texts: What kind of Quantum cryptography technology(protocols) can be used for Mobile Ad hoc networks(MANETS)?

texts: Typically ad hoc networks do not have a proper infrastructure and the routing is done only through the base stations which are connecting a wired and wireless network. Does quantum cryptography protocols and QKD provide a better security for such ad hoc networks.?


texts:
Recently, a new cipher called Spritz has been released by Ronald L. Rivest and Jacob Schuldt. It should be a "drop-in replacement" for RC4.

There are many differences to RC4, Spritz is "spongy" and also has a complete different way to handle the key setup. But still there are many similarities to RC4 in generating the key stream or the whole structure of the cipher it self.

There are many results against RC4, so Spritz should be an interesting topic for analysis.

I have looked at some attacks on RC4 and be curious if some of them can be applied to Spritz as well. Does anybody else has analysed Spritz so far? Or is it far too early for results against Spritz?

From the performance viewpoint Spritz is really slow (compared to other related ciphers e.g. Keccak or Salsa20, SHA-256). Why didn't they go for performance? Nobody will use it if its that slow.


texts: Why are elliptic curve variants of RSA "chiefly of academic interest"?

texts:
Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My understanding of RSA and elliptic curves told me that it should be possible.

After some searching I found the following explanation:

  As we have mentioned, there are elliptic curve analogs to RSA but it turns out that these are chiefly of academic interest since they offer essentially no practical advantages over RSA. This is primarily the case because elliptic curve variants of RSA actually rely for their security on the same underlying problem as RSA, namely that of integer factorization.

This got me thinking. I had thought that the discrete log based systems I mentioned earlier were also based on the same underlying problem, the discrete log. But the article had this to say:

  The situation is different with variants of discrete logarithm cryptosystems. The security of the elliptic curve variants of discrete logarithm cryptosystems depends on a restatement of the conventional discrete logarithm problem for elliptic curves. This restatement is such that current algorithms that solve the conventional discrete logarithm problem in what is termed sub-exponential time are of little value in attacking the analogous elliptic curve problem. Instead the only available algorithms for solving these elliptic curve problems are more general techniques that run in what is termed exponential time.

So now, to my question: Why are we able to restate the discrete log problem to make it more practical on elliptic curves but not the RSA problem?

1. ECES is the elliptic curve variant of ElGamal


texts: Can we encrypt data that must be decrypted with any private key plus a server generate bits?

texts:
I have come up with a scenario to make a secure data. Suppose I have a public encrypted file that anybody can download. But whenever anyone want to decrypt that data they need to get a key from server

To make the key cannot be shared. The key from server will not be able to decrypt the data directly. But the data must be decrypted with the client's private key after, without server knowing those client's privateKey

I hope below diagram could explain it clearly

Is it possible? What is the algorithm that could do this?


texts: Is it possible to create "non overlapping" RNGs?

texts:
For example, let's say I want two cryptographically strong RNGs (R1 and R2).
And I want them to have the following property:
R1 (resp. R2) will never generate the same random number twice.
R1 (resp. R2) will never generate a random number that R2 (resp. R1) can generate.

Is it possible for three RNGs, 4, N ?

Unlike other questions already on the site, I don't need the generated RNGs to be tracked back to their generator.


texts: decrypt numbers multiplied by a certain floating point number

texts:
A friend has about 10K numbers in a an excel sheet. He wanted to encrypt these numbers in order to share the file with a 3rd party that will help him reorganize the tables. What he did, to hide the numbers, is to multiply all the numbers by a floating point number.

Based on my limited knowledge of encryption I argued that this method seems fairly weak (compared to other methods of encryption). My question is - Am I right in my argument or is it really difficult to decipher this sort of encryption.


texts: Are mouse movement coordinates useful as a seed for a RNG?

texts:
Is it good to use a mouse movement as a 64-bit random seed for a Pseudorandom Generator like AES in Counter Mode?

Should I only need to get the X and Y coordinates of the mouse movement?


texts: In the original paper of Paillier, lemma 1 shows why $n$ must divide the order of $g$. What I don't understand in the proof of this lemma is why $g^{x_2-x_1}(y_2/y_1)^n$ implies $g^{\lambda(x_2-x_1)}$. Where does this result come from?


texts: How to find q in a corrupted ECDSA signauture

texts:
I'm doing exam papers for a crypto exam and I've been given a corrupted ECDSA signature. I'm asked to check if the signature is valid (which I know how to do), however, the q value is corrupted and so I can't actually check the signature. Any ideas on how i'd find the value of q?

Curve, E = y^2 = x^3 + 2x + 2

Field size, p = 17

q = 1~ (where tilda stands for the corrupted value)

Base Point, P = (5, 1)

Public key, y = (0, 6)

h(M) = 26

(r, s) = (9, 17)


texts:
I have a few questions regarding universal-hash functions:

Is there a way universal hash functions can be used to provide unconditional authentication in the way the OTP provides unconditional security?
Assuming a TRNG is used how could this be combined to form a perfect cryptosystem, assuming PSK's  are secured?
Is there unconditional non-repudiation(acceptance by third-party) to go along with this?
And lastly, why are these hash functions not used as a SHA-#?


texts:
I am reading up on Sonic: Zero Knowledge SNARKS from Linear - Sized Universal And Updateable Structured Reference Strings.

An excerpt:

  For soundness, we do not use the standard definition of special soundness because our verifier provides two challenges, but rather the generalized not of witness-extended emulation.

Can anyone provide both a simple and terse explanation of the term
 "witness-extended emulation"


texts: TLS ciphersuite without mode of operation

texts:
Will there be any security concern if there is no mode of operation specified in the ciphersuite name?

For instance, there is no mode of operation in TLS_ECDHE_RSA_WITH_AES_256_SHA.


texts:
In most uses of Sponge mode of operations such as SHA3 and many of the round-2 candidates in the NIST lightweight cryptography project, the underlaying primitive is a cryptographic permutation - that is, it's bijective.

For reasons of curiosity, I noticed that a proposed Sponge-based PRNG implement forward secrecy (back-tracing resistance) by truncating part of the permutation state to all-bits-zero (Section 4.3 of the linked paper).

This got me wonder, what if the permutation is one-way (e.g. $p(x) \oplus x$):

Q1: What are the security implications if SHA3 hash and XOF functions were built on top of Sponge-PRF?

Q2: If the proposed PRNG used PRF, how would the security proof break apart?

Q3: If sponge-based duplex AEADs used PRF, how would their security proof break apart?


texts: cryptographic function that changes with time?

texts:
Is it possible to create a function that varies with time but is also useful when encrypting information that is meant to later be decrypted?

Or in other words, we have the function $T(t)$ where $t$ is the input and the output is a function $f(x)$ where $f$ is an encrypting function that takes $x$ as input, $x$ is the information we want to encrypt and the output of $f(x)$ is the encrypted information.

Is it possible to decrypt the output of $f(x)$ knowing function $T$ but not the input $t$ and $f(x)$?

By the way if it wasn't obvious already I’m far from knowledgeable about cryptography.


texts: Any standards for canonical ordering of HMAC or additional data in AEAD ciphers?

texts:
According to RFC 5116...  If the AD input is constructed out of multiple data elements, then it is essential that it be unambiguously parseable into its constituent elements, without the use of any unauthenticated data in the parsing process.  (In mathematical terms, the AD input must be an injective function of the data elements.)  If an application constructs its AD input in such a way that there are two distinct sets of data elements that result in the same AD value, then an attacker could cause a receiver to accept a bogus set by substituting one set for the other. The requirement that the AD be uniquely parseable ensures that this attack is not possible.  This requirement is trivially met if the AD is composed of fixed-width elements.  If the AD contains a variable-length string, for example, this requirement can be met by also including the length of the string in the AD.

I’m using an AEAD to confirm integrity on a message and occasionally decrypt a payload if it exists, but my issue should apply to any arbitrary data in CRC to HMAC. How do you take arbitrary data and unambiguously order it

Imagine I have some serialization (example JSON) that can have 1-100 fields I’ll assemble into data to be get a MAC (my AD in AEAD). The receiving end has no idea which ones are coming, and the ordering of decode is not guaranteed.

It seems my options are to order the object data in some predetermined way like apple’s value is placed into a byte array  before bannana’s value is. But then there is an issue of types, in my system apples will only ever be 0-12 so one byte works great, but bananas can get to 65000, so two bytes, carrots need a 32bit, and I  am owe dates so I need signed there. Or I have the option of using the serialized container without parsing it at all but there are other problems with that.

Without getting too over the top in examples, I see the issue even if I gave everything a 64bit space and put its length in front, I quickly end up with a confining system - or I end up with a schema that needs to be shared on both sides.

So are there any standards or even formally recommended practices for this?


texts: What is the concrete communication complexity of Commitment schemes?

texts:
Say you want to commit an $n$-bit plaintext, $x \leftarrow ^ r \{0,1\}^n$.

What is the concrete communication cost, in terms of $n$, of the following:

Data sent by verifier to initialize (applies in Pedersen, may not apply in other schemes).
The commitment
The decommitment

I read this description of the Pedersen scheme. Since the scheme only allows you to commit to values in $Z_q$, I assume that, in order to avoid dealing with enormous primes, in practice you would break up your input into $b$-bit blocks such that $q > 2^b$. It seems reasonable to me to pick $b=128$, $q$ a 129-bit prime chosen such that $p=2q+1$, making $p$ a 130-bit prime. I assume $p$, $q$ and $g$ (the generator) are publicly known and calculated before hand. In this case, the cost of sending 128 bits would be:

Data sent by verifier: $h =g^a\mod p$, a 130-bit number
The commitment: $c = g^m h^r \mod p$, another 130-bit number.
The decommitment: $m, r \in Z_q$, two 129-bit numbers.

So the total communication cost would be $\frac{518 n}{128}$ bits.

Is this right?

If there are other commitment schemes that are better, feel free to give concrete numbers for those instead. However, I would like to commitment scheme to be self contained, so this paper, while it provides very clear explanations of its concrete security, doesn't fit the requirements I need because it requires a common reference string.


texts: What type of attacks are practical for this situation?

texts:
Here is the details: I found a web api while pentesting for a company which I cannot disclose and while doing so I found a API which signs a request of the users choice, but it adds a tag to the top then SHA1's the message then signs it with RSA textbook scheme with no padding. And I'm trying to attack another API that uses the same key keypair for verification, but it cannot have that tag that's appended on the top for use.

What type of attacks are practical for this situation (If there is any)?

What I'm trying to do: Is forge a signature with my selection of the message/SHA1 hash.


texts: How to find the integer multiplicand from given two points?

texts:
I have two points on an elliptic curve $P(x_1,y_1)$ and $Q(x_2,y_2)$ and a scalar value $x$, where $P=x \cdot Q$. What is the best way that I could figure out the value of $x$?

