$\forall_{A;PPT} \exists_N \forall_{n>N} \Pr_{h \rightarrow H_n} [A(1^n, h) = (x, x') \land x \neq x' \land h(x) = h(x')] = neg(n)$$

Proving the existence of $PRG$ or $PRF$s would suffice.

Related but answered question here.


texts:
I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately the master key will be unique¹.

My original plan was to simply set the nonce to 0. Assuming no collision happens when deriving the 128 bit AES key from the master key, this should as secure as conventional CTR, where the nonce is prepended to the message.

An alternative plan is to also derive the nonce from the master-key. This seems to offer two advantages:

It makes key-nonce pair reuse more unlikely, since now they have 256 bits and not just 128
It prevents some kinds of known-plaintext attacks, since the attacker now doesn't know the content of the counter-stream, effectively turning the nonce into some kind of secondary key.

Is there a problem with either scheme? Is the second scheme better than the first?

¹ assuming the 256 bit hashfunction I use is collision free


texts: Encrypting twice with same key gives back plain text

texts:
I read in the answer here that when encrypting twice the plain text with same key could result in plain text as shown below

$encrypt_{key}((encrypt_{key}(plain)) = plain $

Which block-cipher algorithms are they? What is this property called in general? Is it considered weak?

Edit 1 : the question is about block ciphers, not block cipher modes of operation
Edit 2 : added more clarity to the question through an equation


texts:
I'm reading a cryptanalysis on Blowfish, and I've come across something that I don't quite get. Let's denote

$$\delta = a \oplus a'$$

where a and  a' are bytes that cause a collision in some S-box when entered as the position to use in said box.

The structure of Blowfish looks like this:

with N+2 positions in P, where N is the number of rounds. Every zero represents one zero-byte. For each plaintext pair where
$$P \oplus P' = [0000\delta000]$$
we will get some corresponding ciphertext pairs where
$$C \oplus C' = [\delta000xyzt]$$
We denote
$$C = (L,R)$$
Now, the cryptanalysis claims that we have the equation
$$F(L \oplus P_{N+2}) \oplus F(L \oplus P_{N+2} \oplus [\delta000]) = [xyzt]$$
This is where I get stuck. I don't really see the connection, as the last position in the subkey array P is actually never part of any input to F(), except for in the decryption function, but I don't see how we end up with this algorithm that way either. Any ideas?

The article where I found the equation can be found here.


texts:
I have been recently considering becoming a cryptanalyst. I have moderate background in mathematics, but I am not sure if that is the case with breaking codes and cryptanalysis is just like in the movies. I have passion for puzzles in many forms and brain teasers, finding patterns etc. I have seen that there are contests with brain teasers that agencies such as GCHQ claim to use to screen candidates for code breakers. I don't generally know how do the things look with general code-breaking and I'm asking for some clarification.

Is being cryptanalyst synonymous with being a code breaker?

How much maths will I need? What knowledge will I need?

As someone said with maths Olympiads you use theorems as tools that you have to know well and all the tricks that come with them to do something at Olympiad.


texts: Security of XORing hashes vs concatenating

texts:
On this question https://stackoverflow.com/questions/5889238/why-is-xor-the-default-way-to-combine-hashes a couple of the answers say that xoring is a bad/insecure choice for combining hashes. However, most of them say that in regards to xoring two identical hashes.

If I want to combine a Keccak-256, Skein-256-256, Blake2b-256, and Groestl-256 hash, would it be more secure to concatenate parts of the hash, or to xor the hashes together?


texts: Where did Martin Hellman acknowledge Ralph Merkle's contribution to public-key cryptography?

texts:
I am trying to find the article to reference when discussing the Diffie-Hellman key exchange.

According to Wikipedia Hellman said that

  The system...has since become known as Diffie–Hellman key exchange. While that system was first described in a paper by Diffie and me, it is a public key distribution system, a concept developed by Merkle, and hence should be called 'Diffie–Hellman–Merkle key exchange' if names are to be associated with it. I hope this small pulpit might help in that endeavor to recognize Merkle's equal contribution to the invention of public key cryptography.

Any ideas where I can find the original article? The wikipedia link itself is dead.


texts: Working of Algorithm on SP network by Kam and L. Davida

texts:
I am reading the paper titled "Structured Design of Substitution-Permutation Encryption Networks". by John B. Kam and Georges I. Davida (1979)
They have presented and algorithm for constructing complete SP network

I am having trouble understanding this part of the algo:
"connect the output bits of partition i of stage j to the input bit 1 of each box in partition [in/k] of state j+1. Similarly, connect the output bits of partition i+q of stage to the input bit q of each box in [i/k] of stage j+1 where 1<=q<=k"

If someone can please explain with the help of an example.


texts:
I am currently trying to implement a AES-256 cipher according to this sepcificaciton:
http://techheap.packetizer.com/cryptography/encryption/spec.v36.pdf

As well as on Wikipedia and in the document these offsets for the shift-rows operation are given (depending on the key size):

Row  128 192 256
 1    0   0   0
 2    1   1   1
 3    2   2   3
 4    3   3   4

The example for 256-Bit encryption (page 26 onwards) obivously uses the same offsets (0-1-2-3) for all key sizes:

R[ 1].s_row   d4bf5d30e0b452aeb84111f11e2798e5 (given Example)
R[ 1].s_row   d4bf52aee0b411f1b84198e51e275d30 (my calculation with 0-1-3-4)

Extracting the rows:

Row#  0-1-3-4 calculation  example calculation
 1    d4 e0 b8 1e          d4 e0 b8 1e
 2    bf b4 41 27          bf b4 41 27
 3    52 11 98 5d          5d 52 11 98
 4    ae f1 e5 30          30 ae f1 e5

So the question is: What are the correct offsets: 0-1-2-3 or 0-1-3-4? If the latter is correct (what i believe) there is an error in this document or i missed the up-to-date version since 2003 is already a while ago...


texts: How to generate different hash values for same files/messages?

texts:
I was generating HashValue for contents in the file. I want a different hash value every time I wanna generate even if the file is the same.
I am using SHA256. For the same files, the hash value I am getting is the same. Is there any way to generate different hash values?


texts: What should be broken to break a cipher with perfect forward secrecy?

texts: What should be broken to break a cipher with perfect forward secrecy as a passive observer? RSA/EC analog, (EC)DHE or both?


texts: In network security, encryption and integrity done by the same algorithm that is AES-CCM in that MIC generated by CBC-MAC and encryption done by CTR mode. So suppose I want to do encryption with any stream cipher algorithm, can I use some hashing mechanism like HMAC separately for integrity purposes?


texts:
Consider a protocol, wherein Alice wants to send a message $M$ to many friends $F_1, F_2, \dots F_n$, from whom she has (some form of) public keys ($e_{F_i}$, with private key $d_{F_i}$). She does not want her friend Bob ($B=F_1$) to know that she sent the same message to her friend Charlie ($C=F_2$), and vice versa.

Alice wants to send out one single message, as opposed to distinct messages to every recipient. (Think for example a single email message, or publication on a website, as opposed to distinct emails)

One such scheme would be to encrypt the message with a symmetric key $K$, and attach a dictionary of ($F_i$: $e_{F_i}\{K\}$). In this scheme however, Charlie will notice the presence of a key for Bob (and vice versa).
Even when hiding the index $F_i$ in the dictionary, Charlie might be able to find out that Bob is in the list of recipients.

Is such a scheme possible? Is such a scheme possible, without revealing even the number of recipients?


texts:
I've always been interested in encryption but I have never found a good explanation (beginners explanation) of how encryption with public key and decryption with private key works.

