texts: Discovering private exponent from public key

texts:
I'm going to assume this isn't possible, but I have to ask because I'm trying to fundamentally understand what I've thus far been trying to implement by following an RFC.

SRP-6a starts off with declaring that I should choose $N$, a sufficiently large prime, and $g$, a generator.  Let's say $N$ is 1024-bits and $g$ is 2.  A sufficiently random number $a$ is generated.  For arguments sake I chose the length of $a$ to be 128 bits.  My public key $A$ is then given as $g^a \bmod N$.

Now, assume that I'm the server (or in this case I'm just trying to debug an SRP-6a protocol), and I receive $A$.  Since I know both $g$ and $N$, can I determine $a$ (in a reasonable amount of time). I'm guessing absolutely not, but it would be nice to know precisely why.


texts: How will Cryptography be changed by Quantum Computing?

texts:
I realise this isn't a 'yes or no' question, and I apologise for asking something that could be seen as a discussion thread, but I had to ask.

I'm currently doing an EPQ in CS (specifically how QC will change Cryptography). I'm trying to gather up topics to cover, and so far I've scribbled down -

Effects -

National security, classical cryptographic methods (RSA, DSA, AES-256). Including Shor's algorithm.
Communications
Online services, e.g. BitCoin.

How would we counter this (not sure how better to phrase this) -

Lattice-based
Multivariate
Hash-based signatures
Code-based cryptography

Is there anything else you'd recommend me including (as well as the above), or anything in the above you don't think I should include?

Honestly, the list above is a rough, first draft the main bulk of it... so don't it as gospel.

Best regards,

Cameron.


texts: Can the XOR of two non-collision-resistant hashes be collision resistant?

texts:
Suppose I have two hash functions, of which neither (or only one) is collision resistant, and I want to create a new hash function by taking the bitwise exclusive or (XOR) of the results of those two functions.

Is it possible for this new function to be collision resistant? I suppose not, but I'm not sure why.


texts: Impossibility of recovering the key of a keyed pseudorandom permutation

texts:
I'm currently working on some cryptography homework, but I'm stuck on this particular question.

Let $F$ be a pseudorandom permutation with identical key length and
block length (both equal to the security parameter $n$).
Prove that there is no probabilistic polynomial time algorithm $\mathcal{A}$ that, on input
$1^n$, and based on $n$ queries to $F_k(\cdot)$ (with
$k \leftarrow \{0, 1\}^n$), recovers $k$ with probability $1$.

My initial idea was to prove this by considering the statement that for any family $F$, there must be some pair of keys $k, k'$ such that $F_k(x) = F_{k'}(x)$ for all $n$ queries $x$, and at some point using the bijectivity of pseudorandom permutations, but so far I've not managed to arrive at a proof. Does it make sense to prove this statement in that way, or is there something else I should think about? Thanks in advance.


texts: Applicability of birthday attack to AES brute force

texts:
Is the following snippet from a recently published cryptography book correct?
EDIT: Expand the snippet from the book to make the context (symmetric key search) more clear.

You can apply this to other cryptographic issues as well. Let's return to the DES algorithm.  Recall that it has 72,057,594,037,927,936 possible keys. To guarantee that you find the correct key, you may need to check all 72,057,594,037,927,936 possibilities.  However, if all you are seeking is a greater than 50 percent chance of finding the right key, you can try $1.774 \sqrt{72,057,594,037,927,936}$ possible keys -- only 476,204,499 possible keys. This is far more manageable.  In fact, again referring to our earlier scenario with DES, if you can attempt 1 million keys per second, you have a 50 percent chance of finding the right key in 7.9 minutes.  Although 1 million keys per second is beyond the capability of your standard personal computer, it is well within the capabilities of supercomputers or even computing clusters.
The birthday paradox is one reason why larger key sizes are necessary
for security.  If we move our attention from DES to an AES 128-bit
key, there are approximately $3.402 * 10^{38}$ possible keys.  Applying
the birthday paradox gives us $1.774 * \sqrt{3.402 * 10^{38}}$, or
32,724,523,986,760,744,567 keys that need to be attempted to have a 50
percent chance of finding a match.  This number is large enough that
it is computationally infeasible to break it through brute-force
methods, even with the birthday paradox.


texts: ECDH, x25519 and limitations for securing client-certificates on the server

texts:
g'day Crypto.SE

I'm working on a practical application of sharing a static key to better-identify a user, between the recipient (server) and the initiator (client ie. user's machine).

My core question is:

For x25519, can multiple PK's resolve to a single SK, or is there ever only one unique PK-SK pair?

I'm wondering whether it's rational to think of x25519 public-keys as holding an "almost" equal share in securing information? By "almost" equal, I mean that I can always derive the PK from the SK.

If I didn't have the PK or the SK, would I be able to produce a message that matched an SK at better probability than a brute-force guess across (half?) the x25519 key-space?

My original q, slightly re-worded and still bl**dy confusing, sorry!

Without either the PK or SK for an x25519 key-pair, is there a greater probability that I can encrypt a message for an unknown SK, than I would otherwise have being able to determine the SK from the PK (if I had the PK).

Specifics for my application handshake is here:

Handshake protocol that uses x25519 and Argon2 to secure user secret-keys on the server


texts: libSTARK TinyRAM private inputs (Zero-knowledge proofs)

texts:
I am looking into libSTARK and specifically TinyRAM and I cannot find out how to provide private inputs in a TinyRAM program. As private input I mean a variable that only the prover knows; i.e. the verifier has zero-knowledge of it.

In the DNA profile match (DPM) example that is described in "Scalable, transparent, and post-quantum secure computational
integrity", both the DNA fingerprint database and the suspect's fingerprint are supposed private. However, the DPM example is not implemented in TinyRAM and there is no TinyRAM example with private inputs. Also, by looking at the code, I could not find a command or a way to "hide" the value of a specific variable from the verifier.


texts: Cracking simple RSA when just the ciphertext and one public key is known

texts:
Can someone explain to me (Or better yet, point me to a tool that does the brute forcing) how to crack a standard, simple RSA cipher (So don't bother with padding) if I know just one public key, the ciphertext, and some text that I know for sure is part of the plaintext?

Please don't point me to the Wikipedia article or something, I'm trying to get a simple explanation that is fully understandable.


texts:
I'm analyzing a binary which for its AES encryption, its only calling aeskeygenassist once and for the last argument (imm8, the round) its sending static value of 0x46.

Does this mean its using only one round of AES key derivation? Does this make the crypto implementation vulnerable?

If yes, how? How can we recover the encrypted data? Let's say it's in use in a malicious app and if the code is vulnerable I want to recover encrypted data.


texts: plain textbook RSA signature with a fixed format input

texts:
We have an old system using the following algorithm related to authentication:

input: a fixed format integer (hex): <user-id>0000f000<device-id>

user-id: 4 bytes
device-id: 4 bytes

algorithm: textbook RSA 2048, sign with (N, d).

and assumes that an attacker can request limited times (5 times per account per day) with arbitrary device-ids, or try with different user-ids.

Update

sign with (N, d), not (d, e), already updated above;
the background is, logged-in users can apply for usage of a device, if the device is not in use, the user will get a QR code containing the info of the signature. The device will check it (user-id and device-id), if succeeded, the device will unlock automatically.

Question: is it possible that an attacker without login can generate a QR code to unlock any device (device-id is right on the device, and is a random number each time)?

by the way, the device does not deserve much cost. We consider it is not safe when there is an easily-adopted hacking method. And also ignore the case that one can remember the corresponding QR code.


texts:
I'm trying to understand the Gram-Schmidt Orthogonalization process. Below, there is an explanation that a lattice basis can be described by an upper triangular vector.

It is often convenient to rotate our coordinates to that the Gram-Schmidt vectors are aligned with the standard basis. In these coordinates, our basis $(\pmb{b}_1,\dots,\pmb{b}_n)$ becomes upper triangular, $$
    \begin{pmatrix}
    \lVert\widetilde{\pmb{b}}_1\rVert & \mu_{1,2}\lVert\widetilde{\pmb{b}}_1\rVert & \mu_{1,3}\lVert\widetilde{\pmb{b}}_1\rVert & \cdots & \mu_{1,n}\lVert\widetilde{\pmb{b}}_1\rVert \\
    0 & \lVert\widetilde{\pmb{b}}_2\rVert & \mu_{2,3}\lVert\widetilde{\pmb{b}}_2\rVert & \cdots & \mu_{2,n}\lVert\widetilde{\pmb{b}}_2\rVert \\
    0 & 0 & \lVert\widetilde{\pmb{b}}_3\rVert & \cdots & \mu_{3,n}\lVert\widetilde{\pmb{b}}_3\rVert \\
    \vdots & \vdots & \vdots & \ddots & \vdots \\
    0 & 0 & 0 & \cdots & \lVert\widetilde{\pmb{b}}_n\rVert
    \end{pmatrix}
$$

I cannot figure out this representation. How does our basis vector become this kind of matrix? And when will we use this representation?


texts: Stream cipher -- Are all random bit generators suitable for stream cipher?

texts: I learned the stream cipher using LFSR in the book. I wonder whether all random bit generators (i.e. BBS, Rabin generator) are suitable for stream cipher. I search using keywords "stream cipher" and "BBS", and there are few results.


texts: How distinct are the meanings of the terms "CSPRNG," "DRBG" and "stream cipher"?

texts:
Are there universal, consensus definitions for the following terms?