Given that I know all the necessary key and constants. (a,b,p,G,nA,PB...)


texts: Dependency of cryptographic protocols on cryptography primitives

texts:
To what extent depend cryptographic protocols on cryptographic primitives? Are there cryptographic protocols that can only be implemented with certain cryptographic primitives?

If the answer is yes, could you give an example of a protocol depending on a primitive?


texts:
From the Curve25519 spec I learned that it possible to take a random 32 bytes and with a few operations make it on the curve:

To generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe source:

mysecret[0], mysecret[1], ..., mysecret[31].

Then do

mysecret[0] &= 248;
mysecret[31] &= 127;
mysecret[31] |= 64;

Is there a similar way to take random bytes and use it for a p-256 private key?


texts: Why are finite groups used in cryptography?

texts:
Most of the cryptographic schemes I know are all based on group theory, e.g. they use finite groups.
Can someone explain why is that the case? And why not base the schemes on elements and operations say from natural numbers or some other infinite sets? E.g. $\mathbb{Q, Z, R}$?


texts: Camellia cipher - is it a symmetric or asymmetric cipher?

texts:
I read a wiki page about Camellia cipher and know that it is a block cipher that can use 128-bit, 192-bit or 256-bit keys. But I cant find any information about if its a symmetric cipher (uses one key for both encryption and decryption) or asymmetric cipher (uses different key for encryption and different key for decryption)?

And in which cipher modes can Camellia operate? (ECB,CBC, ...)?


texts: Can public key cryptography be equivalent to asymmetric cryptography? If not, what's the difference?

texts: I'm currently studying modern public key cryptography course, and I'm confused whether public key and asymmetric cryptography are the same.


texts: Is it necessary for the Rijndael polynomial to be primitive?

texts:
I am working on selecting a S-box for my Cipher (Similar to AES). I found out there are 30 irreducible polynomials and over 16 primitive polynomials of degree 8. Is it necessary to choose a primitive polynomial for an S-Box? In other words, Is it necessary for the feild to be of full order(255) for a S-Box?

What are the consequences in the each case?


texts: Quantum key distribution and the one-time pad

texts:
Why is QKD usually associated with OTP ?

QKD is about key distribution, where as OTP is about using key as long as message to get perfect secrecy, can any one explain how they are related ?


texts: Question on the disprove of CCA security

texts:
I have a question on the disprove of the CCA-security given in Katz & Lindell's textbook (2nd edition) in chapter 3.7 on page 97. It works like this:

Consider our construction based on PRFs: $\text{Enc}(k, m) := (r , s) = (r , F (k, r ) \oplus m)$
Set $m_0 = 0^n$ and $m_1 = 1^n$
Adversary A gets $(r , s)$ and flips the first bit of s. Denote the ciphertext by $(r , s' )$
A sends $(r , s' )$ to his decryption oracle
A obtains either $0\mathbin\|1^{n−1}$ or $1\mathbin\|0^{n−1}$ which allows him to win the game

My question: Why does A not obtain $0\mathbin\|1^{n−1}$ and $1\mathbin\|1^{n−1}$ or $0\mathbin\|0^{n−1}$ and $1\mathbin\|0^{n−1}$ and can therefore still distinguish the messages, if $n>2$?


texts: Which gives better deterministic encryption SIV or Plain ECB mode?

texts:
Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ?

AES-ECB($key$ , $msg$)
SIV($key$, NIL , $msg$) where associated data is NIL.

I could not make out much from Rogaway and Shrimpton's paper on "Deterministic Authenticated Encryption" which introduces Synthentic IV (SIV) mode.

Edit: Here $msg$ is same as single block .


texts: Has there been any cryptanalysis of RC4-52?

texts:
Several websites ( such as Is there a secure cryptosystem that can be performed mentally? ) briefly mention RC4-52 as a modification of standard RC4.

RC4-52 has only with 52 instead of 256 elements in the state array, so encryption or decryption (or both) can more easily be executed manually (literally "by hand") with a standard deck of playing cards, far away from any computer.
Some people seem to think that, unlike classical ciphers, RC4-52 is difficult to decrypt even using computer assistance.

Has anyone done any cryptanalysis on RC4-52?
Where can I find such cryptanalysis?
A published thesis or magazine article would be nice, but I'd be happy with a well-written blog post.


texts: Can SHA256 hash be considered as a secure key proof?

texts:
I want to use PBKDF2 with 1,000,000 iterations (I don't know yet exactly how many I will choose) to derive a 256-bit symmetric key K from a password provided by a user (at least 40 bits of entropy). Then I would like to have a proof that the user has/knows the key K. The key will be hashed once with a SHA256 function and the result H will be stored in a database (SHA256(key)). So, whenever I will need to verify that the user has the key K, it will be hashed on frontend and only the H value will be sent to the server, so I can compare it with the value stored in DB. The key will never leave a user's computer.
Let's say a hacker wants to find out what the 256-bit key is. There are two ways:

Brute force password - since we are using slow hashing function (PBKDF2) and at least 40-bits of entropy passwords, it will take years.
Try to find out the key by attacking from "the other side". So, the hacker will need to find a preimage, thus key K of the hash H. As we know SHA256 is one-way function, so it is nearly impossible.

The question is: are there any possible vulnerabilities in this solution? I know that finding a 256-bit random preimage of SHA256 is not possible, but we are not dealing here with a "true" 256-bit value generated by a cryptographically secure random number generator. The 256-bit key K we are dealing with is in fact derived from a user password which entropy is much, much lower, let's say only 40 bits.
What I understand is that from the perspective of a second attack we can treat the key K as a true 256-bit value because we have to find out the exact 256-bit value. We don't need to worry that it was derived from a source with 40-bits entropy. We have to worry about this only in the first scenario, so that's why I want to use a slow hashing function.
Conclusion: it is more likely the key K will be found by following the first way of attack than the second one, thus this only one SHA256 hashing round is secure. If I want to make the entire solution more secure I should consider more PBKDF2 iterations or the PBKDF2 should be replaced with a better function (like Argon2). Am I right?


texts: Can I derive an IV as a segment counter for AES256-GCM?

texts:
I'm writing a software that will be encrypting & authenticating segments of data, each 4096 bytes long. These segments are saved to disk in a sequential order that will never change. So I was thinking to encrypt each one of them using AES256-GCM, but before I code it I need to confirm a couple of points:

To conserve space for saving an IV for AES-GCM encryption/decryption, I was thinking to use each of my segments' sequential number as an IV. Would that pose an issue (in cryptographic sense)?
I decided to go with a 16-byte TAG (that is used by AES-GCM for authentication.) Is that an overkill for an encrypted 4096 byte segment?


texts: RSA Decryption: Doubts: knowing p or $\phi(n)$ can lead to find private exponent?

texts:
I have some doubts about RSA (the public key $n$ and $e$ is public):

Note $n = pq$ and $\phi (n) = (p-1)(q-1)$

1) Say if some hacker knew $p$, why would it be easy for them to find $q, \phi (n), d$?

$d$ is a prime larger than $p, q$ so that $1 = k\cdot \phi(n) + d\cdot e$

2) Now, say if a hacker knew $\phi (n)$, why would it be easy to find $p,q,d$?


texts: A problem about Gaussian distribution in paper GPV08

texts:
These are contents from the paper Trapdoors for Hard Lattices
and New Cryptographic Constructions(GPV08). I do not know the reason about the last sentence. Why these two distributions D_{\Lambda, s, c}(x) and D_{\Lambda, s, c^{'}}(x) are identical?


texts: Are there Cryptography certifications variants of CISSP?

texts: Are there Cryptography certifications variants of CISSP ( Certified Information Systems Security Professional)? Like a CISSP exams, but only for cryptography?


texts:
How we can solve this equation and get the value of M?

$$8 = M^{13} \mod 33$$

not a computer program, but a mathematical operation.


texts: What is the relation between AES and PTK in WPA2 wifi

texts:
I know that modern wpa2 wifis use AES key to encrypt data.

a client who has the password, can obtain psk/pmk use it for handshaking .

so what is the purpose of ptk, and   how AES key is generated?


texts:
I'm given a prime number $p = 1217$

I'm also given the following equations:

$$ 40 \equiv \log2 \pmod{64} \\
63 \equiv \log3 \pmod{64} \\
13 \equiv \log5 \pmod{64} \\
13 \equiv \log2 \pmod{19} \\
10 \equiv \log3 \pmod{19} \\
01 \equiv \log5 \pmod{19} $$

The question asks to give the answers to

$$ \log 2 \pmod{p-1} \\
\log 3 \pmod{p-1} \\
\log 5 \pmod{p-1} $$

I know the answers are $488, 447, 77$ respectively.

And I know they are the Discrete Logarithms of $2,3,5$ respectively.

However there is no other explanation of how to get this answer.

I've observed that $1216$ is the Lowest common multiple of $64$ and $19$.

I also think the Chinese remainder theorem might be useful here.

It bothers me that we don't know the base of the logarithms and this makes me totally confused.

I would hugely appreciate an explanation on what's going on here, I don't fully understand what the question is asking, let alone how they got to their answer.


texts: Suppose we have a set of $N$ parties. I am looking for a scheme to generate shares of a random secret $s$ where any subset of the participants with size $k$ can recover the secret similar to Shamir's scheme. Additionally, no party outside of the group, such as a dealer, has access to $s$.


texts: Discrete logarithm problem is easy in a cyclic group of order a power of two

texts: Let $G=\langle g\rangle$ be a cyclic group of order $2^{k}$ and let $h\in G$. I have read that it is easy to find $\log _{g} h$, but I haven't been able to figure out how. Do you know why this can be done in polynomial time? Do you know of a book where I can find this?


texts: Is there a library-less implementation of DSA available to read?

texts:
Is there a pedagogical library-less implementation of DSA available to read?  (Not ECDSA.)

Obviously BigInteger and hash functions may be from libraries, but I want to read the implementation of all of the calculations involved in signing a message and verifying a signature, using whatever BigInteger operations are appropriate for the language.

Ideally it will treat keys as numbers, and not interact with DER/PEM file formats in any way.

Java, Python, Javascript, Haskell, or even C would be great.

