texts: Difference between Pseudorandom Function vs randomly chosen function

texts:
I am currently going through a course in cryptography.
In this, I stumbled upon Pseudorandom Functions. I got a little idea of Pseudorandom Generators which map an input string (key) to an extended string.
However, I do not understand the pseudorandomness in case of a function.

In the book Introduction to modern cryptography by Katz and Lindell, I found this:

  Since the notion of choosing a function at random is less familiar than the
  notion of choosing a string at random, it is worth spending a bit more time on
  this idea. From a mathematical point of view, we can consider the set $\operatorname{Func}n$
  of all functions mapping $n$-bit strings to $n$-bit strings; this set is finite (as we
  will see in a moment), and so randomly selecting a function mapping $n$-bit
  strings to $n$-bit strings corresponds exactly to choosing an element uniformly
  at random from this set.

  How large is the set $\operatorname{Func}n$? A function $f$ is exactly
  specified by its value on each point in its domain; in fact, we can view any
  function (over a finite domain) as a large look-up table that stores $f(x)$ in
  the row of the table labeled by $x$. For $f_n\in\operatorname{Func}n$, the look-up table for $f_n$
  has $2^n$ rows (one for each point of the domain $\{0,1\}^n$) and each row contains
  an $n$-bit string (since the range of $f_n$ is $\{0,1\}^n$). Any such table can thus be
  represented using exactly $n\cdot2^n$ bits.

  Moreover, the functions in $\operatorname{Func}n$ are
  in one-to-one correspondence with look-up tables of this form; meaning that
  they are in one-to-one correspondence
   with all strings of length $n\cdot2^n$.

  We conclude that the size of $\operatorname{Func}n$ is $2^{n\cdot2^n}$ .
  Viewing a function as a look-up table provides another useful way to think
  about selecting a function $f_n\in\operatorname{Func}n$ uniformly at random. Indeed, this is exactly equivalent to choosing each row of the look-up table of $f_n$ uniformly
  at random. That is, the values $f_n(x)$ and $f_n(y)$ (for $x\neq y$) are completely
  independent and uniformly distributed.

  Coming back to our discussion of pseudorandom functions, recall that we
  wish to construct a keyed function $F$ such that $F_k$ (for $k\gets\{0, 1\}^n$ chosen
  uniformly at randomly) is indistinguishable from $f_n$ (for $f_n\gets\operatorname{Func}n$ chosen
  uniformly at random). Note that the former is chosen from a distribution over
  (at most) $2^n$ distinct functions, whereas the latter is chosen from a distribution over all $2^{n\cdot2^n}$
   functions in $\operatorname{Func}n$. Despite this, the "behavior" of these
  functions must look the same to any polynomial-time distinguisher.

Can anyone please explain me this concept in easier terms?


texts: Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

texts:
Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key?

My reasoning is as follows:  the Rumba compression function allows attackers to supply any 48-byte input to the core, and HS1-SIV (a CAESAR 2nd round candidate) explicitly assumes and requires that ChaCha20 be secure in the related-key model.  As the HS1-SIV authors point out, this IS secure if the ChaCha and Salsa cores are ideal $48B\rightarrow 64B$ PRFs (they XOR a MAC with the key).


texts:
I have a question regarding the proof that RSA works
I understand that $m^{(ed \bmod z)} \bmod n = m \bmod n$ , but I don't understand why $m \bmod n = m$
(This question assumes m is the message, $z=(p-1)(q-1)$, $d$ is such that $(ed \bmod z) = 1$, and $e$ is such that $e$ is relatively prime with $z$)


texts: Convert projective to affine coordinates in ECC?

texts:
I am working with my project. I use projective coordinates but when I convert to affine coordinates, I can't get it. Can anyone help me?

Projective Coordinates $(X,Y,Z)$ to Affine Coordinates $(X,Y)$:

When $Z$ is not $0$ the point represented is the point (X/Z, Y/Z) in the Euclidean plane (Affine Coordinates)
When $Z$ is $0$ the point represented is a point at “infinity”

If I am using projective cordinates, I get 3 points $(x_3,y_3,z_3)$, is that correct? So I must convert to affine coordinates $(x_3,y_3)$? Can I convert projective to present affine coordinates?


texts:
Are all or any hash functions evenly distributed?

For example: if you had every combination of 256 bits and ran that through SHA256, would that produce approximately 1 of each combination, or would there be peaks?

Are distributions of the hashes calculable without going through the permutations in lower bit sizes?

Is evenness of the distribution of a hash function impacted by the length of the input vs the resultant hash length?

Which hashing functions are most evenly distributed?  (e.g. as close to 1 of each equal-bit-length combination possible)

Edit: The linked "duplicate" doesn't come close to addressing all these questions.


texts: What is the error in this collision probability approximation?

texts:
Theorem: Choose $Q$ random natural numbers in the set $\{1,2, \dots, M\}.$ The probability of getting at least one collision is

$$P_C(Q) = 1 - \frac{M - (Q - 1)}{M} P_{\neg C}(Q-1).$$

Notation:  By $P_C$, I mean the probability of getting a collision.  By $P_{\neg C}$ I mean the probability of not getting a collision.

Remark: This is the birthday problem.

Remark: So $P_C(Q)$ is just being computed by using its complement. The reason I express the theorem this way is because its induction proof relates directly to it being enunciated this way.

Theorem:  $$P_C(Q) \approx 1 - e^{-\tfrac{(Q-1)Q}{2M}}.$$

Proof: We know
    $$e^{-x} = 1 - x + \frac{x^2}{2!} - \frac{x^3}{3!} + \frac{x^4}{4!} - \ldots$$

If we take the two terms of this expansion, we get $e^{-x} \approx 1 - x$.  Then

\begin{align}
  P_{\neg C}(Q)&= \prod_{i=1}^{Q-1} \left(1 - \dfrac{i}{M}\right)\\
       &\approx \prod_{i=1}^{Q-1} e^{-i/M} \\
       &= e^{-1/M} e^{-2/M} \dotsc\ e^{-(Q - 1)/M} \\
       &= e^{-\sum_{i=1}^{Q-1} i/M} \\
       &= e^{-\dfrac{1}{M} (Q-1)Q/2}\\
       &= e^{-\dfrac{(Q-1)Q}{2M}},
\end{align}

So $P_C(Q) \approx 1 - P_{\neg C}(Q),$ as desired.

Question:  How can I (at least) have some notion of how off the right number I am if I use this estimation to compute the probability of getting a collision in a concrete case?


texts: Best group if one wants the discrete log problem to be hard?

texts:
Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are simple but it doesn't need to be extremely efficient. I would therefore prefer some type of multiplicative group mod n. It seems different "diffie-hellmann" like schemes employ different groups. So here's some possibilities - I would ideally like them "ranked" in terms of security wrt. the discrete log problem (or any comments if some of them are terrible/insecure choices)

1) Generate a random, big prime "p" and use (Z_p)* as the group (i.e. the multiplicative group modulo a prime p) - the group will have order p-1.

2) Generate a random big integer "n" and use (Z_n)* as the group (i.e. the group will have order phi(n)).

3) Generate a large prime "p" and find a large prime-sized subgroup of (Z_p)*.

4) Generate a large number (not prime) "n" and find a large prime-sized subgroup of (Z_n)*.

(My guess of a ranking - in increasing level of security - would be 2, 1, 3/4).

Some articles seem to call for #3-#4. But are the benefits and are 1+2 inherently secure (I would guess #2 might be depending on factorization of n)? Also, what is the best way to generate a group like #3/#4 (depending on which one is better) Are there other even better choices for groups than 1-4? Also, does it matter what generator one uses? For instance, is the security of #1 intact if one uses the base g = 2?

Thank you in advance!


texts: Relationship between existence of OWFs and OWPs

texts:
OWPs are bijective OWFs, so every OWP is a OWF, but not the other way around.

However, I'm wondering what the relationship between the existence of both types of functions is. Obviously if one assumes OWPs to exist, OWFs will also exist.

But: Does the existence of OWFs imply the existence of OWPs?


texts: Hashing items of different Bytes but same length would enable a timing attack?

texts:
I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main question is about is how the design prevents account enumeration (an attacker finding out if usernames are valid on the server).

To summarise the final solution in Section 4:

  On the server, each valid user has a different $v$ which is generated by a CSPRNG and is at least 128-bits of random data.

  For login, if the user exists, it computes the salt as:

  hash( username || domain-name || $v$ ).

  If the user does not exist, it computes the salt as:

  hash( username || domain-name || $σ$ )

  Where σ is a server secret value of 128 bits of random data.

The point of this is that a salt is always returned, regardless of whether the username is valid or not. This prevents an attacker from making many queries to figure out everyone's usernames and it also prevents timing attacks as the computation is always done server side and it takes the same time.

However in the system we have, we do not have usernames so we are replacing the username here with the user's email address instead. Also we have another requirement where our support team needs to change user's email addresses on their behalf if they lose access to them. The design in the paper would appear not to work in that case because the salt is then based on the email address, and hence the PPF computation is also tied to it. So if the user changes their email then their previous salt is no longer valid and they need to re-do the PPF computation which is a nuisance. Also it's much worse if the support team changed the user's email because then they would definitely be locked out of their account.

So my thoughts to resolve this for valid users is to have the salt calculated as:

  Salt = hash( domain-name || padding || $v$ )

And for invalid users the salt would be calculated as:

  Salt = hash( email || domain-name || padding || $σ$ )

So for this to work, emails would be limited to maximum 80 characters. Then the length of email + domain-name + padding would always be 100 Bytes. And for valid users the domain name + padding would also always be 100 Bytes. The padding character could just be a 'P' and everything is always padded to 100 Bytes.

So my main questions:

Is it possible for an attacker to do a timing attack on the network
request with the server to check if an email is valid/invalid?
Will there be a give-away (detectable) timing difference between hashing        the email || domain-name || padding, vs hashing just domain-name || padding if they're both 100 Bytes in length? I.e. does hashing different characters make the computation take longer or go faster.


texts: Convergent Encryption: integrity and authenticity

texts:
I have one question about convergent encryption.

Suppose I use AES-256 in CBC mode. I need a 256 bits key and a 128 bits IV. If I use SHA-256 to hash one file, then I can use directly that hash as the key.

When decryption occurs, is integrity and authenticity given by checking the hash of the decrypted plaintext, OR is there a need to add additionnals integrity and authenticity checks like CBC-MAC ?


texts: Can one deduce the symmetric key size used to encrypt a given a piece of ciphertext?

texts:
Assume an attacker captures a piece of ciphertext encrypted with a symmetric key.

He knows all the details of the algorithm used to encrypt except for the size of the key used in this case.

Can he deduce the size of the key used to encrypt that particular piece of ciphertext?

