texts:
Imagine the following senario. We have $n$ participants. Participant $i$ has a set of elements $S_i$ with the elements being in a random order, possibly different for each participant.

The participants want some way to get something like a "hash" of the sets. Particularly they want for the hash to be collision resistant, so that it is hard to find two different sets with the same hash.

The hash function should also be pre-image attack resistant, so that given a hash (or a set) it is hard to find a (another) set that hashes to this values.

The catch is that the participants cannot reorder their sets. This means that the hash function must be order independant of the order of the elements but not of their contents.

Is there a secure and solid way to fulfil the requirements?

( I had a simple idea, to compute something like $SetHash(S) = Hash(e_1) \oplus Hash(e_2) \oplus \dots \oplus Hash(e_n)$ which i think satisfies the preimage attack resistance property but i cant formally prove that it is also collision resistant)


texts: is this authenticated key exchange protocol sound? too complicated? obviously flawed?

texts:
(significantly reworded this question to fit better into crypto.se).

I have static RSA keypairs for both sides and an encrypted transport that needs symmetric keys, and need to exchange session keys. The library I base this on is OpenSSL, which doesn't seem to have some pre-canned AKC protocol for me to use, so I have to roll my own.

I thought about various options, all of which use RSA for authentication and session key exchange and an additional curve25519 ecdh exchange for perfect forward secrecy.

I wonder how complicated it needs to be. Right now I do this - to start a half-duplex connection (session and hmac keys for sending only), I send a fully random RSA challenge and the public ecdh key.

The other side responds by checksumming the decrypted rsa challenge and the ecdh key, thereby proving that it has the private key, and then enganges in exactly the same protocol in reverse, so there are two rsa and ecdh exchanges (this is because it is simpler than doing only one ecdh exchange, even if it is slower).

The devil is in the details, here are my questions:

is it safe to use the random rsa challenge for key material (I use hkdf to derice keys)? I.e. is it safe to use the random rsa challenge data both for authentication and for encryption keys? My gues sis yes, but I would like to have an informed opinion, not mine :)
how should the authentication proof (digest (rsa + ecdh)) be calculated? Is a straight sha512 safe? Right now, I use hmac(part-of-rsa-challenge, rsa-challenge + ecdh), but this might be overkill, and even detrimental, as the hmac key is part of the hashed challenge data.
should the authentication proof include the ecdh data? If it does, then tampering could be detected earlier, if it does not, then the decryption fails later. My guess is that it doesn't really matter for the security.
the rsa challenge includes the hkdf salt, and additional keying material used by both sides, and there would even be space to include the ecdh key in the rsa. is it best to take as little as possible from the rsa challenge and send e.g. ecdh and hkdf salt in cleartext, or is it best to have as much data inside the rsa challenge?
Should I use a kdf to derive as many keys as possible from the same key material, or should I use as much independent key material as possible, e.g., when I have 1024 bit key material, should I use a single hkdf to derive 4 session keys from it, or should I use four independent hkdf invocations of each 256 bit part of the key material?

Most of these more or less boil down to the first question: how much (if any) of the random rsa challenge should be used for session key material.


texts: Random Masking of Padded RSA Ciphertext through homomorphism

texts:
I had asked a question related to this before:
Oblivious Decryption: Decrypting with a private key, without knowing the message

@rikhavshah has an answer, which I would like to discuss the security of.

Simply put:

Alice has an RSA public key $(e, N)$ and a private key $(d,N)$
There's a ciphertext $x$, padded and encrypted using Alice's public key.
Bob doesn't know what the padded plaintext $m_p$ is, but has the ciphertext $x$.
Bob randomly chooses a mask $r$ from $\{1,\cdots,N-1\}$, calculates $x\,r^e\bmod N$ and sends it to Alice.
Alice decrypts $x\,r^e$ by computing $(x\,r^e)^d\bmod N$, which is also $x^d\,r\bmod N$, and sends it to Bob
Bob multiples the value by $r^{-1}$ (the modular multiplicative inverse of $r$ modulo $N$, which with overwhelming odds is well-defined) to extract $x^d\bmod N = m_p$. And later on removes/decodes the padding to extract $m$.

This way, Alice decrypts $x$, without knowing what $m_p$ is. Bob knows the value of $m_p$ without knowing the value of Alice's private exponent $d$

Is there a known attack, that this scheme is vulnerable to? Can the choice of $r$ make this more or less secure? Or simply, how can we approach this scheme and make it secure?

Note: as @rikhavshah has also mentioned in their answer, this has a potential attack where Bob can get Alice to decrypt anything encrypted with her public key. But this is actually what the scheme requires. So I wouldn't consider this as a vulnerability. And please assume, they are using a signature scheme to verify each-others identity.


texts: Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

texts:
If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce:
import Crypto.Random, Crypto.Cipher.AES, numpy as np
key = bytes.fromhex('7d29ccf69c671775e17d4b9dd6485fd8')
nonce = bytes.fromhex('04972c7927042af0ee10c7e6ac56ddd3')
cipher = Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_GCM, nonce=nonce)
print(cipher.encrypt(b'goodgoodcrypto').hex())     # e7e4d3b74617d78022376651ba3a

can be obtained with the same result by obtaining a cipherstream (encryption of a stream of \x00\x00... null bytes) to XOR with the plaintext
xor = lambda x, y: (np.frombuffer(x, dtype='uint8') ^ np.frombuffer(y, dtype='uint8')).tobytes()
cipher = Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_GCM, nonce=nonce)
cipherstream = cipher.encrypt(b'\x00' * 14)     # 808bbcd32178b8e441451f21ce55
print(cipherstream.hex())
print(xor(cipherstream, b'goodgoodcrypto').hex())   # e7e4d3b74617d78022376651ba3a !! same ciphertext!

Here I only took 14 bytes of cipherstream because I only needed 14 bytes to encode plaintext.
Thus, it looks like in this context of AES-GCM that:

encryption here is equivalent to just having a long-enough stream of random-looking bytes (cipherstream above),
deterministically initialized with key and nonce (similar to the seed in PRNG terminology)
encryption is just this cipherstream XORed with plaintext

Question: can we turn a (cryptographically secure) PRNG into a stream cipher? (the PRNG's seed is the key / nonce)
The reciprocal seems also true: AES-GCM encrypting a flow of null bytes b"\x00\x00\x00\x00..." seems to give a cryptographically secure PRNG. The seed is the key+nonce pair.


texts: Why the data length is shifted 3-bit in MD4 Java implementation?

texts:
In RFC 1320, It is stated that "A 64-bit representation of b (the length of the message before the padding bits were added) is appended to the result of the previous step. In the unlikely event that b is greater than 2^64, then only the low-order 64 bits of b are used. (These bits are appended as two 32-bit words and appended low-order word first in accordance with the previous conventions.)".

I have three Java implementation of MD4, and each of them first shifts the lenght 3-bit to left. I could not understand why? I am sure it is a Java related issue, but I do not know what causes that?

Implementation 1: https://svn.apache.org/repos/asf/mina/mina/branches/2.0/mina-core/src/main/java/org/apache/mina/proxy/utils/MD4.java

Implementation 2: https://llvm.org/svn/llvm-project/llvm-gcc-4.2/trunk/libjava/classpath/gnu/java/security/hash/MD4.java

You can google for more implementations, I could not enter more than 2 links because of my reputation.

Regards,
Bünyamin.


texts: How is a non-interactive zero-knowlege proof constructed using homomorphic encryption?

texts:
I've been reading too much, and I still haven't found the explaination I so crave. I'm looking specifically at zk-SNARKs, as implemented by ZCash. They say they use homomorphic encryption in their non-interactive, zero-knowledge proof systems, which I am just beginning to understand, but am very fascinated with.
I've encountered quite a bit of what appears to be infinitely confusing algebra in the explaination of these systems, and would like a more word of mouth based answer.
So, in layman's terms, how would one construct a non-interactive, zero-knowledge proof system using homomorphic encryption?


texts: I wanted to know the size of plaintext, key and ciphertext of the KP-ABE algorithm

texts: I have to present an ieee paper at my college, and I picked up a topic based on KP-ABE encryption and the paper doesn't have the size of plaintext, key and ciphertext in it


texts: Why doesn't this replay attack work on ECDSA?

texts:
I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great.  The thing I'm currently stuck on is trying to understand why replay attacks don't work on ECSDA.

For this scenario, the public key, $Q = x \centerdot G$, where $x$ is the private key and $G$ is the generator of size $n$.  Additionally, $H(m)$ is the hash of message $m$ and $k$ is a random number in $[1,n-1]$.  The signature $(r,s)$ would then be defined as

$\begin{eqnarray*}
r &=& (kG)_x \mod n\\
s &=& k^{-1}(H(m) + rx) \mod \ n
\end{eqnarray*}$

Now, in this hypothetical attack, the attacker sees $(r,s)$ along with message $m_1$ and wants to send message $m_2$ on the next transmission via replay attack.  If my math is correct, and it most assuredly isn't, he could achieve this by keeping the original $r$ and deriving the following:

($mod\ n$ omitted for tidiness)

$\begin{eqnarray}
s_1 &=& k^{-1}(H(m_1) + rx)\\
 &=& k^{-1}(H(m_1)) + xk^{-1}(kG)_x\\
 &=& k^{-1}(H(m_1)) + (xG)_x\\
 &=& k^{-1}(H(m_1)) + Q_x\\
k^{-1}(H(m_1)) &=& s_1 - Q_x\\
...\\
s_2 &=& k^{-1}(H(m_2)) + Q_x\\
s_2 &=& (k^{-1}H(m_2))(H(m_1)H(m_1)^{-1}) + Q_x\\
s_2 &=& (k^{-1}H(m_1))(H(m_2)H(m_1)^{-1}) + Q_x\\
s_2 &=& (s_1 - Q_x)(H(m_2)H(m_1)^{-1}) + Q_x
\end{eqnarray}$

$(r, s2)$ is now a valid signature for $m_2$.  But that's way too easy to be realistic, so where's the error?  The only thing I can think of is if $xk^{-1}(kG)_x \neq (xG)_x$, but it seems like it would need to for the authentication steps to cancel correctly.

If this were a valid attack, then the receiver would need to counter it by logging $r$ to ensure that it's never reused, and I've never heard anyone suggesting doing that.


texts: Has the Linear Congruent Generator ever been used in any of the early crypto algorithms?

texts: The Linear Congruent random number generator is the simplest kind of pseudo random number generator. I know that its now long broken. But I am curious -- has it ever been used in any of the early crypto algorithms, say 70 years ago? Or has it been used for basic statistical simulations from day one. I read somewhere that it was used in the old IBM-360 computers. I am curious what it was used for.


texts: Random semantic security and bijective PRGs

texts:
I'm working through Boneh and Shoup's "Graduate Course in Applied Cryptography", and have just finished reading the chapter on stream ciphers and PRGs.