Cryptographically secure pseudo-random number generator ("CSPRNG")
Deterministic random bit generator ("DRBG")
Stream cipher

This is primarily a question about the terminology rather than the concepts (although I do not master the concepts by any means either).  My confusion arises because:

I recall seeing some reference (that I can't find again now) which equated CSPRNGs and stream ciphers, due to the fact that expanding a finite key to a long, secure keystream is basically the same problem as generating a long cryptographically-secure pseudo-random sequence from a short seed.  So correspondingly, stream ciphers are sometimes used as PRNGs, as in for example Rust's ChaChaRng.
The term "DRBG" appears to be mostly used by NIST in connection with their SP 800-90A algorithms, and which stresses safety against adversaries who can observe the state at one point in time.  The key concepts here, as I understand them, are forward secrecy and periodic reseeding from external entropy sources.
The term "CSPRNG" apparently gets used in both senses (see for example the answers to this question).


texts: Can someone explain me in basic simplistic english if possible how does McEliece asymmetric encryption works and why its quantum safe ? Thanks in advance.


texts: What's the difference between polylogarithmic and logarithmic?

texts:
I can't imagine one that is not polylogarithmic
but logarithmic.

$O(\log N)$ satisfies both.

What about $O(\log^{3}N)$, $O(\log^{100}N)$, and  $O(\log^{10000}N)$ ?

Let's say $N=10^{10}$


texts:
I seeing a paper about Elliptic curve based proxy re-encryption.
And I want to implement this through BLS12-381 Curve.
However, When looking at the documentation for paring or the library, the value of $F_{q^{12}}$ is output as the output of pairing.
The paper requires:

Let e : $G_1$ × $G_1$ → $G_2$ be a bilinear map, z = e($G_1$, $G_1$) ∈ $G_2$
And need to compute (zrG + Pm)

How can I multiply z in $F_{q^{12}}$ and $rG$ Point in $F_{q}$from "$z$ $rG$"?
Should I replace $F_{q^{12}}$ with $F_{q}$? If so, how?
And please let me know what to look for to get relevant knowledge.


texts: Can the Smart-Vercauteren Homomorphic Encryption be implemented as a practical fully homomorphic encryption scheme?

texts:
Smart and Vercauteren proposed a homomorphic encryption scheme (PKC 2010) following Gentry's principles.  Though their scheme can achieve fully homomorphism theoretically, they admitted that "for practical values of n our scheme cannot be made fully homomorphic" (p. 16).

However, perhaps the only (see update 1 below) public fully (not somewhat) homomorphic encryption implementation libScarab, is claimed to be using the SV scheme.  The authors of that library also have a paper "POSTER: An Implementation of the Fully Homomorphic Smart-Vercauteren Crypto-System" (CCS'11) about their implementation.

There are several parameters chosen differently in the latter paper
from the original paper, maybe for achieving full homomorphism. But they did not explain the security of their choices, and I cannot figure out it by myself.

So my question is, can libScarab be viewed as a serious secure FHE implementation?

Update 1 (18 Nov 2015)

I've found there are two other public fully homomorphic encryption (including bootstrapping) libraries (HELib and FHEW) released by illustrious cryptologists Shai Halevi / Victor Shoup and Leo Ducas / Daniele Micciancio. Both are slower than libScarab, but I think they supply more security.


texts: Number of unique outputs in hash function (SHA256) against all possible inputs

texts:
If I use SHA256 as a hash function, and I try all inputs starting from 0 to 2^256 (means all possible combination of 256-bit), then will it give me 2^256 unique output without any collision?

Or in other words, does 2^256 different inputs maps to 2^256 different output in SHA256?


texts: Why does side-channel security focus on “shielding” rather than “jamming”?

texts:
I have always found it weird when in a crypto discussion people stressed the importance of making algorithms runtime-deterministic, to the point of avoiding any compiler optimisations.
To me, it seems that it's from the start futile to try and completely avoid side-channel information leaking out. Even if an algorithm always takes the same number of processor cycles: the processor is ultimately a coupled bunch of wires, and any signal passing through anywhere will inevitably couple to output connectors in the form of clock jitter, power-supply sag, etc.
The real question seems to be not whether information leaks out but whether the secret pieces of information will be possible to reconstruct. Granted, minimising leakage does always make this more difficult, but it is only one factor. In isolation, even a very small signal can be analysed.
Physically speaking, the crucial quantity is the signal-to-noise ratio: if a little bit of signal comes out on a given channel but also a whole lot of random noise, and you have no a-priori way of telling them apart, then extraction of the secret becomes exponentially inefficient.
In particular, for timing attacks, I think it would be a much better approach to not try and make the timing completely deterministic, but instead to make it deliberately completely nondeterministic. The simplest way would be to let the processor randomly intersperse the crypto calculation with nonsense boilerplate instructions (ideally, triggered right at the hardware level with a shot-noise source). The attacks I've read about seem rather delicate and would fail even if only part of the attacker's timings were foiled.
More sophisticated schemes might instead randomise the order of instructions or quickly multitask between many unrelated computations.
All such methods would incur some performance penalty, but it would likely be offset if we were again able to optimise our code without reservations. And we would be safer than with the approach of trying to eliminate any side-channels from forming in the first place. Processors are so complex that there will always be side-channels that weren't discovered, but the outside connections are better to oversee. If, without exception, all connections to the outside are thoroughly jammed, it doesn't matter what side-channels are open inside because only the public signal is strong enough to stand out over the noise floor.
What am I missing? Are these just my thoughts as a physicist and inapplicable to cryptography for some reason?


texts: Testing if a password for an eCryptfs mount is valid

texts:
I'm using "eCryptfs" on several directories on my dedicated Debian server. I mount them manually via

mount -t ecryptfs [dir] [mountpoint]

But after some weeks being mounted it's not easy to remember the exact passwords for each directory. I want to make sure that I got the right passwords before unmounting them or rebooting the server.

I thought of generating an "eCryptfs" signature and comparing it with the directory's "eCryptfs" signature. Which parameters do I need to know and what is the algorithm for the "eCryptfs" signature? And is this the right way to verify my password?


texts: CAs are pre-loaded on the system, but how is it able to get intermediate certs?


texts: The modes of encryption that preserve the format

texts: Can anyone give me some documentation on the various format preserving encryption modes?


texts:
Suppose Bob wishes to send an encrypted message $M$ to 4 people $P_1,P_2,P_3,P_4.$ Each one has their own RSA key $(N_1;e_1),(N_2;e_2),(N_3;e_3),(N_4;e_4)$.

The encrypted messages are $C_i=M^{e_i}\bmod{N_i}.$

The $e_i$ are pairwise distinct (per comment).

How to decipher the original message $M$ ?


texts: I'm just going by this diagram of KeeLoq encryption and it resembles these diagrams of Crypto-1 and Hitag2. I'm wondering how it is a block cipher. If it is one and that diagram represents most or all of its design, then it is a very exotic block cipher.


texts: Should the seed of CSPRNG produce the same random number?

texts:
Assume we are designing a CSPRNG to be used in encryption like that used for ECC-based cryptography.

Is it required that the seed always produces the same random number always? Or should it be  designed to produce different numbers, making it even more secure?


texts: Post-quantum crypto based on undecidable problems

texts:
Usual post-quantum crypto, like the isogeny-based algorithm, has its value lying in that no one yet has found a quick way to break it with quantum computer. This makes me wonder why don't we build post-quantum crypto based on undecidable problems? Yes, in some case quantum computers can be much faster than traditional ones, but they are still weaker than Turing machines, which can not solve the undecidable problems.
What's the difficulty and why few people consider it?


texts: Choice of bilinear group for implementation of BLS signature with NIWI proof?

texts:
I am trying to sign the multiple (millions of) different readings but the receiver should not be able to link multiple signed readings together (unlinkability) or with the identity of the signer (anonymity).

As a potential solution, the sender sends the reading $m$ along with non-interactive witness indistinguishable (NIWI) proof of knowledge (PoK) of signature on $m$. I am looking at certified signature scheme where CA certifies the public keys of legitimate signers. The signer signs the reading $m$, generate NIWI proof of knowledge of his/her signature on the reading $m$ and sends ($m$ and the NIWI proof) to the receiver. I want to use BLS signatures as the signature is one element in $G_1$ (and the signature size can be as short as 161 bits). BLS signature scheme uses gap Diffie-Hellman (co-GDH) groups $(G_1,G_2)$ of prime order $p$, where co-DDH is easy but co-CDH is hard.

Now, in order to construct proof of knowledge of BLS signature, I want to use the Groth and Sahai's NIWI proof in Efficient Noninteractive Proof Systems for Bilinear Groups which can be constructed based on one of the three assumptions:

sub-group assumption
SXDH assumption
DLIN assumption.

I am confused, which assumption can I make for generating NIWI PoK of BLS signature?