My research:

According to this answer about the more general question of telling what algorithm is used, since ciphertext encrypted with a symmetric key looks like random, one cannot answer the question what key size it is using.
https://crypto.stackexchange.com/a/138/15012


texts: Is Triple DES still considered safe to use?

texts: What it says on the tin. Is it still used in things like TLS?


texts: Rationale of "r" AES key use in OTR version 3 AKE protocol?

texts:
I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here  , and aiming to achieve Perfect Forward Secrecy

I am a little bit confused with the described handling of the "r" aes key in the presented DHE (Ephemeral Diffie-Hellman) protocol:

DHE is used in asymmetric way : g^x is sent encrypted with r aes key by Bob while g^y is sent in clear form by Alice
then r (step 7) is further sent in clear form by Bob so that g^x is recovered by Alice

What may be the rationale for such r aes  key use which seems very strange to me ?

is g^x to be temporarily hidden to Alice until Bob check that g^y has legal value ?
I surely missed the real reason


texts:
Consider a use case that requires the creation of multiple asymmetric key pairs. There are two options for generating random seeds for a PRF:

Use a software based RNG and generate a new seed for each key pair
Use a hardware based TRNG, generate a single seed, and increment that value for each new key pair

Would either of these options be superior to the other, in terms of security strengths/weaknesses?
EDIT
My thinking is that neither solution above would be necessarily insecure.
The RNG solution would generate less entropy than the TRNG initially, but that may not be a problem, depending on the use case, if no other weaknesses were present.
For the TRNG solution, my understanding is that the larger goal is for the salt value to be unique, rather than secret (the private key needs to be secret). As the seed increments, the PRF will mask any resemblance to the original seed.


texts: How to crack unknown 8-bit encryption algorithm?

texts:
Can anyone tell me how to crack the encryption of 8 bit algorithm, when you have some clue that CBC mode is used, but the algorithm is secret. You also have some encrypted data (chosen plain text), which belong from 0 to 256.

How can you crack the encryption in that case?


texts: Question about using isogenies to mask elliptic pair

texts:
For this question I'm referring to the ed25519 algorithm

In blockchain one project (Monero) shot itself in the foot a while back by having senders derive public keys from an ed25519 pair, by performing scalar multiplication of the random value against the '8' co-factor subgroup.
The issue here was that they were using a scheme which requires that there be no other valid derivations among other co-factor subgroups (i.e., '4' and '2').
This led to the construction of Ristretto, which is like an abstraction of the ed25519 coordinates to provide a prime order subgroup. The implementation I'm going by is the one where this Ristretto abstraction is built from the '4' co-factor subgroup of the ed25519 key pair in order to form a Jacobi quartic curve.
To my understanding, from that point - an isogeny between the Jacobi quartic and the ed25519 pair we used before (but this time creating a mapping with the '8' co-factor subgroup).
My Questions
Let's say that there's a 3rd-party somewhere that needs to verify the authenticity of a signature.
Also, let's say that this 3rd-party possesses knowledge of the jacobi quartic but nothing else. So they do not know what this was abstracted from.
Now let's say the original creator of the ed25519 key pair that the Jacobi quartic was created from provides:

Public key derived from the isogeny;

A valid signature constructed from the private key of that public key derived from the isogeny.

From here, I am curious:

Is it possible for this 3rd-party to determine whether the public key is the correctly derived isogeny?

If 'yes' to the question above, is it reasonable to assume that it would be impossible for the 3rd-party observer to have derived the ed25519 public key from the Jacobi quartic, correct?

How is the 'Jacobi quartic' represented notationally? Is it presented in the same way as a public key from other private / public key pairings derived from points on an algebraic curve of some sort?

Can one generate a signature from that Jacobi quartic curve that's formed? (via Ristretto's btw)

If yes to the question above, is it the same or different from the derived isogeny?

If the signature of the Jacobi quartic is different from its derived isogeny, is there any mathematical relationship between the two?

If the signature of the Jacobi quartic is different from its derived isogeny, could one somehow mathematically figure out what the isogeny signature is supposed to be if they knew the ed25519 pairing that the isogeny would be formed from as well as the message in question that needed to be signed?


texts:
I'm writing a symmetric encryption scheme for a product that I'm working on which doesn't store sensitive data (license validation data). I'd still rather do it right and reuse it than do it wrong and make something useless.

I have some concerns about HMAC after encrypting and making sure that the HMAC actually serves its purpose. I read this article on avoiding mcrypt vs OpenSSL which pretty adamently promotes the concept of MAC-after-encryption.

Now here is my current process for encrypting the data (you can imagine how the decryption side works):

//PHP7
function encrypt($message, $key){
  $method = 'aes-256-cbc';

  if (mb_strlen($key, '8bit') !== 32) {
    throw new Exception("Needs a 256-bit key");
  }

  $ivsize = openssl_cipher_iv_length($method);
  $iv = random_bytes($ivsize);

  $ciphertext = openssl_encrypt(
    $message,
    $method,
    $key,
    OPENSSL_RAW_DATA,
    $iv
  );

  $hmac = hash_hmac('sha256', $iv . $ciphertext, $iv, true);

  return base64_encode($hmac . $iv . $ciphertext);
}

My concern is that the HMAC key is the same as the IV which is prepended to the data stream. In theory, anybody attempting to break this can figure out that the first 32 bytes are the HMAC, the second 16 bytes are the IV, and the rest is the cipher text, since it seems to be an industry standard. Somebody running a Vaudenay Attack could potentially modify the cipher text and regenerate the HMAC easily using the IV.

So would it be more secure to use the AES key for the HMAC since that is not passed or stored? Or maybe something different like the XOR of the AES key and the IV? Or a completely new key using another round of random_bytes()?

Should the MAC key be treated just like the AES key in terms of secrecy?

This post titled "Why Can't I use the same key for encryption and MAC" suggests that it is not appropriate to do for AES-CBC mode, lets assume that AES-CBC-MAC is not available to me (because the decryption side is a different library and language).


texts:
I have a question regarding pitfalls of using only encryption.
Suppose Bob and Alice want to flip a coin over a network. Alice proposes the following protocol.

Alice randomly selects a value X ∈ {0,1}.
Alice generates a 256-bit random symmetric key K.
Using the AES cipher, Alice computes Y = E(X,R,K), where R consists of 255 randomly selected bits.
Alice sends Y to Bob.
Bob guesses a value Z ∈ {0,1} and tells Alice.
Alice gives the key K to Bob who computes (X,R) = D(Y, K).
If X = Z then Bob wins, otherwise Alice wins.

This protocol is insecure.

a. Explain how Alice can cheat.
b. Using a cryptographic hash function h, modify this protocol so that Alice can't cheat.

My guess is that Alice can repudiate the fact that she did not receive the value Z sent by Bob and hence does not provide the key. Can anyone suggest other ways in which Alice can cheat ?


texts:
I've seen the term "$q$-type assumption" used in a few papers without a definition. A Google search doesn't seem to come up with anything useful either (except the same papers without a definition). Could someone elaborate on what they are and how they compare to static assumptions?

Are there some other typical "types" or classifications of assumptions that one should know of?

PS: There doesn't seem to be a tag named "assumptions." Something like that should exist, but I don't have enough points to add it.


texts: Difference between SHA 512, SHA 512 Half, SHA 256

texts:
I was trying to create a python wrapper for RIPPLE crypto currency, and i ran into SHA 512 half which i have no idea or reverse googled it to no avail. Can someone help me understand the difference. Currently i am assuming its any 256 bits of SHA512.
RIPPLE Address Encoding


texts: GCM: use the same key:IV pair to encrypt file and filename

texts:
Using Java, I wrote a piece of code that encrypts a given file with AES in GCM mode of operation. So far nothing uncommon.

Now I would also like to encrypt the filename, in the following way:

encrypted filename <- AES(key, IV, original filename).

In order to avoid having multiple key:IV pairs, I also encrypt data with the same key and nonce, like so:

encrypted file <- AES(key, IV, original file)

I know that reusing a key:IV pair is strictly forbidden when dealing with stream ciphers, but since the filename and the file are both in the same set of data, my guess is that it should be fine. However, I am not sure.

Anyone can confirm this ?

tl;dr is it OK to encrypt both a file and the filename with the same key:IV pair with GCM ?


texts:
i wondered what the security implications are if I do the following. If I had a large file encrypted with a OTP and want to change only a few bytes in the plaintext. what security vulnerabilities do I get if I only generate a new OTP for the changing bytes leave the old OTP as is and substitute the new OTP, and do this every time i make a change to the plaintext.

To be clear:

plaintext p;
OTP o;
cyphertext c

Start with…

p = 1111 1111 1111 1111
o = 0001 0001 0001 0001
c = 1110 1110 1110 1110

change plaintext…

p = 1111 1111 1111 __1010__

generate new OTP for the last 4 bit 0101 und substitute it in the "old" OTP…

o = 0001 0001 0001 __0101__
c = 1110 1110 1110 1111

What are the problems ( if there are any ) resulting from this?

I know that if I want to use OTP, I have to generate a hole new pad. But if I have a huge file (multiple GBs), it is hard to generate a new pad of this size if I only want to change a few bytes.

I haven't found material about this topic so far and analyzing attacks against some cypher application is a hard task, but maybe someone has read an article about that OTP application and why you should not do this.


texts: What is the purpose of pre master secret in SSL/TLS?

texts:
I studied about SSL/TLS and learned that client and server must share keys below.

common key for encryption
common key for generating message authentication code

Then, in SSL/TLS, a client doesn't send these keys to server directly, but it sends pre master secret and generates keys from it.
This is why?


texts:
I'm implementing AES and I'm getting confused in the ShiftRows step. So far, my key expansion and SubBytes works and I get the same output as specified by the NIST publication.

For the ShiftRows Steps, if we refer to the test vector below from NIST, the output is incorrect according to this:

Round 1, from NIST page 35:

--------------------------------------------------------------
state:      63cab7040953d051cd60e0e7ba70e18c <-- SubBytes()
state:      6353e08c0960e104cd70b751bacad0e7 <-- ShiftRows()
--------------------------------------------------------------

If we consider the matrix below:

$$\begin{pmatrix}
S_{00} & S_{01} & S_{02} & S_{03} \\
S_{10} & S_{11} & S_{12} & S_{13} \\
S_{20} & S_{21} & S_{22} & S_{23} \\
S_{30} & S_{31} & S_{32} & S_{33} \\
\end{pmatrix}$$

$$\begin{pmatrix}
\texttt{63} & \texttt{ca} & \texttt{b7} & \texttt{04} \\
\texttt{09} & \texttt{53} & \texttt{d0} & \texttt{51} \\
\texttt{cd} & \texttt{60} & \texttt{e0} & \texttt{e7} \\
\texttt{ba} & \texttt{70} & \texttt{e1} &  \texttt{8c} \\
\end{pmatrix}$$

Then the output is clearly different.

$$\begin{pmatrix}
\texttt{63} & \texttt{ca} & \texttt{b7} & \texttt{04} \\
\texttt{53} & \texttt{d0} & \texttt{51} & \texttt{09} \\
\texttt{e0} & \texttt{e7} & \texttt{cd} & \texttt{60} \\
\texttt{8c} & \texttt{ba} & \texttt{70} & \texttt{e1} \\
\end{pmatrix}$$


texts: Security proof in (Ciphertext-Policy) Attribute-Based Encryption

texts:
I am having hard time understanding the security proof in Attribute-Based Encryption, especially in Ciphertext-Policy Attribute-Based Encryption.