How does it encrypt something with one key and decipher it with another key?


texts: $X_ {i_1}, . . . , X_{ i_ k} $ are IID random variables or not?

texts:
In this paper
secret
sharing is to distribute information (the secret) over
a set of participants such that the secret can only be reconstructed if certain authorized combinations of participants join their information. The set of authorized combinations is called the access structure.

Formally, the secret is modeled as a random variable S, and a secret sharing scheme
assigns a random variable $X_i$ to each participant $i$ in such a way that if $\{ i_ 1, . . . , i_ k \} $is an authorized
set of participants, then S is a function of $X_ {i_1}, . . . , X_{ i_ k}$  that is, $H ( S |X_ {i_1}, . . . , X_{ i_ k} ) = 0$;

Here my doubt is $X_ {i_1}, . . . , X_{ i_ k}$ are IID random variables or not


texts: Shor's algorithm for elliptic curve discrete logarithm problem

texts: Could someone write Shor's algorithm for solving the discrete logarithm problem and how it could apply to elliptic curves in a few, easy to understand steps? I have a basic understanding of quantum computing, but not enough to understand his paper.


texts: Why is Blum-Goldwasser not IND-CCA-2 secure?

texts:
Consider the Blum-Goldwasser encryption scheme as described on Wikipedia. I was told that it was not IND-CCA-2 secure.

I heard there was malleabilty, probably it has to do with XOR-ing. But I do not see the point. As stated in the Wikipedia article, in step 2 of the encryption, we choose a random element. So what we xor to the message looks totally different every time. How can we have malleability here?


texts:
I am working on an assignment and I am stuck with the last part of proving witness hiding for the protocol.

I have previously proved it is witness indistinguishable, and it has q (primer number chosen as in Schnorr's protocol) different values for the witness.

The protocol goes as follows:

To prove the witness hiding it is hinted to show two things:

1.) if an adversary computes a valid witness (w1', w2') for a conversation it will be a different one with a high probability

I assume this is just due to that fact of witness hiding, e.g. the conversation tells noting about which of the q different witnesses was used.

2.) But if such a different pair is computed, one can compute the dsicrete log of g1 base g2.

I am pretty much stuck on this part.

I get to a point where I have an equation like this
$$
g_1^{w_1}\cdot g_2^{w_2} = g_1^{w'_1}\cdot g_2^{w'_2} \text{ mod p}
$$

But where to go from here...


texts: Finding a keylength in a repeating key XOR cipher

texts:
In an old cryptography FAQ, I found the following step described for determining a the length of the key a cipher was repeatedly XORed against:

  Discover the length of the key by counting coincidences.
  (See Gaines [GAI44], Sinkov [SIN66].) Trying each displacement of
  the ciphertext against itself, count those bytes which are equal.
  If the two ciphertext portions have used the same key, something
  over 6% of the bytes will be equal. If they have used different
  keys, then less than 0.4% will be equal (assuming random 8-bit bytes
  of key covering normal ASCII text). The smallest displacement which
  indicates an equal key is the length of the repeated key.

The wording of the bolded text is the part I'm confused with. Given that my plaintext equals the string "This is a secret message", would I be comparing the first n number of bytes with a second set of n number of bytes that is offset from the first (e.g. the xor'd version of "Th" with "is", if I was comparing 2-byte chunks of the cipher against itself)?

If not, what's the correct way to interpret this passage? Thank you.


texts: What is the best way to send two floating point numbers to a server on the internet from a small device such as an arduino?

texts:
I was thinking about sending some sensitive data (temperature) from an arduino (AVR 8-bit processor) to a server on the internet.

But I would like to make sure that it would not be possible for Eve to find the temperature.

I understand that the only way to solve this is to share a secret between the arduino and the server that Eve doesn't know. But where is the line between security by obscurity and a compile-time constant shared by server and arduino?
(I ruled out asymmetric encryption due to performance & (expected) implementation problems).

So assuming they can encrypt the data with a secret key, I still have a sort of known-plaintext problem since Eve knows (from reading the source) that I'm sending 2 floats in a predictable range (-20C..50C). The only solution I could think about is interleaving the 2 floats in an array of random floats and an initial (random) byte to signal the kind of interleaving used. While this sounds to add security, I wonder if it actually does.

So perhaps to recap: what would be the best scenario for sending two temperature measurements to a server on the internet?

ps. at the moment I'm not worrying about authentification but if needed I could add a H/CMAC?


texts: Suppose I have an encryption oracle which can encrypt $m^e \mod n$ for any $m$. I know $n$ and I know $\varphi(n)$. However the public exponent $e$ is secret. Is it possible to figure out it's value when $e$ is not bruteforce-able?


texts: Elliptic curve point addition with $Z_1 = Z_2 = 1$

texts: Elliptic curve point addition and point doubling operations using Projective and Jacobian coordinates require fewer field multiplication operations when considering $Z$ coordinates of input points equal to one ($Z_1=Z_2=1$). Is there any drawback of this strategy?


texts: How to attack a two time pad if the plain text is randomized?

texts:
As an extension to this quesiton, or this one how would you go about attacking a re used pad if the plaintext was randomized before being encrypted?

  0 0 0 1...         Plaintext

  0 1 1 1            seed(truly random number)
  0 1 0 1            Key1
  0 0 1 0            seed + Key1 mod 2 (=Cipher1)

  0 1 1 0...         Plaintext + PRNG(seed) mod 2 (=CipherR)
  1 0 1 0...         Key2(repeating 2 bit key "1 0")
  1 1 0 0...         CipherR + Key2 mod 2 (=Cipher2)

  0 0 1 0 1 1 0 0... Cipher1 & Cipher2 → ciphertext

This is using a OTP cipher to transmit the seed of a PRNG, then using a Vernam cipher with a repeating key to transmit the plaintext XORed with the PRN. Increasing the message length a little, hopefully to avoid cribbing.

How do you decode the Vernam cipher after the plain text has been randomized?


texts:
I am trying to design the s-box for AES. Quoting from Wikipedia, the algorithm for applying affine transformation in AES s-box calculation is

Let s (an 8-bit unsigned variable) be the input number.
Let result be 0.
For 5 times:
   XOR result with s.
   Rotate s one bit to the left.

My question is why the multiplication is done this way? Why only 5 steps?


texts:
Does this mean that the message is being added onto the hashed(message, tag) ?

m || H(m, "secret")

So the output would be something like:

"RandomMessage"+N8HqKCG01b


texts: Security of AES after key expansion 4-MB with ECB and CBC

texts:
My question is,

how does the security depend or change if I encrypt with AES-128 in total 4-MB of Data?

With Electronic Code Book Mode and
Cipher Block Chaining Mode ?
Does an adversary still need $2^{126}$ tries (like Wikipedia suggests) to guess the key or is it less (which in my opinion it should)?

The encrypted data would be a videostream.


texts: Is this commutative encryption protocol secure?

texts:
My assumptions are:

encryption must be commutative
man-in-the-middle is not an issue

I would like to implement the following scheme between 2 parties ($A$ and $B$) to exchange a key:

Lets $C = P \oplus F(K, IV)$ is a commutative encryption, resp. CTR mode of some symmetric block cipher with random key $K$, random initialisation vector $IV$, and $P$ is plaintext, $C$ ciphertext.