The first exercise for this chapter introduces the notion of semantic security of a cipher for random plaintext messages. Formally, for a cipher $\mathcal{E}=(E, D)$ defined over $(\mathcal{K}, \mathcal{M}, \mathcal{C})$, we define an attack game where the challenger (instead of the adversary $\mathcal{A}$) chooses two messages $(m_0, m_1) \xleftarrow{R} \mathcal{M}$ uniformly at random from the message space, and encrypts $m_b$ in Experiment $b \in \{0, 1\}$, sending the adversary the resulting ciphertext $c$. $\mathcal{A}$ then sends back a single bit $\hat{b} \in \{0, 1\}$ to end the game. $\mathcal{A}$'s advantage in this game is then defined as

$$
SSRadv[\mathcal{A}, \mathcal{E}] = \left|Pr[\hat{b}=1|b=0] - Pr[\hat{b}=1|b=1]\right|
$$

and $\mathcal{E}$ is said to be semantically secure for random plaintexts if $SSRadv[\mathcal{A}, \mathcal{E}]$ is negligible for any efficient adversary $\mathcal{A}$.

The main body of the question asks about how one would build a cipher $\mathcal{E}'=(E', D')$ defined over $(\mathcal{K}', \mathcal{M}', \mathcal{C}')$ that is semantically secure in the "normal sense" (i.e. in an attack game where the adversary chooses $m_0$ and $m_1$), using an SSR-secure (as defined above) cipher $\mathcal{E}$ as a starting point. For complete context, the problem also states that $\mathcal{K}=\mathcal{K}', \mathcal{M}=\mathcal{M}'$.

Given the topic of the preceding chapter, it feels like a natural solution here is to use a secure PRG $G$. Specifically, let $G$ be a secure PRG defined over $(\mathcal{M}, \mathcal{M})$, and then for a given key $k \in \mathcal{K}$ and message $m \in \mathcal{M}$, define $E'(k, m) = E(k, G(m))$. Intuitively, G transforms any chosen plaintext $m$ into an essentially random element of $\mathcal{M}$, and then the random semantic security of $\mathcal{E}$ implies the semantic security of $\mathcal{E}'$. For brevity, I won't try to spell out the actual security proof here.

My main concern here arises when trying to define what the decryption algorithm $D'$ would look like here. In order to undo the application of $G$, we'd need $G$ to have an inverse, and since $G$ is defined over $(\mathcal{M}, \mathcal{M})$, this implies that $G$ is a bijection. This seems like it would contradict the assumed security of $G$; if we can readily define an inverse for $G$, then we could retrieve any seed from its corresponding image in $G$.

Is it possible to have a secure PRG $G$ that is also a bijection, and if so are there restrictions on $\mathcal{M}$ (e.g. $\mathcal{M}$ is super-poly in the security parameter, etc.)?
Is there a different approach to building $\mathcal{E}'$ that gets around this potential security flaw?


texts: Cracking WWII-era codes - code found on a pigeon's leg in Surrey

texts:
A recent BBC article entitled WWII code 'may never be cracked' posted a code:

AOAKN HVPKD FNFJW YIDDC
RQXSR DJHFP GOVFN MIAPX
PABUZ WYYNP CMPNW HJRZH
NLXKG MEMKK ONOIB AKEEQ
WAOTA RBQRH DJOFM TPZEH
LKXGH RGGHT JRZCQ FNKTQ
KLDTS FQIRW AOAKN 27 1525/6

According to the article the code was found on the leg of a pigeon in a chimney in Surrey a few weeks ago.

Do we have enough information about WWII-era codes (presuming that is when it comes from), such as the one above, to figure out what these long-forgotten codes might say?

EDIT: This was discussed on slashdot.


texts: Malleability attacks against encryption without authentication

texts:
Suppose there is a message that is encrypted with AES-128-CBC.  The message is as follows, new lines are used to delimit the 16 byte boundary for each block:

Wire funds from:
Alice to Bob in
 the amount of $
1

Because this message is encrypted using CBC mode,  any modification of the first block of cipher text would propagate throughout the message.   However, the amount of the fund transfer falls in the last block.  I am under the assumption that an attacker can use the property of Malleability to alter the last block and produce a valid amount that is greater than \$1 in far fewer than $2^{128}$ operations.

Is this a correct assumption?  Is there a name for this attack or do you know of a real world example?

My instinct is that if you just need one byte of the 16 byte block to be of a specific value then it would only require $2^8$ operations because the other 120 bits of the plain text could be any value. For example lets say we wanted the last block of cipher text to decrypt to 9\0 (where \0 denotes a single null byte, and the message would be interpreted as \$9), then it would take only $2^{16}$ operations to find this cipher text block.

Is there something I am missing?


texts: Possibility for same Private Key Generation in identity-based encryption

texts:
In private key generation of IBE scheme, private key is generated as follows: $SK_{ID}=s.H(ID)$
Suppose two servers use the same curve domain parameters.
If PKG on server A generates private key $SK_{ID}=s.H(ID)$
PKG on server B generates private key $SK_{ID}=b.H(ID)$
for the same ID.
If there are more than 100000 servers, will there be possibility for generating same private key?


texts:
we normally always encrypt by public key and decrypt with private key.

If i encrypt with private key, then its still secure as normal PKI ?
i mean known-plain-text will not take private key on the risk ? (for example when people know the plain text and signed message with private key, then private key is safe or will compromise?
When we encrypt with the public key then known-plain-text make public key compromise but private key is safe?


texts: Is there a fast implementation of RSA for Microcontrollers?

texts:
Zhe Liu, Johann Großschädl, and Ilya Kizhvatov. "Efficient and Side-Channel Resistant RSA Implementation for 8-bit AVR Microcontrollers" describes a fast implementation, but only contains a sketch of the algorithm with partial pseudo-code.

Is there a worked implementation publicly available?
If not, what is a good fast implementation for small-memory footprint microcontrollers?


texts:
We do compression in PGP.
Does this step increase/decrease or either have any effect regarding the authentication of a message?


texts: What does (block cipher) decryption parallelizable mean?

texts:
I've tried searching this answer on here and on google, but I cant seem to find a succinct answer (maybe because its obvious).

My understanding from wiki/tutorialspoint/ppt is that for CBC/CFB, decryption parallelizable means a plaintext block can be recovered from two adjacent ciphertext block. Is this correct or is there more? I really don't see how the word parallel fits into this at all.
It is stated as advantage for the decryption to be parallelizable, but if an attacker has access to your ciphertext, then couldn't the attacker just decrypt it easily by using adjacent ciphertext blocks.
I've know about C threading, is this related to it? As in you can decrypt the from multiple threads. I don't see how this is possible either because it seems to be done from one chain.


texts:
Need some help. I am not versed in hashing and just started programming with PHP and currently need to hash some strings but required it to be unique. Found that OpenSSL can hash with SHAKE128 but without the option to select the lengths of the output. Notice that every openssl_digest function with shake128 hash output is 256 character by default, can I just take the first 20 character to use since I notice only the last few characters are appended with each length change?
shake128 hash "hello"
example:

5 byte - 8eb4b6a932

6 byte - 8eb4b6a932f2

7 byte - 8eb4b6a932f280

8 byte - 8eb4b6a932f28033

16 byte - 8eb4b6a932f280335ee1a279f8c208a3

Appreciate your insight. Thank you.


texts: How to know the type of encryption method

texts:
If I have a program that take a string to give me the ciphertext, nothing stored, using the same keys. The ciphertext is a base64. Can I figure out the type of encryption by the amount of characters in the base64 string?

Is it true that, 17 character string gives:

16 Bytes = MD5,
20 Bytes = SHA-1,
24 Bytes = 3/DES,
32 Bytes = AES?

If that is true, what is the range of bytes for each encryption by specific encrypted text length?

I'm a beginner, so please tell me if there are any other notes or hints...


texts: Tree structure with XTS and HMAC: MAC in parent

texts:
Situation:
A file format contains a tree-like data structure; parent nodes can find children and child nodes can also find their (single) parent. To protect confidentiality, the nodes in the file are encrypted with AES-XTS (one node may be more than one AES block, ie. more than 16 bytes). For authenticity, a HMAC is used on the encrypted nodes (ie. "encrypt-then-MAC").

What are the advantages/disadvantages between
a) Storing the MAC togther with the node
b) Storing the MAC in the parent node plaintext (MAC together with parent   plaintext is then encrypted and MACed again as part of the parent).

For A, I can think at least of an attacker observing changes to the file, and then changing a whole node back to an old state - as the MAC is changed back too, it won't be recognized. With B, either the whole file or nothing can be rolled back like that, just parts of the file won't work. (If the authenticity of the top node can be protected in some other way, the problem is solved completely).

So, B sounds much better - but are there other problems that A won't have? (And, are there some huge problems for confid./authent. that I have overlooked in both methods?)


texts:
Let ssuppose that we are using AES in CTR mode to encrypt a number of blocks ($x$ bytes each).
How is the current used IV (nonce+ctr) synchronized among both communicating entities?
I suppose that the Nonce can be exchanged in advanced in plaintext. The ctr value can then be appended to each cipher as plaintext. In that way both, sender and recipient can always generate the correct nonce by using the pre-exchanged IV and the appended ctr. Even during the event of packet loss, the received packet can always be decrypted.


texts: Where do the PKs come from in Bluetooth device?

texts:
I am studying the Elliptic Curve Diffie-Hellman (ECDH) on Bluetooth 4.2.
There are some questions about the PK..
Where do these public and private keys come from?
Who defines them?
and Will it be changed ?
if it can be changed, How to do certification ?


texts: Attack on DSA with signatures made with k, k+1, k+2

texts:
For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages $(m_1, m_2, m_3)$, their hash values $(H(m_1), H(m_2), H(m_3))$ and the three signatures $([r_1, s_1], [r_2,s_3], [r_3,s_3])$. What is insecure about this particular instance is that the exponent, $k$, that we use to generate the signatures is $k+1$ in the second message, and $k+2$ in the third message.