To do reduction in CP-ABE scheme, how do I check that the security proof is correct or works. For example, there is a CP-ABE scheme in section 3 of Ciphertext-Policy Attribute-Based Encryption: An Expressive, Efficient, and Provably Secure Realization. How can I approach the paper and check whether the security proof of the scheme is correct?


texts:
Suppose I have n hash/MAC functions, of which n-1 are extremely insecure, leaving only one that is in fact cryptographically secure. If I use all of them on a message and the XOR them together the result will be cryptographically secure or not?
I believe it would, because if 1 is secure than it's output is undistinguishable from random, and will act as a one time pad for the insecure ones. Is this reasoning sound?


texts: How many bits of plaintext are required to verify a stream cipher key?

texts:
If a stream cipher has an $n$-bit internal state, how many bits of known plaintext are required to confirm that particular key is the key?

I believe that the answer is at least $n$-bit's of plaintext. My reasoning is that an $n$-bit state would allow it to generate at most $2^n$ different key-streams, assuming it was a perfect bijection onto the first $n$-bits - which it probably isn't. Is this correct?


texts: Practicality of codebook in current-day secret communications

texts:
Codebook appears, if I don't err, to be an antiquitated topic rarely touched upon in discussions of modern cryptography. Couldn't codebook nonetheless be of high practical utility and even be extremely advantageous in certain critical fields of modern secret communications? Consider e.g. the hypothetical situation where a manager has to securely correspond with his representative who is negotiating with the customer in a bid under rival competitions. It seems that the essential instructions and responses could be realistically formulated as sentences and phrases of an appropriately designed codebook having entries of, say, 256 in number. That is, one needs only to suitably employ a highly limited number of code words in entirely neutral appearing text messages or to otherwise transmit somehow a small number of bits denoting the indices of the involved sentences or phrases in the codebook in certain appropriate way (e.g. the scheme http://s13.zetaboards.com/Crypto/topic/6939954/1/). It may be remarked that the codebook need not be static but can preferrably be dynamic, i.e. the mapping between the codewords and their meanings is dependent on a session key, being a random permutation (Fisher and Yates algorithm or alternatives) determined by it. The codewords are preferrably to be chosen to be certain commonly employed words, e.g. surnames etc. in order to ease the composition of a fairly natural covertext. In case it is desired to have integrity check, one could employ two disjoint sets of codewords that are independently permuted w.r.p.t. the set of meanings so that each meaning (or only those meanings that are classified as important) will be trasmitted via the coexistence of at least one keyword from each set.

Thus seen, top secret communication isn't necessarily a hard problem, or is it? Since no encrypted stuffs are involved, the scheme avoids from the outset issues like enforcing delivery of encryption keys or implanting of "official" backdoors (cf. news of a current debate in US on Apple's phones.)


texts: How to correctly encrypt data with proper authentication using AES-256-CBC in php?

texts:
I have been using the openssl function for encrypting data with AES-256-CBC in php. I have been able to encrypt it using an unique IV (by generating with openssl_random_pseudo_bytes)for each new encryption.

But I am struggling with the idea of authenticated encryption with aes cbc. How do I basically authenticate when I am about to decrypt the data?

Do I need to use something like PBKDF2, blowfish or hash_hmac()?

Do I need to hash the key somehow?

Any help is extremely appreciated.


texts: Why is SIV a thing if MAC-and-encrypt is not the most secure way to go?

texts: The question that I am asking is exactly what I ask in the title.


texts: Does Microsoft use Dual_EC_DRBG by default?

texts:
So, as we all know, Dual_EC_DRBG contains an NSA back door. At this point, there is no reason to call it a "potential" or even an "alleged" back door; the presence is obvious even to the NY Times.

As we also know, RSA BSAFE has been using Dual_EC_DRBG by default, with a justification so stupid it can only be translated as "because NSA paid us to".

This comment on Ars Technica asserts that Microsoft also uses this generator. But I have seen claims to the contrary. Thus my questions are:

What PRNG does Windows Server use to generate private keys for Certificate Signing Requests?

What PRNG does Internet Explorer on Windows use to generate session keys? How about Chrome and Firefox on Windows?

What PRNG does IIS on Windows use to generate ephemeral key material for PFS?

I am most interested in the latest versions of all of these products, and certainly only those released after 2007. References or at least an air of authority are preferred.


texts: Using GMAC for Authentication without encrypting the message

texts:
I am pretty new to cryptography and have a sample of GCM mode of operation for AES.
PFB the code

    Cipher c = Cipher.getInstance ("AES/GCM/NoPadding");
    final int blockSize = 96;//c.getBlockSize();
    final byte[] ivData = new byte[blockSize];
    System.out.println("IV :- "+new String(ivData) );
    final SecureRandom rnd = SecureRandom.getInstance("SHA1PRNG");
    rnd.nextBytes(ivData);
    System.out.println("IV :- "+new String(ivData) );
    /**
     *
     */
    GCMParameterSpec params = new GCMParameterSpec(blockSize , ivData);
    SecureRandom sr = new SecureRandom();
    byte[] aesKey = MessageDigest.getInstance("MD5").digest(
            "som3C0o7p@s5".getBytes());
    byte[] ciphertext;
    byte[] head = "Header information".getBytes();
    byte[] data = "Data to encrypt".getBytes();
    sr.nextBytes(aesKey);
    SecretKeySpec sks = new SecretKeySpec(aesKey, "AES");
    c.init(Cipher.ENCRYPT_MODE, sks, params);
    c.updateAAD(head);
    ciphertext = c.doFinal(data);
    System.out.println("done   "+ new String(ciphertext));

    c.init(Cipher.DECRYPT_MODE, sks, params);
    c.updateAAD(head);

    ciphertext = c.doFinal(ciphertext);
    System.out.println("done   "+ new String(ciphertext));

But I need to do Authentication using GMAC. How do I do authentication using GMAC without encrypting/decrypting? Any pointers or suggestions will be very helpful.


texts:
Given an elliptic curve $(E/\mathbb{K})$ where $char(\mathbb{K}) \ne 2,3$ defined by the Weierstrass equation $y^2=x^3+ax+b$. The $j$-invariant is $j=1728 \frac{4a^3}{4a^3+27b^2}$.

I want to understand very clearly how this j-invariant is constructed and especially from where does the 1728 come.

A rather simple but interesting explanation is, given $(E/\mathbb{K})$ in Legendre form $y^2=x(x-1)(x-\lambda)$, one looks for metric that is invariant with respect to $\lambda$ permutations; that is invariant w.r.t. $\lambda, \frac{1}{\lambda}, \lambda-1, \frac{1}{\lambda-1}, \frac{\lambda}{\lambda-1}, \frac{\lambda-1}{\lambda}$. One can try to multiply or sum these permutations but the result is not only invartiant w.r.t $\lambda$ but also w.r.t the elliptic curve. Finally trying to sum the squares results in the $j$-invariant but without the constant 1728.

So where does it come from? An answer with all the math details of the complex multiplication theory would be great.


texts: XMSS WOTS+ private keys vs XMSS private keys

texts:
The length of WOTS+ private key is an array of length "len" of n-Byte strings. Meaning, for w=16 and n=32, the len is 72. So the WOTS+ max length of the private key is 72, meaning only 72 messages can be signed.
Now my problem is, when you read about XMSS Keys, it says that the private key is defined by 2^h OTS private keys, h is usually 20 so 2^20 keys. What do I generate first? With the first definition I can only have 72 private WOTS+ keys and the second one extends it to over a milion.
Do I have to ignore the fact of array[len] n-Byte private keys and generate just 2^h WOTS+ keys using the chaining function?


texts: Proving that a scheme is not IND-CPA-secure

texts: Suppose I want to prove that a given symmetric encryption scheme is not IND-CPA secure. The first thing I do is to define a specific adversary that attacks the scheme. How can I proof neatly, (using the game where A chooses two messages and is given a ciphertext $c$) that the adversary indeed almost always can determine which of the two messages is encrypted? So the result must be $Pr[$Game$_A^{CPA}(n)=1]-\frac{1}{2}$ is non-negligible. I get stuck in using the probabilities. Like what exactly does $Pr[$Game$_A^{CPA}(n)=1]$ (where $n$ is a security parameter)mean? Is it $Pr$[A outputs 1 and $c$ is the encryption of message1] + $Pr$[A outputs 0 and $c$ is the encryption of message0]? The output of A (guessing the right message) depends on the ciphertext so I am a bit confused.


texts: Why would an RSA library tell me that the public key must be at least 512 bits in size?

texts:
I'm trying to interoperate with a web service by reverse-engineering it. Currently, when sending a POST request, it encrypts the form data one-by-one with a 'RSA' function. But it's rather weird as everywhere else i've tried to use these values have given me errors. It's using this library: https://code.google.com/p/pajhome/source/browse/trunk/crypt/md5/rsa/RSA.js?r=133
Like this:

var crypto = new RSAKeyPair(
    "9d7aa162117a8a9610ed2ddea713d7b",
    "",
    "c9869917572adbb60a2c30ddec2551f")

I know just a little bit of RSA, but if i'm right, this should be the public key with (e,m). But when trying to work it in Java I get the error saying that the RSA public key must be at least 512 bits in size. Where is my mistake happening here?

BigInteger e = new BigInteger("3855b21eba4eb9a8a88117878e1fda49", 16);
BigInteger m = new BigInteger("ac5d160611804794d3e0240f2042b919", 16);

RSAPublicKeySpec spec = new RSAPublicKeySpec(e, m);
KeyFactory keyFact = KeyFactory.getInstance("RSA");
PublicKey publicKey = keyFact.generatePublic(spec);

On my setup, (e,m) are being (13082845549543033994073971762152947067, 229110545576645850236522690668306544921) in decimal (?!?!)


texts:
In Montgomery Reduction, we need to compute $z = x y \text{ mod  } N$ and the Montgomery Reduction of $x$ is $xR^{-1}$.

Why should the choice of $R$ be $2^l$ where $l$ is the length of $N$ to the base $2$?
Why cannot we have a larger $R$?

This is a cross question with math.stackexchange.


texts: Randomness Testing of Block Ciphers with 256-bit Block/ Key length

texts:
NIST explained the process of "Randomness Testing of the AES Candidate Algorithms" in the document.
The document explains the generation of 9 datasets for AES candidates with 128-bit block length and 128-key length. The document also state the number of streams and length of each stream that were set in NIST Statistical Test Suite for randomness testing.
However, the document does not state the process for 192-bit and 256-bit key lengths. Whereas AES candidates also support these two key settings.
From details of each test, one can generate all 9 data sets for 192 and 256 bit keys. But then what should be the stream length and number of streams to be tested, specially for the following tests where number of blocks to be generated is dependent on the key length.

Key Avalanche
Low Density Keys
High Density Keys

Generating above three datasets for 256-bit key, results in much longer bit stream as compared to the one generated by 128-bit key length. So in order to analyze the complete bit stream, one should increase the "number of streams" parameter in NIST or "length of stream" parameter? If both the parameters to be increased, then what should be their value?
Going further, what should be the value of these two parameters for all 9 data sets for block ciphers with 256-bit block and key length?


texts: Is prime order group used in ECDSA unique?

texts: In ECDSA, we use a prime order group $\langle G\rangle$ for cryptographical use. Assume $\#\langle G\rangle = p$. Is there another subgroup in the curve used for ECDSA whose order is also $p$?


texts: ISAKMP 'master key' PFS (phase I) vs Ipsec session key PFS (Phase II)

texts:
A question for the crypto-experts to help out a somewhat confused guy: why does PFS (perfect forward secrecy) also exist in phase II as well as in phase I?