$A$ has a $P$ which would like to share with $B$

So the following protocol would be done:

$A$ will choose a random $K_1$ and $IV_1$ and produce $C_1 = P \oplus F(K_1, IV_1)$
$A$ will send $C_1$ to $B$
$B$ will choose a random $K_2$ and $IV_2$ and produce $C_2 = C_1 \oplus F(K_2, IV_2) = P \oplus F(K_1, IV_1) \oplus F(K_2, IV_2)$
$B$ will send $C_2$ to $A$
$A$ will decrypt $C_2$ using $K_1$ and $IV_1$ so produce $C_3 = C_2 \oplus F(K_1, IV_1) = P \oplus F(K_1, IV_1) \oplus F(K_2, IV_2) \oplus F(K_1, IV_1) = P \oplus F(K_2, IV_2)$
$A$ will send $C_3$ to $B$
$B$ will decrypt $C_3$ using $K_2$ and $IV_2$ so produce $P = C_3 \oplus F(K_2, IV_2) = P \oplus F(K_2, IV_2) \oplus F(K_2, IV_2)$
$A$ and $B$ shares the same value $P$ now

Is there any security risk by combining any of the $C_1$, $C_2$, $C_3$ to get the actual value of $P$?

$C_1 \oplus C_2 = F(K_2, IV_2)$

$C_1 \oplus C_3 = F(K_1, IV_1) \oplus F(K_2, IV_2)$

$C_2 \oplus C_3 = F(K_1, IV_1)$

Could it be any possible attack how to get the value $P$?


texts:
With reference to this question:

First, when using padding (PKCS or OAEP), if the ciphertext has errors in transmission we'll always get an error at the decryption process?

where the answer is:

Yes, with extremely high probability. This is basically a chosen-ciphertext attack and RSA-OAEP is fully immune to them, so the odds that you won't detect this attack (a.k.a. "error") are extremely low (below $2^{−128}$).

May I know how the $2^{−128}$ is computed? Is it true for RSA 1024 and 2048 bits?
Some Finding
With reference to https://tools.ietf.org/html/rfc3447, Chapter "3. EME-OAEP decoding", point g(as below):

g. Separate DB into an octet string lHash' of length hLen, a
(possibly empty) padding string PS consisting of octets with
hexadecimal value 0x00, and a message M as
DB = lHash' || PS || 0x01 || M.
If there is no octet with hexadecimal value 0x01 to separate PS from
M, if lHash does not equal lHash', or if Y is nonzero, output
"decryption error" and stop.  (See the note below.)

For the implementation of openssl, SHA1 is used and SHA1 is 20 bytes and implies the length of lHash(and lHash') is 20 bytes. Therefore, I will suggest that the probability of error rate is below $2^{−160}$. Can anyone have some contribution on this? thanks.
P.S.
From the source code for openssl(https://docs.huihoo.com/doxygen/openssl/1.0.1c/rsa__oaep_8c_source.html), the RSA_padding_check_PKCS1_OAEP(), line 152, it codes as below. I believe it is checking for if lHash does not equal lHash', or if Y is nonzero. Can anyone have a view on this? thanks.

if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)


texts: Why is Symmetric encryption classed as Private Key?

texts:
I am going for my ethical hacking exam soon and I still can't get my head around why symmetric key encryption is classed as "Private/Secret Key encryption" when symmetric encryption uses the same key and asymmetric encryption (Public Key) uses a public and PRIVATE key.

I just remember by thinking "As symmetric encryption begins with an S that's Secret key and secret key doesn't have a public and secret (private) key because it's weird."

I'm hoping someone will help me think of this in a less confusing way.


texts: Is there a relationship between the secp256k1 public key of the sum of two private keys, and the public keys of those original two private keys?

texts:
If I have two secp256k1 private keys and add them together, can I derive the public key for the sum, if I only know the public keys for the two original private keys?
(I think this may be the core of understanding bip32.)


texts:
I was playing around with the idea of modifying infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any attempts to alter propagating cipher block chaining (PCBC) mode to provide authentication and I stumbled upon this paper analyzing a proposed authenticated encryption mode that looks a lot like IGE mode. The creator of the mode of operation analyzed in that paper has a blog dedicated to it and also developed one of the entries in CAESAR competition, ++AE.

If you aren't familiar with IGE mode, here is how it works:

In the case of encryption:

$CT_{0} = E(K, PT_{0} \oplus IV) \oplus IV$.
$CT_{i} = E(K, PT_{i} \oplus CT_{i - 1}) \oplus PT_{i - 1}$ for $i > 0$.

In the case of decryption:

$PT_{0} = D(K, CT_{0} \oplus IV) \oplus IV$.
$PT_{i} = D(K, CT_{i} \oplus PT_{i - 1}) \oplus CT_{i - 1}$ for $i > 0$.

I might have garbled the details of it, nyuk nyuk nyuk, because I remember that the value XORed with the output of the block cipher to get the first ciphertext block might have been generated by encrypting the IV in one paper.

I figure that an extension to IGE to provide authentication would consist of appending an all-zero block to the end, encrypting it as if it were just another block of plaintext, and then checking that the value equals zero when the ciphertext is decrypted. However, given the similarity of this idea to the one attacked in the first paper I linked to and said paper saying that these "special modes" have all proven weak, I'm wondering if this idea is also susceptible.


texts: Compositions of specific pseudorandom permutations

texts:
Let's consider some specific pseudorandom permutations (PRP). Most of their bits cannot be distinguished from a random permutation, but there is one exeption. If number of the set is divisible by $2^{n}$, then such permutation gives number/block which has $n$ zeros at the beginning and at $n+1$ bit place there will be always one. All the other bits cannot be distinguished from a random. Example - number $2^{3}$ in $64$ element permutation gives:
$0001rr$
Where $r$ are some indistinguishable from random bits. Let's consider permutations which have $2^{128}$ elements (so we work on 128-bit blocks). Ignore problem with number $2^{128}$ (it will gives always all zeros, let's say we don't have to encrypt all zeros blocks). Let's say we can define every such permutation by a 128-bit key. How many compositions of that permutations we have to do, to get secure permutation at the end?
If we consider for example $5$ compositions we can definie them by five 128-bit keys (so key security level is enough). But the problem is whether encryption will be secure after $5$ composiotions?
PS All I could do was attack such naive cipher with number $2^{127}$ in $1$ round. Then $2^{127}$ always became number $1$, by definition. But in $2$ rounds it is impossible to get some information about plaintext this way. Probability shows that if we will starded from blocks with about half of zeros at the begining, we got $1$ to $2^{k}$ chances that there will be still one zero bit at the begining after all compositions, where $k$ is number of compositions. And also there is $2^{k+k}$ chances that we will get two zero bits at the beginning of our entrance block. And so on. So in $5$ rounds we have $1$ to $32$ chances that some number divisible by $32$ will got one zero-bit at the beginning. Isn't it to much? Can such thing be even secure?


texts: Can Diffie-Hellman generate values in a specified range?

texts:
Is there any way to generate values only between $0$ and $255$ with the Diffie-Hellman method? I need to create keys for communication algorithms with $32$ and $16$ numbers between that range.

The idea is to exchange the keys between the participants using the results of the Diffie-Hellman key agreement algorithm. Then we create the keys on the clients side, so they can use the keys.

Letting $x$ be any number,
$$3^x \bmod 17 = W$$

$W$ can be any number between $0$ and $17$. I need $W$ to be a number between $0$ and $255$.


texts: Are there any arithmetic or mathematical functions that can be used as PRPs or PRFs ?  Since, Conventional block ciphers like AES are that are proven to be good PRPs are not based on mathematics but on other principles like confusion and diffusion etc.


texts: Is my identity exposed when publishing my public key or encrypting with PGP?

texts:
Let's say I create my PGP keys with my appropriate name and email address.

Will these personal information be exposed if I publish my public key?
When I encrypt a message for sending it to my communication partner, if someone intercepts this encrypted message, will he or she get to know about my personal information?


texts: How to create reduction functions in rainbow tables?

texts:
I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I have 50 000 hash to reduce then.