I'm trying to figure out how to exploit this. My initial thought was to use the equations for calculating $r_i$ and $s_i$, substituting the appropriate value of $k$, $m$ and $r$ and then adding the equations or using some sort of modular arithmetic to solve the system of equations to first find $k$ in the equations for $r_i$ and then to find $x$ by using $k$ in the equations to find $s_i$. But when I add them together, I'm not able to simplify the equations into anything that can be solved because it is essentially in the same form of the original equation, which I assume can't be solved easily unless the entire algorithm is insecure. Here's what I mean:

The general equation for $r$: $r = (g^k \bmod p) \bmod q$
Adding the 3 $r$'s: $r_1+r_2+r_3 = ((g^k + g^{k+1} + g^{k+2}) \bmod p) \bmod q$

The only value I don't know here is $k$, but since I can't solve it in the first one, I don't think I can solve it in the second one. I think if I found $k$, I'd easily be able to solve for $x$ using the equation for $s$, but I can't find $k$. Do I have the right idea but the wrong math or am I completely on the wrong track?


texts: Many time pad if cleartext contains arbitrary bytes

texts:
I understand the problem of reusing the same key in the one-time pad if the cleartext message only contains characters such as A-Z, a-z and spaces.

But what if our cleartext is composed of arbitrary bytes? Which type of attack can we make to find the key or/and decrypt the ciphertext?


texts:
I'm looking for an encryption scheme that has the following properties:

Decryption is CPU intensive, so decrypting an encrypted text may take some time (relatively, of course). Preferably, encryption should be negligible.
The time to decrypt can be easily raised.
The time to decrypt can be easily lowered.

Naively, I could accomplish #2 and #3 by re-encrypting the data n times and increasing and decreasing n to raise or lower the decryption time.

Is there any such encryption method?


texts: Is length extension attack considered as collision?

texts:
I came across a few articles about length extension attacks on cryptographic hash functions. I was very surprised to read that SHA-256 and SHA-512 are prone to length extension attacks. This seems contradictory to the fact that—to the best of my knowledge—there are no known collisions on these algorithms.

According to the comparison of SHA functions table from Wikipedia the capacity
against length extension attacks is 0 for both SHA-256 and SHA-512 which should mean that this attack does not require much computing resources.

Aren't length extension attacks considered as collisions as well?


texts: Why blake2b is the fastest despite it being 512 bits hashing algorithm?

texts: I am struggling to understand why blake2b is faster than blake2s, despite that blake2b is 512 bits hashing. I hope someone can clarify that for me. I read the official paper for blake2b, but I am not a very technical guy. I didn't understand much of it.


texts: Secondary private key that produces limited certificates

texts:
I want some notion of a secondary key that behaves like this:

Given a public/private key pair, it is not the private key but rather it is once-removed from it. Like the original private key, it is also not public. Unlike it, it was made for a specific purpose (a string) and has expiration.

The secondary key can produce certificates that prove that the certificate-maker has that secondary key, that the secondary key was produced using the original private key belonging to some public key, for some purpose (a string) with expiration limit, and the token produced is within the expiration limit.

When a user which owns a private key produces a secondary key, they essentially say "I grant the carrier of this token permission to act as me for this purpose for this period of time".

What am I looking for?

Some clarification:

The bearer of the secondary key is some half-trusted code in the user's PC. It cannot carry any secrets other than the secondary key, and it uses it with other users, which are also not trustworthy, so this code cannot pass the secondary key to them, so it needs to be able to generate new certificates from it.

So in diagram it is $A \rightarrow c \rightarrow B$, meaning Alice installs some software $c$ she wants to handle her banking stuff, so she grants a secondary key to $c$ that says they can impersonate her when it comes to banking stuff for a certain amount of time. The code $c$ then interacts with some other user, Bob, producing certificates that means it represents Alice when it comes to banking.

In addition there is no external authority, so everything must be validated locally.


texts: Key derivation scheme with shared secrets?

texts:
I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function KDF:

derived[t] = KDF(mk, t)

However mk has already been distributed by a M-of-N threshold secret sharing scheme:

shared_keys = secret_sharing(mk, M, N)

Is it possible to find a KDF and a secret sharing scheme such that I can derive a list of keys from the shared secrets like below? Maybe combine a homomorphic KDF and secret sharing scheme?

pieces = random_pick(shared_keys, M)
derived2[t] = recover([KDF(s, t) for s in pieces])
assert derived[t] == derived2[t]


texts:
In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this:

Alice encrypts her message to Bob with KA and sends it to Trent.
Trent decrypts the message with KA.
Trent takes the decrypted message and a statement that he has received this
message from Alice, and encrypts the whole bundle with KB.
Trent sends the encrypted bundle to Bob.
Bob decrypts the bundle with KB. He can now read both the message and
Trent’s certification that Alice sent it.

I don't understand the last step. The "certification" had not been mentioned in any of the previous steps.

Does "certification" mean "a statement that he has received this message from Alice"?


texts:
I have a simple question:

Are we certain that the md5 hashing algorithm can produce $2^{128}$ different outputs ?
If so, how ?

Note: Sorry if this has already been asked, I really couldn't find it.


texts: Does an anonymous signature hide the sender's identity from the receiver?

texts: Does an anonymous signature hide the sender's identity from the receiver, or simply just hide the sender's identity from an eavesdropper or third party?


texts:
Prove that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure.

I want to show that $P(P=p | C=c)=P(P=p)$. But I don't know how to relate. Can anyone guide me?


texts: How can the Stern's algorithm be used to attack McEliece?

texts:
I'm reading about the attacks of the McEliece cryptosystem. I needed to work out a lot of things because most descriptions I have found so far on the internet seems to be quite hand-wavy about the details. So I wrote down what I understand or I think I understand then I have some questions at the end.
In a McEliece cryptosystem the public key consists of a $k×n$ key matrix $K$ and and the number of errors $t$ to introduce into the ciphertext. To encrypt we take a $k$ element long message $\mathbf{m}$, an $n$ element long error vector $\mathbf{z}$ with $t$ non-zero elements, and finally we get the ciphertext $\mathbf{y} = \mathbf{m}K + \mathbf{z}$.
The attacker can decode the plaintext using information set decoding (ISD). In which we choose $k$ random linearly independent columns from $K$ to form an invertible $k×k$ square matrix $A$, also we choose $k$ elements from the same positions as the columns to form the vector $\mathbf{a}$.
In an attempt to get the plain text we compute $\mathbf{q} = \mathbf{a}A^{-1}$, if all elements in a are error free this should give us the plain text.
Verify the result by computing $\mathbf{y} - \mathbf{q}K = \mathbf{m}K + \mathbf{z} - \mathbf{q}K = (\mathbf{m}-\mathbf{q})K + \mathbf{z}$.
If $\mathbf{m} = \mathbf{q}$, then the result is $\mathbf{z}$ which has $t$ non-zero elements and we are done.
If $\mathbf{m} \neq \mathbf{q}$, then our guess was wrong. The Hamming distance between two codewords is it least $2t+1$, so $(\mathbf{m}-\mathbf{q})K$ is a vector that has at least $2t+1$ non-zero elements. $\mathbf{z}$ has $t$ non-zero elements so even if $\mathbf{z}$ happens to cancel exactly $t$ elements from $(\mathbf{m}-\mathbf{q})K$, then the result still has $t+1$ non-zero elements. So having more than $t$ non-zero elements in the result means failure.
The McEliece cryptosystem chooses the parameters such that finding error free sub sequences is unlikely.
Then I read that there are other attacks. One that turns the problem into a shortest codeword finding problem. And does so by changing the linear code to such that message is mapped like this: $\mathbf{x} \mapsto \mathbf{x}K - \mathbf{y}$. So this translates the codewords in the code defined by $K$ and this preserves the minimum Hamming-distance requirements so it's still an error correcting code. In this code there is no zero element and the shortest codeword is $-\mathbf{z}$ with $t$ non-zero elements (when $\mathbf{x} = \mathbf{m}$). Since the minimum distance is still $2t+1$ all other codewords have at least $t+1$ non-zero elements. So if we can find this shortest codeword, then we can remove errors from the ciphertext making the ISD succeed on first try.
Now here is one thing I got stuck at: the code obtained by translation isn't a linear code because translation isn't linear transformation. The linear combination of codewords in it isn't necessarily another codeword, and doesn't contain an all-zero codeword. Right?
But still most descriptions I saw proceed by adding $\mathbf{y}$ as a new row into $K$, then compute the parity check matrix of this modified code and feed it into a minimum-length codeword searching algorithm such as Stern's algorithm. How and why does this work when the code isn't linear?


texts: AES mode which verifies data integrity AFTER decryption

texts:
I wonder if there is an AES mode which would verify data integrity after decryption operation.

Due to the reasons which does not matter here, there is a possibility that AES implementation I use may produce wrong results under certain conditions (particular data length, memory alignment etc). On the platform, two authenticated encryption modes are available: GCM and CCM.

There is an answer on Crypto which explains that CCM does MAC on plaintext whereas GCM does on cyphertext. Does it mean that if AES should malfunction during decryption, CCM will detect it whereas GCM won't?


texts: AES-256 9 round related key attack - getting possible state differences

texts:
I'm trying to implement related key attack on 9 round AES256, described here:
Biryukov, Dunkelman, Keller, Khovratovich, Shamir, but I am stuck at the very beginning with Observation A, used to validate state difference before final round.

Since I have to guess byte 12 of the subkey, I can end up with impossible value of the byte 12 of the state and Observation A states, that only 127 out of 256 bytes are possible and having one of possible values, whole column of the state can be immediately recovered.

  Observation A.

  Consider a pair that satisfies the main differential described in Section 4.1.1.
  As noted above, the difference in columns 1,2,3 after the MC operation of round 7 is unknown.
  However, due to the properties of the SB and MC operations, there are only 127 possible values for
  the difference in each of these columns. Moreover, these 127 differences assume 127 different values
  in each of the four bytes. As a result, if the attacker knows the difference in one byte, she can obtain
  immediately the difference in the other three bytes of the same column, along with a one-bit filtering
  (since only 127 out of the 256 byte values are possible differences).

  Similarly, if a pair satisfies the
  complementary differential described in Section 4.1.1, then if the attacker knows the difference ∆(I
  7
  )
  in one byte, she can obtain immediately the difference in the other three bytes of the same column
  (though, without the additional filtering since in this case there are 256 possible differences).

It requires 'main differential' which by itself have $2^{-36}$ probability of appearing and then I would get one of 127 possible values of byte 12 and the rest of the column that comes with it. But that seems like awful lot of trouble just to get all values into the lookup table.

How is it supposed to be done? Is there somewhere an actual implementation of this algorithm? Haven't found any, but that would be very helpful.


texts: Predicting values from a Linear Congruential Generator

texts:
I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form:

X_n = (aX_(n-1) + c) mod m

It is possible to predict future X_n given a number of past X_n (even without knowing a, c, m).

In most implementations however there are a couple of complicating factors:

The values returned usually hide a certain number of the least significant bits of X_n
In most cases the values are returned modulo a small integer p.

So rather than the internal states themselves we often have only the high order bits modulo p of each state.

My question is: is it tractable to predict future values given a number of past values with these restrictions - with proof?