Rationale:
 In phase I ISAKMP, the result of main mode is following keying material:

SKEYID_d = prf(SKEYID, g^xy | CKY-I | CKY-R | 0)

SKEYID_a = prf(SKEYID, SKEYID_d | g^xy | CKY-I | CKY-R | 1)

SKEYID_e = prf(SKEYID, SKEYID_a | g^xy | CKY-I | CKY-R | 2)

SKEYID_d is used in phase II to come up with a session key.
g^xy is the DH (Diffie-Hellman) shared secret.

So there is already PFS in phase I by design. Each time someone establishes a new IPsec VPN tunnel, a new DH shared secret g^xy will be used to compute SKEYID_d, right? Hence, the session key in phase II will also be unique. This is PFS right there?

So if we also do DH in phase II we have double PFS? What is the point?


texts: What is the longest AES key that has been recovered in practice?

texts:
I can recover something trivial like a 16-bit AES key in practice. I'm confident that a 64-bit AES key can be recovered. However, I have been unable to find any documentation of the biggest AES key that anyone claims to have recovered in practice. Are such competitions held, and is there a recognized progress meter that is kept?
Edit:  I'm talking about brute-forcing intentionally weakened keys, i.e. repeating the first X bits of the key to the end.


texts: Is it possible to determine the group order by knowing the "public" and "private" key exponents in an RSA group?

texts: I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If I know $\phi(n)$ I can calculate $p$ and $q$. I ask myself what is if I know $e$ and $d$ (and $m$ and $n$) with $m^{d \cdot e\ \bmod\ \phi(n)}\ \bmod\ n$. Is it possible to calculate $\phi$ (and then $p$ and $q$)?


texts: SSL - encrypt with private key and then with public key?

texts:
Say there are 2 sides that wish to communicate: side A and side B. Let's say we are looking at side A sending messages.

When establishing connection in SSL protocol, does the protocol always require that the message is first encrypted using side A's private key (so side B knows that only A could have encrypted it) and then is encrypted with B's public key ? So that only B could decrypt it ?

In what case would side A encrypt the message only with B's public key and then just send it ?


texts: Secrete message sharing using N private keys

texts:
I'm looking for an encryption scheme that could possibly meet the following requirements.

Let,

$X = plaintext$
$M = (pub, priv)$, where $priv == (Ky + Kz)$

Given func [genKeys, partDec, fullDec, enc] perform,

$genKeys() \rightarrow (Ky, Kz)$
$enc(X, Mpub) \rightarrow C$

$partDec(C, Ky) \rightarrow C'$
$fullDec(C', Kx) \rightarrow X$

Now this is just my view of how the process should be done. I'm familiar with the aspects of symmetric vs asymmetric encryption. However, I have never encountered such requirements before.

To sum it all up:

I would like to share some encrypted message $C$ using $Mpub$. Generate dynamic keys $Ky$ and $Kz$.

$Ky_1+C$ can only be decrypted using $Kx_1$ and not any of the the other $Kx_n$ keys. This may be similar to one of the secret sharing algorithms or key regression scheme.

If this is not possible, then something similar should be sufficient.


texts: Using PKCS #11 Certificate Objects for Verification

texts:
What is the proper way to use the public key contained in a X.509 certificate with PKCS #11?

C_VerifyInit's hKey input says "hKey is the handle of the verification key"

Is it permitted to pass the handle of a certificate containing a public key?

Or is it required that the public key is extracted from the certificate and re-imported as a solo public key, and then this public key handle used for verify operations?

Thank you!


texts: Is there a length-preserving encryption scheme?

texts: Is there a length-preserving encryption scheme, that preserves the lengths of input sizes such that the length of the input plain text is same as length of the output cipher text ?


texts: Can we build a zero knowledge mapping using public-key encryption?

texts:
I'm trying to understand if this design is possible. I want to build a mapping that is zero-knowledge, between a (pubkey, proposalId) => bytes form, without revealing the key.

Let's say we build a ZK circuit with private inputs (pubkey, proposalId), and the public input (sig), where sig = sign(H(pubkey, proposalId), pubkey). It's my understanding that if you sign with a public key, it's effectively public-key encryption, where you can only decrypt with the private key.

If the circuit logic verified that you could decrypt the sig, and hence  the commit to (pubkey, proposalId) was valid, then you could use sig as a key in the ZK mapping. Am I correct in my thinking?


texts: How does HTTPS transfer the symmetric key?

texts:
How is the server's public key used to encrypt the symmetric key in a way so that only the sever's private key can decrypt the cipher?

  The client uses the server’s public key to encrypt the symmetric key and send it securely to the server, and the server uses its private
  key to decrypt it. Anyone can encrypt using the public key, but only
  the server can decrypt using the private key.


texts: what is a rigorous definition of "proof-of-possession"?

texts:
I cannot find a rigorous definition of what the "proof of possession" attribute means.  Different webpages seem to give conflicting definitions:

Some of them say that it means, literally, proving that you possess a value (a key or a password):
https://www.w3.org/2012/webcrypto/webcrypto-next-workshop/papers/webcrypto2014_submission_8.pdf
https://idm.unl.edu/4254-proof-possession
This doesn't seem like a useful definition, though, because almost every crypto operation involves a key, so by this definition, anything would constitute "proof of possession", including just giving the key out to prove you have it.

Some of them say it specifically refers to proof of possession of a private key in a public-private key pair:
https://help.sap.com/doc/saphelp_nwpi711/7.1.1/en-US/4c/a09b7e1fd9634ae10000000a421392/content.htm
http://www.convertwriteservices.com/assets/docs/API/certj_reference/javadoc/com/rsa/certj/PKIService.html
but I think this is probably wrong, as more authoritative sources like https://tools.ietf.org/html/rfc7800 talk specifically about proof of possession in the context of symmetric keys.

One page which is on an internal company wiki that I cannot share, which says that proof of possession means proving that you possess a value, without sending the value to the other party.  Ironically, this is the definition that seems most likely to be correct, since it's most consistent with how people use it, even though I can't find any public-facing webpages giving this definition.

So is it the case that definition #3 is correct and that sources which give definition #1 or #2 are (mildly) wrong?


texts: What characters are valid in PGP encrypted and signed messages?

texts:
What characters may be present in a PGP encrypted message or a PGP signature? For example, do encrypted messages only use the Roman alphabet + some numbers and symbols? Can the character set be configured by the user? Is everything Base64 encoded?

Also, are there special characters that will never be used in a message?


texts: Unconditionally secure message authentication, how does it work?

texts: The definition of an unconditionally secure cryptosystem is that it cannot be broken even with infinitely computational resources and time. The one-time pad (OTP) is an example of an unconditionally secure system, there is nothing in the ciphertext that makes one message seem more probable than the other, brute-force cryptanalysis is in vain because every plaintext is equally likely, even with infinite computational resources and time. OTP is unconditionally secure encryption. Is there also unconditionally secure message authentication, and if there is, how does it work?


texts: What is the use of pre-computed points in ECC?

texts: I am trying to understand the use of pre-computed points in ECC for ECC signature, verification, key generation, and so on. After searching on the internet, I understand that pre-computed points aid faster execution. However, I am unable to get the complete picture. Can someone help with an example? Also, once the pre-computed points are calculated, are these secrets?


texts:
Is signing something 2 times with two different 128 bit keys as safe
as signing once with 256 bit key ?
Does signing 2 times with 256 bit key will make it stronger than
signing once ?


texts: RSA public key and private key calculation: multiple answer

texts:
Given N = 91
public key (11, 91)
Plaintext (88)

Ciphertext = 88 ^11 mod 91 = 30

to decrypt,
30 ^ 59 mod 91 = 88 (plaintext)
30 ^ 11 mod 91 = 88 (plaintext)
30 ^ 47 mod 91 = 88 (plaintext)

How can there be multiple suitable instance of private key such as 59/11/47?

Lastly, must public and private key always be a prime number?


texts:
I have a naive question, what is the nomenclature of exponentiation mean in ECC?

I was reading about exponential ElGamal, what does it mean if a generator point $G^x$ ?  What does $G * \ldots * G$ actually mean?

I know what point double and point addition are, they are inline with scalar operations with the base point.  How can two curve points be multiplied together?


texts: Security of deterministic encryption that uses CBC mode and plaintext as iv

texts:
As title, is this a safe deterministic encryption to use the second block of plaintext as IV, and encrypt with CBC mode?

I am sure that the second block used as IV is different than the first block for each record, so there won't be an "all zeros" problem.


texts:
while working on tate pairing, i have to implement towering technique. like i have point p on F(q) and point Q(F(q^k)) (here embedding degree k=12 for BN curve).

instead of taking a point Q on F(q^12), i take this point on twisted curve E'(q^2).

finally i need to map this point to F(q^12),how can i use this towering technique (2-2-3), because output of tate pairing for BN curve should be F(q^12).
i have studied different articles but still confused, any numerical example would be very helpful.
thanks in advance


texts:
This summer I have made a website for my school's NHS program and integrated it with google scripts to automate tasks such as accessing how many hours users have and to allow members to view how many volunteer hours they themselves have earned. The next step I want to take is to automate the sign-in process for each student's attendance. I would like members to be able to come into a meeting, log in on their google account, and mark themselves as present on the website.

The problem is that I need a system such that members must be at the meeting in order to mark themselves as present. A simple code given at the meeting which members must enter on the website will not work, for members could text other members the code that was at the meeting, thus circumventing the whole system. It is really important that the system only allows people who are present to mark themselves as present since we have very strict attendance policies.

The system last year required students to mark themselves as present on a sign in piece of paper. Not only did trouble the officers with having to manually enter all of the attendance information in, but it also caused really long lines to form outside of the room just for sign-in.

Thanks in advance!


texts: What's the difference between the long term key and the session keys?

texts:
I'm currently studying secret key cryptography, and I've come across the terms "long-term key" and "session key".

What's the difference between these two kinds of keys?


texts: bcrypt - collision-resistance against chosen salt and work factor?

texts:
Would it be difficult to find (cost, salt, input, password0, password1) such that

bcrypt(cost, salt, password0, input) = bcrypt(workfactor, salt, password1, input)

and

password0 != password1

where cost is not too small?

(If no, then the combination of bcrypt with PAKE described in this answer would be insecure.)


texts: What to do when crib dragging does not work in OTP (One-time pad) ciphers?

texts:
With a Cipher text of

7ECC555AB95BF6EC605E5F22B772D2B34FF4636340D32FABC29B
73CB4855BE44F6EC60594C2BB47997B60EEE303049CD3CABC29B
64C6401BAF45F6A930435F3DF875C4E102F8742A45C824AFCA9B
7AC24F5EAF17F0A0754D5834BC3CC3A90ABD7B2A52C222ABC89B
72C24A52B550B3B8624D4F22F86BD2B30ABD642C498122A1D29B
73CC5457BF17E7A4750C5423B178D0A44FFF756355C03CABC28A
74CC0155B443B3A8795F4224AA7E97B507F2632606CF3FA0D59B

It is assumed that each line is a different message encrypted with the same pad.