Any recommendations?


texts: Encryption and decryption of Request and response for REST API

texts:
I am working on encryption/decryption for the rest of the API.
The client here can be mobile, desktop, web browsers, etc and all the requests will be made to an https endpoint.
The main goal here is that the encryption/decryption has to be performed in client-side applications. The user himself should not be able to monitor the request/response made from his device(phone, browser, etc) and be able to perform encryption/decryption by himself. He should not be able to see the request/response in cleartext. Everything should happen in the client-side application.
For every request it should follow the steps as follows :

Client application encrypts the request data and makes an API call
Server decrypts the data and performs operations
Before sending the response back to the client application, the server encrypts the response and sends it
Client application decrypts the response and uses it

I had planned to use AES-256 but faced the following problems :

Secret key has to be stored hardcoded in the client-side applications. Doing so won't be safe
Getting the secret key every time from a rest API is not safe either as the request can be monitored and the key can be fetched from the response

I had planned to use AWS KMS service but faced the following problems :

For every encryption/decryption to be performed the client side has to login to AWS and then use the KMS service
If the login request is made then the request can be monitored again and the access key and secret key can be fetched from the response/request and then once the login access is gained, anyone can use the KMS service to encrypt/decrypt data

I did check articles where the secret key should be separate for each user and should be based on password but in my case User can log into to client-side application as a guest user so there won't be any password, email that has to be provided.
Not very sure how separate keys can be used for each user as the encryption/decryption has to be performed every time on both the client and server-side.
AES-256 is considered to be safe but I still didn't find any ways on how can a private key be managed on the client-side.
Any help here on how can AES, KMS be used? Any other solutions would be fine too.


texts: For a typical n-bit symmetric key, how many keys would be considered too weak to use?

texts:
I understand that all zeros or all ones would be weak for any cipher. And certain ciphers, e.g. DES, have a list of weak keys. But I assume that there would many 'patterns' that would be detected (if that is the correct term) as weak. For example, 0x0505 ...05, 0x1010...01 and 0x0A0A...0A. Or other patterns such as half the key being 0s and the other half being 1s or half the keys being 3s and the other half being Cs (i.e. the compliment of 3.

A key must have a large number of patterns, so is there a way to calculate this number?

Are the patterns I mentioned above (and similar) weak keys?


texts:
I've been reading a paper [1], and I've ran across something called a "Group Cipher", which is similar to homomorphic encryption, with an important difference.

In homomorphic encryption we have an encryption operation $E_k: P \rightarrow C$, where $P$ is the set of plain texts and $C$ is the set of cipher texts. We also have an efficient group operation on $C$ that induces a homomorphism to the group operation on $P$.

The difference with Group Ciphers is that the group operation on $C$ is composition of encryption $E$, and it induces a homomorphism on the group operation of the set of keys $K$. That means, if we denote an encryption of a plain text $X$ as ${X}_i$, then we would have that ${ { X }_i }_j = { X }_{i \circ j}$.

In the paper they use it to do something like asymmetric encryption, but using symmetric encryption. They do need a semi-trusted third party.

For example, Alice's key is $i$, Bob's key is $j$. Ted has the key $i^{-1} \circ j$.

Alice will encryption something : ${X}_i$. Send it to Ted, who will then encrypt it again : ${ {X}_i }_{i^{-1} \circ j}$ , which will yield ${X}_j$, then Ted send it to Alice again. After that Alice sends it to Bob. Bob can then decrypt it.

What happened here is that Alice can send to Bob, without knowing bob's (symmetric) key. And Bob can decrypt without knowing Alice's (symmetric) key. Just like asymmetric encryption. But using symmetric encryption instead (and a semi-trusted third party).

They also prove that the Pohlig-Hellman cipher has this property.

The question is:

  1- Does Group Ciphers have any other applications in the literature (with references) ?

  2- What are the drawbacks of this scheme compared to asymmetric encryption (other than the required semi-trusted third party) ?

(I was not sure of which tag to use for this question.)

1 S. M. Bellovin and W. R. Cheskwick (2004). "Privacy-Enhanced Searches Using Encrypted Bloom Filters". Draft.


texts: Understanding fail-stop subliminal channels

texts:
It has long been known that randomness can be used to create subliminal channels (see Simmons' "Prisoner's problem" in 1983) and that preventing such subliminal channels is hard.

For the case at hand, Simmons proposed a protocol for preventing subliminal channels within the random numbers generated during the creation of DSA signatures in his "An Introduction to the Mathematics of Trust in Security Protocols" paper in 1993. In Simmons' modification to DSA, the signer Alice (A) tries to communicate a subliminal bit b to Bob (B), communicating through a warden (W) who tries to prevent subliminal channels. The approach to prevent it is basically forcing A to incorporate some randomness that W provides A before A generates the final signature. The rationale of subliminal-freeness being that A can no longer choose the random number on her own.

However, it was later shown by Desmedt in "Simmons' protocol is not free of subliminal channels" that even in that case, there exists a specific type of subliminal channel, which I've seen sometimes referred to as fail-stop subliminal channel. This type of channel works as follows in the DSA case: since A has access to W's randomness before producing the final signature, she can (a) halt the signing process if the last bit of the signature after having incorporated W's randomness does not match b; or (b) complete the process if, after having incorporated W's randomness, the resulting signature's last bit matches b. There may of course be more convoluted ways to decide whether or not to keep going, but that seems to be the overall idea.

My doubt comes at this point. After this reasoning, Desmedt argues that, in order to show whether or not a channel is subliminal-free (i.e., no subliminal channel can be created within it), only the case in which A does not stop should be considered, as in the case in which she stops, W detects that some suspicious behavior is taking place and thus no subliminal exchange can occur (because W detects it, which directly contradicts the principle of subliminal communications). So, following this argument, a system with a fail-stop subliminal channel would (assuming uniformity of the bits to transmit in a subliminal manner) be detectable 1/2 of the executions.

But then, this subliminal channel is of little use in general: if I have a device/software that fails 1/2 of the times, I would, in the best case, assume it is a quite useless device/software and would change it for another different device/software, so no subliminal communication would be possible any longer (and probably, I would think that something weird is happening in that device/software).

Main question: Is this the way in which fail-stop subliminal channels are expected to work, or have I misunderstood something?

Follow up question: If this is indeed the way they do work, when does this type of subliminal channels make sense in practice and how can they be used? (Note: I am not asking in what kind of real-world scenario would a fail-stop channel be applicable, although that can of course help. Rather, I am interested in how could a fail-stop channel be used without the warden detecting/highly suspecting that subliminal communications are taking place and deciding to discard the involved software/device.)


texts: I have used AES to secure my short term wireless network(1 day lifetime). The same symmetric key is used for securing entire network traffic. is it possible to improve security with onetime password scheme? ie, Again AES encryption,but with different 128 bit keys each time.


texts:
We have p and q which are distinct primes congruent to 1 mod 4. Then we have n = p*q.

Do you know any algorith for calculating square roots for the decryption in this case? I'm asking for some explanation how to calculate or some pseudocode. Thanks in advance


texts: How do I demonstrate that a PRNG not designed for cryptography is not suitable for generating passwords?

texts:
This is a replication of this question on Stack Overflow. There's class Random in .NET runtime which is designed for use as a cheap fast source of pseudo-random numbers for simulation - very fast, seed can be passed in explicitly, emits easily reproducible sequences.

This class is often misused for generating passwords and similar secret stuff. Here's a question showing one possible attack on this PRNG, but it only works in a very specific scenario (when a lot of data is emitted in series) and also takes some time - up to a year on a single CPU.

Is there a clearer and faster way to show that passwords generated using data from class Random() are much weaker than typically expected?


texts: Practical uses of Manipulation Detection Code (MDC) and IGE

texts:
I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below:

  We show that generic compositions of confidentiality-secure encryption
  schemes with Manipulation Detection Code (MDC) functions for
  authenticated encryption are, in general, weaker than
  "encrypt-than-authenticate" compositions using strong Message
  Authentication Code [edit: (MAC)] schemes. Since the former
  compositions lead, in general, to authenticated encryption schemes
  that are faster, more power-efficient, and simpler implementations
  than the latter, we conclude that both types of composition are
  necessary in practice for different application environments.

Now despite this claim I cannot find any protocols that e.g. use the Infinite Garble Extension (IGE) or double IGE (biIGE) modes of encryption.

Furthermore I found the following rather alarming notes (that are more alarming since the aforementioned paper seems to be of a later date than the attack described in the last link):

http://www.metzdowd.com/pipermail/cryptography/2006-September/011423.html

https://groups.google.com/forum/#!topic/sci.crypt/4bkzm_n7UGA

So my two related questions are:

Can there be any practical use of MDCs in general?
Can there be any  practical use of IGE or biIGE mode encryption?


texts:
I've seen the ECB Penguin used to demonstrate why ECB is not a recommended method of encryption, but I do not understand how this translates to text or passwords.

Aren't the people who create these images comparing apples and oranges?


texts: Generalizing the conversion of Diffie-Hellman to El Gamal

texts:
How can we generalize the conversion of Diffie-Hellman to El Gamal public-key encryption scheme? The goals is to be eventually able to show that any 2-round key-exchange protocol can be converted into a public encryption scheme that is CPA-secure.

The 2-round key-exchange protocol mentioned should satisfy the requirement that: given a key K, it will not be able to determine whether it was given the "correct" key corresponding to the given execution of the protocol, or whether K is completely random key independent of the execution.


texts:
I have one problem about cryptography which I don't if someone already solved it. I want one device (master) to receive one encrypted package from each one of the other $n$ devices (normal) and I want the master to be able to decrypt each package without being able to identify from which device it came, knowing that the master knows from which device he received the encrypted package.

Is it possible to do this if the encrypted packages were not shuffled betewen the $n$ normal devices, like some kind of group decryption in which the information is preserved but the order is randomized, so that the device of origin is untraceable? Can it be achived without comunication betwen the normal devices?

Also I couldn't find any tags besides encryption that were appropriate to the question, could anyone help me choose another tag?


texts: RSA & DH at risk due to math advances, will this eventually affect elliptic curves too?

texts: I was looking into the predictions by some researchers that RSA and Diffie-Hellman may not be secure in the next few years due to advances in math and being able to calculate the discrete logarithm problem in new ways no longer making them "impossible" to solve backwards (Math Advances Raise the Prospect of an Internet Security Crisis).  Would this cause problems with Elliptic Curves?  I know they are based on different principles, but could continued advances in this area compromise ECC?  Can we consider ECC a replacement if RSA and DH were compromised?


texts: Post-Quantum security of Pseudo-Random Functions

texts:
I am wondering what is the exact post-quantum security of a PRF. I know that for most symmetric mechanisms, it is assumed it is sufficient to double the key size, but I am looking for a more precise analysis in the case of Pseudo-Random Functions (like $2^{(n/2)}$ operations with Grover algorithm for the preimage).

To clarify, I am searching for (1) generic attacks (not on any specific PRF) (2) for an attacker that only has classical access to the PRF.


texts:
I looked into the math behind RSA and seem to understand the basic encryption and decryption scheme.

Let's say there are two parties, Alice and Bob, who wish to communicate and secure their conversation using RSA.

Alice generates two prime numbers ($p$ and $q$), uses those to compute $n = p q$, and $\phi(n) = (p-1) (q-1)$. Then she computes two values, $e$ and $d$ which are relatively prime to $n$.  She sends over the publicly accessible values $n$ and $e$ to Bob, who encrypts his message $m$ by computing a value $c = m^e \bmod n$. He sends this publicly accessible value to Alice who then uses $d$ to compute $m = c^d \bmod n$.