I have found this paper by J. Boyar, from what I can work out it only considers point (1) though.

edit

@fgrieu has shown that is is indeed quite trivial if we know a, c and m and m is a power of two. I'm still interested if there is a more general solution.


texts: Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

texts:
I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation,
Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the Derived Master Key to Protect Data.

Here is Figure 3 from this document:

I am using the Option 1b: Generate Master Key (MK) first, and the get Data Protection Key(DPK) for file encryption.

I have 3 questions about this scheme:

If I have a lot (more than $2^{32}$) of files to be encrypted, each file is encrypted using newly generated DPK. Will it somehow cause the MK to be easily found? or easier to find?
The document does not specify which KDF to be used when generating DPK. Can I use back the PBKDF2 again?
Should I generate new random salt for each DPK? Or should I use something related (timestamp or file name) for the salt?

Reference: Secure Programming CookbookΤΜ for C and C++,
Page 142,
4.11 Algorithmically Generating Symmetric Keys from One Base Secret


texts: Are basic replacement ciphers always bad for structured data encryption?

texts:
I have read that basic replacement ciphers, such as replacing one byte with another specific byte at each location, are far less effective with non-randomized data. My question is, can this problem be mitigated to the point where basic ciphers can be effective on structured data by encrypting the data with other methods before passing it through the basic cipher?
For encrypting exclusively highly structured data, are basic substitution ciphers useful from early on in the encryption process, such as directly after something simple like a single XOR, or only after heavy encryption or should such basic replacements be avoided for this purpose all together?


texts: What is the difference between "securely realizes" and "securely implements"?

texts:
In some security proofs it is stated that "a protocol securely realizes an ideal functionality" while in some others "a protocol securely implements an ideal functionality".

Is there a meaningful difference or it is just another verb to say a
similar thing?
Also, is there any difference between emulation and simulation in the context of MPC?

Update:

Example for question 1: Outsourced pattern matching, S. Faust, et al. see Definition 3 and compare with 5PM: secure pattern matching, J. Baron, et al. page 29 definition 5.

Example for question 2: wikipedia article on Universal composability:

  Literally, the protocol may simulate the other protocol (without
  having access to the code). The notion of security is derived by
  implication. Assume a protocol P_1 is secure per definition. If
  another protocol P_2 emulates protocol P_1 such that no environment
  tells apart the emulation from the execution of the protocol, then the
  emulated protocol P_2 is as secure as protocol P_1.


texts:
Context:
We usually assume that the hash functions we use in practice are both: collision resistant and pseudorandom. I wonder what's the relation between those properties.

Question:
Is a pseudo random function always collision resistant?


texts: Finding a Caesar cipher key given encrypted message and part of decrypted message?

texts:
How can I find the Caesar cipher key if I have an encrypted message and part of the decrypted message? For example: I know that the message ends with a constant set of words, but the length of the key is not known.

I have tried using the Kasiski test to check for repeating strings in the encrypted message, but the message i have is a very small one (around 200 characters) so i don't see any useful patterns that might help me narrow down on the length on the key.


texts: Do you use a salt when encrypting a password or just when hashing a password?

texts:
A password is used to connect to a database.
This password is kept in a file.
This password (therefore) needs to be encrypted.
A program to access the aforementioned database needs (of course) the password.
Currently the program decrypts the password, uses the password to connect to the aforementioned database.
Is it recommended to use a salt value when encrypting this password?  Or is salting only related to hashing?  Or is salting something that is used with both encryption and hashing.  My understanding is that using a salt in 'one-way' and related to hashing.


texts:
I don't want the answer to this problem, I just want to understand the steps that need to be followed to solve it. Maybe an example could help.

Problem

We use $\mathbin\Vert$ for  concatenation.

Let $P_1 \mathbin\Vert P_2$ be a message that is two blocks long, and let $P'_1$ be a message that is
one block long.

Let $C_0 \mathbin\Vert C_1 \mathbin\Vert C_2$ be the encryption of $P_1 \mathbin\Vert P_2$ using CBC mode with a
random IV and a random key, and let $C'_0 \mathbin\Vert C'_1$ be the encryption of $P'_1$ using CBC
mode with a random IV and the same key.

Suppose an attacker knows $P_1 \mathbin\Vert P_2$ and
suppose the attacker intercepted and thus know $C_0 \mathbin\Vert C_1 \mathbin\Vert C_2$ and $C'_0 \mathbin\Vert C'_1$.
Further suppose that, by random chance, $C'_1=C_2$.

Show that the attacker can compute $P'_1$.


texts: List of security protocols that have been proved to have bugs using formal methods

texts:
I'm looking for articles about finding bugs in security protocols using formal methods so I can test them using tools like proverif

I've searched a lot of references but most of them seem to be about formal methods itself and why we should use them not testing a particular security protocol.

Are there any security protocols that proved to have bugs using formal methods?


texts: Selecting secret value in certificateless identity-based encryption

texts:
In certificateless identity-based cryptography, selecting secret value $$x_i \in Z_p$$ and declaring public key of individual users such as $$Pub_i=g^{x_i}$$
$g$ is public parameter.
I think there will be some kind of collision in selecting secret value.
In security proof, they make assumption that secret value cannot be allowed to attackers. Is it enough?


texts: Negotiate a secure connection without certificates?

texts:
I would like to have a simple  experience for a user for setting up a secure connection between two computers against a MITM attack. Something like the following:

  A number (possibly base64) appears on both screens, the user verifies
  that the number is identical and clicks OK.

Is there a standard algorithm for this?

If not - would the following be secure?

Each computer sends the other its public signing key. And then on each computer:
The keys are concatenated.
Then hashed with PBKDF2 (or the like).
The user is then shown that hash on both computers, and clicks OK on
both if they match.

Since an attacker can create signing keys quickly (since the attacker doesn't care that they be prime-based) trying for keys that will create the same hash as the one shown, the hash shown to the user would need to be relatively long (~100 bits?).


texts: What does MULx operation in SNOW 3G correspond to?

texts:
According to the spec, MULx operation is defined as  -

MULx maps 16 bits to 8 bits. Let V and c be 8-bit input values. Then MULx is defined:
If the leftmost (i.e. the most significant) bit of V equals 1, then
 MULx(V, c) = (V <<8 1) ⊕ c,
else
 MULx(V, c) = V <<8 1.
Example:
MULx(0x69,0x1B) = 0xC2
MULx(0x96,0x1B) = 0x2C ⊕ 0x1B = 0x37.

What does it really do ?


texts:
In public key crypto, the popular definitions of security (CPA, CCA1,2) depend on PPT adversaries. I'm trying to understand why adversaries should be PPT.

It's clear that adversaries should be at most probabilistic sub-exponential, because otherwise they could exhaust the message space. It's also clear that adversaries should be at least PPT, because any computer can run low-order polynomial algorithms (barring unusual cases) and there's no good way to distinguish low-order polynomials from very high-order (and practically inefficient) polynomials.

So why not allow the adversaries to be probabilistic quasi-polynomials? Where quasi-polynomial means its time complexity is larger than all polynomials and smaller than all exponentials, like $n^{log(n)}$. Is there some example showing why it would not make sense for an adversary to be probabilitic quasi-polynomial?


texts: Why do the majority of SSL cipher suite used CBC?

texts:
I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM.

Why is CBC most used? Is there a specific property that makes CBC preferred by web communications?

Also literature suggests that the non-feedback modes (e.g., counter mode) perform better in practice; however GCM shows up in only a few cipher suites.  Any ideas why?


texts: Does a one-time pad of digits 0-9 have any weaknesses?

texts:
I'm working on one of those unsolved puzzles, and one theory I have is that one or more sections of it are using digits of pi, e, or some other irrational number as a one-time pad.
(The obvious approach would just be to try well-known irrational numbers, but I've tried that without success and if it is that there must be some other complication.)
Are there any cryptanalysis methods that that allows for that wouldn't apply to a one-time pad composed of letters?  One thing that occurred to me is that since letters can't be shifted by more than 9 places, it ought to show very small peaks in its frequency distribution, one-tenth the size of ones for plain text and displaced about five letters to the right along the alphabet.  But I don't know how much practical use that would be.
The question is probably equivalent to whether a Gronsfeld cipher has any weaknesses that a Vigenere cipher doesn't.


texts: To get 128-bit security for RSA, the modulus should be 4096 bits. How was that determined?

texts:
My understanding of security level is that for a crypto scheme to have n-bit security means it would take $2^n$ operations to break it.

For something like AES with a 128-bit key, it's straight-forward to see why it has 128-bit security.

What I don't understand is how 4096-bit RSA is estimated to have 128-bit security. How was that estimation determined?


texts: Is it possible to determine a PGP public key from encrypted data?

texts:
Is it possible to find out which public key was used to generate the message?

Scenario is like this :

I got data which is encrypted with a public key. Now a "bad guy" hast the encrypted data, and knows the decrypted content and wants to know who was the receiver of the data. The "bad guy" has all possible public keys which could have been used to encrypt the data.

Is it possible for the "bad guy" to find out who was the receiver(or witch public key was used).

Thanks a lot.


texts:
What is best to use (for message integrity) between…

AES(Data) + HMAC(Data)
AES(Data + HMAC(Data))
AES(Data + Hash(Data))

…and why?


texts:
all,
I have a very fundamental question on Secret Sharing schemes such as SPDZ families.
As far as I can see for now, SS schemes always assume a certain variable range. For example, suppose the bit length of the variable is $k=32$ and its underlying operational domain is in $p$ ($p$'s bit length is $l=128$), then, all secret values $x$ are shared within $[-2^{31},2^{31}-1]$.
But, when it comes to generate random numbers, I am a little confused. Say, I am trying to generate a Beaver's Triple, should I have $c=a\cdot b$, where all these numbers are shared within $[-2^{31},2^{31}-1]$, or should I have all these numbers shared under $p$. From the original paper itself, I cannot find the answer. Therefore, I want to ask here for some help and the insight why it should be this case. And should it be with the same case as ABY or any other frameworks?
Thanks for help and suggestions!


texts: Can you build a One Way function from a Collision Resistant Function Family?

texts:
The assumption is you have a Collision Resistant function(CRF) Family F. How do you use F to build a One Way function (OWF).

One Idea I have is to use 2 functions from the CRF Family. Both these functions have n input and n/2 output. You as a user inputs n bits ({0,1}^n) and get an output of n, by using 2 of these functions that output n/2 and concatenate them together to get n output.

This would work in creating a one-way function? or is the idea of a one-way function is that it needs to be able to be inverted, but that it is computationally difficult to do so, while a CRF you can not invert to the original answer?


texts: Research Question (Part 2): new symmetric key cryptosystem

texts:
A few weeks ago I asked about a new symmetric cryptosystem discovered as consequence of some new mathematics work (link here). As per suggestion of commenters, I spoke with a cryptography professor, a computer security expert, and also continued to discuss with different math professors.  We have since established the following facts as given in the below list. We wanted to (for the last time) ask a broad audience that could provide useful feedback given this now established new information.