I have tried countless lengths of words that are supposed to lead me somewhere to the decryption of this cipher, however isn't it just downright impossible to "guess" your way to the answer?

Crib dragging does not seem to work since there seem to be too many possibilities…


texts:
Can anyone answer me, if I can embed a message when I convert it to ASCII value to points on Elliptic curve $E(Fp)$ , by multiplied the ASCII value with a base point B?

For example, I have  $E(F_{31}): y^2=x^3+x+3 \bmod 31$, a base point $B=(1,6)$ and the order of the the elliptic curve is $N= 41.$

To convert the text "Hello" to ASCII values we get $\{72,101,108,108,111\}$ and embedding them to get points lie on $E(F_{31})$ by following:

$72 B=72 (1,6)=(26,11)$ and so on.

Is that true to do that??


texts: security of using digital signature as key derivation material

texts:
I want all keys in my iOS application to rely on the Secure Enclave for security as the iOS keychain becomes insecure on jailbroken devices. Currently, the Secure Enclave currently only supports generation/storage of EC and RSA keys. I'm considering the following design for indirectly using the Secure Enclave to store symmetric encryption keys, but want to validate its security:

On application initialization, generate an asymmetric EC key K in the Secure Enclave.
Use it to sign the device UUID (or some other constant), yielding signature S.
Derive encryption key E = KDF(S)
Use encryption key E to encrypt items in the local database. (E itself is not stored anywhere.)
On any subsequent application start, re-derive S and E and use E to decrypt the local database.

Edit: as @zaph pointed out, the Secure Enclave protects the entire Keychain. The distinction lies in that some keys can be generated in the Secure Enclave (curve p256 EC keys and RSA keys) and some can't. Those that can, enjoy a higher level of security as their private keys cannot be exported from the Secure Enclave. It is those keys that I'm interested in exploiting to indirectly protect other keys/data.


texts: How does a ring affect an inverse rotor?

texts:
Rotor I with ring A would look like this:

ABCDEFGHIJKLMNOPQRSTUVWXYZ
↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓
EKMFLGDQVZNTOWYHXUSPAIBRCJ

Inverse rotor I with ring A would look like this:

ABCDEFGHIJKLMNOPQRSTUVWXYZ
↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓
UWYGADFPVZBECKMTHXSLRINQOJ

Rotor I with ring B would look like this:

ABCDEFGHIJKLMNOPQRSTUVWXYZ
↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓
FLNGMHERWAOUPXZIYVTQBJCSDK

Am I right that inverse rotor I with ring B will look like this?

ABCDEFGHIJKLMNOPQRSTUVWXYZ
↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓
JUWYGADFPVZBECKMTHXSLRINQO


texts: Is it possible to create a detection oracle for all block cipher modes? -- ciphertext-only cryptanalysis

texts:
I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this reason.

My issue is that, other than ECB, the detection I know how to do at this point involves corrupting a bit of the ciphertext and analyzing the error propagation in the subsequent cleartext (like explained here, and as read about in Applied Cryptography). The problem of course is that this requires knowledge of the key and IV to be able to view the cleartext.

Is it possible to analyze only a ciphertext and determine the block cipher mode used to encrypt it?


texts:
I am somewhat new to Cryptography and I'm struggling with this proof I came across in my Intro to Cryptography course. I understand the proof of security for a one-time pad:
Pr[M = m | C = c]
= Pr[M = m| C = c] * Pr[M = m] / Pr[C = c]
= (1/2^n) * Pr[M = m] / (1/2^n) = Pr[M = m]
I was wondering what happens if m > n? Pr[M = m|C = c] != Pr[C = c] but I want to know why and exactly what values these probabilities acquire.
Thanks


texts:
It is known that DES has the key-complementation property. That is, given any key $k$ and any
message $m\in\{0,1\}^{64}$
$$\operatorname{DES}_k(m)=\overline{\operatorname{DES}_\overline k(\overline m)}$$

By using this property, show that the key search of DES can be sped up by a factor of two.


texts: Proof that PRG of itself is a PRG (composition)

texts:
I have this question and I am struggling to find a formal answer to this:

Given $G$ is a PRG, show that $H(s)=G(G(s))$ is also a PRG.

I know that a proof for this would assume that there exists a p.p.t. $\mathcal{A}$ that wins the adversary game against $H(s)$ and thereby there also has to exist one that wins against $G(s)$. But how can I formalize this?


texts:
I found this on page 538 (resp. 576) of Introduction to Modern Cryptography 2nd (resp 3rd) edition by Katz and Lindell. The third bullet point under Example A.6 says:
$$\begin{array}{l}\text{Let }f(n)=n^4+3n+500.\text{ Then:}\\
\quad\text{(…)}\\
•\;\; f(n) = Ω(n^3 \log n).\text{ In fact, }f(n) = ω(n^3 \log n).\end{array}$$
I am just looking for a high level explanation, not a mathematical proof or something, about what this means.


texts:
AES/ECB is commonly considered "weak" to the point that some static analysis software identifies it as not secure and suggests using AES/CBC instead.
The question is: what if size of encrypted input is always less or equal 16 bytes?
I suspect AES/ECB will be as good as AES/CBC in this case...
The other question is: will AES/GCM be any better (secure) for <16 bytes input compared to AES/ECB &| AES/CBC?
Thank You


texts:
I am trying to crack a SHA-256 hash but I am not sure how to approach this in an efficient way. The following is known of the original non-hashed content:

64 characters long
only consists 0-9 and a-z (no capital letters)
the original content does not consist dictionary words
the hash is not salted

I have done some reading on the subject of cracking hashes and some information I have read is conflicting. For example, one said on a public forum that SHA-256 is virtually impossible to crack while the other said that it's a rather poor method for password storage as it could be cracked easily.

Is SHA-256 a safe method to hash passwords with (if not, what are the alternatives) and how do I crack a given hash in an efficient way (assuming the given criteria above).

Thanks in advance!


texts: What is the most secure key expansion routine?

texts:
I am looking at G now, but is there a better, (in terms of security and speed), means by which a byte array can be expanded that doesn't involve another cipher, just a simple algorithm?

I need to expand 1024 bytes to 4096 for use in a stream cipher, and speed is less important than overall distribution of entropy. I am also trying to find something that is strictly algorithmic, that doesn't employ hashing or another cipher. Any thoughts/recommendations?


texts: Security strength of JPBC Type A curve compared to SecP curve

texts:
I recently encountered some problems when learning about the JPBC library.

Does the curve generated by (J)PBC using the method typeAcurvegenerator(160,512) and the curve secp160k1 achieve the same 80 bit security level?

How should I understand the terms qbit and rbit?


texts: I was trying to implement the RSA algorithm myself. I have written the key generation part. My question is if I have the word "apple" which I want to encrypt, do I have to convert each alphabet to ASCII and then apply RSA to each letter or are there some other way?


texts:
In my introductory cryptography class. There is a line describe the construction of S-box in AES
 "The S-box of AES is constructed by combining a function $h(x)=x^{254}$ defined on $GF(256)$  with an invertible affine transformation."
However, when I look into the Advanced Encryption Standard (AES) document , I can not find where the $h(x)=x^{254}$ is used. I understand that S-box is constructed by $a_{i,j}\to a_{i,j}^{-1}(mod\,x^8+x^4+x^3+x+1)$ and subsequent affine transformation. Does $h(x)=x^{254}=x^{-1}$ is used during the inverse proccess?


texts: Proof that counter mode of operation and CBC mode are CPA secure when pseudorandom permutations?

texts:
I know counter mode can be CPA secure, when used with block ciphers modeled as  random permutations. If we use pseudo-random permutations, is it still CPA secure? Is there a proof?

How about CBC mode? When used with block ciphers modeled as pseudo-random permutations, will it be CPA secure? Again, is there a proof?


texts: how Content Scramble System (CSS) works?

texts:
As I understand, the Content Scramble System (CSS) uses proprietary 40-bit stream cipher algorithm to decrypt the DVD content

My question is; where does this key come from? is it embedded within the Hardware DVD player or within the software player?

what's the principle in which this method prevent DVD copy?


texts: Universal Circuits in Indistinguishability Obfuscation Candidate Construction

texts:
I am currently working on an implementation of the candidate construction for an indistinguishability obfuscator that was recently proposed by Garg et al. The relevant paper can be found here. Specifically I am only implementing the construction for circuits in NC1, because the construction for polynomial-sized circuits requires homomorphic-encryption.

In the construction of the indistinguishability obfuscator, they transform a universal circuit into a branching program and fix parts of its input to obtain the obfuscation of the original circuit. Since universal circuits can be quite big and tedious to generate, I am wondering, why it's even necessary to use them. In how far is a universal circuit with partially fixed inputs different from the original circuit? Would it not be possible to simply transform the original circuit into a branching program and apply the whole obfuscation process to it?

The proof of security in the paper is not trivial to me, so it's not clear for me, in how far the security relies on the usage of the universal circuit. I'd be thankful for any enlightenment on the issue :)


texts: How to calculate min entropy of the output of PRNG?

texts: As min entropy of a random variable provides the maximum probability of getting the desired realization of the random variable, which is the most conservative way of measuring the uncertainty of outcomes. Min entropy analysis is required to bound the characteristics of the attacker's perceived observation from the output of the PRNG.


texts:
I'm working on an implementation of Krawczyk and Eronen HKDF from RFC 5869. From Krawczyk's original paper, he identifies four inputs to a KDF in Cryptographic Extraction and Key Derivation: The HKDF Scheme. The four inputs are:

base keying material (secret or seed)
context information (binds security parameters)
public salt (optional, provides uniqueness)
length of derived key

I'm trying to reconcile the differences between a KDF (used in, say, a Diffie-Hellman based scheme) and a PBKDF (used for, say, digesting a password into key material) to provide a common software interface. I think the difference are:

KDFs generally enjoy higher entropy seeds, and don't use an iteration count
PBKDFs generally lack higher entropy seeds, and use an iteration count to help with some attacks. Sometimes they use a purpose byte, sometimes they use a salt, etc. (The purpose byte seems to be a specialization of contextual information).

Adding PBKDF to the requirements, I think the list becomes:

base keying material (secret or seed)
context information (binds security parameters)
public salt (optional, provides uniqueness)
length of derived key (optional)
iteration count

I want to ensure that the security parameters are well represented in a extensible way, which leads me to two questions:

Is it fair to say a PBKDF is a specialization of KDF?
Will a software interface that support the five parameters above be sufficient?

(Sorry about wandering into software design. I need the help and expertise of folks who understand the cryptography, and not the [purely] software architects).


texts: As a cryptographer, what are the things I should care about in my implementation of pairing functions?

texts:
As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing.

I am curious whether I should care which type of pairing I am using in my implementations? Do they affect performance or security at all?

What should I know about these types?