If an eavesdropper intercepts their conversation and gets the value of $c = m^e \bmod n$ and knows $e$ and $n$, could he not just brute-force different values of $m$ to see which works?


texts:
I am implementing the SHA-3 algorithm in AVX2 assembly. The part where I am getting confused is that the padding with 10*1. Now my understanding is that the
data message M first needs to be padded with a '01'bit sequence. So, N= M || '01'.

Next, for the moment, please assume that the implementation is for KECCAK[1024] which is sponge(KECCAK-p[1600,24],pad 10*1,576](n,d). This implies, all the packets P_{i} have to be 576 bits long (1600-1024).

Now, my confusion is when the incoming message M itself is of 573 bits length. Then, N=M || '01' becomes 575 bits length. Then, do I just pad a single bit '1'? This is not then 10*1. How does one handle this specific length message, please?

Any advice is welcome. Remain grateful.


texts: Breaking ciphertext using a quantum computer when the public key is not available

texts:
As we know about Shor's algorithm on quantum computers it is possible to crack RSA / ECC easily if we have enough qubits.

Is it possible to crack RSA / ECC on a quantum computer if we only have ciphertext and don't have the public key used to encrypt itself?

Does it matter if we have many ciphertexts and corresponding plaintext for some of them that are generated using the same public key?


texts: Extractability property in Zero Knowledge Discrete Log problems

texts:
I am trying to construct a simulator and an extractor for a zero knowledge protocol. I just encountered this text that explains the construction of the simulator.

Does someone know of a similar text that explains extractor construction in depth? I need to construct the extractor and prove that it extracts with non negligible probability.


texts: Proof Dlog is hard in generic group model

texts: I want to know a proof for why the dlog problem is hard in the generic group model. But i can't find any resources online. Can someone please provide me a link or an explanation?


texts: Is using different public keys for different peers safer than reusing the public key, beyond forward secrecy?

texts:
In X25519 (ECDH over Curve25519) Peer A and B exchange their Public Keys PkA and PkB and then calculate a shared-secret SecAB using cominationOf(SkA, PkB) == combinationOf(SkB, PkA).

For forward secrecy, I think it's recommended for A and B to re-negotiate a new shared-secret regularly (thus advertise new Public Keys).

Leaving that aside is there any other disadvantage if A uses the same Public Key that they have with everyone to get corresponding shared-secret VS if they use new Public Key with each new peer ?

In other words:

Peer A gives PkA to all, B, C, D ..., and as usual calculates shared-secret using PkB, PkC, PkD as SecAB, SecAC, SecAD and so on and uses those to encrypt/decrypt messages to the corresponding peers.
Peer A gives new Public Keys to each. So PkAB to B, PkAC to C, PkAD to D and so on. Then, just like before, calculate the shared-secret after using Public Keys of the corresponding peers as SecAB, SecAC, SecAD and so on.

Is 1. above less secure in context of how X25519 (and its maths) works than 2. ? Or is it just wasteful to do 2. and 1. is equally good ?


texts: How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

texts:
I have a question about RCON

here is my illustration...

this is the 128 bit key..

[2b] [28] [ab] [09]
[7e] [ae] [f7] [cf]
[15] [d2] [15] [4f]
[16] [a6] [88] [3c]

and then I will get this..

[09]
[cf]
[4f]
[3c]

and then I will put down the first 8bit(1byte) where it is the 09:

[cf]
[4f]
[3c]
[09]

after that I will change their value according to s-box..

[8a]
[84]
[eb]
[01]

and then I will xor that substituted 32 bit value to

[2b]        [8a]        [01]
[7e]  XOR   [84]  XOR   [00] <--- that is a RCON(4)
[15]        [eb]        [00]
[16]        [01]        [00]

My question is: How will I determine the RCON that I will use? Or will I only used this one?

[01]
[00] <--- that is a RCON(4)
[00]
[00]

But why?


texts: Do I still need SHA256 if I already had a AES 256 key that is 44 characters long?

texts:
Several months ago, I was required to research AES and SHA-256 to make a secured license system for my app. However, I was dumb enough that couldn't distinguish between the 256 bits from AES and the actual SHA-256, which resulted in me making a system that generates a 256-bit long key (44 characters long base64 key) for AES-GCM encryption and decryption without the actual SHA-256. Now, it's time for me to update the system that cooperates with an AES system in PHP. But then I found the PHP resources (it's used for research purposes so it can be changed) provided to me has actually used SHA-256 which made both systems totally different. Then my question is, is the 256-bit long key secure enough that I don't actually need the SHA-256 in the PHP system?
P.S.: If I misunderstood anything in the question, I would like to apologize since I am still new to the area of cryptography...
PHP code:
<?php
echo '
';

$hash_string = 'qIANSOwtdfF4y5Yk33ZLE5s6KwKBAeu6qzJRG84Sjjo=';
echo "password : ";
var_dump($hash_string);
echo '
';
$decode_string = base64_decode($hash_string);
$hash = hash('SHA256', $decode_string, true);
echo "hash : ";
var_dump($hash);
echo '
';
$app_cc_aes_key = substr($hash, 0, 32);
$cipher = 'aes-256-gcm';
$iv_len = openssl_cipher_iv_length($cipher);
echo "app_cc_aes_key : ";
var_dump($app_cc_aes_key);
echo '
';
echo "cipher :";
var_dump($cipher);
echo '
';

$data = '7bc9d6ae-982f-11e9-bc42-526af7764f64';
echo "data : {$data}";
echo '
';

$tag_length = 16;
$iv = openssl_random_pseudo_bytes($iv_len);
$tag = "";
$encrypt = openssl_encrypt($data, $cipher, $app_cc_aes_key, OPENSSL_RAW_DATA, $iv, $tag, "", $tag_length);
$encrypt_text = base64_encode($iv.$tag.$encrypt);
echo "encrypt :";
var_dump($encrypt);
echo '
';
echo "encrypt_text :";
var_dump($encrypt_text);
echo '
';

$decoded_text = base64_decode($encrypt_text);
$iv = substr($decoded_text, 0, $iv_len);
$tag = substr($decoded_text, $iv_len, $tag_length);
$ciphertext = substr($decoded_text, $iv_len + $tag_length);
$decrypt_text = openssl_decrypt($ciphertext, $cipher, $app_cc_aes_key, OPENSSL_RAW_DATA, $iv, $tag);
echo "decrypt_text : {$decrypt_text}";
echo '
';
?>

The method to generate AES key in C#:
public string NewKey()
{
    var key = new byte[KEY_BIT_SIZE / 8];
    random.NextBytes(key);
    return Convert.ToBase64String(key);
}

About the license system: It's on Android. When the app first opens, the app will generate a UUID and send it to the server for authorization. Then our staff will authorize manually and send an authorization code back. If there is the code, the app can then automatically license for using our courses which are arranged by our staff.


texts: I am trying to prove that changing an input in a security game from a randomly permuted set to a set that is permuted using a pseudorandom permutation (PRP) results in a negligible distinguishing advantage between the two games. Does anyone know of any good examples in the literature of this kind of game hop. I have already read through the Shoup 2006 paper on games.


texts: I have a list of DES encrypted strings/data, they come in two lengths, 32 chars hex (16 bytes) or - I believe - 64 chars. I know the key, which is 8 ascii chars (I might add that I am the rightful owner of the key and all data). Is is possible to decrypt the strings, given this information, or is is impossible without additional info about the implementation, IV's, padding whatnot?


texts: If a key is used to encrypt that same key, is the computational cost to brute force it decreased?

texts:
If a key $d$ is used to encrypt a message $m$ that is identical to the key $d$, resulting in a cipher $c$

$c = \text{Encrypt}(m, d) = \text{Encrypt}(d, d)$

is the computational cost to brute force $d$ lower than if the key $d \ne m$ ?


texts: Is there any cipher standard based on SHA-3, where it is not used as part of RFC2104?

texts:
I'm thinking about using a cipher, which uses AES CTR+SHA-3. My basic idea is this:

IV|AES-CTR(PLAINTEXT_SIZE|PLAINTEXT|SHA-3(KEY|PLAINTEXT_SIZE|PLAINTEXT))

So, basically, the encrypted data contains the following:

IV for AES-CTR
AES-CTR encrypted of the following:

size of plaintext in 64-bit little endian encoding
plaintext
Keyed SHA-3 of 1. and 2.

Is there a standard/recommendation, which is like this? I don't want to design the system from scratch, as I certainly will make mistakes, so I'd like to follow some standard designed by experts.

I'd like to use SHA-3 in way I written (if possible), not like as RFC2104 uses it (H(K XOR opad, H(K XOR ipad, text)))

But, if SHA-3 is better if it is used in a Encrypt-then-MAC way, I'll accept it.


texts: When would I need DSA as opposed to RSA for digital signature?

texts:
The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key. This multiple encryptions is a pretty expensive process since public key encryption is so resource intensive.

On the other hand, the RSA-based digital signature algorithm encrypts the hash using only the senders private key, which is a much cheaper operation.

Under what circumstances would I need to use the expensive DSA as opposed to using the much faster RSA?


texts: GCM: Math behind update of AAD after ciphertext has been processed

texts:
In the Bouncy Castle libraries, the GCM cipher implementation has an interesting property that does not seem described in the GCM papers (neither the NIST or the original paper):

  Some AAD was sent after the cipher started. We determine the difference b/w the hash value we actually used when the cipher started (S_atPre) and the final hash value calculated (S_at). Then we carry this difference forward by multiplying by H^c, where c is the number of (full or partial) cipher-text blocks produced, and adjust the current hash.

This scheme is present in the final calculations (in the doFinal() method).

Now what I understand is that addition of within the polynomial is equivalent to XOR. I can also see why exponentiation is required to carry the difference forward. What I don't see is how the complete scheme works, especially for partial 16 byte blocks.

Can somebody show how the adjustment in the doFinal method is defined  mathematically?