Q1. Can I use SXDH assumption based NIWI PoK i.e. is it valid to simultaneously make co-GDH and SXDH assumptions on the group pair $(G_1,G_2)$?

Q2. DLIN based NIWI proof will require me use symmetric pairings for BLS signatures. Is symmetric setting suitable for secure and short BLS signatures?

Q3. Can I use subgroup assumption for NIWI PoK of BLS signature? as $|G_1|=|G_2|= p$.


texts:
Reading about triple DES and understanding the principles, I am still curious how Firefox defines their three keys for the encryption/decryption.
Suppose that the user saves his passwords in the browser without a master key, are the default keys randomized and saved to the separate file?
Also, if the user enters a master key for the encryption, which of the three keys will the master key be and why?

I'm a developer myself and technical details in a programming sense would be greatly appreciated.

I've been fooling around with a helper I found for cracking passwords in FF and added it to my program, but it really bugs me that I have no real knowledge what is going on.

Thanks, please don't flame me too much!


texts: Repeatedly using same key on different plaintexts

texts:
Symmetric encryption:  Does using the same key over and over again introduce a vulnerability?

Meaning, if I transmit a different piece of plaintext encrypted with the same key every day, will an attacker eventually be able to deduce the key?  (In what lengths of time?)


texts: How many blocks can securely be encrypted with XTS

texts:
I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES.

Through the recommendations, I've found:

  The length of the data unit for any instance of an implementation of XTS-AES shall not exceed $2^{20}$ AES blocks.

The specification cited in NIST The XTS-AES Tweakable Block Cipher states:

  The number of 128-bit blocks in the data unit shall not exceed $2^{128}-2$. The number of 128-bit blocks should not exceed $2^{20}$.

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk's capacity).


texts: Why was WEP apparently not reviewed by many cryptographers?

texts:
According to this analysis of WEP,

  These attacks point to the importance of inviting public review from people with expertise in cryptographic protocol design; had this been done, the problems stated here would have surely been avoided.

It is my understanding that the design flaws of WEP were well known from its beginning. In WEP’s design process, why were no people with sufficient “expertise in cryptographic protocol design” involved in the creation of a cryptographic protocol intended for broad adoption?


texts: Paillier can add and multiply, why is it only partially homomorphic?

texts:
I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme.

I've read here in another answer that:

  "...there are many known partially homomorphic cryptosystems, each one
  can either multiply or add numbers."

Now here on some interactive webpage allowing to test Paillier here:

mhe.github.io/jspaillier/

I can do [(A+B)*C], hence doing both addition and multiplication (?).

Why is Paillier not fully homomorphic seen that it can do both addition and multiplication?


texts: Recommended way to Implement One Time Password?

texts:
I need help with the process/commands needed to implement the below functionality:

I'm modeling an OTP System, in which the user would request an OTP and the app will send him one. Later the user will use the OTP to use some functionality or something, and the OTP needs to be validated.
Constraints:

The OTP cannot be stored in the Clear.
Need to use Thales payShield 9000, that I have available, sending HOST COMMANDS.

This is the process:

App A request an OTP using a User Account
App B Generates the OTP for that User Account and send it to App A
App B Can't store the OTP in clear, so it must use the HSM to, in some way, store the OTP that can be validated later
App A, later, sends the OTP to App B which validates it (using the HSM) and then procedes to send the approval to App A

My apologies if this doesn't make sense, and I don't have idea what I'm doing.


texts: Why does HS1-SIV allow forgeries when the SIV collides, even when the PMN does not collide?

texts:
The HS1-SIV authors claim that forgeries are possible if an SIV collision occurs.

However, I do not understand how this is possible unless the PMN collides too.  Otherwise, the collision  will be in the output of a PRF and will not be useful to the attacker unless the SIV is being used as an index or the like.


texts: Davies-Meyer without XORing in the previous state

texts: A Davies-Meyer ccompression function operates with $H_{i} = E(m_{i}, H_{i-1}) \oplus H_{i-1}$. Why not use $H_{i} = E(m_{i}, H_{i-1})$ instead?


texts: Encryption with two meanings without computer or programming

texts: Can one create a cipher with two meanings? Not two layers, two phrases in the same cipher in the way that it would have a meaning X, for example, if deciphered using Transposition cipher and meaning Y if deciphered with the Playfair chipher. Is it possible?


texts: concerning collision-resistant hash function

texts:
Let H, H' be collision-resistant hash functions. Which of the following functions H'' is NOT
necessarily collision-resistant?

1) H''(x) = H(H'(x))

2) H''(x) = H(x)||H'(x), where || denotes concatenation.

3) H''(x) = H(x)||0...0, where || denotes concatenation.

4) H''(x) = H(x) xor H'(x)

My conclusion is the following:

1. H(H'(x)) is the collision resistant as H(x) is collision resistant thus it will return the output as collision resistant.

2. In this there is concatenation of two collision resistant functions thus the output will also be collision resistant.

3. It is also collision resistant as this is just concatenation of collision resistant and 0.'s thus it will also be collision resistant.

4. As H''(x) is the XOR operation thus there could be chances that result of both of them would be same due to which it will always return 0.

Thus it may not be collision resistant.

I appreciate if experts correct me if i am wrong.


texts: How can create a proof that we have a sequence of binary digits?

texts:
Given a sequence of bits (either a 0 or 1), for example:

0110100110110001

How can one create a proof that we have this bit sequence, without actually revealing the bit sequence?

I know that there are several examples of proof mediums, such as polynomials for zk-SNARKs, however, how would one go about defining a proof medium for the above question?

EDIT: This bit sequence is derived from some input x which passes through some arithmetic circuit C in which a set of environmental conditions (i.e. delay) determine the propagation through paths, such that (for example) the first path to the goal will be associated with a 1, else 0, which ultimately make up a sequence of bits.


texts: Problems with Matsui's Linear Cryptanalysis on round reduced DES

texts:
I'm trying to understand the known plaintext attack that is briefly explained in the paper Linear Cryptanalysis Method for DES Cipher by Mitsuru Matsui. I've almost understood it (since I'm programming it and it's yielding good partial results) but there are some things I'm not understanding completely.
If I'm not mistaken, for the 4 round attack, Matsui uses a 3 round DES linear approximation, decrypts the final round and expresses that linear approximation using plaintext bits, ciphertext bits and the bits from the $F(C_R,K_4)$ being $C_R$ the right part of the ciphertext and $K_4$ the 4th subkey derived by the DES key schedule. This way, and since only one bit of $F(C_R,K_4)$ is used in the expression, only one S-Box affects it, so we can get those 6 bits using Algorithm 2. Furthermore we can get a 7th bit by the right part of the linear expression using Algorithm 2 too. Now we have 7 bits of the 56-bit key, and in order to get 7 more we do the same but instead of decrypting the last round we encrypt the first one, expressing the three remaining rounds with the same linear expression but this time using $F(P_R, K_1)$, and that gives us another 7 bits. The problems I'm having are:
1- If I haven't programmed it wrong, at least one bit of the key (after inversing the DES key schedule) is in both of the sets of 7 bits, so it gives us with only 13 (not 14) effective bits of the actual key. Where do I get the 14th bit Matsui says?
2- Even if I get 14 bits, how am I supposed to get the rest of the bits? In the paper he says that "It is easy to deduce the remaining key bits, and we omit the detail", but honestly I have no idea on how to do that beside the obvious way of bruteforcing the 42 bits, that I think it's completely unfeasible.
Any guidance would be welcome.


texts: Security of AES CTR with multiple messages containing the same known plain text

texts:
I have this scenario:

The same plain text (that is part of an unkown bigger message) is being ecrypted multiple times using AES 128 CTR with a random key, the key is being transfered encrypted using RSA public key.
For example:

(www.myBlog.com, some_random_text)

The location and the content of the plain text doesnt change.

Is there a way to break the AES? ( Assuming I know the plaintext)

I have full man in the middle.


texts: Is EFS vulnerable to chosen plaintext attack?

texts:
I have some backup files encrypted with EFS, but I lost the EFS certificate--thus I am unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key (not sure how it's calculated) and then attach it to the file so later using the private key you can decrypt the symmetric key and thus use it to decrypt the file. I understand that this symmetric key is usually AES or a mix between other encryption algorithms such as SHA and ECC.

I do have full file binaries from before the encryption was done, and I still remember the Windows password and username used at the time of encrypting the files.

My question is: using this information, can I deduce the symmetric key directly without knowing the key pair?


texts:
how can we prove that if there is a secure PRG then P!=NP or in reverse order?(is there any reduction?)

a secure PRG is a pseudo random generator that for every eficient (running in probabilistic polynomial time) statistical test algorithm A , A cannot distinguish PRG from a truly random generator with a non-neglogible advantage.

"Negligible" means "within $O(2^{-p})$" where p is a security parameter associated with the algorithm.

I know that we must use a reduction. reducing P!=NP to existance of PRG or reverse.but how to reduce?

suppose we have a secure PRG , then for every "eff" adversary A , A cannot distinguish PRG from a truly random function with a non-negligible advantage. so it implies that there is no polynomial time algorithm to solve it without having the key. and it shows that P!=NP.