So far, I think I've got these points:

There is an obvious and serious difference between different types of "Curve Generation" in pairings. I mean, whether they are Super Singular, MNT curves, Cocks-Pinch, Barreto-Naehrig, etc is really important because it affects the "security multiplier" (i.e. embedding rate). And for a certain security parameter higher embedding rate means better performance and shorter representation of elements of $G_1$.
Also it is important whether the curves are over "large prime fields" or over fields of "small characteristic" because recent research works in cryptanalysis of elliptic curves show that elliptic curves over fields of small characteristic are not secure anymore.


texts: AES-128 CBC encryption : ciphertext size seems too large

texts:
I am trying to encrypt messages with the AES symmetric algorithm using C language.
I am using a key, an Initialization Vector (IV) and a plaintext, all with a length of 16 bytes.
I expected as output a ciphertext of 128 bit, instead it is of 256 bit. Can you explain me why?


texts: What are the properties of a function based on multiple iterations of a pseudo-random permutation?

texts:
Let $F(S) = \text{Keccak-}f[1600](S)$.

Assuming that the length of $S$ is equal to $1600 \times k$ and if $k$ is greater than $1$, we define a function $F_{k}(S)$ as follows.

We note that $S$ is a concatenation of $k$ $1600$-bit sequences. We denote these parts by $X_1$, $X_2$, ..., $X_k$.

We choose (arbitrarily or randomly) $k^2$ different $1600$-bit sequences and denote them by $Y_1$, $Y_2$, ..., $Y_{k^2-1}$, $Y_{k^2}$. Note that these sequences are open, not secret.

Then $F_{2}(S) = A_{1} \mathbin\Vert A_{2}$, where $$\begin{array}{l}
A_1 = F(F(X_1 \oplus Y_1) \oplus X_2 \oplus Y_2)    ,\\
A_2 = F(F(X_1 \oplus Y_3) \oplus X_2 \oplus Y_4).\\
\end{array}$$

Similarly, $F_{3}(S) = A_{1} \mathbin\Vert A_{2} \mathbin\Vert A_{3}$, where $$\begin{array}{l}
A_1 = F(F(F(X_1 \oplus Y_1) \oplus X_2 \oplus Y_2) \oplus X_3 \oplus Y_3),\\
A_2 = F(F(F(X_1 \oplus Y_4) \oplus X_2 \oplus Y_5) \oplus X_3 \oplus Y_6),\\
A_3 = F(F(F(X_1 \oplus Y_7) \oplus X_2 \oplus Y_8) \oplus X_3 \oplus Y_9),\\
\end{array}$$ and so on.

Question:  if $k$ is greater than or equal to $2$, is $F_{k}(S)$ a PRF or PRP? What is its security parameter (the expected number of security bits)?


texts: Deduce modulus N from public exponent and encrypted data

texts:
This is an RSA question, given data encrypted with a public key from an unknown RSA certificate of 2048 bit, let $X$ be the encrypted data, $M$ the unencrypted data, $c$ the public exponent and $N$ it's modulus. Knowing $X$, $M$ and $c$, can you deduce $N$?

$$
X = M^c \mod N
$$

You can have as many $M$ and corresponding $X$ as you want, hence:

$$
X_1 = M_1^c \mod N \\
X_2 = M_2^c \mod N \\
\dots
$$

I want to know if this is possible, mathematically and programatically. A brute force won't work here. Any ideas?


texts: Can repeatedly encrypting a message with a secure cipher ever produce the original input like what happens in ROT13?

texts:
Lets say we have a message 'm'.
We encrypt 'm' using a stream cipher or any other type of cipher with cryptographic security that produces an output equal in length to the length of 'm'.
Then if we keep on on re-encrypting the output with same cipher (but different key each round) for eternity, what are the chances of it ever producing  'm' as the cipher-text.


texts: In group key agreement/exchange protocols, does key independence implies forward and backward secrecy?

texts:
Kim et al. [here] define Foward and Backward secrecy as follows:

Forward Secrecy (not perfect foward secrecy): the inability for a passive attacker to obtain past group keys from a subset of new group keys.
Backward Secrecy (not post compromise security): the inability for a passive attacker to obtain new group keys from a subset of old group keys.
Key Independence: An attacker who knows a subset of group keys cannot discover a key that does not belong to that subset.

Therefore, it is safe to assume that $\textrm{Key Independence} \Rightarrow (\textrm{Forward Secrecy and Backward Secrecy})$?
Futhermore, does $\textrm{Forward Secrecy}$ implies that new group members should be able to access session keys that were derived before their integration? And does $\textrm{Backward Secrecy}$ implies that removed group members should not be able to access session keys that will be derived after their removal?


texts: How to generate a permutation of n numbers using secret sharing scheme?

texts: Consider $n$ parties having their private inputs $s_1,\cdots,s_n$. How can they compute a public function $f(s_1,\cdots,s_n)= \pi$, where $\pi$ is a permutation of numbers between $1,\cdots,n$, using secret sharing scheme?


texts: At present, all FHE scheme are be constructed based on circuit approach. Can we construct fully homomorphic encryption scheme based on non-circuit approach?  Is Polly cracker non-circuit approach ?


texts: Is it safe to reuse the same random session number r in the Guillou-Quisquarter protocol?

texts:
I basically use the method below, one difference is that after receiving the first proof the verifier asks the prover to create a proof for another challenge d and this several times without having the prover generate a new random value r.
Is this safe? I was not able to find indications in the literature about it and r is never defined as a nonce but I am afraid this could leak the provers secret key A.

  Guillou and Quisquater ([link][1]) present a zero-knowledge proof of
  an RSA signature. Basically, the scheme is as follows:

  Public knowledge: RSA modulus $n$, public RSA exponent $v$, preimage
  $X$.

  Secret knowledge for prover: $A$, such that $A^v = X \mod n$.

  $$ \begin{matrix} \mathcal{P} & & \mathcal{V} \\ r \xleftarrow{\$}
 \mathbb{Z}_n^* \phantom{\mod n} & & \\ T \leftarrow r^v \mod n & & \\
 & \xrightarrow{\quad{}T\quad{}} & \\  & & d \xleftarrow{\$}
 \{0,1,\ldots,v-1\} \\  & \xleftarrow{d} & \\  t \leftarrow A^dr \mod n
 & & \\  & \xrightarrow{\quad{}t\quad} & \\  & & t^v \stackrel{?}{=}
 X^{d}T \mod n \end{matrix} $$

  In this diagram, $\leftarrow$ denotes assignment of a value to a
  variable and $\xleftarrow{\$}$ denotes uniformly random selection from
  a finite set.

  [1]: http://dl.acm.org/citation.cfm?id=88372


texts:
How many different keys can be derived with HKDF before two outputs are identical?
This question is about collision resistance, not about generating different keys with different parameters (eg. different salts/info parameters).
For HKDF with SHA-256 would it be $2^{128}$ since the collision resistance of HMAC-SHA-256 is 128 bit?


texts: One way communication with forward secrecy?

texts:
Is it possible to achieve forward secrecy using a one way communication channel with pre-shared secret?

I have a setup where I need to send some information across a unsafe channel between server A and server B. This communication can only go from A to B so no handshake or two way key exchange is possible.

I could simply share a key between the two servers and use symmetric encryption. But I would like to get forward secrecy if possible so that if the shared keys are compromised in the future the old communication is not compromised.

Is there a known protocol that can do this?

I guess the problem is its impossible to share random session keys like you can in say diffie-hellman and then have to rely on deterministic key generation such as TOTP which derives from the shared secret.

The data to be transmitted is less then 2 kb, all the usual stuff about authentication, replay, tampering etc. still applies.


texts:
I'm trying to understand Matsui's linear attack on DES and I have something I don't understand in his paper. In his paper he say that:

$NS_{5}(16,15)=12$ (which is OK)

and from that he say that:

$X[15]\bigoplus F_5(X,K)[7,18,24,29]=K[22]$

My problem here are the indices 7,18,24,29 - where did they come from?
They are supposed to be the output bits of S5 after the P box but those bits are 17, 32, 24, 26 if I take the P box from wikipedia. Why is that true?


texts: What is the reason of using Pedersen Commitment scheme over HMAC?

texts:
I want to implement non-interactive Bit Commitment scheme for messages of arbitrary length.

And I am curious, what is the reason of using Pedersen Commitment scheme over Salted Hash (in other words HMAC).

Example is coin flipping protocol from Wikipedia:

Alice "calls" the coin flip but only tells Bob a commitment to her call,
Bob flips the coin and reports the result,
Alice reveals what she committed to,
Bob verifies that Alice's call matches her commitment,
If Alice's revelation matches the coin result Bob reported, Alice wins

With HMAC Alice calculates a hash of her call at step 1 and reports it to Bob, keeps key (salt) in secret. During reveal step (3) she reveals a key.

With Pedersen Commitment scheme she reports her commitment at step 1, then reveals her call at step 3 with additional data, related to scheme.


texts:
I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1.
Can i achieve something like this in ECDH? where Bob can calculate the shared key without knowing the private key?


texts: Which keys are necessary to decrypt Application data in a SSL connection?

texts:
I'm debugging an application which communicates between client and server using a SSL/TLS connection, and want to capture and analyze the sent data.

Are the client write keys and server write keys enough to decrypt the data, or do we also need the MAC keys?


texts: Zero Knowledge Proof extended Schnorr - average secrets

texts:
I am trying to compute and an overall average number of given secrets from inside the commitments.
I have the following set-up:

Three commitments;

$C_{1}(id, num, r) = g_{1}^{id} g_{2}^{num}  g_{3}^{r}$,

$C_{2}(id, num, r) = g_{1}^{id} g_{2}^{num}  g_{3}^{r}$,

$C_{3}(id, num, r) = g_{1}^{id} g_{2}^{num}  g_{3}^{r}$. In this we have secret parameters $id$, $num$ and $r$ (random opening). Also for each commitment $id$ and $num$ are different.

So my question is how can I prove to someone what the overall average of nums is without revealing the individual num/s?

Secondly, how could the ids be hidden as along with secrets and still only prove the average?

I tried adding another commitment and just having a linear relation between secrets $num$. However I have a feeling it is not the correct way of dealing with it.


texts:
Hopefully, Crypto can help me understand homomorphic cryptosystems.

I'm designing a high score server for a game I made, and because of facets in the language I'm using, the player would be able to look through the code and execute functions in my game. So, I'm trying to encrypt the score when it is sent to the server. The suggestion was made on Stack Overflow that I try and use a Homomorphic cryptosystem, which would allow the client's game to add or change the value given by the server, then the server retrieves that value and decrypts it as a highscore. Anyway, what I'm having trouble with is the "homomorphic property", or as Wikipedia describes it:

  If the RSA public key is modulus $m$ and exponent $e$, then the encryption of a message $x$ is given by $\epsilon(x)={x}^{e} \bmod m$. The homomorphic property is then
  $$
\epsilon(x_1)\cdot\epsilon(x_2) = x_1^ex_2^e \bmod m=(x_1x_2)^e \bmod m=\epsilon(x_1\cdot x_2)
$$

Now I understand the arithmetic fine, but don't understand this. Is the homomorphic property showing that the encryption is malleable?

That you can perform operations on two unknown (encrypted) ciphertexts, $\epsilon(x_1)$ and $\epsilon(x_2)$, and recieve the result, $\epsilon(x_1\cdot x_2)$ by preforming $x_1^ex_2^e\bmod m$? Or is it just showing that $\epsilon(x_1)\cdot \epsilon(x_2)$ is the same as   $x_1^ex_2^e\bmod m$?