Is it necessary to have 50 000 different reducing functions to avoid the collisions?
How do I create those reduction functions (not just take the n-first letters of the hash for instance) ?


texts: Can we break RSA with an optical Fourier Transform?

texts:
We all known that RSA can be compromised using quantum Shor's algorithm. The horsepower underlying this algorithm is the Fourier transform. However, we can use alternatives to perform this function, such as An optical Fourier transform coprocessor with direct phase determination.

In accordance to the paper, you may need a high resolution optical sensor for this task. But how high does it need to be? Can we get a rough estimation using a lower resolution and guess something close?

Are such alternatives viable (in a near future) to break RSA?

PS: The largest optical sensor in existence is a 3.2 gigapixel


texts: Is it proven that breaking RSA is equivalent to factoring as of 2021?

texts: I can't find any publication that proves this.


texts: estimate of time required to crack sha512crypt password with JtR + OpenCL

texts: OK, I have a shadow file with a password that I know, it is 4 letters followed by two numbers. Using John The Ripper with OpenCL support, on a laptop with AMD Radeon Mobility graphics, how long would it take to brute-force it? What speed should I expect?


texts: Sensible usecase for restricting special characters in passwords?

texts:
Please See Why Not Allow Special Characters In a Password on Security.

Several websites I've come across limit the allowed special characters for a password. My thought was, it should all be hashed anyway so why does it matter?

Is there an actual security reason to restrict this?

Example error:

The password needs to be at least 4 characters.
Valid characters are: letters, numbers and the following symbols: #$%&!?@.


texts: CMS encryption application using Windows system certificate store

texts:
Hy!
I'm looking for an application, which can make cms encryption/decryption, but with the use of the windows certificate store.
I already found out, that openssl can't do it out of the box (just by exporting the cert out from the windows certificate store, and then exporting it to openssl's cert store), and sadly powershell's Protect-CmsMessage doesn't work with elliptic curve (ECC) keys. (as far as I know, I tested it, and it just throws 'Unknown encryption algorithm').
So I need an application which can encrypt/decrypt with an ECC certificate from the windows cert store.


texts: What is the best way to encrypt form data from client end javascript and decrypt at server side Java?

texts:
I have to send user data from a form to server side and process it. But I would like to encrypt this information to make sure the information is safe.

I am using a random word Array as salt, another random word array as IV, userId as passphrase to encrypt the password.
Same salt and IV, password (without encryption) as passphrase is used to encrypt userId.

Salt, IV, userId (both plain and encrypted), encrypted password is sent to server side where the reverse operation is performed to decrypt the data.

But since passphrase is also available at client end, this doesn't seem safe. What is the best way to achieve this?


texts: Is PCBC using XOR still susceptible to adjacent swap attacks if a permutation is used?

texts:
PCBC with XOR as the operation used to combine the plaintext and cipherext blocks is vulnerable to adjacent swap attacks. But is it still susceptible to this attack if one of the following is done:

An unkeyed permutation is applied to $PT_{i} \oplus CT_{i}$.
An unkeyed permutation $F$ is applied to the plaintext and cipherext to blocks such that the value that is XORed with the next plaintext block is $F(PT_{i}) \oplus F(CT_{i})$.


texts: What are the advantages and disadvantages of Merkle signatures over Lamport signatures?

texts: I know they are both hash-based and post-quantum secure, and that Lamport signatures can form the basis for a Merkle scheme, but what do you actually gain over standard Lamport signatures by doing this? To put it another way, since Merkle signatures make use of another one-time signature scheme, why would someone use Merkle signatures when they have a perfectly fine one-time signature already?


texts: Is encrypting a single 128 bit block with AES ECB "safe"

texts:
I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key.  The typical suggestion is to never use ECB, but if there is just a single block being encrypted, is it a concern?

The reason I want to use ECB is because I want the encrypted value of the block to be consistent between encryptions for other reasons (so I can check if a value already exists by just comparing the uniqueness of the cipherText).

Updated: Also note that these encrypted values will be stored in a set, so there will not be data leakage by having multiple encrypted values of the same plainText available.


texts: AES Affine Transformation Polynom Representation

texts:
I have been reading on the polynomial representation of the AES Sbox in the PDF “Essential Algebraic Structure Within the AES” by Murphy and Robshaw (www.isg.rhul.ac.uk/~sean/crypto.pdf) on page 7, that the affine transformation can be represented as $f(a) = \sum^7_{k=0} \lambda_ka^{2^k}$ where $(\lambda_0, \lambda_1, \lambda_2, \lambda_3, \lambda_4, \lambda_5, \lambda_6, \lambda_7)$ = (0x05, 0x09, 0xf9, 0x25, 0xf4, 0x01, 0xb5, 0x8f). Can me anybody tell how to compute this values $\lambda_0,\ldots,\lambda_7$ from the Matrix $L_A$ on page 7?

Best regards


texts: Which homomorphic encryption scheme has the same size of plaintext space and ciphertext space?

texts:
I want to pre-compute the result for all possible ciphertext of a homomorphic encryption. Is it acheivable?

Is there a fully homomorphic encryption scheme that has the same size of plaintext space and ciphertext space?


texts:
I'm about to implement my very first crypto system probably using AES128. (still trying to figure which mode to use)

Is there a weakness in encrypting a plain text of which 50% is known by the attacker? Will an attacker be able to decrypt the unknown 50%.

Let me explain. In my project I need to encrypt dictionaries (list of key/value). I suppose that all the keys are known to the attacker (by reverse engineering), as such an attacker knows more or less half of the plain text. Would that make the encryption of the values weaker?

For what I have understood of chosen plain text attacks, knowing a part of the plain text should not be a problem. But the approval of someone smarter than me would relieve me from anxiety.

Thanks


texts:
Background

I'm trying to make sense of the error in implementations of LWE and R-LWE.  In LWE and R-LWE error is added to vectors in lattices to make it computationally infeasible to recover any meaningful data.

It was said here that using float operations in PRNG's aren't reliable enough across different environments.

According to the accepted answer on this question though, it's possible to "trivially" generate cryptographically secure, nearly uniform distributions of floating point decimals.

Questions

Does the error used in LWE or R-LWE rely primarily on float operations?
Do float operations need to be in a finite field to be secure?
Before rounding occurs, are all numbers floating decimals?

Conjectures

My assumption is that Case 1 may be likely, but Case 2 is true.  This leads me to believe that only error terms are treated as floating point decimals as a way to maintain efficiency and security, but taking everything either modulo a number or modulo an ideal generates an integer.  So in effect, the error taken modulo a number produces a lattice point (integer), or error taken modulo an ideal produces a lattice (finite field).