Encryption takes form $E(T, K, P) = (T, C)$, and $D(T,K, C) = P$ for publicly chosen $T$.  Some of the following points have redundancies between each other, but I allow this for clarity.  The main properties of the cryptosystem are as follows.

The security of the system rests on no unproven assumptions (such as the difficulty of factoring).
Perfect secrecy: for $x \in P, y \in C$, $p(x|y) = p(x)$  (unconditionally secure), as arbitrary number of ciphertext gives no information about key or message.
Key reuse: unlike the one-time pad, given arbitrary number of $(T, C_i)$ pairs and no plaintext, the attacker learns nothing about $P_i$ or $K$.  Given $(T, P_i, C_i)$, the attacker learns nothing about $P_j$, $i \not=j$, given $E(T', K, P_j) = (T', C_j)$ for $T' \not=T$, nor about the key $K$.
Secure under chosen plaintext attack: the attacker learns nothing usable about $K$ with an arbitrary number of chosen plaintext/ciphertext pairs.
Semantically secure
Probabilistic system, but Bob can always successfully decrypt with probability 1
If the attacker guesses a key $K$, they have no way of verifying if the guess is correct, only that it is false.
If Alice and Bob share $l$ messages using the same public object $T$, then if Eve obtains a plaintext/ciphertext pair she may decrypt all such messages, but she will be unable to decrypt messages sent using public object $T' \not=T$.
More general cryptanalysis: with large number $l$ of distinct $(T_i, C_i)$ pairs so that $(T_i, C_i) \not = (T_j, C_j), i \not=j$, then, if Eve has a lot of compute, she may brute force construct an approximating key $K_a$, that would, with probability proportional to the size of $l$, give useful information about any new $C$, thereby ruining any previous notion of perfect secrecy with the cipher.  However, if Alice and Bob use the same $T$ for each message, such an approximating key could not be built, but then the messages would be susceptible to plaintext attack.
Note on efficiency: worst case encryption and decryption times grow linearly with key size.  In most cases encryption/decryption time grows at rate of log of key length.

Again, given this new (verified) information, does this system offer any theoretically interesting properties that could warrant publication?  Thank you all for your time.


texts: ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?

texts:
I know the usual way of using getting shared secrets for encryption with ECC is DH, however, this only works with two keypairs of exactly the same kind, for example two curve25519- or two p256-keypairs.

With ElGamal, one can get a symmetric key for a recipients public key no matter which kind of key they are using themselves.
This works great if users don't have the same kinds of keys, and it doesn't use the same shared secret each time. This behaviour makes development and use of an application using ECC for encryption much easier and probably even is more secure (as the shared secret is different each time), so I'd prefer using ElGamal if possible.

However, it only seems to work for Short type curves - NIST, SECG, brainpool and so on. (My javascript implementation (1) is based on SJCL's implementation, but uses "elliptic" as a library, which supports Short, Montgomery and Edwards curves, while SJCL and JSBN only know Short.)

I don't really get this, as the logic behind ElGamal is really simple:

public_key = curve_param_G * secret_key
tag = curve_param_G * random_secret
key = public_key * random_secret = curve_param_G * secret_key * random_secret
key = tag*secret_key = curve_param_G * random_secret * secret_key

The implementation of multiplication for Montgomery and Edwards curves seems to be different from the multiplication function of Short curves. Still, shouldn't it work?

Is there any change to make ElGamal work with Montgomery curves like curve25519, or Edwards type curves like ed25519, and is it just implementations fault?
Or is there any reason this actually isn't possible?

Reasearching on this topic doesn't bring much detailed information(, unless you get the exact math behind Montgomery and Edwards curves, which I don't at the moment, I'm just using the elliptic library for a simple app).

Thank you for your answers :)

(1) Some pseudocode (simplified):

Get a symmetric key for a known public key (to get a symmetric key only the recipient will be able to find out knowing a public key):

ec = curveobject(curve_the_pubkey_is_on);
secret = random_secret_key();
tag = ec.g.mul(secret); // pass along with the message
key = public_key.mul(secret); // use for symmetric encryption

Get a symmetric key for a known tag (to get the symmetric key knowing the tag
and own private key):

key = tag.mul(private_key); // can decrypt message with


texts: 80-bit collision resistance because of 80-bit x87 registers?

texts:
This is just a curious question, and it probably doesn't belong here anyway, and I'm just being bold asking it here.

80-bit used to be considered an adequate level of security, Skipjack and SHA1 were designed to be 80-bit-secure. But why 80 bits? Isn't 96 bits better because it's a multiple of 32 and gives a higher margin?

Does the choice of 80 bits have anything to do with the fact that the 8087 processor has a 80-bit floating-point register as part of the design?


texts: Questions regarding random values in Schnorr authentication

texts:
In Chapter 21.3 of Schneier, Applied Cryptography I read the following about the Schnorr Authentication Protocol:

To generate a key pair, first choose two primes, $p$ and $q$, such that $q$ is a prime factor of $p - 1$. Then, choose an $a$ not equal to $1$, such that $a^q \equiv 1 \pmod{p}$. Then choose a random number less than $q$. This is the private key $s$. Then calculate $v = a^{-s} \mod p$. This is the public key.
Authentication Protocol
(1) Peggy picks a random number, $r$, less than $q$, and computes $x = a^r \mod p$.
(2) Peggy sends $x$ to Victor.
(3) Victor sends Peggy a random number, $e$, between $0$ and $2^t - 1$. (I’ll discuss $t$ in a moment.)
(4) Peggy computes $y = (r + se) \mod q$ and sends $y$ to Victor.
(5) Victor verifies that $x = a^yv^e \mod p$.
The security is based on the parameter $t$. The difficulty of breaking the algorithm is about $2t$. Schnorr recommended that $p$ be about $512$ bits, $q$ be about $140$ bits, and $t$ be $72$.

I have two questions regarding this:

Why can $r$ not also be $q$? This would make the commitment $x=1$, but what would be the problem with that?
Why is the challenge $t$ not allowed to be as large as $q$? It would not break anything, would it? I even found this lecture on Youtube where the lecturer lets the challenge (there denomiated $c$) be $c \in \mathbb{Z}_q$. Does limiting the size of $t$ make the procedure more efficient? If so, how?


texts: Forge CBC-MAC by creating a new message, given the MAC of two messages

texts:
The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation
But I still cannot fully understand it, and here's my question:
given two messages with known MAC:
CBC-MAC(a||b)= x
CBC-MAC(d||e)= y
So from the given messages, I am able to forge a new message like this:
CBC-MAC(a || b || (d XOR x) || e ) = y
(which is just like the post I read).
But how about if I want to forge the message like this:
CBC-MAC(a || b || c || d || e ) = z
The "c" maybe is something calculated from those two messages and its MAC, but I am not sure about it.
Is it possible to achieve this?


texts: Why do all SSH-RSA Keys begin with "AAAAB3NzaC1yc"?

texts:
My friend and I have been generating a few SSH2 RSA keys and noticed all the public keys begin with AAAAB3NzaC1yc, with the similarity extending to AAAAB3NzaC1yc2EAAAABIwAAAQEA between two keys generated on the same machine in two successive attempts (googling AAAAB3Nz ends up getting a few hits as well).
Is this normal or are we doing something wrong while generating, such as suffering from insufficient entropy?


texts: Security of randomized data dependant key schedules?

texts:
An example to demonstrate the point with two Feistel networks:

Cipher A:
\begin{align}
roundkey = hash(key || counter)\\
roundkey = hash(key || roundkey)\\
left = left\oplus hash(roundkey || right)\\
... swap\ and\ continue
\end{align}

Cipher B:
\begin{align}
roundkey = hash(key || counter || right)\\
roundkey = hash(key || roundkey)\\
left = left\oplus hash(roundkey || right)\\
...swap\ and\ continue
\end{align}

In the above, Cipher A would produce identical round keys during every encryption/decryption, while the round keys in Cipher B would be different for each set of plaintext/ciphertext pairs.

Do key schedules which incorporate plaintext data to generate randomized round keys offer any particular benefits or complaints compared to key schedules which produce the same round key regardless of the data being operated upon?

I understand that incorporating plaintext data might potentially allow an adversary to influence the key schedule, but the extent of which that is a problem probably depends on the specifics of the algorithm in question. I'm more interested about the general case, if there's anything that can be said about it. I'm also interested in whether or not it could complicate statistical side channel attacks like differential power analysis.

Are there many examples of randomized data dependent key schedules? Or better, papers outlining attacks against them? My search mostly turned up "data dependent rotations".


texts: Kleptographic attack of ECDSA key generation?

texts:
Kleptographic attacks can be designed for RSA key generation, Diffie–Hellman key exchange, DSA/ECDSA signing, etc. Is it also possible for ECDSA key generation?
More detailed: Is it possible for an attacker to design an ECDSA key generation algorithm, for which the attacker can easily derive the private keys of all generated public keys, while nobody else has any advantage in getting the private keys? (and even nobody else could distinguish public keys generated this way from other public keys)
Edit:
I'm talking about key generation on a specified curve (such as secp256k1), rather than adding backdoors into ECC parameters. What I am looking for is an ECDSA version of this answer: https://crypto.stackexchange.com/a/32155/58843


texts:
I am reading https://en.wikipedia.org/wiki/Curve25519 and it states

Also in 2018, RFC 8446 was published as the new Transport Layer
Security v1.3 standard. It requires mandatory support for X25519,
Ed25519, X448, and Ed448 algorithms.[24]

I understand from various answers on this site that the ECDSA is a different algorithm than EdDSA with EdDSA being simpler, faster and more secure than ECDSA. I am not familiar with the math behind ECC. I am looking for answers to the following questions.

Is X25519 and Ed25519 the same curve?
Is X25519 used by ECDSA?
What does the X in X25519 and X448 stand for?
Is the security advantage of EdDSA a result or the Ed25519 curve or the different algorithm it uses than ECDSA?
If ECDSA is used with the 25519 curve is it just as secure as EdDSA?
Is ECDSA considered to be secure as of Oct 2020?
Should EdDSA be always used over ECDSA?


texts: How is the PKCS #10 signature generated?

texts:
I'm generating certificate signing request in iOS, which does not provide proper ready-made API for CSR generation. Now the library I have used for CSR generation produces the different signature for CSR compared to openssl with the same private key.