And subsequently, to decrypt it, you use the RSA private key?


texts: Proof that $g(x) = f(x) || f(f(x))$ is a OWF when $f$ is a OWF

texts:
Assume that $f$ is a one-way function (OWF), and let $\mathbin\|$ denote string concatenation.
Consider the function $g$ defined by $g(x) = f(x) \mathbin\| f(f(x))$. It is easy to prove that $g$ is a OWF as well, assuming that $f$ is length preserving (that is, $|f(x)|=|x|$ for all $x$). Here's a sample proof, taken from Lindell's final exam:

Now consider the case where $f$ is a general OWF, not necessarily length preserving. This case is considered in Katz & Lindell book, 2nd Edition, Exercise 7.8:

Q: Why Lindell's proof for length-preserving $f$ does not work?
A: In the proof mentioned above, $\mathcal{A}'$ invokes $\mathcal{A}$ on $y || f(y)$, which upon success, returns $x'$ such that $f(x') \mathbin\| f(f(x')) = y \mathbin\| f(y)$. However, this does not entail $f(x') = y$, as the length of $f(x')$ might be different from the length of $y$.

My question is, how to prove that that $g(x) = f(x) \mathbin\| f(f(x))$ is a OWF when $f$ is a general OWF?


texts: RSA Encryption problem for Discrete Math

texts:
I am doing practice problems for my upcoming final exam, and am having trouble with this RSA encryption problem. If any one could check to see if i did these correctly, it would be greatly appreciated.

For (a) I got $\mathbb{Z}^*_8 = \{1,2,3,4,5,6,7\}$,

(b) i got $3*3 = 1 \text{ mod } 8 = 3^{-1} = 3$

(c) this one i am not sure how to do

(d) $M = N^d \text{ mod } 15$, i got $d = 3$, so $M = 4^3 \text{ mod } 15 = 4$


texts: Berlekamp-Massey to construct minimal LFSR

texts:
Given the sequence 0010001111 (or any other, not homework, but exam practice), how do you use the Berlekamp-Massey algorithm to construct a minimal LFSR?

I have read several definitions of how Berlekamp-Massey works, but I'm missing some simple example that actually demonstrates the algorithm in use.

Trying to use the following http://en.wikipedia.org/wiki/Berlekamp-Massey#The_algorithm_for_the_binary_field this is how far (or short) I get:

Let $s_0, s_1, \dots, s_9$ be the bits 0,0,1,0,0,0,1,1,1,1.
Let the arrays b and c, each of length 10, be: b = {1,0,0,0,0,0,0,0,0,0}, c = {1,0,0,0,0,0,0,0,0,0}
Let L = 0, m = -1
Iterate 10 times:

Iteration 0:

$$d = s_0 + c_1s_{-1} + c_2s_{-2} + \cdots + c_9s_{-9}$$

Already at this first iteration (0) I run into problems. What are these negative subscript s variables?

I'm using the formula on Wikipedia, which is:

$$d = s_N + c_1s_{N-1} + c_2s_{N-2} + \cdots + c_Ls_{N-L}$$

Is there a fault in this formula? Earlier at step 3, the algorithm states L = 0, hence the final term with:

$$c_Ls_{N-L}$$

makes no intuitive sense if it is taken literally? I assume that the subscript of this s variable should keep decreasing and for c it should keep increasing? If taken as the formula states it, these would be just 0?

But regardless, there is this problem with the negative s variables.


texts: Sliding windows implementation (Exponentiation by squaring)

texts:
I am conducting a research on cpu-cache based info leak caused by using Sliding window in the diffie helman key exchange.

For my research I am looking for a real-world implementation of sliding window,I have read the source of BouncyCastle and Gnu-TLs and came out empty.

Can someone share some light on the real world use of this algorithm and where, if at all I will be able to find implementation of it?


texts: Use Cases of Otway Rees key exchange protocol

texts:
I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is not much literature existing.

So I did a little bit of research and have some basic knowledge regarding OR-protocol. I thing I somehow couldn't find were applications / use cases of Utway-Rees.

In literature they are talking about that its used for parties to agree on a secret key using TTP in unsafe networks and that its a common thing for VPNs. But one thing I am still missing is: where is implemented? Does it have some applications in TLS/SSL, or IPSec?


texts: Is it possible to compress random sequence with high entropy

texts:
I have an algorithm that generates pseudo random sequence with length of 100k and high entropy. I would like to check the quality of randomness. So, I used a popular software to compress the generated file and it could manage to compress the original file into a file with just one-third of original file.
I have come across to some random test suites out there. But, I have no idea why a random sequence with high capacity can be compressed like this.

My question is whether compressing the generated file is a proper test?
Does the algorithm fail because of the generated file can be compressed?

Any comment is appreciated.


texts: Minimizing exchanges for ZK proof of a message with given SHA-256

texts:
Consider the problem of proving knowledge of a message $m$ which has a certain public SHA-256 hash $h$, without disclosing $m$ or usable information about it, while minimizing the information exchange (across a bidirectional channel assumed to provide integrity). First restrict to single-block SHA-256 ($m$ less than 448 bits).

Are there firm lower bounds on the necessary information flow in both directions, number of exchanges, and probability $\varepsilon$ of reaching a wrong conclusion?

How far from that are current implementations, perhaps Irene Giacomelli, Jesper Madsen, Claudio Orlandi, ZKBoo: Faster Zero-Knowledge for Boolean Circuits, in proceedings of SEC'2016 ?

Independently, can such proof be non-interactive (becoming a static proof that knowledge of $m$ hashing to $h$ was used in making the proof, with no indication about the proof's origin or freshness)?

The question is motivated by these two.


texts: Proxy decrypt algorithm in Extended Proxy-Assisted Attribute Based Encryption (ABE) Scheme

texts:
Context

I'm trying to implement the Attribute-Based Encryption (ABE) scheme described in the paper - Extended Proxy-Assisted Approach: Achieving Revocable Fine-Grained Encryption of Cloud Data (Yang et al.).

To summarize the scheme in my own words - it is a CP-ABE scheme where decryption of a ciphertext c is performed in 2 stages - firstly, at the cloud server using the cloud server's CS secret key skcs together with a user-specific attribute-based proxy key pxku - and secondly, on the user's machine using their secret key sku.

The first stage is performed by the proxy decrypt algorithm PxDec. From the paper:

  PxDec(skcs , pxku , c) → v: The proxy decryption algorithm takes as input
  CS’s private key, skcs , a user’s proxy key, pxku , and a ciphertext, c, and
  outputs an intermediate value, v.
  The CS runs this algorithm to help a user, u, partially decrypt an encrypted
  record requested by the user with the corresponding proxy key.

Problem

The paper goes on to describe the construction of the PxDec() algorithm and that is where I'm struggling with my understanding.

I've highlighted the problem section in the below excerpt, from the paper:

Question

Considering DecNd() operates on each node in the policy tree,
one by one, what is the meaning of the set S and from where does it originate?

Then, what exactly does the (0) part mean in
$\Delta_{i,S}(0)$ ?

Lastly, how does the recursive sub-routine DecNd() differentiate between ANDs and ORs in the policy tree?

(It may help to know that my background is in software engineering rather than cryptography or mathematics.)


texts:
I'm currently dealing on the so called “Walsh Function” (WF) that is written like:
$$f^W(a)=\sum_{x\in{F^n_2}}(-1)^{f(x)+(a,x)}$$
What I know is that this function is used to approximate an arbitrary function like $f: F^n_2  \to F_2$ and that the $a$ in the upper function is the so called Walsh Coefficient.

But whats in detail about the WF? What can I do with it exactly? How do the elements in the set of the WF look like? As far as I know is this set called the Walsh Spectrum!?
How can an arbitrary function be approximated by the WF?

And what exactly is the the Walsh Transformation (WT). I know there is a method to conduct the WT, the so called Fast-Fourier-Transformation. Why do I do a WT?


texts: Probability approximation of no collisions

texts:
I am comparing the actual probability of no collisions to the probability approximation formula of no collisions from the Understanding Cryptography text.

The approximation is as follows:

$$P(\text{no collisions}) = \frac{e^{-t(t-1)}}{2 \cdot 2^n}$$

I know that t represents the number of elements but I am confused about the denominator. The text says that $n$ is the output width of $h()$. I don't really understand this. Does this mean that for lets say the Birthday Paradox, $n  = 365$? So the denominator would be $2 \cdot 2^{365}$?


texts: Incorporating known ciphertext into new message

texts:
Which ciphers $c_k$ enable one to define a joining function $f_{c,k}$ such that:

$$
f_{c,k}(c_k(p_1), p_2) = c_k(p_1 + p_2)
$$

That is, the result of joining some known ciphertext $c_k(p_1)$ with a plaintext $p_2$ produces the same ciphertext as the concatenation of the respective plaintexts?  Whilst there is some flexibility to modify $p_2$ (e.g. with padding) it cannot be chosen entirely arbitrarily.

What terminology applies to such cipher/function/messages?


texts: Why constrain the message lengths in indistinguishability in the presence of an eavesdropper?

texts:
I need your help with a very basic concept in cryptography which I can't understand/prove on my own.

I'm trying to prove and understand why, under "indistinguishability in the presence
of an eavesdropper" encrpytion, it is required that the lengths of the messages output by the adversary satisfy $|m_0| = |m_1|$.

Just to make sure the reader understand exactly what's I'm talking about, the context of my question is page 6 of these lecture notes on Constructing a Computationally Secure Scheme Pseudorandomness (“Claim of indistinguishable encryptions in the presence of an eavesdropper”).


texts: The security of blind RSA signatures with modular exponentiation as padding

texts:
It is known that (blind) RSA signature implementations should apply some sort of padding to messages before signing or blinding them. Does blind RSA signature with modular exponentiation as a padding scheme, ie. $H(m)=g^m \mod N$ for some generator $g$, remain secure? I can restrict the message space to be $\mathbb{Z}^{*}_{N}$.

My motivation to do this is to preserve some homomorphicity of messages as later I would like to prove some relations between blinded messages. Instead if I would use FDH (full domain hash), then I would lose homomorphic properties of (blinded) messages and could not prove anymore relations between the underlying messages.

A counter-example would be blind BLS, which is completely broken with modular exponentiation as a hash function. Is there any similarly obvious negative indication against applying modular exponentiation as padding/hashing in case of blind RSA?


texts: Why does AES-GCM need a hash/MAC in TLS?

texts:
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this:

It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman Ephemeral, whose public keys are signed with RSA and afterwards AES 128 bit is used with the Galois Counter Mode, which provides authenticated encryption. The last function is a hash algorithm which is used for calculating the message authentification code for each packet.

Given that AES-GCM already provides integrity, why is an additional hash algorithm for authentication needed? Or am I mistaken with the interpretation of this?


texts: Client side encryption / hashing of "person ID's" with password?

texts:
What we're looking for

A solution where data is stored and retrieved (!) from a server using a person ID that can only be known at the client (form of anonymization). Furthermore, the client should be able to calculate the original person ID back from a data record.

Storing certificates on the client is not an option, asking the user for a password is.