Is this an accurate assessment?


texts:
Please only look at for loop in source code below, especially SP1,SP2,SP3.......
Is it similar to what S-box does?(Ignore the other)

int fval, work, right, leftt;
int round;
int keysi = 0;

leftt = inInts[0];
right = inInts[1];

work   = ((leftt >>  4) ^ right) & 0x0f0f0f0f;
right ^= work;
leftt ^= (work << 4);

work   = ((leftt >> 16) ^ right) & 0x0000ffff;
right ^= work;
leftt ^= (work << 16);

work   = ((right >>  2) ^ leftt) & 0x33333333;
leftt ^= work;
right ^= (work << 2);

work   = ((right >>  8) ^ leftt) & 0x00ff00ff;
leftt ^= work;
right ^= (work << 8);
right  = (right << 1) | ((right >> 31) & 1);

work   = (leftt ^ right) & 0xaaaaaaaa;
leftt ^= work;
right ^= work;
leftt  = (leftt << 1) | ((leftt >> 31) & 1);

for ( round = 0; round < 8; ++round )
    {
    work   = (right << 28) | (right >> 4);
    work  ^= keys[keysi++];
    fval   = SP7[ work        & 0x0000003f ];
    fval  |= SP5[(work >>  8) & 0x0000003f ];
    fval  |= SP3[(work >> 16) & 0x0000003f ];
    fval  |= SP1[(work >> 24) & 0x0000003f ];
    work   = right ^ keys[keysi++];
    fval  |= SP8[ work         & 0x0000003f ];
    fval  |= SP6[(work >>  8) & 0x0000003f ];
    fval  |= SP4[(work >> 16) & 0x0000003f ];
    fval  |= SP2[(work >> 24) & 0x0000003f ];
    leftt ^= fval;
    work   = (leftt << 28) | (leftt >>> 4);
    work  ^= keys[keysi++];
    fval   = SP7[ work         & 0x0000003f ];
    fval  |= SP5[(work >>  8) & 0x0000003f ];
    fval  |= SP3[(work >> 16) & 0x0000003f ];
    fval  |= SP1[(work >> 24) & 0x0000003f ];
    work   = leftt ^ keys[keysi++];
    fval  |= SP8[ work         & 0x0000003f ];
    fval  |= SP6[(work >>  8) & 0x0000003f ];
    fval  |= SP4[(work >> 16) & 0x0000003f ];
    fval  |= SP2[(work >> 24) & 0x0000003f ];
    right ^= fval;
    }

right  = (right << 31) | (right >> 1);
work   = (leftt ^ right) & 0xaaaaaaaa;
leftt ^= work;
right ^= work;
leftt  = (leftt << 31) | (leftt >> 1);
work   = ((leftt >>  8) ^ right) & 0x00ff00ff;
right ^= work;
leftt ^= (work << 8);
work   = ((leftt >>  2) ^ right) & 0x33333333;
right ^= work;
leftt ^= (work << 2);
work   = ((right >> 16) ^ leftt) & 0x0000ffff;
leftt ^= work;
right ^= (work << 16);
work   = ((right >>  4) ^ leftt) & 0x0f0f0f0f;
leftt ^= work;
right ^= (work << 4);
outInts[0] = right;
outInts[1] = leftt;


texts: HKDF vs TLS PRF. Which of the one is better?

texts: Which of the one (HKDF or TLS1.1+ PRF) is more secure and why?


texts: Can cryptocurrency mining devices be used for cryptanalysis?

texts: In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies.  These devices can perform SHA256 hashing at rates much higher than was seen in the past and are continually advancing in power.  Can such devices be used to perform cryptanalysis instead of mining? Does this development pose a threat to our current security assumptions?


texts: Identity Based Encryption: Known Random Value

texts:
Let's consider a situation whereby:

  Alice generates a ciphertext c from a message m using Bob’s ID.

  An attacker Carol can get c from the open channel. She knows that c is
  generated by using Bob’s ID but she does not know Bob’s secret key.

  On the other side, Carol is able to know the random number r that
  Alice has used in the encryption process

Also, it is given that the identity-based decryption formula is as such:

  Encrpytion: $c = (u,v) = (\mathtt{g}^{r}, m \oplus {H({T}_{id}^r)})$

  Decryption: $m = v \oplus H(e(\mathtt{d}_{id}, u))$

This is also the standard IBE Bilinear Pairing.

I also managed to deduce this equation below from deriving the decryption algorithm.

  $m = v \oplus H(\mathtt{{\mathtt{T}_{id}}}^{r})$

Now consider this question:

  Can Carol compute the plaintext message $m$ by just knowing $r$ but not Bob’s secret key?

My answer: It's not possible for Carol to compute $m$ just by knowing $r$ because she still has to solve the discrete log problem in the last equation given which is considered hard.

However, I am unsure whether this is right or wrong.

Edit:

  Formula for ${T}_{id}= e({Q}_{id},{K})$, where K is the master public key (${g}^{s}$), and ${Q}_{id}$ is the hash of the user id

  Formula for ${d}_{id} = ({Q}_{id})^s$, where s is the master secret key


texts: How come Shamir Secret Sharing uses Lagrange interpolation?

texts: I've read that Newton polynomials have better computational complexity, but Shamir's uses Lagrange polynomials instead. Does anyone know if there are particular reason why Newton polynomials aren't used instead?


texts: Can I use a key twice if the message is longer than the key in one-time pad?

texts:
I have a key for a one-time pad. Its length is 512, and I have a message to encrypt whose length is 600. Can I reuse the first 88 chars of the key to encrypt the end of the message?

The key is still random, so it should be still secure, right? If it isn't secure, why not?


texts: Is ElGamal still unforgeable if the adversary knows r?

texts:
Is ElGamal still unforgeable if the adversary knows the value of $r$ that was calculated by $g^k$?

When we do sign the message $msg$, we calculate $r = g^k$.

As we know, the regular ElGamal is existentially forgeable:

$e$ is picked randomly from $\mathbb{Z}_{p-1}$
$r = g^e \cdot y$ mod $p$ and $s$ is $-r$ mod $p$
When we check if it was forged we check for $y^r \cdot r^s = g^m$. Thus $g^{xr} \cdot (g^{e} y)^ {-r} = g^{-er} = g^{es} = g^m$. Where $m = H(msg)$.

if now $m = H(msg) + r$ (concatenate $r$ to $H(msg)$ is it now unforgable ?


texts: Why Bellare-Micali Oblivious Transfer Construction requires ElGamal with hashed key?

texts:
The idea of the Bellare-Micali Oblivious Transfer Constructions is the following:

Informally, the receiver is required to generate two public keys $y_b$, $y_{b-1}$ such that it knows only the secret key paired with $y_b$ (where $b$ is its choice bit), indicated with $k$.
In order to prevent the receiver from cheating, the sender requires that the two generated public keys have to satisfy a certain constraint, i.e., $y_b \cdot y_{b-1} = c$ . In such a way, the receiver cannot know both private keys or it can compute DLOG. At this point, the receiver sends the two public keys to the sender.
Then, the sender encrypts $m_0$ with $y_0$ and $m_1$ with $y_1$ and sends both encryptions $c_0$, $c_1$ to the receiver.
Finally, the receiver obtains $m_b$ by decrypting the chipertext $c_b$ (corresponding to its choice bit) using the private key $k$ (note that $c_b$ is the only chipertext it can decrypt).
While the general idea is clear to me, I do not get why ElGamal is not computed as $y_{0}^{r_{0}} \cdot m_{0}$ (and $y_{1}^{r_{1}} \cdot m_{1}$) but $H(y_{0}^{r_{0}}) \oplus m_{0}$ is used instead.


texts: Is there an efficient way to hide the encrypted plaintext length with a block cipher?

texts:
In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ciphertext is $N+1$, where the extra block is the IV.

Is there an efficient way to have fixed (parametrizable) larger length output on variable length input, to hide the plaintext size?

For example, for a short plaintext of $16$ or $20$ bytes I want to generate a larger ciphertext like 128 bytes, so an attacker can't learn the plaintext size from the ciphertext size.

The only way I can think of is just to produce pseudo-random pad to increase the plaintext message to equal the size of the ciphertext you want to output.


texts: Why do I need to store the salt for generated hashes?

texts:
I am new to crypto and authentication so have been doing reading around this and thought that I had a pretty good understanding of how this works. However when implementing my hashing using bcrypt.js I am once again confused.