How is the signature generated and do you think there is an error somewhere, if the signature generated by openssl and the library I'm using does not match?


texts:
There are two ways for key change: key update, and Re-keying.
Which of these methods use a KDF (Key Derivation Function) for getting new keys?


texts:
I have been assigned this hex file :

https://drive.google.com/file/d/1EeidY67VuIddIC-e-xiiKhth1ucMhM_r/view?usp=sharing

The goal is to decrypt it to something meaningful. The only hint given is that the 1st letter of the plaintext is P.

I have tried so far:

Caesar Cipher

  Simple key addition/subtraction
  Simple key addition/subtraction but circular in the ASCII range
  Pattern-based (+-+-+ or any other pattern)

Substitution

  Bigram Substitution (36 unique hex values => no)
  Quadrigram Substitution (61 unique hex values => no)

Vigenere

  Very hard to find patterns since there is no repeated hex value subset of at least 3 letters

Transposition

   Even using anagrams but still no

If you don`t like to give me the answer a hint would be great.


texts: Berlekamp-Massey algorithm, correct stepping

texts:
I'm trying to use the Berlekamp-Massey algorithm on the following bit sequence:

0 1 0 0 1 0 0 1 0 1

I have the correct answer and most of the approach to get there, but I'm unable to fill in what I don't have, in other words I don't understand how it works.

I create a table, written horizontally here just for convenience:

N: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
S_N: Ø, ...
f_N: 1, ...
L_N: 0, ...

Where ... means the values I should determine using the BM algorithm. Ø is the empty set.

I have already filled in the values for S_0, f_0 and L_0, as these are trivial.

My first step is to calculate f_1:

This is the formula that I use, this is directly copied from some printed lecture notes, so it should be correct.

$$f_1 = \begin{cases} f_N + X^{2L-N-1}\cdot f_m, & \mbox{if } L > N/2 \\ X^{N-2L+1}\cdot f_N + f_m, & \mbox{if } L \leq N/2 \end{cases}$$

We see that for the case of f_1, L = 0 and N = 0, hence we use the lower case:

$$f_1 = X^{N-2L+1}\cdot f_N + f_m
= X^{0-2\cdot 0+1}\cdot 1 + 1 = X + 1$$

However, from my known solution I know f_1 should be 1. I have double checked this, why do I get X + 1 when I just mechanically follow this simple formula? Is there something more to this that I'm overlooking?


texts: Taking half of a X bits hash key as secure as using a X/2 bit hash function?

texts:
This question comes from a (nitpicking) comment by me in this SO question.

I said that using the half of the output from a 256 bit hash function is worse than using a 128 bit hash function. My reasoning is that the contract of the 256 bit function takes into account the full length output so you can find more collisions in the first half of the 256 bits output than you would in a 128 bit hash function.

As I saw here Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1? that that could not be applied to SHA so I was wrong there but in a more broad scenario, does it provides the same security taking the half of the output from an X bit hash function than using a X/2 hash function?


texts: Non-repudiation in classical cryptosystem

texts:
How can we modify classical cryptography system to provide non-repudiation?

I want to ensure non-repudiation in symmetric key cryptography so that we can find out who is sender of a particular message.As sender and receiver share the same key, we can't find out who the sender was.


texts: Securing Data via secret key that must be revealed later

texts:
This question is language and platform independent.

Assumptions:  I am a service provider and my service is storing data encrypted with a key that my customer knows - but I do not.

My customer (party A) wants me to retain this data to a specific time then release the data to another party (party B) who does not know the decryption key.

I should never be able to decrypt the data myself - even writing code to do so.

The initial customer is unavailable and unable to pass the decryption key on to party B.  It is my job as the service provider to provide a way for party B to decrypt the data.

Because party A cannot share the decryption key with party B ahead of time.

The catch is it must be impossible for me to know this decryption key and I must not be able to decrypt this data myself.  A computer program can do this - that is allowed - but there must be no way for me to manipulate the data stored and decrypt it.

It would be a simple matter to store the decryption key and pass it on at the proper time,  but I would then have access to decrypt the data and I do not want to even have that option.  So how do we keep the decryption key secret until time for the exchange and exchange it without revealing it to me?

Edit: ideally B should have to do nothing. B may not even be aware of the situation until it becomes necessary to decrypt the data.  This is the reason for the SP - but the SP cannot be able to decrypt.  SP is necessary to prevent B from accessing data prematurely and to facilitate decryption by B.  When it is time for B to decrypt A cannot be involved.

Purpose: protect data exchange from a to b where through dishonesty or coercion it is impossible for the SP to compromise the data and where a is no longer able to grant access to the decryption keys.   Impossible?

The root question is: is there a scheme by which SP can encrypt data and convey decryption info to B without being able to use the decryption key.

The solution can be complex.  SP doesn't have to know the link between the keys and the data or the links between data and recipient but when event occurs that releases the data then B must be able to decrypt.  It must be impossible to decrypt before event.

How can this be accomplished?

Thanks!


texts: How are hash functions analyzed in an open competition?

texts:
There was a well-known SHA-3 Competition held between 2007 and 2012, where the winner would be standardized as SHA-3. Now that the competition has ended and NIST has released reports on the different rounds. From the Round 3 report it looks like all five finalists are fairly competitive. It'd be interesting to understand why Keccak stands out in the competition and becomes the winner.

In the report, NIST mentioned several aspects of security analysis such as domain extenders, security margin, etc. However, NIST also admits that no  finalist was considered to be a clear winner or loser from the security analysis in the same report. What kinds of cryptanalysis methods do we have at hand? Given the fact that no candidate algorithm is broken, how do we determine (or gain confidence) that one is better than another?


texts: Does encrypting a result of AES block cipher provide more security?

texts:
I would like to know if encrypting a result of AES256 block cipher provides more security.

Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. The server needs to store it in the database and later send it back to the client. Incidentally, the ciphertext is an encryption of some key important to the client, and is sensitive.

On the server side, there are two options:

Save the ciphertext without further processing
Encrypt the ciphertext again with a different key, and save the result (let's call it c). When the server needs to send the original ciphertext back to the client, it will decrypt c to the get original ciphertext, and send to it the client.

Option 2 sounds more secure, but I am unsure if it really provides more security. Any ideas?


texts: Suppose I've got two clients $A$ and $B$. Client $A$ encrypts data in CTR (Counter) mode to get a ciphertext. What information will client $B$ have to receive from $A$ to decrypt the ciphertext? Just the “key”, “IV” (nonce), and “counter start value”?


texts: To prove $r_2$ is a uniformly at random value in $Z_n$, where $r_2=r_1 . m$

texts:
$m$ is arbitrary value in $Z_n$, where n is RSA modulo. Then we do: $r_2=r_1 . m (modn)$, where $r_1$ is a random value such that $r_1\in Z^*_n$.

** Question(1): is  $r_2$ a uniformly at random value in $Z_n$?

**Question(2): Would this be secure: $r_2=r_1 . m (modn)$ (where $m\in Z_n$ and $r_1\in Z^*_n$ )?


texts:
Is it secure to use authentication strategy like this:

store key in database - crypto.randomBytes(32)
store IV and encrypted data in user cookies - crypto.randomBytes(16)

On request decrypt encrypted data using cookies.iv, cookies.data, database.key. If decrypt was successful proceed with request.

Encrypted data is random string with no value.

If database key was hacked, login is impossible because IV that stored in user cookies is needed.

If cookies was stolen, than I think it's user problem.

My only concern is that there is a way decrypt will be successful for some random attacker key. And that decrypt will be heavy for performance for most of the requests.

Example code for cookie encryption / decryption:

/**
 * @param {string} data dummy
 * @param {string} userKey from database or create new
 * @return {object} {iv, key, encryptedData}
 */
function encrypt(data, userKey) {
  let key = userKey ? Buffer.from(userKey, 'hex') : crypto.randomBytes(32)
  let iv = crypto.randomBytes(16)
  let cipher = crypto.createCipheriv('aes-256-cbc', Buffer.from(key), iv)
  let encrypted = cipher.update(data)
  encrypted = Buffer.concat([encrypted, cipher.final()])
  return { iv: iv.toString('hex'), key: key.toString('hex'), encryptedData: encrypted.toString('hex') }
}

/**
 * @param {string} iv
 * @param {string} key
 * @param {string} encryptedData
 * @return {string} decrupted dummy data
 */
function decrypt(iv, key, encryptedData) {
  try {
    iv = Buffer.from(iv, 'hex')
    key = Buffer.from(key, 'hex')
    encryptedData = Buffer.from(encryptedData, 'hex')
    let decipher = crypto.createDecipheriv('aes-256-cbc', key, iv)
    let decrypted = decipher.update(encryptedData)
    decrypted = Buffer.concat([decrypted, decipher.final()])
    return decrypted.toString()
  } catch (err) {
    return false
  }
}


texts:
I know using homebrew encryption can be very dangerous as it is very likely to have many flaws in its design. The following concept is just for learning purpose in case anybody is getting red flags reading this. Hopefully this is the right place to ask.

I have made up a block cipher and would like to know how I can possibly find flaws or might even break it. As it is self-made and I have no prior in-depth knowledge in cryptography I assume it is likely to find ways to attack this encryption. As there is no general breaking tool for ciphers (at least not from what I understand) I would be very interested if some of you might share some ideas.

The cipher is used in CBC mode has a block size of 512 bit and a key size of 1480 bit.
The 512 bit input is filled into 64 cubes (or matrices) consisting of 2x2x2 bit. Each cube is filled with 8 bit of consecutive data from the input. Three times for each cube we are reading three bit from the key to determine operations to be done. These operations are the rotations of a single layer of the cube selectively in X,Y,Z direction and a circular shift of the bit (probability of circular shift is higher 2/8)
The idea of using three operations is, that it cannot arrive at the initial position.
Then for each cube 4 bit from the key are used to xor the cube from top to bottom. This avoids same outputs for cube filled just with zeros (or ones) and in generally should increase security as it adds confusion to the input.
The 64 cube get shuffled, by using 64 times 6 Bit to determine a new position.
Then 8 cubes each are used to create a 4x4x4 cube. We apply four operations on each cube. Three of them are again layer rotation, circular shifting and new rotation of the entire cube identified from 4 bit of the key (all operations same probability). Another 2 bit are used to either mirror on an axis or invert.
Again the cubes get xored this time it needs 16 bit for each cube.
In the final step the cubes get shuffled and put into an 8x8x8 cube. We read the output of the cube as the output of the cipher.

What would be the first approach to possibly break it?

My thoughts so far were, that it should not be likely to have key collision as each bit of the key would cause a different behavior of the algorithm. The cipher strongly depends on the key, so small portions of the key leaking would greatly compromise the security. Slightly different input with the same key will produce very similar output.
Is it a security flaw that it cannot produce the same output as input as this could be case for the impossible differential cryptanalsis?