Note that the $\operatorname{GHASH}$ function is performed over the follwing data within GCM:

$S = \operatorname{GHASH}_H (A || 0^v || C || 0^u || [len(A)]_{64} || [len(C)]_{64})$

where

$0^v$ and $0^u$ is padding (0..127 bits of zero's) up to the block size

$\operatorname{GHASH}$ itself is defined as follows:

Steps:

Let $X_1, X_2, ... , X_{m-1}, X_m$ denote the unique sequence of blocks such that $X = X_1 || X_2 || ... || X_{m-1} || X_m$.
Let $Y_0$ be the “zero block,” $0^{128}$.
For $i = 1, ..., m$, let $Y_i = (Y_{i-1} \oplus X_i) • H$.
Return $Y_m$

and

$X•Y$ is the product of two blocks, $X$ and $Y$, regarded as elements within the binary Galois field

So in this scheme additional AAD ($A$) is send after ciphertext ($C$) was already put within the calculation.


texts: Implement deterministic authenticated encryption using libsodium

texts:
Note: this is my first question on stack exchange, let me know if you miss some details to answer and I will edit the question accordingly
Context
I'm  willing to create a git encryption tool (marauder) that will encrypt files that are marked in .gitattributes.
.gitattributes
my-project.password filter="marauder" diff="marauder" merge=marauder"
.env filter="marauder" diff="marauder" merge=marauder"

.git/config
[filter "marauder"]
  clean = ~/marauder git-clean
  smudge = ~/marauder git-smudge
[diff "marauder"]
  textconv = ~/marauder git-diff
  cachetextconv = true
[marauder]
  key = d2rmvoMBcPAcs-otYtbRH_WIIztXtg7ONcbGgzwcpQo=

This, with above config will encrypt files before sending them to the server, and decrypt them on git pull.
Key characteristics

Authenticated encryption (AEAD): we are using https://github.com/elasticdog/transcrypt but it does not offer authentication. We had a bug were the key wasn't set correctly (env variable not set) and the decryption run unsuccessfully with a key "undefined", making the clear text completely wrong. We would prefer to have the CI process failing
Deterministic: as the file is encrypted in git, we cannot afford to have the blob changing every time, even if the text stay the same. That means for symmetric encryption "stable nonce"
State of the art crypto: a good balance between "boring" (not too recent, established) and "feature proof"

Library
OpenSSL, especially on older mac doesn't include AEAD scheme, such as AES-GCM.
I have planed this to rely on libsodium secret box (xsalsa20 and poly1305).
Question

What will be the best way to do a proper AEAD scheme, with deterministic encryption using libsodium

Prior research & proposed solutions
Solution 1: Deterministic nonce based on content
pseudo code
// Given
let key = <32 bits random key>
// Then
let nonce = crypto_generichash_blake2b(file_content, key)[:24]
let authenticatedciphertext = crypto_secretbox(file_content, nonce, key)

Pro:

simple
"looks" (ugg) correct

Cons:

not standard
is it safe to use blacke2b hash to generate nonce?

Solution 2: Daence
https://eprint.iacr.org/2020/067.pdf
Pro:

at least some crypto analysis

Cons:

libsodium wrapper (eg node) doesn't expose HSalsa20
is there any review on the above paper

Solution 3: XChaCha20-HMAC-SHA256-SIV
https://datatracker.ietf.org/doc/html/draft-madden-generalised-siv-00
Pro:

at least some crypto analysis

Cons:

draft
I haven't tested implementing it

Final words
I lack cryptographic knowledge saying what is better, and why.
Considering the above context (medium size message, relative short number of message, deterministic nonce), what will you do and why ?


texts: Rabin code same message sent with different $N$

texts:
I use Rabin code with modulus $N$. Now assume that Alice sends me a message $m$ $(1\le m\le N)$ encoded by Rabin code. Unfortunately after Alice sent me the text I lose the information about the factorization of $N$ and therefore I cant decipher the message. I take new primes and construct a $\bar{N}>N$ and tell Alice to encode it again with $\bar{N}$.

An enemy finds both messages (the one encoded with $N$ and the one encoded with $\bar{N}$). My question now is how can he finds out the message $m$?

EDIT: According to the comment, here my method for the Rabin cipher:

The primes $p,q$ are of the form $p=4k-1, q=4m-1, N=pq$. Public key is $N$ and the encrypting fuction is $m\rightarrow m^2 \mod N$ $gcd(m,N)=1$. I also know that if $c\equiv m^2 \mod p$ then $m\equiv \pm c^k \mod p$


texts: Sodium crypto_aead_aes256gcm_encrypt ciphertext length > plaintext length

texts:
Using the crypto_aead_aes256gcm functions from Sodium produces a ciphertext of "at most mlen (plaintext length) + crypto_aead_aes256gcm_ABYTES bytes (16 bytes) are put into c (ciphertext), and the actual number of bytes is stored into clen if clen is not a NULL pointer. The phrase "at most" is deceiving because, in testing, ciphertext length is always plaintext length + 16 bytes. Why is this the case if in the specifications for GCM the output is a ciphertext, denoted C, whose bit length is the same as that of the plaintext (5.2.1.2).

I was going to attempt to read/write files using this, so would I just read 32 bytes at a time?


texts: What is the difference between the adversary and the algorithm?

texts:
I recently saw a sketch relating to provable security in a book, regarding the amount of time it takes to factor N where N = pq and p,q are primes.

It says that "There is a trivial algorithm which always factors a number in time $\sqrt N$ , so there is an adversary $A$ such that $Adv_b (A, 2^{b/2}) = 1$" b is the amount of bits of $N$.

Here there is a distinction drawn between the adversary and the algorithm. However, if the algorithm can always factor a number in $\sqrt N$ why does it matter, how strong the adversary is?


texts: What is meant by this notation in the ElGamal key generation process?

texts:
Alice chooses
i) A large prime $p_A$ (say 200 to 300 digits)
ii) A primitive element $\alpha_A$ modulo $p_A$,
iii) A (possibly random) integer $d_A$ with $2 \le d_A \le p_A-2$.
Alice computes
iv) $\beta_A \equiv \alpha_A^{d_A} \pmod {p_A}$.
Alice's public key is $(p_A,\alpha_A,\beta_A)$. Her private key is $d_A$.

What is meant by the notation $\alpha_A$, $p_A$, and what is meant by a 'primitive element', does it mean a small number or something else entirely?


texts: Schnorr Identification protocol sometimes wrong?

texts:
I'm implementing the Schnorr Identification protocol as part of a larger protocol. In a large percentage of cases, around 20%, my test fails. I don't think it's a code problem, although possible, but I think it's a problem with my understanding of the protocol.

Here's how I currently perform Schnorr Identification:

Using OpenSSL, I find a safe prime $p$ and subsequent prime $q = (p - 1) / 2$
I find a generator $g$ for the cyclic group $\mathbb{G}_q$ of order $q$.

This is the part I'm the most suspicious of. I've read that it's believed taking random $h \in \mathbb{Z}^{*}_{p}$ and setting $g = h^{(p-1)/q} \mod q$ will result in $g$ being a likely generator for $\mathbb{G}_q$ as long as $g \neq 1$, although it's not proven. I don't fully understand this, and it seems a probable place for my implementation to fall down.

I generate a random private key $x \in \mathbb{Z}_q$ and set $y = g^x \mod p$

With the ElGamal key now set up, I want to prove knowledge of $x$ to a verifier who knows the public key $(p, q, g, y)$.

I pick a random $e \in \mathbb{Z}_q$ and send $w = g^e \mod p$ as my commitment.
As verifier, send random $c \in \mathbb{Z}_q$ to prover.
As prover, send $s = cx + e \mod q$ to verifier.
As verifier, check that $wy^c \mod p = g^s \mod p$.

The final step is where it will sometimes fail; the equality doesn't hold. Because each test run generates new random numbers, it's hard to see what's causing the failure.

I don't think it's a code problem; I believe I have coded everything to do exactly what the above steps outline. I think one or more of the steps themselves might be wrong. Note that I have included the modulus for each calculation that I'm doing, because some papers tend to leave them as implicit.

Is my understanding of the Schnorr Identification protocol correct, and have I correctly reproduced the formulas? If so, can I do it better?


texts:
I want to encrypt a file with a RSA public key.

I generate a random 16 bytes key
I encrypt the file with AES + the random key (aes.NewCipher() + cipher.NewGCM() + aesgcm.Seal())
I encrypt the random key with RSA (rsa.EncryptOAEP())

Now I can send the encrypted file + encrypted random key to the person who has the private RSA key.

I read that secretbox should be favored over the RSA package: should I keep using RSA? What is the difference with the secretbox package?


texts: How does Output Feedback mode use the initialization vector?

texts:
How can I process Initialization Vector inside the Block Cipher Encryption box (using for example AES) together with the Key?

Will I encrypt the Initialization Vector like a block of plaintext?
So I can generate a keystream, which I will then XOR  to the plaintext to generate ciphertext?


texts: Question on Tokenization and the need to maintain a value to token lookup

texts: I'm a newbie and an idiot to boot. I've a question in relation to tokenizing: is there a methodology out there that would allow you reidentify without using a token to value lookup?  I'd have thought no but have a developer claiming something different.  I contend that what he's talking about is an encryption process.


texts: Which block cipher parameters should be kept secret?

texts: Which of the parameters of a block cipher (e.g., algorithm name, mode of operation, IV (if any), key length) are essential to keep secret?


texts: Is this modified Schnorr signature scheme secure?

texts:
Signing

Let $y = g^x$, which is your public/private keypair.
Let $r = g^v$, for random $v$
Let $c = H(M)$
Let $z = (v + cx) \bmod q$
The signature is the pair $(r,z)$

Verifying

$g^z = ry^c \bmod p$

We further assume that the signer takes care not to sign the same message twice (that's his job in my application), and that the resulting malleability is not an issue. Is this scheme secure in the Random Oracle model?

If so, we can get trivially fast non-interactive multisignature aggregation.
https://crypto.stackexchange.com/questions/19291/need-fast-bulk-signature-verification-followed-by-fast-non-interactive-multisig


texts: Cipher Block Chaining - How do you change the plaintext of all blocks?

texts:
I've just read about CBC encryption and decryption and was wondering how you can change every plaintext block?

Let's say you have an initialization vector, 3 ciphertext blocks, know each block-cipher-decryption and you know each plaintext block too. Then you have some string that you want to change these given plaintexts to. Edit: Assume there is a padding oracle available as well.

If I understood correctly, it will be quite easy to change the very first plaintext block: You take each byte of the initialization vector XORed with each byte of the first plaintext block XORed with the character of the string you want to change these plaintexts to. Putting all these new bytes together, this is now the new initialization vector and XORing this new initialization vector with the first ciphertext block, we will get another plaintext; that one we wanted.

The change of the iv has no effect on the plaintext of the next ciphertext block. But now in order to change the next, namely the second plaintext, we would have to do changes on the first ciphertext block which will sadly destroy the first plaintext block... And the same will happen if we move to the next ciphertext block and try to change its plaintext. So, in the end, there will just be junk plaintext or nothing at all, bad format. But I don't see any other way where you could change all plaintext blocks correctly? : /

I've mainly oriented myself on this nice diagram here from Wikipedia:


texts: If I send a signed email, how does the end user get the public key?

texts:
I am sending a signed email using Python and smtplib. I have successfully signed the email using this example: http://proj.badc.rl.ac.uk/svn/ndg-security/branches/Dependencies/m2crypto/doc/howto.smime.html

My question is how does the end user get the public key to check the signature? I have not seen any examples of attaching the public key to the same email. Thanks.


texts: How to get an output of SHA-1 with first 2-bit are zeros?

texts: Can someone explain what are the ways to get an output of SHA-1 with first 2-bits which are zeros?


texts:
I would like to insert a key deriving function into EAX mode, in order to hamper brute-force attacks for a key-size restricted cipher (56 bits). The modification inserts an identical multi-block pattern $S$ behind the corresponding tweaks:

Original: $OMAC(T||...)$ where the 128-bit tweak $T$ is either 0, 1, 2.