I thought that the steps were:

Store Credentials:

Generate random salt
Append salt to password
Generate hash from concatenated string
Store the username, hash and salt

Verify User:

Find user record using username
append stored salt to entered password
hash concatenated string
compare generated hash with stored hash

However reading the bcrypt.js readme I can generate with:

var salt = bcrypt.genSaltSync(10);
var hash = bcrypt.hashSync("B4c0/\/", salt);

then compare with:

bcrypt.compareSync("enteredPassword", storedHash)

So it seems that there is no need to store the salt at all.

Also looking at the generated hashes:

[
    {
        "username": "UserOne",
        "hash": "$2a$10$M6qZCSbwhXipdmMy7kQ4V.obtALLSAjZsMYD/oGDAo0i/fcSGrmn2",
        "salt": "$2a$10$M6qZCSbwhXipdmMy7kQ4V."
    },
    {
        "username": "UserTwo",
        "hash": "$2a$10$Yb04C6pVgKVdNjHRB42vKOkr5Wf4QVG8gXyXVqZWnzCs6/MFnIC9G",
        "salt": "$2a$10$Yb04C6pVgKVdNjHRB42vKO"
    }
]

The salt seems to be appended to the hash. Not appended to the password before hashing. This seems pretty pointless to me as any attacker could just strip the salt from the hashes to get a table of not salted hashes.

As I said I am really new to this stuff and getting my head around it is a little difficult. Any simple explanations much appreciated.


texts: finding hash collisions for set of hashes

texts:
I am searching info on dependencies between different hash functions.
Let's say that we have a set of x hashes H1, H2 ... Hn (using different hashing functions) of the same string S. For every hash we can find collision in some time T1, T2 ... Tn
It seems logical that finding collision for every hash in set will take time T = T1+T2+..Tn
On the other hand, every hash exposes additional information on string, thus there is a possibility that some hashes could have properties which can speed up finding collision in another hash (to give a simplified example, something like "if md5 ends with 1111 then last bit of sha1 must be 0")
So, question is, if there exists any research on that subject (or maybe a proof or counter -proof that such dependencies exists for some hashing alghoritms) ?


texts: Sigma proofs for Pedersen commitments arithmetic under different bases

texts:
I was wondering if it's possible to prove an equality of openings between $3$ Pedersen commitments $P\cdot Q$ and $R$ when $P, Q, R$ have different commitment keys.
Suppose that commitment $R$ commits to $a+b$ and $P$ and $Q$ commit to $a$ and $b$ respectively. How can we prove, that $P$ and $Q$ combined commit to the same value as $R$ if we don't know relation betwen $(g_1, h_1)$ and $(g_2,h_2)$?
$P = g_1^ah_1^{r_1}$, $Q = g_2^b h_2^{r_2}$ and $R = g_3^{a+b}h_3^{r_3}$.
LegoSNARKs does something similar ($CP_{had}$), but I was curious if there is a solution with sigma protocols.


texts: Confirmation signature - Improved Feldman VSS

texts:
I am working through the implementation of A Distributed Private-Key Generator for Identity-Based Cryptography. In the paper (Figure 1, page 8) the validation of a share by a node says that once validated the node sends a confirmation or accusation signature to the bulletin board (step 2 below):

It mentions these signatures later on in the process as well but does not mention how to generate them (they are short ints in the implementation section 7.1)

Is the confirmation or accusation signature a cryptographic signature or simply and indicator that the node could verify its share?

If it is simply an indicator then how can the bulletin board know that the node is being honest?
If they are cryptographic signatures how are they generated? It doesn't appear that the bulletin board ever knows the public key for that node so how can they be validated?


texts:
Let $R$ be an ring, and let $(a),(b)$ be the ideals generated by $a,b\in R$ respectively. Let $c=a\cdot b$ and $(c)$ the ideal generated by $c$.

I am supposing that, given $c$, it is computationally difficult to deduce $a,b$ (because the group of units of $R$ is large).
Suppose that we are given $c$ and we have a test function $T:R\to \{0,1\}$ that outputs 1 if the input is in $\{a,b\}$ and 0 otherwise.

Is it an algorithm to parameterize a list of ideals $I_1,I_2$ such that $(c)=I_1\cap I_2$? It looks to my that writing all such decompositions is essentially the same as listing all solutions $x,y$ such that $c=xy\in R$. Is that so?

I am interested in the particular case $R=\mathbb{Z}[x]/(x^{2^k}+1)$, and the coefficients of $a,b$ are bounded in magnitude by $B\in \mathbb{Z}_+, B>2$.


texts: How to choose the reduction function in rainbow tables?

texts:
I have a question regarding Reduction Functions in Rainbow Tables.

If the hashing function is MD5 or SHA-1 etc then should the reduction functions also be MD5 or SHA-1? That is, should the Reduction Function be the same as the Hashing Function but of course with a different set of rules/constraints for  input and output parameters?

So, basically should the reduction function algorithms be same/similar as the Hashing Function algorithm but just differ in terms of rules/constraints for input and output parameters?


texts: Advantages of using 64-bit word size over 32-bit word size

texts:
I'm learning about cryptographic hash functions and I have some questions about SHA-2.

SHA-256 uses 8 32-bit words. SHA-512 uses 8 64-bit words.

Is there a specific reason why SHA-512 uses 64-bit words? Why not 16 32-bit words?

And if 64-bit words have their advantages over 32-bit words. Why doesn't SHA-256 use 4 64-bit words?


texts:
I'm new to cryptography and have just completed homework on Monoalphabetic cipher.

I managed to decrypt the cipher text successfully but I cannot identify the key from my plaintext to ciphertext mapping table which is shown below (top is ciphertext and below in caps is what I have substituted with). No substitution were required for a, h and z. Notice r is substituted with B and y is substituted with y which I am a little confused with.

Although the decrypted message seems correct, I would like to understand what is the key for this.

a   b   c   d   e   f   g   h   i   j
    D   E   F   G   H   I       K   L
k   l   m   n   o   p   q   r   s   t
M   N   O   P   Q   R   S   B   T   U
u   v   w   x   y   z
V   W   X   Y   C


texts: How to generate a public key from a private ECDSA key?

texts: Having some specific ECDSA curve and a private key, how does one calculate the public key? I am having a hard time finding the algorithm and equations for it.


texts: In CBC mode if 2 cipher blocks are same then is CBC still secure?

texts:
I was going through this question Why is it said that if we have a duplicate ciphertext block it can leak our information? and I was just wondering

if there is a $P_i \oplus P_j= C_{i−1}\oplus C_{j−1}$ relationship, is CBC still secure?
How does this equality lead to information leak?


texts:
Is it possible to do a greater than homomorphic comparison in the form ($c_1 < c_2$) on two ciphertexts using Helib?

The equal comparison ($c_1 == c_2$) can be done in modulus 2 by adding both ciphertexts. Does it give any multiplication and/or addition combination to obtain the greater than comparison ( $<$) on binary numbers?


texts: How to implement correctly a "secure" authentication protocol?

texts:
Due to my lack of knowledge in this matter I am facing some problems to identify which features are sign of a bad implementation of a symmetric authorization application.

As I am concerned the system must generate session keys using PRFs (Pseudorendom Functions) by the way of the master key(''MK') and a seed. Then this session keys will be used to encryption, decryption and authorization. Encryption and decryption keys('K1') have to be the same, nevertheless the authorization keys('K2') must never be the same as the keys used to confidentiality.

The 'MK' is never used in any task, only as a parameter to generate the session keys. All the keys (master and sessions) have to be securely stored inside of a specific HW. The 'MK' is specially delicate since if it is discovered all session keys will be threatened; however in case of one session key is being compromised the remaining keys will be still protected.(Q: Has to be 'MK' stored a long with the session keys or in a independent entity ? The target is a tag coupled to a reader, so I guess that the session keys has to be kept on both devices, but the 'MK' is stored apart form these entities, such as a secure PC or a trusted 3º company. Are session keys generated on the tags or in a PC to then being placed inside ?)