Is my reduction correct?


texts: If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?

texts:
AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly to another suitable one:

how can we be sure it will still be protected against DCA and LCA attacks?
can we show it is still protected against DCA, LCA and other attacks without having to test large amounts of data? If so, how?
how, if at all, would this change other parts of the cipher (e.g. MixCols)

I have tried to find clear answers on this but they seem hard to come by. Many books have merely asserted that changing the irreducible poly (to one of the other 29) would not adversely affect security, but I cannot find a clear reasoning.

A simple answer with clear examples would be much appreciated. I am still very much a beginner in cryptography.


texts:
I am trying to create a secure Bluetooth Low Energy connection. The peripheral server (the main device other people would connect to) would need to service many clients (users) and due to hardware limitations, I would not be able to let the hardware manage security (essentially, it has a limit of 4 keys, i.e., 4 users).

I have researched and have decided on the following general scheme.

Use AES128 for encryption.  The key is held in the server and client, assuming that is done securely.

To do this, the device can generate a random "password" and make it visually appear to the user, which has to enter it on his client device (smartphone). The smartphone, which has generated the AES key would use the password to encrypt the key and send it to the device for storage.

Use SHA-256 with a cryptographic key to authenticate messages. I know that this should be done after the encryption.
Upon connection, generate an authentication key and send it to the other one.

I thought about this (not using a static authentication key), so that an attacker cannot record the messages of a session and replay that later. I guess this must be a well-known problem.
Question 1: How can the key be reliably sent from one to the other?
Question 2: Who should be the one generating this authentication key? The server device? Or the smartphone?

To know which encryption key to use, the userid could be sent in plaintext.

Question 3: Is it possible not to send userid in plaintext and still be able to understand which key to use for the communication? Does it matter?

On each message passing, derive a new authentication key from the previous one.

I thought about this, so that if an attacker hijacks a session, previously sent cyphered messages in this session would look invalid.
Question 4: What algorithm could be used to derive a new key from the old one, ensuring that the result is also a "good" key (high entropy and such)?

Use an IV to make sure the same message (a command to the server device) encrypts to different messages every time.

Question 5: Should this also change on every command similar to the authentication key?

Regarding Question 1, during the authentication key exchange, HMAC doesn't seem to be possible, so I was thinking of sending the generated key only encrypted. The other end of the communication can recover the authentication key by decrypting the message. Question 6: could an attacker be able to recover the key by pretending to be on the key-receiving end of the communication? How about if it is pretending to be on the key-sending end?

Regarding Question 2, I am inclined towards having the smartphone generate a key, as it probably has better access to cryptographic libraries (as opposed to the device, which runs on a microcontroller).

Regarding Question 3, I cannot see a problem with an attacker knowing which userid the communication is established with. A system with multiple users with visible ids is, I think, as secure as a system with a single user. Then again, I'm not a security expert.

Regarding Question 4 and 5, I am guessing a pseudo-random number generator seeded with the authentication key/IV should do.


texts: decrypting a one-time-pad that outputs 0,1 in preknown probabilities

texts:
assuming a two users want to use a one time pad ciphersystem, and they are using a program that was developed by a third party that was supposed to create random undependable bits, but for some reason it tends to output 1 in probability of 70% and 0 in probability of 30%.

does it make the one time encryption not perfect mathmatically?

my assumption that yes, because $p(P=p | C=c) = p(P=p)$ is not always true here. for an edge case, if most of the bits are 0 then after xoring, the encrypted bit is equivalent to the decrypted bit in most of the bytes. if the message is in english for instance, it's just fixing spelling errors.

but my problem is not intuition, but mathmatics: how can i show that $p(P=p | C=c) = p(P=p)$ is not always true and that in the given case the cryptosystem is not perfect?

this is what i've done so far:

the probability of generating 0 is 0.3. this is the first event, A.

the probability that there are k zeroes in a string consists of n characters: $0.5\left(\binom{n}{k}\right)\left(0.3^k\left(1-0.3\right)^{n-k}\:+0.3^{n-k}\left(1-0.3\right)^k\right)$, meaning since we can choose from {0,1}, then it's 0.5 * choosing k characters from a message with length n knowing there can be n-k or k zeroes in the message cipher, this is event B.

so the probability of having k zeroes if there the bit is zero: $P\left(B\left|A\right|\right)=\left(\binom{n}{k}\right)\left(0.3^k\cdot \left(1-0.3\right)^{n-k}\right)$

now since $P(A|B)=\frac{P(A)P(B|A)}{P(B)}$, meaning that if we opted for  perfect security, it would have meant that $p(P=p | C=c) = p(P=p)$, but it can not be the case since $\frac{P(B|A)}{P(B)} \neq 1$

so the ciphersystem as applied here is not perfectly secure as shown.


texts: How safe is it to derive MAC key from a hashed password?

texts:
Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password and use bcrypted value as an encryption key. Using the same key for MAC purposes seems risky to me, so I reckoned I'd hash my already hashed encryption key (with bcrypt or with a less expensive algorithm) and use that as a MAC key.

Is this OK to do or do I need to have some other derivation procedure?


texts: Why can we not use the group $Z_{p}^{*}$ for cryptography?

texts: Sorry if this is a noob question, but for instance in ECDSA, we start by considering the field $\mathbb F_p$, whose the elements also form a group under multiplication. Why don't we just use this group instead of the one that is generated by the solutions of an elliptic curve equation lying in this field? I.E. choose an element lying in this field $g$ and choose a random number $n$ as a private key, and let $g^n$ be the public key. Is is just because of the reduction in key size? It seems like a high price to pay for the additional structure imposed by the curve equation.


texts: Private Information Retrieval with a pre-prepared database

texts:
Informally, Private Information Retrieval (PIR) is a protocol between a user $U$ and a Server $S$, that meets the following conditions:

$U$ obtains enough information about a database hosted by $S$, to decide which record $i$ in the database to request from $S$.
$U$ initiates the PIR protocol with $S$ and retrieves all information from record $i$, without $S$ learning this was the record $U$ requested.

The trivial PIR protocol consists in $U$ requesting the entire database from $S$, replicating it locally, and performing all queries locally. The purpose of the more elaborate PIR protocols is consequently to reduce the amount of data that has to be transferred between $U$ and $S$, without $U$ loosing this privacy.

However, from what I understand, all existing PIR protocols still require $U$ and $S$ to transfer data with a quantity that is a function of the size of the entire database, rather than a function of the size of the individual records. (If not for any other reasons, because $U$ has to obtain enough information about the database in advance, to be able to pick $i$.)

I would like to know if it would be possible to reduce the quantity of the data transmitted, by introducing a third party $TP$ and changing the game (exactly) as follows:

$TP$ obtains the long term public key of $U$. This is the only information exchanged directly between $TP$ and $U$ throughout the entire protocol
$TP$ decides what information $U$ is to retrieve, prepares it using the long term public key of $U$, and posts it to the database of $S$
$U$ requests the record posted by $TP$ by sending her long term public key to $S$. $S$ responds and $U$ decodes the response using her long term private key. $S$ doesn't learn which record was requested by $U$.

The trivial protocol that meets these conditions, would be if $TP$ performs a conventional public key encryption of the record, $U$ requests the entire database, attempt to decrypt each record in order, and picks the one that decrypts correctly.

Granted, such a protocol would, in some respects, be significantly different from PIR, so perhaps there already exists a better term for it that I am not familiar with.


texts:
In AES-192 key expansion there are 12 rounds and 52 keys.

I am not sure why 52 keys are derived since each block consist of 4 rows and 6 columns (192 bit keys).

So if the block is 4 x 4 then we simply multiply rounds with key size. 13 x 4 = 52 but here we have 4 x 6 matrix (block).

Can someone tell me why we get 52 keys in that case?


texts: CBC MAC attack using Arbitrary-length Messages

texts:
This is from a lecture :

The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...,mn,m′1⊕τ,m′2,...,m′n)
The message-tag pair( m'',τ′)is a forgery

But I don't understand why xoring the tag τ of the first message with the 2nd message gives a message whose tag is the tag of the second message.

How is first tag used to determine that the tag of m'' is τ′?


texts: Prove the size of a message in a succinct way

texts:
A party A gives me a commitment of a message $m$ and want to convince B that is $|m|=L$. The proof myst be:

Non-interactive (a prover can convince me by sending me one message)
Succint (constant or sublinear size in the length of m)

I was looking into the NIZK space but I could not think of any solution.

Note: I have a candidate which however, it really is an overkill:

  Create a SNARK proof that proves the witness: $m$ such that length is $L$ and hash is $H(m)$, where $H$ is a cryptographic hash function and $H(m)$ is public knowledge (so verifier knows)


texts: Proof that a modified public-key encryption scheme is not CCA secure

texts:
Let $\mathcal{E} = (G, E, D)$ be a CCA-secure public-key encryption scheme defined
over $(\mathcal{M, C})$ where $\mathcal{C} := \{0, 1\}^\ell$.