Modification: $OMAC(T||S||...)$

The state of the MAC behind $S$ is different for disjunct tweaks, because the MAC's state behind $S$ can be decrypted back to the original tweak, and identical states would yield identical tweaks.

Is this EAX extension weakening the (provable) security of EAX?


texts: How decode works in CCA1 scheme based on MP12 construction?

texts:
In Section 6.3 from MP12 we have that $encode(m) = Sm$, for $S$ any basis of $\Lambda(G^t)$. Then I have:

$S = \begin{pmatrix}
1 & 2 & 4 & 8 & 16 & 32 & 64 & 128 & 256\\
2 & 4 & 8 & 16 & 32 & 64 & 128 & 256 & 0\\
4 & 8 & 16 & 32 & 64 & 128 & 256 & 0 & 0\\
8 & 16 & 32 & 64 & 128 & 256 & 0 & 0 & 0\\
16 & 32 & 64 & 128 & 256 & 0 & 0 & 0 & 0\\
32 & 64 & 128 & 256 & 0 & 0 & 0 & 0 & 0\\
64 & 128 & 256 & 0 & 0 & 0 & 0 & 0 & 0\\
128 & 256 & 0 & 0 & 0 & 0 & 0 & 0 & 0\\
256 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0
\end{pmatrix}$

I used very simple parameters: $q=512$, $k=9$, $n=1$, $m=18$. I set $H$ and $R$ to the identity matrix.This way I have that $A_u = [A' \mid -A' + G]$.
Therefore, I have that $encode([1, 0, 0, 0, 0, 0, 0, 0, 0]) = [1, 2, 4, 8, 16, 32, 64, 128, 256] = G$. Fixing $s=1$, I computed $2s.A_u + e + encode(m) = [2.A' \mid -2A' +  2.G] + [0 \mid G] + e = [2.A' \mid -2A' + 3.G] + e \pmod{2q}$.

The inversion oracle returns $z=3$ and a big error $e'$ (but such that $e'.[R \mid I]^t = e.[R \mid I]^t \pmod{q}$). The decryption algorithm returns $m=[1, 1, 0, 0, 0, 0, 0, 0]$.

In general I have that $m$ is being added to $2s$, so the decryption algorithm returns the binary decomposition of $DecimalRepresentation(m)+2s$, instead of only $m$.

In Lemma 6.2, we have that $v^t.[R \mid I]^t = 2(sG \pmod{q}) + encode(m) \pmod{2q}$. Therefore I reached this point successfully. Hence I guess my Decode algorithm is wrong. In order to decode, I am multiplying by $Inverse(S)$. Afterwards I divide the obtained vector by $q^{k-1}$.

What am I doing wrong?


texts: An unpredictable PRG is secure (Theorem Yao'82)

texts:
in the Mr Boneh's online course is stated the following theorem:

  Let $G:K \to \{0,1\}^n$ be a PRG.

  “Thm”: if $\forall i \in \{0, … ,n-1\}$ the PRG $G$ is unpredictable at pos. $i$,
  then $G$ is a secure PRG.

Moreover, according to his words, proving this is just a "puzzle" to prove, but actually I can't see it so easily, the only idea I have at the moment is arguing that if you can't predict the next bit of some pseudo-random string, then you can't distinguish between that pseudo-random string and a that pseudo concatenated with a truly random one in that position, It's a nice beginning but I don't know how to exploit it. Can someone give me a hand in the argument for the proof? Thank you very much.

PS: Here you can find the definition of unpredictable, secure PRG we've used and the theorem itself (Althought in my opinion, those definitions as stated there are not satisfactory from a mathematical point of view).


texts:
I am building a small embedded system of two nodes that communicate wirelessly.  The microcontrollers I'm using are very limited: they only have 256 bytes of RAM.  I would like to be able to authenticate messages sent and received between the nodes, but traditional methods such as HMAC aren't possible because of the constraints of the system (lack of RAM).

I do have a large (2 megabit) EEPROM that is largely unused.  I would like to use this space to store a (relatively) large one-time pad that could be used to authenticate the messages, which are only a few bytes long.  I do not care about the secrecy of the messages, only their unforgeability and integrity.  If only, say, 4 bytes of pad are used per message, the pad should far outlast the system's expected usefulness.  Finally, messages are not guaranteed to be received by the other node (for example, due to interference, malicious or not).

Are there any schemes that use a one-time pad for message authentication?  Assume the one-time pad is truly random.  Or is this an entirely hair-brained idea that is inherently insecure?


texts: Vulnerabilities of encrypting data with known regularities

texts:
I need to encrypt data that has a pre-defined header and footer structure, and furthermore the data follows pre-defined patterns. The header and footer structure follow a defined structure but cannot be left out because they are never truly equal. An example of this kind of data is an html file: it will in most cases start with a doctype declaration (which has a pre-defined form) and html opening tag. The file ends with the html closing tag, and even though the data in between tags can be arbitrary, the tags are fixed structures as well. This is like a known-plaintext attack.

Suppose an attacker were to do a brute-force attack, then he could easily verify that a key is wrong after decrypting only a few bytes. My question is: is this a vulnerability? I presume that when the key size is large enough, it is not, but consider the case for a small enough key where the amount of work required could make a significant difference. Ideally, it should only be possible to check whether the decrypted data is correct after all data has been decrypted. (I assume that it requires much more work to process large amounts of data, similar to PBKDF using many iterations to make trying many words infeasable; is this correct?) Could the information that plaintext must follow a pattern be of any use to an attacker?

If it is a vulnerability, how would one resolve the issue? In other words, is it possible to encrypt data with many regularities in such a way that these regularities only become apparent after decrypting all the data?

My question applies to encryption algorithms in general, but I intend to use AES with a 256-bit key.


texts: Check validity of generated parameters for SIDH

texts:
In section 4.1 of the paper Towards quantum-resistant Cryptosystems From Supersingular Elliptic Curve Isogenies by Feo, Jao and Plût it is described how you generate valid parameters for the SIDH scheme. After finding a suitable supersingular elliptic curve, you pick two points $P_A$ and $Q_A$ in $E[l_A^{e_a}]$ of order $l_A^{e_A}$ for Alice. As they form a basis for $E[l_A^{e_a}]$ they need to be independent of each other. For that, you should compute the Weil pairing and check if the order is $l_A^{e_A}$.
So I started using Jao's example sage snippet which can be found on github.com/sidh-crypto/sidh-sage-reference. The parameters are the following:
lA = 2
lB = 3
eA = 63
eB = 41
f = 11
p = lA ^ eA * lB ^ eB * f - 1

F.<z> = GF(prime^2, modulus=x^2+1)
E = EllipticCurve([F(1), F(0)])

PAx = F(2374093068336250774107936421407893885897*z + 2524646701852396349308425328218203569693)
PAy = F(1944869260414574206229153243510104781725*z + 1309099413211767078055232768460483417201)
PA = E(PAx,PAy)
QA = E(F(-PAx),F(z*PAy))

It's a supersingular curve with the requested cardinality and the points $P_A$ and $Q_A$ seem to have the right order $l_A^{e_A}$:
sage: E.is_supersingular()
True
sage: factor(PA.order())
2^63
sage: factor(QA.order())
2^63

But when I calculate the Weil pairing for $P_A$ and $Q_A$, I end up with a order of $p=l_A^{e_A} \cdot l_B^{e_B} \cdot f - 1$ and not $l_A^{e_A}$:
sage: pairing = PA.weil_pairing(QA, lA^eA)
sage: pairing
1324361388592786441589732914656853536873*z + 3172046595776778884104328104615186693655
sage: pairing.order() == lA^eA
False
sage: pairing.order() == p
True

So I have problems proving the example parameters as described in the paper (but the same applies to the parameters of SIDHp503 of the lib PQCrypto-SIDH). Am I computing the Weil pairing wrong? Moreover, why should $|e(P_A,Q_A)|=l_A^{e_A}$ hold theoretically?


texts: What is the purpose of decomposing ciphertext into digits during relinearization in Brakerski Vaikuntanathan homomorphic encryption?

texts:
In Brakerski and Vaikuntanathan's homomorphic encryption scheme, the relinearization function turns a 3-element cipher back to a 2-element cipher by using a set of public homomorphism keys (https://eprint.iacr.org/2011/405.pdf, see section titled "An Optimization to Reduce Ciphertext Size").

I do not understand the point of encrypting the base-t digits of $c_2$ instead of just encrypting $c_2$ as a whole. Can someone explain? For example, instead of publishing a large set of homomorphism keys encrypting $t^is^2$ (where s = secret key): $$hk_i = (a_i, b_i=-(a_is + te_i) + t^is^2)$$for each i, and making the untrusted server build $c_2s^2$ out of these components, you could just publish a single key $$hk = (a, b=-(as+te) + s^2)$$and have the relinearization operation be $$c_0^{relin}=c_0+c_2b$$ $$c_1^{relin}=c_1 + c_2a$$ and the decryption would yield $$m=c_0^{relin} + c_1^{relin}s$$$$=c_0+c_1s+c_2as + c_2b$$$$=c_0+c_1s + c_2s^2-tec_2$$which, taken mod t, gives the correct result of the homomorphic multiplication. Is there a problem with this much simpler way? Why decompose $c_2$ into digits?


texts: Assume we have two computing parties for SPDZ protocol. The two parties are also the input parties. How can they share the MACs on their input shares assuming one party is the master who owns the MAC key and one is the client who do not have the key ?


texts: How "hard" it is to take an e'th root mod p?

texts: I know it's hard to find the $e$th root of a number mod $n=p_1*p_2$, and if it would be possible we could break RSA. But how hard it is to take an $e$th root mod $p$ where $p$ is a prime and $\gcd(e,p-1)=1$?


texts: Does AES(x || x) provide secure message authentication when message fits in a single block?

texts:
Suppose I have x = <64 bits of data>. I build a 128 bit block $P = x || x$, and transmit a message $M = AES(K, P)$. The receiver has the same $K$.

The receiver can then decrypt the message, split the decrypted block in two 64 bits parts, and comparing them for equality. What kind of guarantee would the equality check provide? Would they be able to securely authenticate the message?

Edit: as stated in a couple answers, the $x||x$ concatenation is a red herring. The scheme looks equivalent to padding x to 128 bits with all zeroes, then checking the decrypted block for the same sequence.


texts: PostQuantum Lattice-based schemes and Nguyen-Regev like attacks

texts:
As far as I know NTRUSign is considered to be a Post-Quantum scheme but it's vulnerable to the Nguyen-Regev attack that allow to recover private key when there is an access to signature oracle (as it stated in the original paper, 400 message-signature pairs are enough).

After that paper some improvements were proposed and cracked and now NTRUSign seems to be broken.

Do other lattice-based Post-Quantum schemes suffer from the attack by Nguyen-Regev or similar attacks? Signature and key agreement schemes should also be considered.


texts:
At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised.