Confidentiality :

To achieve the confidentiality feature the plain-text is usually chew by a cryptographic function or 'primitives', such as AES-128(Advanced Encryption Standard- 128 bit text) using 'K1'. AES-128 will encode texts of 128 bit length and if the text is shorter then it may be padded with a single '1' and successive '0's until 128 bit is reached.

When the text needs more than one crypt-block then this boxes are chained, having many variations or 'modes of operations'. CBC (cipher block chaining) is one of them and  it has a IV(initialization vector) in order to give randomness to the first iterations. This IV must be different for each message, it will be attached to the plain-text(padded) before going thought the ciphering blocks, and usually has 128 bit length. (Q: How IV are generated? A randomized algorithm or something else? Can a IV be constructed using 'K2' on ECB(electronic codebook) mode of operation?)

Authentication:

To gain authenticity a MAC(message authentication code) is attached to the plain-text or codified-text (if confidentiality has been implemented) to send all the set afterwards. MACs are generated also using crypt-blocks but with few major differences, one example is the CBCMAC. The output is a single 128 bit data (unlike in the confidentiality part), 'K2' is used for the computations, the IV has to be a fixed value, usually '0', and always the input texts must have the same length; to avoid this last restriction OMAC1(knows also as CMAC) is usually used instead of CBCMAC.

The input data to generate the MAC must be the pre-encrypted text, not the plain-text. This procedure is know as E-than-MAC(Encrypt then MAC) and gives the best authentication features.(Q: I guess after generate the MAC and join it to the codified text the same session key has to be used to validate the MAC on the other side; Is it like 'decode' the MAC and make a Boolean comparison on the verification side ?)


texts: Why do we need to go through multiple cycles in block cipher

texts:
According to Computer Networking: a top down approach, Chapter 8 (6th edition), block ciphers involves breaking the input message into blocks of size k, where generally k = 64. However since k = 64 implies that we need to create a table of input size 2k or 264 in our case, therefore we simulate randomly permuted tables. To simulate, we use the following process. The function first breaks a 64-bit block into 8 chunks, with each chunk consisting of 8 bits. Each 8-bit chunk is processed by an 8-bit to 8-bit table, which is of manageable size. For example, the first chunk is processed by the table denoted by T 1 . Next, the 8 output chunks are reassembled into a 64-bit block. The positions of the 64 bits in the block are then scrambled (permuted) to produce a 64-bit output. This output is fed back to the 64-bit input, where another cycle begins. After n such cycles, the function provides a 64-bit block of ciphertext.

Here is the question: Why do we need to process the text through n such cycles? The book states that

  The purpose of the rounds is to make each input bit affect most (if not all) of the final output bits. (If only one round were used, a given input bit would effect only 8 of the 64 output bits.)

The key for this block cipher algorithm would be the eight
permutation tables (assuming the scramble function is publicly known).

*Personal Comment -
However, if the input text has gone through even a single cycle still all the inputs would have been affected since each block went through a mapping based on the corresponding table Tj table. Hence we shouldn't be required to cycle it through n cycles.


texts: Create broken chain certificates for testing

texts:
In our software we receive certificates in binary DER format from our clients. They are in advance used to perform certain identity checks between server and client. To ensure the certificates are valid and trustable, we verify the certificate chain. Using the APIs we have available this is easily possible.

But the main question is: How can we create certain certificates which actually have a broken chain of trust or any integrity problems which should be validated. It seems easy to generate valid ones, but for testing our validation system we need invalid ones.

I would like to understand what to change on my valid certificate to introduce the previously mentioned errors. Can it be easily done on binary level or are there maybe tools for it? I tried to search for explainations but all I found was about how to fix already broken certificates. I expect either I need to change some bytes of the public key, or change the issuer details.


texts: How to use the wiki UMAC example function?

texts:
I want to use the  wiki UMAC example to protect the integrity of the communication between 2 devices. Unfortunately I am not quite sure of the meaning of the parameters and I don't want to get it wrong:

  The following C function generates a 24 bit UMAC. It assumes that secret is a multiple of 24 bits, msg is not longer than secret and
  result already contains the 24 secret bits e.g. f(nonce). nonce does
  not need to be contained in msg.

void UHash24 (uchar *msg, uchar *secret, int len, uchar *result)

msg - my message
secret I assume it is the secret Key (present on both devices) 16 byte key which I'll duplicate as many times as necessary to make it bigger than the msg length.
len - the msg length
result - here I don't understand what f(nonce) mean - I have a 4 byte nonce - I assume that I should make a function to convert it to 3 byte?

I have seen in another post that secret should be f(nonce, Key) - is this a good suggestion? (f could be Tea algorithm)

Can I use the same f function, get only 3 bytes and use it for the result parameter?


texts: Perfect Secrecy and Message distribution

texts:
I have been trying to come up with a proof of the following statement,
Suppose a cryptosystem achieves perfect secrecy for a particular plaintext probability
distribution then Prove that perfect secrecy is maintained for "any" plaintext probability distribution.
Well I know that the perfect secrecy scheme is independent of plaintext distribution, but how to prove the above statement? Any help would be appreciated.


texts: Set passes Dieharder randomness with ints values, fails when ints are split into bytes

texts:
I've generated 100M of random numbers in range (0..255). These numbers fail Dieharder tasts (bitnum = 8). However, I can pass this test by combining four bytes into an int.
Randomness of the set didn't change, so, something isn't correct with the test settings. What could cause it?

    def prep_input(file_name, number_of_iterations,numbit=32):
        f = open(file_name, "a")
        max_rand = (-1 + 2 ** numbit)
        print(str(max_rand))
        a = len(str(max_rand))
        for i in range(0, number_of_iterations):
            f.write(str(randint(0, max_rand)).rjust(a) + "\n")

        f1.close()

With header it looks like

#==================================================================
# Dieharder
#==================================================================
type: d
count: 16180337
numbit: 8
255
  0
 93
 ....

dieharder -a -g 202 -f   input.txt >>result.txt

Report on bytes:  Set fails when bytes are used
Report on ints: Set passes tests when ints are used

Update:

I've tested up to 4Gb of data. This is close to 2^32 although ASCII format requires ~4 characters (4 bytes) per a byte of actual data.
When this file is converted to byte stream it passws several tests and then reaches the end of data. When concatinated it passes tests better than ASCII int version.
When Python random is fed as a binary to

import time
import sys
import os
from random import randint

j=0
div = 2

while(True):
    sys.stdout.write(chr(randint(0, 255)))
    # newFileBytes = [randint(0, 255)]
    # os.write(1, (''.join(chr(i) for i in newFileBytes)).encode('charmap'))
    sys.stdout.flush()
    j+=1

if 0 == j%div :
    dh_file = open("progress.log", "a")
    dh_file.write(str(j)+"\n")
    dh_file.close()
    div = div*2

With python to_terminal.py  |  dieharder -a -g 200 >>test_result.dhres I get 16G  (17179869184) as the last record in the log and out of 75 tests only two tests are weak the rest is a pass.  Python passes DH when supplied as bit stream Clearly, the problem follows 8 bit ASCII representation.


texts: Is the result of HMAC-sha256 distinguishable from random noise?

texts:
Is if the result of HMAC-sha256 distinguishable from random noise?