Let $\mathcal{E'} = (G, E', D')$ be a scheme (over $(\mathcal{M, C'})$ where $\mathcal{C'} := \{0, 1\}^{\ell + 1}$) where:

$E'(pk, m) = E(pk,m) \Vert 0$
$D'(sk, c) = D(sk, c[0...\ell - 1])$

That is, $E'$ always puts a $0$ in the ciphertext and $D'$ ignores the last bit of the ciphertext.

How can an attacker, with just $1$ query, break $\mathcal{E}'$ CCA security?

Additional information:

The query can be one of these:

Encryption query: the attacker sends a pair os messages $(m_0, m_1)$ and gets a ciphertext $c_i$ of one of them.

Decryption query: the attacker sends a ciphertext $c$ and gets its corresponding message.


texts:
I am trying to crack an unpadded RSA set up for a homework.

I have public key (R,e) and encrypted message E.

R:=1189873858375600120035497781492406260116261348762168101523668479976252918878873543993974091515716923413521166189;
e:=7;
E:=935688997292570230577548538417371291686892187342525833188430568797480485753147343888751799688783739259397891334;

Obviously, the attack that I'm supposed to use has something to do with the size of the public encryption exponent but I'm struggling to see exactly how to use it.

I understand the relationship between e, d and φ(n) and understand that there is an integer k < min{e, d} such that φ(n) = (e ∗ d − 1)/k but I don't understand how I can use that fact to brute force discover φ(n).

It appears that the solution comes from doing some kind of search from 1..k but since d is still unknown, I don't really see how to take advantage of that.

Can someone enlighten me, please?


texts: Why are these specific values used to initialise the hash buffer in SHA-512?

texts:
I'm reading the book Network Security Essentials written by William Stallings.

To create a message digest with SHA-512, we have to go through some steps:

append padding bits.
append length
initialize hash buffer
... so on.

In the book is written for step 3:

  A 512 bit buffer is used to hold intermediate & final results of
  the hash function. The buffer can be represented as eight 64-bit
  registers (a,b,c,d,e,f,g,h). These registers are initialized to
  the following 64-bit integers (here in hexadecimal values):

 a = 6A09E667F3BCC908
 b = BB67AE8584CAA73B
 ...

  up to register h.

Why are these specific hexadecimal values used, is there any particular reason behind this? I know why they are necessary, but why these specific ones?


texts: How babai nearest plane algorithm solves approximate CVP

texts:
Babai's nearest plane algorithm solves approximate-CVP (Closest Vector Problem) where the approximation factor is $2(\frac{2}{\sqrt{3}})^n$.

Let $b_1,...,b_n$ be a basis and $t$ be the target. This algorithm finds an integer $c$ such that the hyperplane $c b_n^*+span(b_1,...,b_{n-1})$ is close to $t$. Recursively, it finds a lattice point $x^\prime \in L(b_1,...,b_{n-1})$ that is closest to the projection $t^\prime$ of $t-cb_n$ onto $span(b_1,....,b_{n-1})$ and output $x=x^\prime+cb_n$.

In proof, we have
$$||x-t|| \le 2(\frac{2}{\sqrt{3}})^n||y-t||$$
where y is the nearest point to $t$.

If $||t-y|| \le \frac{b_n^*}{2}$ then $y \in c b_n^*+span(b_1,...,b_{n-1})$ and  $y^\prime =y-cb_n \in L(b_1,....,b_n)$ is the nearest point to $t^\prime$. I could not understand how $x^\prime$ is within the distance $2(\frac{2}{\sqrt{3}})^{n-1}||t^\prime-y^\prime||$ and how to prove in this case.


texts: Do ciphers with a key size of 64 bits still have use under very limited attack models?

texts:
If we have a very performance critical interactive session, like a video game, running on a trusted platform (video game console).
If our goal is to prevent exfiltration of up to date information (enemy locations, health etc) and malicious commands sent to server in a small time frame (aim botting), say ~1000ms through 1h, to prevent MITM cheating, it seems that 128 bits of protection is excessive for our threat model.
Also are there any decent, modern ciphers with a key size of 64 bits that might actually be faster than AES-NI?


texts: Shared-secret authentication with implicit session keys?

texts:
Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which enable NAT traversal.

Connection (1) P --> S, C --> S
Session matching (2) P <--> S <--> C
Server acting as relay (3) P --> S --> C (one-way)

I am looking for an authentication protocol where producers authenticate consumers and the server is able to match a consumer with a producer without prior knowledge. Ideally, a consumer should receive a zero-knowledge proof (if possible; a shared-secret otherwise) from the producer, and then both producer and consumer connect to the server with the server matching the producer and the consumer implicitly from the authentication mechanism.

The main idea here is that the server has no idea of the data being exchanged and the prior-setup is minimal.

Does such an authentication/key-exchange protocol exist? I have been reviewing the SRP protocol which may be suitable if using a random username as matching session.


texts: NIST DRBG algorithms' optional parameter

texts:
As I'm going through NIST-SP-800-90Ar1 spec for DRBG, I found the mention of security_strength in all of the 3 specified construct in the document: Hash_DRBG, HMAC_DRBG, CTR_DRBG. However, they're all noted as optional:

  security_strength: The security strength for the instantiation. This parameter is optional for Hash_DRBG, since it is not used.

and

  security_strength: The security strength for the instantiation. This parameter is optional for HMAC_DRBG, since it is not used.

and

  {3 no df, 4 with df}. security_strength: The security strength for the instantiation. This parameter is optional for CTR_DRBG.

And in the disgraced previous version, there wasn't even mention of this parameter.

What is, or what can we infer as, the rationale for its inclusion?


texts: Is MAC algorithm same at both sender and receiver end

texts:
The MAC algortihm which is used along with a secret key to generate a MAC tag on the sender end ,is it same at the receiver end also who again uses a MAC algorithm to generate a tag?

If yes, then how is the MAC algorithm generated. Is it just a function(a mathematical function to compute)??

If no, then how does the tag get matched to preserve the data integrity??

Is the MAC algorithm, is present as a layer inside of SSL????


texts: Is frequency analysis a useful tool against encryption by multiplication?

texts:
If I transform natural plaintext by:

making each letter two decimal digits, considering the whole as a decimal number;
multiplying by the key (some integer constant), giving the ciphertext;

would frequency analysis still work?

Exemple:

Plaintext:     G o l d U n d e r S e a
Number:       071512042114040518190501 x 911
Ciphertext: 65147470365890912071546411

To get the text again simply divide by 911. Conversion of the ciphertext to letters could be added somehow.

Assuming frequency analysis is not an option, how would one break this?

Note: The question has been improved by the OP, then re-tagged and further edited for clarity. I now wish I could rescind my own vote to close it.


texts:
I'm trying to implement parameters generation for ECDSA according to SEC1 v2.0:
Input: The approximate security level in bits = t is {80, 112, 128, 192, 256}
 Output: Elliptic curve domain parameters over Fp: T = (p, a, b, G, n, h)

Here's the 2nd step of the algorithm:

Select elements $(a, b)$ is $F_p$ to determine the elliptic curve $E(F_p)$ defined by the equation:

$E : y^2 = x^3 + ax + b \bmod p$,
a base point $G = (G_x, G_y)$ on $E(F_p)$, a prime $n$ which is the order of $G$, and an integer $h$ which is the cofactor $h = E(F_p)/n$, subject to the following constraints:

$4a^3 + 27b^2 \neq 0 \bmod p$
$E(Fp) \neq p$.

$p^B \neq 1 \bmod n \space\forall\space 1 <= B < 100$
$h <= 2 ^{(t/8)}$
$n−1$ and $n+1$ should each have a large prime factor $r$, which is large in the sense that $log_n(r) > (19/20)$.

I haven't understood a lot of things in 2nd step.

How to select a and b for E(Fp)? Should it be done randomly just to satisfy 4a^3 + 27b^2 != 0(mod p) ? Yes it should, as far as i've understood.
How to find #E(Fp) -- the cardinality of E(Fp)? -- Schoof or SEA algorithm.
How to choose generator -- $G = (G_x, G_y)$ and find its order $n$? -- Random point should be chosen on a curve. Again not pretty sure about it. EDIT: The point has to have a prime order. How can a point be chosen with a prime order?


texts: how to use salt to sign a message and how is it effective?

texts:
I've had an assignment to sign a file using hash and salt, so I read about salt and I got why it's important when it comes to password, but not to sign messages.

How do I sign something using salt? The only way I could think of is that I add the salt to the message then hash both and then send the hash along with the salt (encrypted of course)… but it makes no sense to me.
Even if what I said earlier is how it's done, it's not useful at all. How and why would I use salt to sign a message ?


texts: Does CBC encryption of a hash provide authenticity?

texts:
Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other words, we encrypt the message and a hash of the message, with CBC.

Does $f$ guarantee the authenticity of the message? (Assume the adversary doesn't know the secret key $K$, of course.)

CBC doesn't provide any authenticity, but changing any bit of the ciphertext completely changes the decryption of the block, which should prevent the adversary from computing the hash of the modified plaintext. Is this right? Does this scheme provide authenticity if the IV isn't reused? If the IV is reused, I get the feeling that there are cases where the adversary can mix parts of the two messages.