In case anyone is interested which I would greatly appreciate, there is an implementation that I could upload for further inspection.


texts:
I have read that XOR provides perfect secrecy, when the key is perfectly random. However it's technically hard to generate truly random numbers, especially on computers, so that is why people use AES, Twofish and other cypthers.

So the conditions for using XOR are that the key has to be true random, and the keysize must be at least as big as the message.

What if we just use a very long key, to guarantee at least as much entropy as the message size?

For instance we need to encrypt 6 bits of message, then using a 32 bit pseudo random key, should have at least 6 bits of entropy in it. Or use even 512-bit key, if the RNG is very weak, to suit our needs. Then we XOR the first 6 bits.

Now the other 26 bits are leaking out, but if the attacker doesn't know the size of the input message, then it should not be a problem.

But if the attacker does know the size of the input, then we will also shift the output bits from the right to the left by n tiles, leaving p spaces between them. Lik this:

Obviously the n and p values are also random and secret choosen by us. So we would only need to keep the XOR key, the n and the p secret.

And after 1 shift operation, the message should be perfectly secret. The XOR already provides perfect secrecy, but the shift operation also hides the needle in the haystack.

Because how can an attacker brute force the original input if he doesn't even know what cypher we are using. So randomizing the cypher parameters is what I am suggesting here.

What is your opinion, is this a viable encryption system?


texts:
In the context of public-key encryption, what would be a formal definition of the decryption oracle?

I know the informal definition (i.e., a function that is available to the adversary and that provides the decryption of any ciphertext of her choice, except for the challenge ciphertext), but I am looking for a formal definition. I have checked some reference textbooks and papers and it is usually defined informally, just before (formally) defining chosen-ciphertext attacks. I am specially interested in a multi-user setting, since I will later be working on definitions of security for proxy re-encryption, but I want first to fully understand the concepts for the case of PKE.

The motivation behind this question is that I don't know if it is necessary to specify the underlying public-key in the oracle query or if it is something implicit. For instance, let us assume that the adversary creates ciphertext $c_1 = Enc(pk_1, m)$. Is it assumed that the decryption oracle should answer the query $\mathcal D(c_1)$, even if the public key used is not specified? In the case that the decryption oracle permits to specify the associated public key, would it be valid the query $\mathcal D(pk_2,c_1)$? That is, trying to "deceive" the decryption oracle into decrypting with a different key.


texts: Client and server using same SSL certificate - any issues?

texts:
I'm working on software where multiple components will communicate with each other using SSL.

There would be one central component acting as a server, which would also require the clients to present a certificate. So there is mutual trust between the clients and server. The software will be deployed internally within organisations.

To avoid the pain of creating and distributing multiple SSL certificates, can a single certificate be generated once for each organisation, and then used by all of the components within that organisation?


texts: From What is the difference between PKCS#5 padding and PKCS#7 padding, I understand that PKCS#5 is defined for 8 byte block sizes. Does this rule it out as a padding option for AES since AES has a 16byte block size. I have seen some conflicting usages and would like to get a definitive answer


texts: Prove in Zero Knowledge the execution of a function

texts:
Given a function:

$$Y = a * b$$

Is there a way to prove in zero knowledge that a value $Y$ was gotten, without revealing $a$ and $b$?  Alternatively, that we have knowledge of $a$ and $b$ such that their product equals $Y$.

public : $Y$

private: $a$,$b$


texts: How to securely store data? / How to securely encrypt a file?

texts:
How do I safely encrypt a file?

or formulated differentely:

How do I safely store the data of my application in a file?

Note: Using established tools isn't an option for this. The tasks need to be done at program level (using libraries and such).


texts: Why in cryptographic schemes we always assume that the key and plaintext are independent?

texts: Why do we always assume in cryptographic schemes that the key and plaintext are independent? What if the plaintext depends on the key? How can this endanger security? Is this assumption essential for both symmetric and asymmetric algorithms?


texts: Drawbacks of Schnorr Authentication that require Fiat-Shamir and Random Oracles?

texts:
I've been going through G. Maxwell's paper on the Borromean Ring Signature, and I don't fully understand this part on Schnorr Signature. If some could explain it more intuitively thank you.
"Intuitively, this is zero knowledge because if the verifier had slipped the prover pre-knowledge
of what $e$ would be, the prover could have produced a legitimate $s$ without knowing $x$ at all.
(Specifically, she would choose $s$ randomly and then choose “$kG$” as $sG−exG$.) The transcript of
the prover/verifier interactions in this case would be statistically indistinguishable from a transcript
in the honest game; thus if the dishonest game revealed nothing about $x$ (and it did not; it did not
even use $x$!) then neither did the honest one.
Intuitively, it proves that the prover knows $x$, since $e$ was chosen uniformly at random. If she
could win no matter what $e$ was, then it is a simple matter to “fork” her and give each fork different
$e$ values, say $e_1$ and $e_2$. Then the two forks would produce $s_1 = k + xe_1$ and s_2 = k + xe_2, which
expose $x$ as $x = (s_1 − s_2)/(e_1 − e_2)$. In other words, a verifier that can win regardless of $e$ can be
used to extract the value of $x$, and therefore she must have knowledge of it.'
While I understand the mathematics of both parts, I don't understand how that proves zero-knowledge within the transcript, and how the verifier must have the value of $x$.


texts: Why use Phi(m) divide Order(p, m) to get slot number in HElib?

texts:
I am reading HElib source code, and have a confusion about FindM function:

static long ms[][4] = {  // pre-computed values of [phi(m),m,d]
  //phi(m), m, ord(2),c_m*1000 (not used anymore)
  { 1176,  1247, 28,  3736}, // gens=5(42)
  ......
};
for (i=0; i<sizeof(ms)/sizeof(long[4]); i++) {
  if (ms[i][0] < N || GCD(p, ms[i][1]) != 1) continue;
  long ordP = multOrd(p, ms[i][1]);
  long nSlots = ms[i][0]/ordP;
  if (d != 0 && ordP % d != 0) continue;
  if (nSlots < s) continue;

  m = ms[i][1];
  break;
}

What I can't understand is why use Phi(m) to divide Order(p, m) to get the slot number? Is there special requirement of getting slot number?


texts: Can a CCA-secure cryptosystem be used as a CMA-secure MAC?

texts:
Can every CCA-secure cryptosystem be used as a CMA-secure MAC?
I know that every CCA-secure system is CPA-secure, but I'm not sure about CMA. From what I understand: for a system to be CCA-secure, it must be both CPA and CMA-secure. So I feel if it is known that the system is CCA-secure then it might be used as a CMA-secure MAC, but not too sure and any insight on this would be appreciated. Thanks!


texts: DES: How to find the Inverse of the Initial Permutation?

texts: I am doing a DES problem by hand and I want to know how you calculate the inverse of the initial permutation. I know what the permutation is, but how do you find it based off the given initial permutation?


texts: Why are asymmetric cryptography keys more vulnerable to brute force attack than symmetric ones?

texts:
I came across this paper which says that

  Asymmetric keys must be many times longer than keys in
  secret-cryptography in order to boast equivalent security.  Keys in
  asymmetric cryptography are also more vulnerable to brute force
  attacks than in secret-key cryptography. There exist algorithms for
  public-key cryptography that allow attackers to crack private keys
  faster than a brute force method would require.

I would like to know:

What makes Asymmetric Cryptography keys more vulnerable to brute force attacks?
In which cases should Asymmetric Cryptography usage be avoided?


texts: Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

texts:
I've been hearing a lot of scare talk about PKCS1 padding attacks.

Is PKCS1 v1.5 safe in signatures as it is practically transporting only message digest?

I'm using it in one of my applications so i'd like to know if it is safe to keep using it.


texts: What is the recommended replacement for MD5?

texts: Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?


texts: How do salt and initialization vector differ?

texts: Reading through the NodeJS API docs I came across IV for the first time. From what I can tell it has the same role as a salt in password hashing? Are they equivalent?


texts:
Many interactive ZK-proofs satisfy non-transferability; that is, the prover performs a series of actions to convince the verifier of a certain fact, and this verifier can't use this proof to convince another party that this proof is constructed by him.

My questions are:

In what case can the ZK proof be transferable and
How can such a proof be made?


texts: Is it true that $\varphi(n)$ is generally larger than $\lambda(n)$ for the same $n$? If so, can anyone give me a proof?


texts: Attacks on AES-128 (ECB) based on some knowledge of plaintext

texts:
I'm working with a third party protocol which employs AES-128 in ECB mode of operation to encrypt a packet composed of 16-byte blocks (it encrypts each block independently). I'm trying to determine if there are any reasonable attacks against the encryption.

One of the plaintext blocks it encrypts has a 4-octet nonce followed by 12-octets that are always the same (part of the device's unique ID). It is also known that those 12 constant octets are one of 16 different values (ASCII hex digits). Not knowing anything else about those 12 constant digits or how the nonce is generated (assume truly random), is there a practical attack against the encryption?

Further, there is a single key shared by all devices which use the protocol, so in theory I could collect these blocks from lots of different devices, all are encrypted with the same key. All of the devices having different IDs, but all packets from a given device having the same ID.

Another plaintext block (this one is actually encrypted with a different key, specific to the device) has a 4-octet nonce, an 8-octet millisecond timestamp, one octet that is always zero, one octet of arbitrary non-constant data, and two octets that give the length of the unpadded message in octets, and can therefore be narrowed down to one of 12 values by counting the number of blocks in the entire packet (each block cannot hold more than 12 octets of message). I don't know if maybe having the timestamp (i.e., a 64-bit value that increases monotonically and by a more-or-less knowable amount between any pair of packets) is useful in breaking the encryption, but I guess if CTR mode isn't a problem, than this wouldn't be either.

I'm looking for basically anything that could compromise the security of the protocol, so anything that significantly narrows down the keyspace, or even the possible values for those 12 constant octets.


texts: What is the difference between access control and authorization? They do not mean same as there is a fine line between the two.


texts: Authenticated encryption without padding

texts:
I want to encrypt data and protect its integrity and confidentiality. However, I cannot increase the length of the data.

Are there any cipher modes of operation which provide confidentiality and integrity protection without increasing the length of the ciphertext?


texts: the decryptNode function for leaf nodes in CP-ABE

texts: Can someone please explain to me why decryptNode gives as result $e(g,g)^rq(0)$ for leaf nodes, I don't understand how they went from the second step to the third (here is the article: Ciphertext-Policy Attribute-Based Encryption), also note that there is an error in the second step, it's $g^q(0)$ and not $h^q(0)$


texts: Safety of encryption when knowing part of the content

texts:
I want to encrypt a JSON file while exposing its interface (the name of the object fields) in clear text.
Since this exposes part of the content of the file, my guess is that an attacker could use this to hack the encryption key.
Are there encryption methods that can circumvent, or at least be safer for cases like this?
I am mostly convinced that knowing part of the content of an encrypted file can make attacks easier, but I do not know if there is a technical term for such conditions or how to evaluate if some algorithms are safer or not. So far I am specially interested if using aes-192-cbc or gpg would be OK.


texts: Why R value in signatures have to be 'calculated' values and not just a random numbers?

texts:
This document (page 27) says that:

  The only significant difference between ECDSA and DSA is in the generation of $r$.