My original idea

PBKDF2 + AES (CCM) on the client. However, because we need to be able to retrieve records later, I had to keep the IV (and salt) constant. For what I've read, this could be a problem (but I'm not sure, especially if the person ID is always smaller than the key?).

My alternative idea

PBKDF2 + AES (CCM) on the client, now with random IV. This can now only be used for calculating the person ID from a data record. For data retrieval we would add a separate column, containing a client-calculated hash of the person ID. To prevent against an attack that hashes all valid person ID's and works back from there, I was thinking to salt with the same user supplied password as we used for encryption (since this can be expected to never leave the client).

I could really use some thoughts on this challenge (and the two ideas described above).


texts: Distinguishing x25519 public keys from random?

texts:
I recently read a piece of protocol that avoided sending ephemeral x25519 keys in the clear as an effort to foil deep-packet inspection.

I understand that x25519 public keys are effectively 255 bits, which must be serialized as 256 bits, leaving one unused bit that libraries typically fix as 0. For the purposes of this question, I'd like to leave this out and focus on the 255 used bits.

Alice generates a random private key K, and 255-bit public key K'. She generates R, a 255-bit random string. She flips a fair coin, and if heads, she sends a message M = K'. Otherwise, she sends M = R.

Eve receives this message and does not know K. She must guess whether M = K'. Can she do this with better than the 50% success rate she'd get by guessing? (In other words, can she distinguish the significant bits of a x25519 public key from random?)

edit: in response to a question, Eve has knowledge of the curve parameters.


texts:
So i came across three padding scheme for RSA: PKCS1, PSS and OAEP.
My intention here is to encrypt a file using AES key. then, encrypt the AES key with
the RSA key and save the encrypted AES key along with the encrypted file.
My question is which one of the padding schemes above best suits my purpose.
Needless to say security is top priority for me and using compromised algorithm is off the table.
Thanks in advance


texts: Is function Deterministic or Probabilistic in the malicious security definition?

texts:
As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic and probabilistic)

Now, my question is, why the authors have not said anything about the type of the $f$ in the malicious world? I mean, whether $f$ has two types like in the semi-honest model or not?


texts: Argon2 output length and parameter storage?

texts:
I just started using the libsodium port for .net today and the output length parameter kind of confused me (I'm using the argon2i implementation).

With my limited exposure to hashing, whatever hash algorithm I've used have always returned a constant bit length (for example MD5 & 128). By default it returns 128 just like MD5 which suprised me. I always equated length with strength (though I realize there isn't a 1 to 1 correlation in every case).

Then comes the question with a variable length output what should I choose :). With argon2 are increased bit lengths really going to be that much more secure? I arbitrarily chose 512 bits but I don't know if that's good or not.

A second, but a little unrelated question, do you think you should store the parameters (that can change the hash) in the database along with the password & salt. Examples would be opsLimit, memLimit, outputLenght, etc...


texts: Can quantum algorithms solve the approximate GCD hard problem efficiently?

texts:
Some cryptographic schemes are based on the hardness of this problem. The answer to this question determines if those schemes are quantum resistant or not. There are a number similar questions but they consider the classic security not the quantum security.
Thank you


texts:
For Java I'm only aware of the Bouncy Castle implementation of Salsa20. However, that version is significantly slower than AES-CTR and ARC4.

There are plenty of libraries in C, but are there any good implementations of this stream cipher in Java?


texts: Can a raw ECDH shared secret be used directly for encryption?

texts:
If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match?

Also the situation I'm specifically looking at using static ECC keys, not ephemeral ones, but I would also be curious if using the raw ECDH value for encryption may be OK when using ephemeral keys.  I do understand that it is ~trivial to apply a KDF to the ECDH secret but I am evaluating an existing system.  The system uses p256r1 and is using the resulting x-coordinate as the shared secret.


texts: How is El Gamal different from Diffie Hellman Key Exchange

texts: I am Reading RSA and Public-Key Cryptography by Mollin and I can't make out how El Gamal is different from Diffie Hellman Key Exchange. Any thoughts?


texts: Challenging Question for the Build a Secure MAC with Special Properties

texts:
We would like to ask you to give a construction for requested scheme which provides those properties or give a proof that is not achievable.

[Note that unsuccessful attempts to build such a scheme can be found on the links Is this "linear combination" of PRFs and Hashes a secure MAC? and Is this construction a secure MAC?

Definition (MAC scheme).
A message authentication code (or MAC) consists of
three probabilistic polynomial-time algorithms $\Pi =(\mathsf{Gen}, \mathsf{Mac}, \mathsf{Vrfy})$ such that:

The key-generation algorithm $\mathsf{Gen}$ takes as input the security parameter $1^n$ and outputs a key $K$.
The tag-generation algorithm $\mathsf{Mac}$ takes as input a key $K$ and a message $m =a_1||a_2$ (where $a_1, a_2 \in \{0, 1\}^{n}$, and outputs a tag $T=(t_1,t_2)$ (where $t_1,t_2 \in \mathbb{F}^*_q$). Since this algorithm may be randomized, we write this as $T \leftarrow \mathsf{Mac}_K(m)$.
The deterministic verification algorithm $\mathsf{Vrfy}$ takes as input a key $K$, a message $m$, and a tag $T$. It outputs a bit $b$, with $b = 1$ meaning valid and
$b = 0$ meaning invalid. We write this as $b := \mathsf{Vrfy}_K(m, T)$.

Expected features include:

correctness condition: it is required that for every $n$, every key $K$ output by $\mathsf{Gen}(1^n)$, and every
$m \in \{0, 1\}^{2n}$, it holds that $\mathsf{Vrfy}_K(m, \mathsf{Mac}_K(m)) = 1$.
linear combination: the construction must be provided based on a linear combination of PRFs and Hashes.
forge conditions: we redefined the condition of the attacker's success for pair $(m=a_1\mathbin\|a_2,\;T)$, so that $\mathsf{Vrfy}_K(m,T)=1$, $a_1 \neq a_2$, and also $a_1\mathbin\|a_2$ or $a_2\mathbin\|a_1$ did not asked its oracle.
validation structure: it is required that algorithm $b := \mathsf{Vrfy}_K(m, T)$ act as follows, where $f$ and $g$ are polynomial-time algorithms:
$$f(g(K,a_1),T) \stackrel{?}{=} f(g(K,a_2),T)$$
That is $\mathsf{Vrfy}$ should return $1$ iff the above expression holds and $0$ otherwise.


texts: Is 50% of bits changed in every round always gives 50% of changed bits in the end?

texts:
Let's say we have a cipher with such property, that every round change 50% of bits in every block in average. Is it obvious or it means that after few rounds we will get exactly 50% changed bits?
If I think about it, it looks like it doesn't have to be like that. Next round can delete some changes from previous round and so on. In the end we we can get a different number of bits changed, even if each round changes exactly 50% of the bits.
Am I right? If we have such property that every round change 50% of bits, how to be sure that in many rounds in the end we will also end up with 50% of bits changed? Can it be proven somehow or usually we have to rely on statistical tests?


texts: How to create a private key using $n,e,d,p,q$ where $n$ is prime

texts:
Someone has incorrectly created a public/private key pair where $N$ (modulus) is a prime number.

This makes $p$ and $q$ trivial as they they are $n$ and $1$.

$d$ is solved from
$d \cdot e =  \bmod (p-1)(q-1)$ which becomes $d \cdot e =  \bmod (n-1)$

I want to create the private key knowing this information but no PEM generators I've found correctly handle $p$ or $q$ being $1$ because when you need to find  $e_1$ or $e_2$ you are looking for $d \bmod (p-1)$ and $(p-1)$ [or $q-1$] would be zero and it crashes.

I've tried python's RSA.construct and attempted to make a asn1.cnf but I am unable to calculated $e_1/e_2$.

I am confident it can be cracked though because RSA decrypt is just ciphertext to the $d$-power, $\bmod n$.


texts:
I've seen this question! from 2 years ago:

  Given $F$ is a $PRF$, we define $G$ for an input $x\in\{0,1\}^n$ as follows:

  $$G(x) = F_k(x) \oplus F_k(x \oplus 1^s)$$

The question was if $G$ is a $PRG$. I edited the question a bit to fit the answers given back then. The answers stated this isn't a $PRG$ because
$$G(x\oplus 1^n)=F_k(x\oplus 1^n)\oplus F_k(x\oplus 1^n \oplus 1^n)=F_k(x\oplus 1^n)\oplus F_k(x)=G(x)$$Now because $x$, the seed, must be random and because the adversary cannot affect the seed in any way. Why wouldn't this be a $PRG$?

For a random uniformly selected $x$ shouldn't the output of $F_k$ on input $x$ and $x\oplus 1^n$ be pseudorandom and thus $F_k(x) \oplus F_k(x \oplus 1^s)$ is also pseudorandom?


texts: Do standalone Oblivious Transfer (OT) Protocols exist?

texts:
Are there any Oblivious Transfer (OT) protocols that don’t rely on asymmetrical encryption, public-key encryption or key-exchange?

I’m starting to wonder, as all the OT protocols I know of (and can understand how it works), rely on such an encryption layer. Are there any out there which is somewhat-standalone and does not depend on the security of the scheme/protocol it uses underneath?


texts: Current situation of bilinear pairing protocols

texts:
The bilinear pairings are considered as the key enabler for many novel cryptographic protocols, such as three-party one round DH[1], shorter signatures and certificateless (ID-based) crypto[3] , which employ Tate and Weil pairings. Lots of promising research and progress has been made in the last decade, and the pairing concept has been hyped quite a bit.

However, there are also some sources claiming that pairings are "useless", for example this article from 2015: On the Disadvantages of Pairing-based Cryptography from university of Shanghai.

As a summary, the article claims that BPC (Bilinear pairing crypto) doesn't bring any advantage, and in fact requires significantly large key sizes. But the article only seems to consider Tate and Weil pairings, and only the short signature protocol.

Also, I haven't somehow found much new research or progress about current situation of pairing concepts from the past 5 years. I assume that at least pairings utilizing Tate and Weil are obsolete, as Ate and optimal Ate over BN-curves have turned out to be much more efficient.

So finally my question is: Are the bilinear pairings still considered useful, and what are the main advantages? I have assumed that they are so far the only way to implement protocols such as ID-based cryptography.

Sources:
A. Joux, (2000) “A one round protocol for tripartite Diﬃe-Hellman”
D. Boneh and M. Franklin,(2001) “Identity-based encryption from the Weil pairing”


texts: How small are we talking about when defining the small public/private key exponent

texts: I've been wondering about the 'small' part of the attacks on RSA, like the small public key exponent and the small private key exponent and what's not really clear is how small are we talking about? Like is it how small with respect to the large prime numbers or what exactly?


texts: Why does a transcript which is indistinguishable from a fake one show zero knowledge?

texts: Is there an intuitive way to understand why having a transcript that the verifier could have created themselves and is indistinguishable from a real transcript , shows zero knowledge?


texts: Deciphering a key from XOR encrypted cypher using boolean logic

texts:
Assume there's an unencrypted message A, and an encrypted message B. You know that message B was encrypted using a simple XOR method of A with a private key K, resulting in message B. Thus,

B = A ⊕ K

Can I use Boolean algebra, i.e. truth tables, and sum of products to decode the key?