 Don't worry, I am not planning on doing that. If I need authenticated encryption, I'll use a proper mode such as EAX or GCM.


texts: How would I prove a number is not within a range?

texts:
This would be the opposite of a rangeproof.

For example, I wanted to prove that my number was not between 0 and 200 in zero knowledge?

On a separate note: how would I prove that I hold a number, but it is not a specific number x ?


texts: Security analysis of a matrix multiplication protocol

texts:
Suppose Alice would like to obtain the product of two mXm matrices i.e. A and B. Alice has A, whereas Bob has B.

Since Alice does not want to reveal A to Bob, she chooses a mXm random invertable matrix R. She sends R*A to Bob over a secure channel.

Bob obtains R*A, and calculates R*A*B, and sends it to Alice over a secure channel.

Alice obtains A*B by inverting R i.e. (R^-1)*R*A*B.

R is only utilized once.

Any ideas on how to proceed with the security analysis of the above protocol?

Specifically is H(A|RA) = H(A)


texts: Uniqueness of checksums using DES-MAC encryption?

texts: I'm in an Intro to Computer Security class, and one concept I'm having trouble understanding is how two different files could produce the same checksum. How would you produce the same checksum given two different files? So far, through reading the book, I found mention of something called the "pidgeonhole principle" that seems to indicate this is possible, but I'm not sure how.


texts: How to determine how good our generator of random numbers is

texts:
I am using SecureRandom class in java with default constructor and after i run it four times and each times i will take back 4 "supposed highly secured random numbers" .

First run : -35
-43
-127
12

Second run:-123
114
4
55

Third run:39
-19
3
-51

Fourth run: 111
-48
-50
55

Now i want to know is there any statistical analysis which i can decide if these generator provide me "good" random numbers . Or i just simply can decide it by eye just seeing that in each run we will not take let say the same value twice or three times . According to Scott Adams and others is impossible to proof how good a generator of random numbers is but if it produce you let say for numbers in range 0-15 and you roll this four times and get 4 nine than it probably is not so good. Anyway i am not sure how to determine if my generator is good or not and i will appreciate any feedback,

Thanks in advance


texts: Understanding birthday attacks on 256 bit hashing and 512 bit hashing

texts: Does it make a difference against birthday attacks if the algorithm that I am using is 512 bit hashing?


texts:
What is the purpose for and distinction between each of the following keys commonly used in cryptocurrencies?

Address
Tracking key
Passphrase
Private key

For context:
I got a bytecoin paper wallet which has a QR code for each of the 4 things above and just wanted to know what they are for / mainly want to know how to check the paper wallet balance to ensure what was sent to the qr code and is actually there.


texts: Best practices for saving encrypted user data without a database

texts:
We are setting up a web application which requires users to submit sensitive data. Since entering all the required data may take a long amount of time, we want to give them the option to save their progress. Maintaining a database to store their information is risky for us, as it opens up our servers to potential attacks. We have a small team and would be hard pressed to maintain the level of security we would want.

Rather than maintaining such a database, we would like to encrypt the user's partial progress (a text string in JSON format) with a password that we provide and that is supplied to them only at the time they wish to save progress. They will be instructed in the UI to physically write the password down rather than save it on their computer. To resume progress, they would supply us the encrypted file and the password. On our end, no data is persisted. If they lose the password they just have to start again.

Is any portion of this method obviously insecure? What encryption algorithms and libraries (Java or Python) are best for performing encryption/decryption?


texts: Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

texts:
In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\gamma_1, \gamma_1)$ are generated using rejection sampling on a stream of uniformly random bytes obtained from a cryptographically-secure pseudo-random number generator.

Since rejection sampling is inherently non-constant-time, why is this
not a problem from a timing side-channel leakage point of view?
Protocols using discrete Gaussian distributions need to ensure
constant-time sampling to prevent side-channel attacks. Why do
similar attacks not work when using rejection sampling?


texts: Creating a random password based off of a prime number

texts:
So I am making an application that basically creates strings that must be encrypted before they are stored on a user's device. If the user blindly starts running the application without creating a password before hand OR they cannot come up with a long, strong password, would this method be appropriate? (Language is java)

Create a probable prime of 512 bit length

BigInteger.probablePrime(512, new Random())

Add a random number of 512 bit length

.add(new BigInteger(512, new Random()))

Convert number into Base32

.toString(32);

The above steps will yield a Base32 string that is about 100-103 characters long and will look something like this:
2si95285qk2trk65hona7q0j27o81ph6adjs2obd2g83q9nho52tonku7s3uajtja54ri2dkbque39hil14f1nrlef0736mtda7rtll

And it is up to the user to safely store this password if they do not create one themselves.

So my question, is this a plausible method to create a random password if the user does not make one before hand or cannot create a password this long (though it is not required)?


texts: Applying machine learning algorithms to homomorphic encrypted data

texts:
I have a basic understanding of encryption and I got back to the topic because of an interesting site that encrypts financial data using  homomorphic encryption (HE) and I would be happy for any input from the community here.

They don't really tell the precise method they use. In the blog they mention the Fan and Vercauteren scheme and on the other hand they mention order-preserving symmetric encryption.

They say that as addition and multiplication in HE is "preserved" one can apply machine learning algorithms (they usually use all operations - not only polynomial ones).

My question: if data is enrypted then the data that was originally on the real line is usually mapped to the algebraic structure of a ring. Thus if we get those elements of the ring, we have to perform the operations that are defined on this ring. Finally we can not (!) apply the usual real number operations that the ML algorithms consist of.

Is this tue for HE? Is it true for order-preserving symmetric encryption?

An example as EDIT as I am not a crypto-pro at all:
say I am given the following data:
$$
(0.2,0.1,0.5,0);
(0.1,0.2,0.3,1); (0.02,0.7,0.33,1)
$$
and several rows thousands of them (and in my application more columns). In this example the first 3 entries are inputs and the 4th one is the target. All I know is that the inputs were decrypted (either HE or order-preserving symmetric) and I see that each column has exactly 1001 unique values (which makes me think that the data is not real numbers but data on some grid or finite ring).
If I interpret the inputs as real numbers and perform the usual ML-algorithms (logistic regression and more complex ones). Is this mathematically sound or am I doing complete nonsense (because the data is not real numbers but rather objects in an algebraic strucutre that does not allow for the usual $+$,$\times\ldots$?


texts: How can I improve a password generation scheme based on a shared secret and URL?

texts:
I currently use the following method to generate a different password on every website I have to login:

password = SHA1 ( mainPassword . domainName . number )

where . stands for concatenation.

Here are my questions:

Is this secure enough?
I mean, if somebody knows my algorithm and one or many passwords, could he find easily one of my other passwords? Up until now, most people I contacted believe it is true, but I didn't get any real strong certitude.
(Related to question 1) When one of my passwords is compromised, I just increment the number. Is this enough?
Now, as many people suggested, SHA-1 can be a bit too weak and many proposed to use bcrypt or even better scrypt. But, as I understand these two algorithms, it is more about encrypting than hashing. Is it secure to use the following passwords?

SHA1( SHA1( … SHA1( str ) … ))

Here is my reasoning:

It is difficult to retrieve str, knowing sha1(str).
I hope that to retrieve str knowing sha1(sha1(str)) one must do twice of the work.
Therefore retrieving str from sha1n(str) should be n times as difficult than to retrieve sha1(str).

I am almost sure there won't be any proof of this. But could I consider this method safe enough?

The problem is just to have a very good algorithm similar to bcrypt or scrypt for hashes without the nightmare of finding a correct implementation in all languages I used to implement this (JavaScript, Objective-C, shell script using openssl).


texts: Mapping of message onto elliptic curve and reverse it?

texts:
I would like to perform a variant of Elliptic Curve ElGamal in java using the BouncyCastle libraries.

I currently face the difficulty of mapping a message $m$ onto the elliptic curve $E_p$. I have so far multiplied the generator $g$ of $E_p$ by the message $m$. However, this is hardly reversible. Hence I cannot retrieve the original message without storing a lookup table for my whole message space.

The post ElGamal with EC quotes that some reversible mapping exists, described in Elliptic Curve Cryptosystem, Koblitz.

After doing some research, I found Mapping an Arbitrary Message to an Elliptic Curve when Defined over $GF(2^n)$, King et al.. However it looks quite cryptic to me, and I believe there must exist some library doing this already.

Is there any widely used mapping available? Also, is there any library implementing this?


texts: Making counter (CTR) mode robust against application state loss

texts:
Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter blocks (the nonce combined with the counter that acts as input to the block cipher) are used.  I'd like to share my ideas about how the counter block can be made reasonably unique even when there is application state loss (reinstalls, etc.) that may otherwise cause non-unique nonces.  If my ideas turn out to be reasonable maybe they'll be helpful to others.

According to appendix B of the NIST guidelines the counter block should either be a simple counter that is incremented without concern for message boundaries (the "first approach") or it should be a combination of a nonce that is changed with each message and a counter (the "second approach").  Either approach is sound, but what if the history of either the counter and or the nonce is lost due to an application reinstall or other reasons?