At the end of the paper, it is mentioned the MAC length can be chosen by users according to their needs.

Was long MACs assumed in the claim of non-malleability, or is the property still holding with short/no MACs ?


texts: AES in CBC Mode Is totally unsecure if no defense is provided for padding oracle attack, right?

texts:
Based on a lot of reading here on crypto.stackexchange.com and around the web, it seems like AES in CBC Mode is totally unsecure if no defense is provided for oracle padding attack.  And it’s not just AES, any crypto algorithm that uses CBC mode is totally unsecure if no defense is provided for padding oracle attacks.  There are even step by step videos of how to recover plain text from CBC mode ciphers.  https://www.youtube.com/watch?v=aH4DENMN_O4

All of this kinda blows my mind though given that Wikipedia says that the original padding oracle attack was published in 2002 https://en.wikipedia.org/wiki/Padding_oracle_attack
If that is the case, how can it be that AES256CBC is often touted as strong modern encryption without mentioning that implementations lacking proper HMAC validation (Encrypt-Then-MAC), or some other padding oracle defense,  are  actually not secure at all?  It kinda blows my mind if I’m understanding this correctly.  Am I understanding this correctly?


texts: How to compare the order of elements in cyclic groups?

texts:
In a cyclic group with randomly looking behavior like the one used in secp256k1, is there any known efficient algorithm to compare the order of two randomly given elements $P_1$ and $P_2$ and find out which one will appear first starting from a known generator point of the cycle? If such algorithm exists, would that be considered a weakness?!

Consider that we have two known integers $a$ and $b$ so that $a>b$. Taking $P_1=a\times G$ and $P_2=b\times G$ we can say $P_2$ has a greater order in the cycle, meaning that starting from the generator point it will appear before than $P_1$.

By this definition is there any known algorithm based which one can compare the order of two random elements of the group $P_1$ and $P_2$?


texts: AES-128: How to find cipherkey comparing wrong and right ciphertexts?

texts:
I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is that there is a bitflip in every byte at the input of the last subbyte operation. I also have every single step of AES-128 (encryption/decryption) algorithm in matlab code. My goal is to find the cipherkey.

Here are some tips I got, but still I can't find a way to complete my task:

  You can calculate the cipherkey byte per byte cause the last round
  (subbyte, shiftrows, addroundkey) does modify each byte separately.
  You can ignore the shiftrows operation cause it does only affect the
  position. What you have to do is: you guess the key byte, calculate
  back to the input of the last subbyte operation for both the correct
  and the faulty ciphertext. Now you can compare them both and check
  whether the guess of the keybyte was good (think about what
  characteristics they should have when comparing them). Maybe you have
  to use multiple pairs of ciphertexts to find one key-byte. After you
  found the keybyte you can repeat this for all 15 other key-bytes.

I will also attach a screenshot of the result I get loading the .mat file.

Do you have any ideas on what to do with the code in order to find the cipherkey?

Thanks in advance for your help.


texts: When to chose hardware accelerated crypto for Big Data

texts:
if you were to recommend a cipher/mode configuration that emphasizes performance for your customers, would you recommend a hardware based accelerated solution over one that isn't? For big data at rest/transit what are some good  cipher/mode choices that work well with hardware accelerators?

In particular, I am thinking of the context of loading hadoop clusters in the cloud from on premise.  Assuming it's not a managed VPN, would it make more sense to go with ChaCha/Poly or hardware accelerated AES?   My thoughts are that the developer loading the cloud will likely have a beefy machine so it should have pretty modern CPUs - therefore I'm thinking of using TLS AES-GCM (I am trying to avoid rolling my own transit security protocol, but this may be necessary).

As this is Big Data, this becomes a significant performance issue when you're talking TB worth of data.

For big data at rest in the cluster, I am thinking definitely hardware accelerated AES, though not sure about the mode of operation.  My understanding is that GCM has opcodes in modern CPUs, however, because of the TLS support so that might be a good performant choice.

(Btw, I understand that supporting all modern secure suites is a good idea, but I am looking for strong default configs on both client/server).


texts: Confused about Merkle Damgard Transform - short messages?

texts: With the Merkle Damgard Transform, how does it handle messages that are shorter than the input message length - hash digest length? Or in other words, how is the last block handled? So for example, if I have a 40 bit long message and I want to use SHA 256 to get a hash digest, how would I do that? Doesn’t SHA 256 require a 512 bit message and the IV plus my message is only 296 bits? Thanks guys


texts: Are there any known weaknesses with ElGamal algorithm?

texts:
I am working on a messaging system and plan to use ElGamal asymmetric encryption to protect the message contents during storage and transmission. (This would be in addition to TLS used during transmission.) What I want to know is if there are any inherent weaknesses in the ElGamal algorithm that I should be aware of or guidelines to the key bit size.

Assumptions:

Messages will be short, so performance is less of a concern.
Keys (and the associated user accounts) are disposable (short lived).
Message retention will be minimized (days, not weeks or months).
Messaging will be asynchronous as users are not expected to be online at the same time. (This is the main reason that I have ruled out the typical D-H key exchange to generate a shared, symmetric key.)
Private keys will never leave the client device.
Public keys will be stored in a database with the anonymous user account consisting of a username and hashed password.
Using libgcrpt.


texts: Why are the initial states of hashes functions (like SHA-1) often non-zero?

texts:
There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this:

Why are the initial states of hash functions often non-zero?

For most, I have been able to find a clear explanation of where the initial values come from, and they are frequently nothing-up-my-sleeve values. That is, they are chosen precisely because they have no significant structure. However, if that is the case, why can they not be left at zero? Is it simply that a zero initial state is itself too suspicious?

(Other related question: "Initialising Sha-512")


texts: Differences between the terms "pre-master secret", "master secret", "private key", and "shared secret"?

texts:
Both crypto.SE and security.SE have excellent Q&As about how TLS generates session keys (I have linked some at the bottom).

In reading these threads I'm having troubles with terminology since the following terms seem to be used with overlapping contexts, though they are clearly different concepts. Reading definitions is only partially helpful since they don't show the differences between their usages.

pre-master secret
master secret
private key
shared secret / session key

As I understand it, the pre-master secret is related to private keys, but is algorithm independent, and the master secret is (often?) used as the session key. But I'm sure there's more nuance to the definitions.

Related Questions:

How does SSL/TLS work? [security.SE]
What's the point of the pre-master key? [security.SE]
What is the purpose of pre master secret in SSL/TLS? [crypto.SE]
What's the difference between the long term key and the session keys? [crypto.SE]


texts: ElGamal and Paillier key sizes for short messages

texts:
I am using ElGamal and Paillier schemes to encrypt a large number of short messages: typical 4-byte integers. I do this for the homomorphic properties of these schemes.

However, the way the encryptions work, with, say, a 1024-bit key a 4-byte integer will blow up into two values of overall size of 4096 bits or 512 bytes, which is, well, mildly inconvenient :)

As I deducted from examining the ECRYPT II report, the recommended key size for ElGamal is at least 1024 bits. I did not find recommendations for Paillier, though. However, as I understood, these recommendations are typically for larger messages. Hence, some questions:

1. Is there a difference in choosing a key length based on the size of a message?

2. What would be acceptable key sizes in the situation described above for both cryptosystems? If possible, I would like references to analyses I could read.

Bonus question: Let's assume an adversary gets a hold of an array of encrypted integers and tries to crack the encryption. How would he be able to determine whether he found a proper private key or not, if we assume that he is unable to tell a properly decrypted array from a random array?


texts: What are the current known weaknesses/attacks on quantum key distribution?

texts: I am writing a paper on the implementation of QKD in the future. I want to know if there are any viable attacks on the BB84 protocol or QKD in general? I know of the Photon Number Splitting attack or spectroscopy in the case of diode manufacturing but I have heard that there are already solutions for those. Are there any other attacks that I have missed out?


texts: Am I understanding AES key padding correctly?

texts:
I’ld like to ensure I understand AES key padding correctly…

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes?
Is there a safe way of determining if decryption was successful (meaning: that the correct key has been used
)?


texts: Algorithm for computing square roots in $GF(2^n)$

texts: Short question: is there an algorithm for efficiently computing square roots in $\mathbb{F}_{2^n}$?


texts:
Let $x_1,\dots,x_n$ and $y_1,\dots,y_N$ be some known integers modulo $2^k$, where $n\ll N$.

For each $x_i$, I have the following polynomial:

$$P_i(z)= \prod_{j=0}^{k-1}(z+2^jx_i) \mod 2^k.$$

Note that these polynomials are sparse, because only high powers of $z$ survive the coefficient-wise reduction.

My objective is to find the values of $y_1,\dots,y_N$ that vanish each of these polynomials, i.e., find the zeroes among $P_i(y_j)$ for $i\leq n, j\leq N$.

The naive approach of (perform every evaluation) is obviously on $O(knN)$ products in this ring of integers. Is there any way to do better, considering the form of these polynomials and the fact that they are sparse?


texts:
This is a form of the Kerberos protocol

I have two questions. Why does this protocol give the opportunity of a known plain-text attack because of no authentication of Joe? And how would an attacker perform a known plain-text attack?


texts: Creating serial key generator using ECDSA, how to get signature short enough?

texts:
I've written some questions in this stackoverflow and got great responses but now I'm trying to wrap it all together.

I have for the last couple of weeks been building a serial key generator project in C# to use in my own software. The goal is to be able to generate serial keys for customers of my software. To stop people from creating key generators I've been looking into elliptical curves and digital signatures using these.

So far I've been able to implement ECDSA using a secp256k1 curve. However one big question remains, how do I keep the signature, which will be made up of two points, short enough to be usable as a serial key? I do not wish to use a license file etc.

Unless I'm doing something wrong I get a signature made up of two points, each point containing a 32 byte BigInteger. This means the total byte count for the signature becomes 128 bytes. Encoding this to hex would yield 256 charactes, way too long to use for a serial key.

Now I've found this sample page:
http://kjur.github.io/jsrsasign/sample-ecdsa.html

Using this page for a secp256k1 curve the signature value in hex becomes much shorter than 256 characters. How do they get such a short signature?

I've also found a commercial solution called ellipter (ellipter.com), they get their key length down to 31 characters for a 128 bit "key strength", how is this even possible? What curves are used for 128 bit security?