If so, given:

a collection of 1000 keys, and
1000 messages of random noise, 100 signed by each of only 10 of those keys

Can any clue be found as to which messages were signed by which of the 1000 keys.

edit:

Assuming 4KB messages, indistinguishable from random noise, and 32 byte keys, also indistinguishable from random noise.


texts: Definition related to homomorphic encryption

texts:
In the definition of leveled FHE scheme, what is the mining of same decryption circuit?
I have read several papers about this, but I don't understand this notion.

In addition, if the scheme {$E^d$} is leveled FHE (notation based on Gentry thesis), why the scheme $E$ works correctly for circuits of some depth?


texts: Things already known to adversary before planning an attack

texts:
This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me.

What are the things that an adversary is usually aware of before planning an attack?
Let's say an adversary plans an attack on a server of a big company.

Does he know what encryption scheme/model is being used by the company to protect its data stored in the server?

I think usually companies use very standard and popular schemes that are known already to the cryptographic community since using a totally unknown scheme might have a huge data leakage which the company was not able to discover.

Let's say adversary knows about the model. So what about the specific functions that are used in them. For eg. Pseudorandom generators used in stream ciphers(obviously, the key is not known), or S-box in case of DES etc. Are these things known to the adversary already?

I think these things are usually fixed while implementing the model. And even if these things are known, for example S-box in DES is known, it still won't change the security of the scheme. But even if the company tried to hide the above functions, can it actually increase the security of the data?

Keys

I think this is mainly the information that separates the user and the adversary. But can you tell what are the other things that are hidden in practical implementations?

My assumptions are based on the quote that one should only use encryption schemes that are trusted by the cryptography community. Else there is a high probability that there can be an unknown leakage that an adversary can exploit.


texts: Why isn't a table used to solve the large number factoring problem?

texts: Lots of modern encryption (RSA comes to mind) are based on the fact that factoring large numbers is hard. However, multiplying large numbers is much easier, and table lookups are very easy. Since these large numbers are semiprimes (in all encryption methods I can think of, anyways), why not just make a table of the products of a bunch of primes and use a lookup to find some large number's prime factors? Would such a table just also be computationally expensive to make? Or too big to store or search through or something?


texts: Are there public $p$ and $q$ numbers for use in DSA?

texts:
There are many RFC documents giving large primes to use in Diffie-Hellman. However, I couldn't find standards on the $p$ and $q$ large primes used in the DSA signature scheme. This is proving to be a major obstacle in my own toy implementation of DSA, as generating these primes uses much messier math and code than the rest of the algorithm, and more places where I could make stupid mistakes that trash the security of the whole scheme.

Where can I find suitbale $p$ and $q$? They don't seem to need to be private, and frankly I'm kind of shocked that there aren't standard numbers for them to save people from needing to do the expensive calculations themselves.


texts: implementing GCM with dev/urandom for a nonce

texts:
I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same nonce multiple times is a terrible, horrible, very bad idea. the question is, using the same key for a decently long period (several hundred or thousand messages), what is the likely hood that a nonce is repeated, if the nonce is randomized each message with /dev/urandom. or should I simply stick to a counter beginning at a random number?

clarification: the keys are unique per session, being derived from diffie hellman group 14. my only concern is the likely hood of generating two matching nonces, given a pool of say 20000 nonces from dev urandom


texts: Why does the WhatsApp protocol require elaborate computation when verifying user keys?

texts:
Reading through the WhatsApp protocol (PDF), I am trying to understand why the multiple hashing and other stuff done is required. According to the paper, one can compare the hash of the key material on both ends. The hash (60 bytes) is computed like this:

  The 60-digit number is computed by concatenating the two 30-digit numeric fingerprints for each user’s Identity Key. To calculate a 30-digit numeric fingerprint:

  Iteratively SHA-512 hash the public Identity Key and user identifier 5200 times.
  Take the first 30 bytes of the final hash output.
  Split the 30-byte result into six 5-byte chunks.
  Convert each 5-byte chunk into 5 digits by interpreting each 5-byte chunk as a (big endian) unsigned integer and reducing it modulo 100000.
  Concatenate the six groups of five digits into thirty digits.

Why is that elaborate computation needed? What if I simply do a hash of both public keys and concatenate the first 30 bytes of each key? Why would it not suffice? Is it simply to make sure to reduce collision when using only 30 bytes of each hash?


texts: Request for 1024-bit primes $p$ , subgroup $q$ and subgroup generator $g$

texts:
I need to find a prime $p$ of $1024$ bits with a $160$ bit sub group size $q$, such that $q|p-1$ , and $g$ is the generator of the sub group size $q$.

I'm looking for the numeric values of $p$ , $q$ and $g$.


texts: What is the practical relevance of the wordsize when using a Hash?

texts: I understand that the word size is the internal "working package size" below the block size of a cryptographic hash function (and a block cipher), as each block is broken into words an than processed round-based. Does this size have any practical relevance when using that function? For instance do algorithms with 64b word size perform better on 64b machines? Or does aligning the message-to-hash at the word size have any impact?


texts: Perfect secrecy is maintained for other plaintext prob distributions?

texts:
Suppose a cryptosystem achieves perfect secrecy for a particular plaintext probability distribution. Prove that perfect secrecy is maintained for any other plaintext probability distribution.

Having trouble starting this one. Just a hint to get started would be appreciated.

I am aware that a cryptosystem is said to be perfectly secure if $P(X|Y)=P(X)$ for all $x\in\mathcal{P}, y\in\mathcal{C}$


texts: Can iterated hashing be used to mitigate collision and preimage weaknesses?

texts:
How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two?

For example, can MD5 be fixed (in practice) by applying the hash function twice (MD5(MD5(x)))? Also, Bitcoin uses SHA256(SHA256(x)). Does this add security in practice?

I understand that iterating a function many times can reduce the number of possible outputs. Also, the function might enter a cycle. Is that a problem with just a few iterations (such as two)?

(This question is not about storing passwords securely.)


texts:
What does the symbol $<\!\!<\!\!<$ mean? It is normally followed by a number. An example:

It would be appreciated if you could explain it in fairly basic terms.


texts: Is there a way to find $a$ and $b$ keywords in an affine cipher when only ciphertext but no plaintext is known?

texts:
I know simple formulas like

$$E(x) = (ax+b)\pmod n$$

where $E(x)$ stands for encryption,

$$D(y)= z(y-b)\pmod n$$

where $D(y)$ stands for decryption,

and

$$ax==1\pmod n$$

Assuming someone gives us an encrypted string, is there a way to find $a$ and $b$ from that string? If not, what informations we should have to find $a$ and $b$ keywords from the encrypted string? Is there a way to find a and b keywords in an affine cipher when only ciphertext but no plaintext is known?

Note that this is not a duplicate of Affine cipher: calculate the key from a known plaintext/ciphertext pair. In that other question, the user knows beginning of both encrypted and decrypted message.


texts: Functions that are only second-preimage resistant?

texts:
Are there functions that satisfy the second-preimage resistance property without satisfying the others (preimage and collision resistance) ?

I'm looking about such functions that compress data (exit the identity function).


texts: Common Crypto C api: Why both CCCryptorUpdate() and CCCryptorFinal()?

texts:
With the C api for Apple's Common Crypto, why is it sometimes necessary to call both CCCryptorUpdate and CCCryptorFinal?

I read in the documentation that CCCryptorFinal is not needed when:
1. Encrypting or decrypting with a block cipher with padding disabled, when the total amount of data provided to CCCryptorUpdate() is an integral multiple of the block size.
2. Encrypting or decrypting with a stream cipher.

So it seems like it has something to do specifically with dealing with the padding for block cipher encrypted data, but I was hoping for more information.


texts: Floating Point Homomorphic Encryption Schemes

texts: Are there any homomorphic schemes that can homomorphically compute addition and/or multiplication of encrypted floating Point data?