For a cipher with a 16 byte block size, such as AES, I'm proposing a counter block that has the following layout:

  NNNNNN0CCCCCCCCC

The six "N"s are the nonce, followed by "0", a zero byte, and finally the nine "C"s for the counter bytes.  Consider the following pseudo code for getting the nonce:

static last_nonce = 0
synchronized get_nonce()
    if (last_nonce == 0)
        last_nonce = get_last_nonce_from_db() // returns 0 on failure
    local nonce = last_nonce + 1
    local since_epoch = get_time_since_epoch_in_msecs()
    if (nonce < since_epoch)
        nonce = since_epoch
    last_nonce = nonce
    return nonce

For each new message the counter ("C") bytes are random.  The increment function simply treats the entire 16 byte counter block as a 16 byte big endian integer where the right most bytes are incremented first.  This is the way Java's CounterMode.increment() seems to do it.  This approach should have the following properties:

In the normal case where the database is intact the nonce is always unique.  In this case the "0" assures that it's possible for the message to be at least 256*10 - 256*9 blocks long before colliding with the next possible nonce.
If the database is reset (this could be restoring the database from a backup, reverting a snapshot on the database system, etc., combined with restarting the application) the system time should assure unique nonces.
If both the database is reset and the system time is reverted the nine random counter bytes should assure that the odds of two one block messages colliding (having a counter block in common) with the same nonce is only one in 256**9.  As the messages get longer the odds get worse.

So it should work correctly in the normal case, but still behave reasonably in the degraded case.

I know this was long, but I wanted to explain it clearly.  I also realize that some of this leverages existing concepts (I think getting a unique incrementing value the way I did with the system time is similar to what's often done for unique identifiers), but I'm interested in how these concepts can be applied to CTR.


texts: What are the advantages of a static ECDH key?

texts: What are the advantages of using "static-ephemeral ECDH" over "ephemeral-ephemeral ECDH"?


texts: How many characters per block in an El Gamal ECC cryptosystem?

texts:
Looking for the number of characters that can be encrypted using the The elliptic curve ElGamal cryptosystem of each block, I found these lines. But I cannot understand them:

  Actually in our case we need to divide into an even number of blocks. If we think in a
  character as a number < 256 (its ASCII code) and we employ $\mathbb{F}_p$ as a field then we can encode
  at most $\log_ {256} (p)$ characters in each block.

What does the notation $\log_{256} (p)$ mean?

I would like an explanation by real examples.


texts: Is a hash function used to expand the key after ECC shared secret is complete?

texts:
I have designed an ECC engine in silicon that handles any curve in the form of $$y^2 = [ax^3 + bx^2 +cx + d] \mod(P)$$

The shared secret is then passed to symmetric encryption engine, which happens to be Simon.  The system is asynchronous and simulates great, but there's an occasion situation where I can have a key underflow.

As an example, the shared secret is 160-bits, but my Simon 128/256 has a 256-bit key.

If the solution to the curve is longer than what I need, I can just truncate the value to fit into my symmetric key requirement; however, in the case that it's shorter, it doesn't make sense to have all of those bits be zero.

This hardware doesn't check for a sane user, so if you want to tell it to do a 4-bit ECC, it'll do that.  For this reason (and because I'm doing the hardware), it seems like there'd be a hash that is used for the shared secret so it is expanded into the key bit width.

Is there a NIST standard or a paper that specifically describes how this situation should be handled?


texts:
We have a scenario where two people A,B have the same modulus $N$ but different exponents $e_1, e_2$ respectively for RSA encryption. They have decryption exponents $d_1, d_2$ respectively.

Suppose for some message $m$, it is sent to B and A intercepts it, i.e. A has $c \equiv m^{e_2} \pmod N$. Assuming $e_1,e_2$ are coprime, how might A be able to obtain $m$?

My thoughts are that $\exists u,v \in \mathbb Z$ such that $ue_1 + ve_2 = 1 \Rightarrow re_2 = 1 - ue_1$

Then A may obtain $c_1 \equiv c^r \equiv m^{re_2} \equiv m^{1-ue_1} \pmod N$
which subsequently lets A compute $c_2 \equiv c_1 ^ {d_1} \equiv m^{d_1-ud_1e_1} \equiv m^{d_1 - u} \pmod N$

Now if $n = gcd(d_1-u, e_2),$ we may find $x,y \in \mathbb Z$ such that $x(d_1-u) + ye_2 = n$.

A then computes $c_3 \equiv c_2^x * c^y \equiv m^n \pmod N$

Now if $n=1$ then we are done. However, if $n>1$ then I am not sure what else to do. I would like to show something along the lines of either $n = 1$ always or that we may find $k\in \mathbb Z$ such that $nk \equiv 1 \pmod {\phi(N)}$ where $\phi$ is the Euler Totient Function.

Any help would be greatly appreciated, thank you!


texts: SNARK-friendly one-way compression functions

texts:
I'm looking for a one-way compression function that is secure and efficient within a zk-SNARK circuit. The motivation behind this comes from these considerations:

SHA256-compression is highly inefficient for SNARKs
The Pedersen hash function is efficient, but has an upper input limit of 32 bytes and outputs 32 bytes
A Merkle-tree implementation requires a hash function that accepts an input 64 bytes (the 32-byte outputs of two hashes).

Hence I'm looking for a way to securely and efficiently combine two 32-byte values into one 32-byte value.

I'm considering the MiMC hash function for this purpose but it seems like overkill for this purpose; I am already hashing data using Pedersen. Perhaps MiMC with fewer rounds would work well, but perhaps there's a better way to do it.


texts: Post-quantum alternative to ElGamal? (public key verifiability)

texts:
Are there any alternatives to ElGamal that would be resistant/annoying to quantum machines?

I would like to preserve public key derivability/verifiability -- ability to ensure existence of corresponding private keys for made-up public-keys.

I've looked up several other cryptosystems from NIST proposals of post-quantum cryptography, but by directly reading the papers it looks like they lack this property.

For instance NTRUencrypt is a lattice-based cryptosystem.
As it operates under a lattice field in theory public keys could be randomly generated without private ones.
But I'm not sure that there would be a way to ensure existence of private keys and possibility of decryption (although the private key space could be large enough and this assumption would somehow hold).


texts: Is there an efficient algorithm that allows to obtain a uniform distribution of all possible $4$-bit permutations from a single keyless $4$-bit S-Box?

texts:
Let $S$ denote a keyless permutation that operates on $4$-bit inputs and returns $4$-bit outputs (that is, $S$ is a $4$-bit S-Box).

In this question, $x_0$ denotes an arbitrary bitstring that ends with 0000 (four zero bits) such that the length $L$ of $x_0$ is a multiple of $4$ and there is no upper bound for $L$. Then $x_0 + i$ denotes a bitstring that represents the sum of $x_0$ and $i$, assuming that $x_0$ is interpreted as a single natural number and all ($L - 4$) leading bits of $x_0$ are not affected. For example,

000001010000 + 1 =  000001010001,
000001010000 + 14 = 000001011110,
000001010000 + 15 = 000001011111

Does there exist an efficient iterative construction $F(x)$ based on $S$ so that the length of $F(x)$ is $4$ and a tuple $$\{F(x_0), F(x_0 + 1), \ldots, F(x_0 + 14), F(x_0 + 15)\}$$ is a sequence of $16$ different $4$-bit elements for any $x_0$ (that is, each $x_0$ generates a permutation of $4$-bit values), and all of the $2^4! = 20922789888000$ possible permutations are equiprobable if $x_0$ is a sequence of random bits followed by four zero bits (assuming that the length of $x_0$ is $4n$, where $n$ is an arbitrarily large natural number greater than $1$)? If it is not possible for all permutations to be absolutely equiprobable in the mathematical sense, then at least the distribution of permutations must be as uniform as possible and look “pseudo-random”.


texts: Constructing a number different than x without revealing x

texts: My question is not really about ZKP but is related to the socialist millionaire problem where A and B can check that their message x and y are different without revealing them. I would actually be interested in a method that allow B to construct a y different than x without A having to reveal any information about x. (x and y can be bounded by a small N)


texts: IND-CCA2 secure schemes without Plaintext Awareness?

texts:
I have been reading up on IND-CCA2 security and was wondering: Are there efficient IND-CCA2 secure schemes that do not require plaintext awareness? I'm guessing yes - could someone point me to these schemes?

I was looking at Cramer-Shoup, and it seems like the general idea is that we make the message complex so that it's hard to come up with a valid ciphertext without using the encrypt algorithm, and then include a validity check in the decryption algorithm. However, this seems... not so nice, as this more or less makes the decryption oracle superfluous, since for a valid message the adversary would know the underlying plaintext anyway. I read (on wikipedia) that plaintext awareness is a very strong requirement and Semantic Security + Plaintext Awareness $\Rightarrow$ IND-CCA2. So ,I would like to read up on a system that does not make use of this approach.


texts: Relation between the correlation coefficients $\widehat F(w) = C(f(a), w^ta)$ and $(-1)^{f(a)}$

texts:
In the paper Correlation Matrices by Joan Daemen et. al., the authors state (on page 3) that if the correlation coefficients $C(f(a),w^ta)$ of a Boolean function $f$ are denoted by $\widehat F(w)$ then $$\widehat f(a) = \sum_w \widehat F(w) (-1)^{w^t a},$$
with $\widehat f(a) = (-1)^{f(a)}$.