Thank you!


texts: Could we share a secret key using the Birthday problem?

texts:
I stumbled upon this code on-line, it seems obvious to me that generating all 2^40 keys in trivial time can always be achieved as can hashing each and everyone of them, using the SHARED Salt that "Eve" could easily see:

### Here we outline:
### Sharing a SINGLE FOURTY BIT secret block, using the birthday problem (Proof Of Concept)

Alice (transmit):
MAKE SALT1
SEND SALT1 to Bob
Listen Until:
RECEIVE SALT2 from Bob
Let x = 2^18 (262,144)
Repeat x times:
Generate random 40 bits, call them Kx
Hash(Kx|SALT1) to make Hx
  Tranmit: SEND ALL Hx Values
WAIT FOR BOB'S RESPONSE
If response is:
  (no match found, try again) --> Go back to start
  (maybe match found, Hx, DATA) // If HASH(Kx|SALT2) = DATA, then common key found
  (if still no match found, try again) --> Go back to start
If common key found, respond: "FOUND"|HASH(Kx|SALT2) to Bob to complete confirmation

####################################################################################

Bob (recieve):
MAKE SALT2
SEND SALT2 to Alice
Listen Until:
RECEIVE SALT1 from Alice
Let x = 2^18 (262,144)
Repeat x times:
Generate random 40 bits, call them Kx
Hash(Kx|SALT1) to make Hx
  Wait for: RECEIVE ALL Hx Values
LOOK FOR the first matching calculated and received Hx, if any match
RESPOND EITHER:
       (maybe match found, Hx, HASH(Kx|SALT2) // where multiple matches are found, we use the first match
OR:
       (no match found, try again)
WAIT FOR RESPONSE
  if response reads "FOUND"|{checkable data} then common key found
  if response reads as SALT1, then go back to start

Does this have any practical applications whatsoever? What if the author had suggested that from each 40-bit secret, we use some to produce a salt for verifying Bob and Alice are still talking. Does this "protocol" have any use? Can anyone link where in Bruce Schneier's Applied Cryptography, something like this comes up? It looks familiar but I don't see how it's practical.


texts:
Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work?

Normally it's done like this:

What if we instead do this:

Seems like it should be more or less the same thing in the end?


texts:
I'm studying Certificateless Cryptography and specifically I'm studying a scheme without pairings.

I read a lot of time this paper (https://www.sciencedirect.com/science/article/pii/S0898122112002490) but I am concerned about some issues in the paper.

Basically, during the key agreement procedure, when the user $B$ receives the first message, how can is possible for $B$ to know that the public key $R_A$ (along with $ID_A$) sent by the user $A$ is authentic (and belongs to $A$)? Furthermore, how can is possible demonstrate that is calculated starting from the Master Public Key of the Authority?

Ok, the key agreement works but who guarantee me that it is not a MITM attack?

Furthermore, how B retrieves $P_A$ to generate the key $K_{BA}^2$ if $A$ did not send it in the $M_1$?


texts: Conditions for proving that a signcryption scheme is secure

texts: If I'm able to prove that any scheme satisfies confidentiality ad unforgeability conditions, will it be a valid signcryption scheme, without explicit signature and encryption parts ?


texts:
Simple version:

Create software that takes a database of the dictionary, alphabet, and phrases. Randomly generate a database of random strings of letters/numbers/symbols of varying length. Randomly assign different strings to different words/letters/phrases.

Frequency analysis should already be hard because you're operating at a higher level than letters. But to make it more difficult, randomly assign multiple strings to the same word.

Throw in a good assortment of null strings for good measure. Certain strings would indicate that X number of strings following it are to be discarded, or various strings could indicate to disregard everything in between, thus adding gibberish to the mix.

Sophisticated version:

Create multiple versions where the same strings are assigned to different words/letters/phrases across each version. Have strings that signal that the following strings are to be interpreted with a certain version. A single version could be used for a whole message, or it could be changed throughout the message.

For example, in one version, f&1nl8(a#v4 could mean car.
In another version it could mean mountain.

Suppose v19g31dfs meant use version 13.
Then f&1nl8(a#v4 v19g31dfs [...] f&1nl8(a#v4 would appear to repeat the same word.

Assume that the software is secure, and the only means of attack is direct cryptanalysis on intercepted messages.

Question:

How secure would this code be against cryptanalysis?


texts:
The algorithm:

I have to determine if the following algorithm is secure:

$p,q \in \mathbb{P}$

and

$N = p \cdot q$

$e \in [2, N - 1]$ such that $\gcd(e, N) = 1$

$r_1, r_2$ are random numbers in the range $[2, N - 1]$

$a_1 \equiv e^{r_1(p-1)} \pmod N$
$a_2 \equiv e^{r_2(q-1)} \pmod N$

The public key is $(N, a_1, a_2)$ and the private key $(p, q, r_1, r_2)$

We encrypt a message $m$ as follow:

We take two random integers $s_1$ and $s_2$ in the range $[2, N - 1]$

$d_1 \equiv {a_1}^{s_1} \pmod N$
$d_2 \equiv {a_1}^{s_2} \pmod N$

Then we compute:

$c_1 \equiv m \cdot d_1 \pmod N$
$c_2 \equiv m \cdot d_2 \pmod N$

$(c_1, c_2)$ is the cipher text.

How to recover the message $m$ without the private key?

What I tried:

First, we can decrypt a message (with private key) by using Fermat's Little Theorem.

I tried to compute $\gcd(c_1 + i \cdot N, c_2 + i \cdot N)$ as usually $d_1$ and $d_2$ are coprime.
I found that we can have a linear relation between $a_1$ and $a_2$ (i.e. $\exists k \ a_2 \equiv ka_1 \pmod N$) same for $c_1$ and $c_2$


texts: What is an Intuitive Explanation for the Sha-2 Hash algorithms?

texts: I know the needs of a basic cryptographic hash function (one way, collision unlikely, and minor changes in input are likely to produce major changes in output) and I can read the code for Sha-2 (it is only about 100 lines long or so). However, I have no idea what, and can find nobody who can explain, the intuition behind the algorithm. Why does the Sha family satisfy these requirements? I understand that "why" questions can be difficult to answer, but there needs to be some rhyme or reason behind its implementation.


texts:
Few homomorphic encryption schemes like Paillier , Ring-LWE support homomorphic multiplication operation by a scalar apart from additive homomorphic property.

Loosely they could be defined as below

$ Additive : Dec(Enc(a)+Enc(b)) = (a+b) $
and
$ MultiByScalar:  Dec(Enc(a)\times b) = a \times b $

Is this any class of homomorphic encryption schemes that supports only these two functions ?

Not sure if they could be called Partial Homomorphic Encryption(PHE) or Some What Homomorphic (SHE) schemes.

Side notes: I saw that few papers are referring $MultiByScalar$ as $absorb$ function too.


texts: Is this algorithm good enough for small radio messages?

texts:
This question is related to:

How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?

I am looking for a message that an attacker listening to the radio trafic will need at least 2 weeks to break it.

I came with this solution:

1 byte header
3 bytes UMAC
4 bytes Nonce (incremental number)
8 bytes data (encrypted with TEA)

Each party has its own keys for UMAC and TEA already known by the other party.

I would like to use the wiki umac implementation which has about 30 lines of C code and the wiki TEA implementation with 10 lines for encryption and the same for decryption. The small code is very helpful with my tiny microcontroller ram/flash size.

So, is it enough for my requirements? Can the message size be further decreased by implementing umac for unencrypted data and then encrypt umac+nonce+data altogether?

Edit - Clarifications on creating the message:

Compute TEA encryption for the 8 byte data with TEA key.

Compute UMAC with umac key and nonce for the previous encrypted data.

The keys don't change.


texts: Trying to understand the constant factors (19 and 38) in Ed25519 ref10 function 'fe_mul'

texts:
I would like to transpose the Ed25519 ref10 implementation to a similar twisted Edwards curve that is based on another prime, in order to have the same speed optimizations in place for the new curve. Most of the code is not too hard to understand.

However, I don't understand what is going on in the function 'fe_mul', where there are several multiplications by constant factors like 19 and 38.

Can somebody please give me a hint where these constants are coming from? Many thanks!


texts:
If $m^{ed} \bmod n = m$ for message $m$, public key $e$ and private key $d$, then adding any integer multiple of $n$ to $m^{ed}$ still equals $m$ modulo $n$.

Supposing it exists, how do I find an equivalent key, d', such that $m^{ed'} = m^{ed} + kn$?


texts: How to interpret a formula from the handbook of applied cryptography

texts: In the handbook of applied cryptography, we can find the following formula for testing PRNG. My question is what does mean 2 in the upper index of the n_00 and others? It is not power because then the formula does not make sense.


texts: Cracking a PRNG by observing ranks within groups of its output

texts:
Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case).   I've read: "[...] observing a sufficient number of iterations (624 in the case of MT19937, since this is the size of the state vector from which future iterations are produced) allows one to predict all future iterations."  This also got into how to actually crack it: Cracking Random Number Generators - Part 3

What if, instead of peeking at random numbers from the generator, you saw repeated rankings of the random numbers?  As an example, the generator repeatedly produces vectors of 100 ranks for 100 uniform 0-1 numbers:

first 100: (47, 22, 1, 12, ...)
second 100: (18, 44, 99, 24, ...)

How much would this slow down the cracking process?  I feel that this has a pretty precise answer, but I have no idea how one would even get started with the analysis/math.


texts:
From SRP section 3:

  The host stores user passwords as triplets of the form

{ <username>, <password verifier>, <salt> }

  Password entries are generated as follows:

<salt> = random()
x = SHA(<salt> | SHA(<username> | ":" | <raw password>))
<password verifier> = v = g^x % N

  Where g and N are agreed upon in advance.

They claim resistance against server compromise, but if an attacker gains access to the password verifier v, how much work is required per guess, to perform an offline brute force dictionary attack?

If I'm not mistaken, the work required for each password guess is two iterations of SHA, and then raising a single large exponent, and computing a single large modulo-division. This is not comparable to pbkdf2, bcrypt, scrypt, or similar, and probably shouldn't be considered a strong enough rate-limiter to protect a low entropy password.


texts:
If I have the unencrypted text and the encrypted text, can I calculate the key?  It seems logical based on my limited knowledge of encryption that I should be able to... but it also seems like too obvious of a vulnerability for it to be possible.

Could someone explain how encryption schemes prevent against this type of vulnerability?


texts:
If given a large set of examples of cyphertext and corresponding plaintext, could AI be trained to decrypt a cyphertext as the examples provided?, and if so, are there any examples online demonstrating this?

For example, lets imagine out cypher is a simple 7-shift ceaser shift, and we have a list of thousands of examples like so

olssv,hello
ifl,bye
dvysk,world

Could a neural network be trained on these examples, and then shown a new cyphertext, not in the training set, such as "isbl" and correctly infer the result as "blue"?


texts:
SHA384 is a hash function that can be (and is) used to verify data by checking it. Can it also be used as the background for a public-key crypto system? Here is what I mean:

A 48-byte string is generated randomly. This is the private key.
That 48-byte string produces another piece of data through SHA384: the public key.
The keys can be shared secretly by exchanging keys (example: Alice tells Bob her private key and it is encrypted with her public key.)

I want to know if this is possible because RSA is currently secure but can be broken by quantum computers in the future. Quantum computers can factor large primes but they can't break hash functions. Also, I picked SHA384 because it can't be broken with a quantum computer.