ECDSA $r = (kG)_x \bmod n$ and,
DSA:  $r=g^k \bmod p$

Why is it necessary to have a function that takes a random number $k$? Why do we cannot use the random $k$ directly as our $r$ value in the signatures?


texts: Error correcting codes that are indistinguishable from random

texts:
Suppose you have a public program P(n) which takes message n and generates an encrypted output (utilizing asymmetric cryptography) for some entity which has the private key to decrypt it.

Using a scheme such as Elligator (for elliptic curves) it is possible to have P which has output indistinguishable from random.

But a problem arises when the output is expected to be subject to corruption (bit flips). An application of error correcting codes seems to break the 'indistinguishable from random' requirement.

After considering the problem I arrived at the following consideration. The actual message n is encrypted by a symmetric encryption scheme using some shared secret, the same shared secret (after KDF) can be used to whiten (w/ stream cipher) the result after the application of error correcting codes to it. Would there be a problem with this approach?

This leaves the ephemeral public key (~256 bits) which due to Elligator is indistinguishable from random. But is subject to corruption. How can error correction be used on it such that the result is itself indistinguishable from random?

Edit:

There appears to be some confusion regarding the encryption part. It's a standard anonymous sender sealed box. https://libsodium.gitbook.io/doc/public-key_cryptography/sealed_boxes

ephemeral_pk ‖ box(m, recipient_pk, ephemeral_sk, nonce=blake2b(ephemeral_pk ‖ recipient_pk))

The 'indistinguishable from random' requirement is mandatory, there is a Markov chain that mixes it with a structured format. Extraction of this embed cannot be allowed to yield something containing detectable error correcting codes, betraying its presence. In its absence, actual noise with no statistical pattern is extracted instead.


texts:
I read that TLS 1.3 supports encrypted handshake. Is it achieved using encrypted_extensions?

Does it mean that the records which contains handshake messages are encrypted/protected from the point of view of record-protocol?

Or

Does it mean that the handshake protocol itself encrypts its message payload and records are plain text from record-protocol perspective?


texts: Authenticated and encrypted radio communications (Non-Internet or TCP/IP)

texts:
I'm working on an IoT project that will control lights and eventually other devices (I know there's plenty of projects like this, but that's not the topic here).

Primarily communications will take place over a 900 MHz band radio, probably through an RFM69 type module, or perhaps LoRa. (The radio type shouldn't really matter, just that it will be low bitrate). The MCU will likely be an ESP8266, so only an 80 MHz clock.

Since I care about this being a useful and secure system, I clearly need some security protocol. If it were WiFi and IP based, of course this could be TCP - but that is not as suitable in this case.

I'm looking for something that will provide these features:

Authenticated. Only the owner of the system should be able to control the lights.
Confidential. Someone listening should not be able to deduce usage patterns such as when people turn the lights off when leaving the building.
Replay protected. If someone does observe a control message they must not be able to use that again.

Given the nature of the system, it has these constraints and parameters:

There is one server "hub" with several client "nodes".
Peer-to-peer is not necessary, nodes talk only to the hub.
Connections are unreliable. I plan to use the RadioHead library which does offer "reliable datagrams", but this may not be appropriate for all cases.
The server is configured to "know" the nodes, so can have a pre-shared public key for each.
Each node is configured to "know" the server, so likewise can have a pre-shared public key for the server.
There is no mesh or routing, the nodes can and must always be one hop from the hub.
Packets will never be fragmented. I don't know yet what the size limit will be, but I do not plan to support fragmentation.
Broadcast messages from the hub must be received and decrypted by all nodes as close to the same time as possible (not individually sent).

I've done a fair bit of searching for something that would fit this bill, but so far have come up short. This is what I've considered so far:

PSK Ciphersuites for TLS (RFC 4279): PSK is better than X.509 for small processors, but it still uses RSA, AES and SHA algorithms. I would prefer something that could use something like Ed25519, Speck, Blake from the ArduinoLibs crypto library. Also, it's TLS so each client-server connection has a different key and so a true "broadcast" doesn't work.
Datagram Transport Layer Security (DTLS) (RFC 6347): Haven't read as much into this, but seems to be closer to what I'd need. But, still includes a lot of overhead like re-ordering etc that I won't need, no message can be out of order because there is no routing, only direct radio link.
CurveCP: Seems to be optimised to fit into a small processor, but aims to be like TLS which again includes overhead I don't need for a single hop link.

What else exists for what I'm trying to do? I have some ideas of how I might make my own solution to this, but "roll your own crypto" is always advised against and not something I'd like to take on if I don't have to.


texts: How to properly apply the AES Mixcolums?

texts:
I had searched a lot but I don't undestand how work the operation on binary (How to solve MixColumns). What I don't undestand is from where he catch 0001 1011 to do the XOR operation.

Can someone explain me? Thanks in advance for the replies.


texts:
In this article applying Pailler encryption and decryption to image bitmaps, Table II is reported to give

Execution Time (sec) of the Paillier encryption/decryption of image using different key sizes on  both personal computer (PC) and mobile device (Mob) clients. We used 512×512 image for PC and 256×256 image for Mob.
$$\begin{array}{l|rr}
\operatorname{Key Size}&256&512&1024&2048\\
\hline
\operatorname{Encrypt-PC}&23.9164&156.905&1154.29&7670.49\\
\operatorname{Decrypt-PC}&1.39223&1.93554&4.06813&9.62313\\
\hline
\operatorname{Encrypt-Mob}&13&73&575&3701\\
\operatorname{Decrypt-Mob}&10&48&325&2268
\end{array}$$

I have a hard time explaining the relatively small time for the $\operatorname{Decrypt-PC}$ line. Reading the article, it seems the quoted time is for two Pailler cryptograms per pixel, thus $2^{19}$ times the computation
$$m\gets \lfloor((c^\lambda\bmod n^2)-1)/n\rfloor\cdot\mu\bmod n$$
What technique can achieve such relatively low decryption time, growing hardly faster than linearly with the key size?
I have examined some of the source code (fully available on github). It seems:

the public modulus is the product of only two primes $p$ and $q$,
it's used the CRT,
the underlying library is GMP,
there's some mysterious precomputation, that I do not get.

Generalizing: What are the best techniques for optimization of Pailler decryption? What runtime do they achieve?

Note: performance of decryption matters to the practical interest of the technique. If the computations offloaded are cheaper than decryption, the holder of the private key is better off accepting the input image(s) traditionally encrypted, and performing the image processing on plaintext. Another benefit is reducing communication cost by several decimal orders of magnitude. And since the offloaded computation does not claim to hide the original images or the processing performed (which is complicated by the separate processing of mantissa and exponent), we'd be left with little discernible benefit.


texts:
This December, $N$ friends play secret santa: they select a random permutation $\sigma$ of $N$ (without fixed point). For Santa Claus, everyone has to bring a gift to the next person in the permutation. To preserve the magical spirit of the game, each participant should only know the strict necessary (i.e. their image by $\sigma$) until the gifts are disclosed in the end of the month.

However, they cannot meet face-to-face before sharing the gifts and would like to generate a proper $\sigma$. We assume that they can communicate together using any cryptographic primitives. Besides, they have no access to a third-party to help generating $\sigma$.

Is there a distributed protocol to generate a random permutation $\sigma$ among them? Which of the following properties can be guaranteed?

Secrecy: Each participant $i$ should only know $\sigma(i)$, and should have no other knowledge about $\sigma$ (i.e. given the messages sent and received by $i$ and $\sigma(i)$, all permutations $\mu$ with $\mu(i) = \sigma(i)$ should be equiprobable).
Secrecy++: Each subgroup of $k < N - 1$ participants should only be able to recover their respective $\sigma(i)$ if they cheat and share information together (again, all permutations that follow these constraints should be equiprobable given their common knowledge). Note that for $k = N - 1$ the permutation is obviously recovered.
Fairness: Each participant cannot cheat to force the value of its $\sigma(i)$, whatever messages they send. Similarly, they cannot force any other $\sigma(j)$, nor bias the distribution of $\sigma$ as a whole.
Fairness++: Each subgroup of $k < N$ participants cannot bias the distribution of $\sigma$.
Validity: $\sigma$ is without fixed point.

The validity property can also be replaced by other sets of permutations:

all permutations ($S_N$)
the alternating group ($A_N$)
similarly, a subgroup of $S_N$
other subsets of $S_N$.

Solution for $N = 2$ :

With validity: there is only one choice of $\sigma$: the transposition.
Without validity: each participant draws a number $x_i \in \{0, 1\}$ and sends it to the other using a commitment scheme. Once the messages are received, they open the values. Let $X = x_0 \oplus x_1$ (i.e. modulo 2). If $X = 0$, $\sigma$ is the identity, otherwise it is the transposition.


texts: Montgomery multiplication without final subtraction

texts: I am looking for methods to avoid the final subtraction in Montgomery multiplication. I found this paper "A Cryptographic Library for the Motorola DSP56000 " (http://goo.gl/DHePEx) In this paper they have said that we can avoid final subtraction if we keep N(modulus)


texts: Is it possible to find a Mersenne Twister seed given only the first output?

texts:
Suppose I have a Mersenne Twister seeded with some unknown value, and I’ve been given the first output. Given only this first output, and no other information, is it possible to derive the unknown seed?

I feel like the answer is no, but I want to be sure I’m not missing something.

Context: I’m looking at Matasano challenge 22. You seed an MT19937 RNG with the current Unix timestamp, wait a random number of seconds (40 ≤ T ≤ 1000), then get the first output from the RNG. The challenge is to find the original seed.

I started by trying to reverse the output process, essentially inverting the inner workings of the twister. But after some effort, it seems like doing so would be incredibly hard and involve lots of linear algebra – if indeed it’s even possible.

I feel like it’s probably impossible, but I’m not completely sure.

I suspect the intended solution is to take an entirely different approach, and

   use the fact that you have a rough idea of when it was seeded, and so a range for the seed values. If I know it was seeded in the last hour, there are only a few thousand possible values. I can check the first output for each possible seed value, and compare to the actual result.

(Spoiler block for anybody working through the Matasano challenges themselves)

But I’m curious whether my original approach would work. Is it impossible to go from the first output to the seed, or is there some trick that I’m missing?