Can someone explain why this formula is correct?


texts: Generating Encryption Keys from Biometric Fingerprint Templates

texts: How would one go about generating Encryption Keys from Biometric Fingerprint Templates extracted from a fingerprint using either Griaule SDK or DigitalPersona SDK or any other SDK that will return the fingerprint template in either ISO or ANSI fingerprint templates format? Is there a way one would do that using Fuzzy Extractors, Secure Sketch, Bio Hashing or any other approach? I will appreciate if anyone can show me how to go about this in any programming language? I intend to use the obtained Encryption Keys in encryption and decryption of data.


texts: How to implement division operation on ciphertext by using HElib or SEAL?

texts: HElib has no general purpose API for number operations such as comparison or division. How can we implement division operation on ciphertext？How to encrypt floating numbers of any length in homomorphism and add, subtract, multiply and divide them？


texts: Is it secure to use Diffie-Hellman key agreement to generate a nonce?

texts:
I have a system, using AES, in one of the modes that uses a nonce and authentication.

We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting secret as an IV.

I want to know if there can be any attack on this system: is it possible to perform a man-in-the-middle attack or a replay attack?


texts: Is the only use for the private key of a root certificate signing certificates issued by it?

texts:
A root certificate can be used to issue intermediate certificates.

The private key of the root certificate is needed in order to sign any intermediate certificates.

However, after that, we only need the public key of the root certificate to verify the signature of intermediate certificates.

Similarly, the private key of an intermediate certificate is needed to sign the public keys of SSL certificates issued by it but after that we no longer seem to need the private key of the intermediate certificate for anything other than issuing and signing more SSL certificates.

Does the private key of a CA certificate have any uses other than signing the certificates issued by it?


texts: Soundness of Trevisan’s Extractor Against Quantum Side Information

texts:
I wonder how sound Trevisan's extractor can be against quantum side information. I checked many papers. And all of these papers were aiming to explain how sound Trevisan's Extractor is against quantum side information but they all have the same information; the papers include:

what is an extractor?

what is a strong extractor?

what is the trevisan extractor?

some entropy explanations(they are the same as for other extractor types)

and after that papers finish without explaining the reason for soundness against quantum side information
Can someone explain this to me briefly?
Best regards


texts: Public key encryption schemes and security of an uncommon use

texts: Suppose that we use a public key encryption scheme by keeping the public key secret. Can we consider a public key encryption scheme at least as secure in this private-key setting, when compared to the normal use?


texts: Entropy estimation by Linux Kernel when adding entropy from TRNG

texts:
As per resources given below, after adding the bits to entropy pool, the Linux RNG estimates the amount of entropy for "credit_entropy_bits" function. It is estimating the amount of entropy of an event as a function of its timing. Initially, the estimator calculates the jiffies differences on three levels. Then, estimator takes the minimum of the differences absolute values and finally, it assigns it a value between 0 and 11.

I am using a TRNG for supplying entropy to Linux entropy pool. The output of TRNG is 160 bits i.e. the entropy of source is 160 bits. In case of TRNG, What will be value of entropy for "credit_entropy_bits" function ? Will it be 160 bits ?

I have pointed the "rng_current" to "rng-caam". I am running "rngd" with r option i.e. "rngd -r /dev/hwrng".

https://hal.inria.fr/hal-00738638/file/rr8060.pdf
https://eprint.iacr.org/2012/487.pdf
https://github.com/torvalds/linux/blob/master/drivers/char/random.c


texts: Time taken for Brute Force Attack on DES

texts:
An attacker is equipped with a computer that performs 10 trillion (1013) DES decryptions per second, what is the average time required, in hours, for a brute force attacker to break DES? Key size is 56 bits.

I tried 256/1013 divided by 3600 but the answer is incorrect.


texts: Property that prevents determining key from ciphertext and plaintext

texts:
What is the property (if it is not Forward Secrecy) that prevents (good) symmetrical encryption algorithms from being vulnerable to an attack vector that requires only decrypted data, and the corresponding encrypted data, and allows the attacker to either:

Obtain the encryption key OR
Obtain some data that is useful to determine some information about the plaintext of a future intercepted ciphertext.

This is a follow-up question to Tom Leek's answer saying that the property mentioned is not Forward Secrecy, that asks, "Then what is it?"

Note that this is not about hashes, or asymmetric encryption (or any other session-token-based method), as those questions can be found at the corresponding links.

(Note, this question was moved from security.SE, which is why most of the links above lead there)


texts: why DES encryption uses different modes like ECB,OFB?

texts: As without using modes we can also encrypt and decrypt data then what is the need of using modes in DES?


texts: Linear cryptanalysis and number of linear approximations

texts:
I try to understand the linear cryptanalysis. Now I am reading as a secondary reference the book "Cryptanalysis of Block Ciphers:
A Survey" by Standaert , Piret and Quisquater. In the first step, the authors are saying that there are $(2^n-1)\times(2^m-1)$ linear approximations for a $n$-input vector and a $m$-output vector.

Since a linear approximation is a linear map between $\mathbb{F}_2^n\rightarrow\mathbb{F}_2^m$, should the number of linear approximation not be $2^n\times 2^m$? Or do I miss a part?

I am grateful every help.

Sincerely,
Hypertrooper


texts: AES-256-CBC with random IV - storing same plaintext as same ciphertext

texts:
I am encrypting some information stored in a column of a MySQL database.
The column can contain repeated values, let's say the table has 7 rows and the column to be encrypted has the following values:

"a", "b", "a", "c", "b", "b", "c"

I would like to know if is insecure to encrypt just one time each different value (each one with a random IV stored along with the ciphertext) and to reuse the same ciphertext for the same plaintext.

Let's say that the encryption of "a" with a random IV (IV1) gives "z", the encryption of "b" with another random IV (IV2) gives "x" and the encryption of "c" with another random IV (IV3) gives "k". Would it be insecure to have all the "a"s encrypted as "z", all the "b"s encrypted as "x" and all the "c"s encrypted as "k"?

"z", "x", "z", "k", "x", "x", "k"

I often read that it is a weakness to have the same ciphertext for the same plaintext, but I was wondering if this weakness is no longer present if you use a random IV each time to encrypt the data.

Thanks for your help.


texts: Can a computationally unbounded adversary break any public-key encryption scheme?

texts:
Assume there is a public-key encryption scheme $(KeyGen, Enc, Dec)$ with perfect correctness (i.e., for all messages M and valid key-pairs (PK,SK), we have $Dec_{SK}(Enc_{PK}(M))=M$).

Will there always be a function $A$ such that for all messages M and valid public-keys PK, $A_{PK}(Enc_{PK}(M))=M$?

In other words, can a computationally unbounded adversary decrypt the message, having only the public key?


texts: Is it okay for a non-cryptographer to submit crypto code to an open source probject?

texts:
I am not a cryptographer, nor do I claim to be.

However, at times I have wanted to contribute to open source cryptography projects such as libsodium.  The maintainer of libsodium is a cryptographer, and I consider it a good assumption that they will review any code submitted to the repo.

Under these conditions, is it okay to write the code, doing my best to get things right, and rely on a qualified person to catch any mistakes?

Edit: I am talking about implementations of already well-known, software-friendly algorithms that are not especially complex.  That is: zero new ideas, just "grunt work" — the problem is already solved and there is only the relatively mechanical task of writing the code.

I am especially talking about "glue code" that ties existing primitives together.


texts:
I'm attempting to encrypt some information into our database to be later pulled back out and displayed to the user. Searching and reading up on different methods I found a post over at stack exchanged with example code for doing AES Encryption.

https://stackoverflow.com/questions/165808/simple-2-way-encryption-for-c-sharp

Reading through the comments and some different articles I've come to realize that using a static IV for your encryption is generally poor form. That using a random IV is better. This would make sense, but to my understanding I need a way to find that IV again in order to be able to decrypt the information.

I would believe that I can't store the IV in my DB as well, since that would defeat the whole purpose of this. The only thing I can think of is to use something in the row (e.g. a Datetime) as a seed for a random number generator. Which would generate the same IV every time, but that doesn't seem that secure to me either if anyone figured that out.

What are the best practices for situations like this?


texts: Map many crytocurrency token IDs (2^512) into a single set of tokens IDs (2^256)

texts:
Let we have a finite (small compared to 2256) set $T$ of 257-bit numbers.
Need a function $f: T \to 2^{256}$ such that it's almost of zero probability that $f(n)=f(m)$ for two different numbers $n,m\in T$.
Computation of $f^{-1}$ must be constant (at worst logarithmic) on the size of $T$.
Computation of $f$ must also be easy (not exponential, ideally constant time).
The function $f$ should "extend" easily when we add one new element to $T$.
How? Is this possible at all?
I need this to map two (in the future three) different kinds of crytocurrency token IDs into a set of tokens IDs.
Update: I realized I need to be able to do this even if 257 is replaced by 512 in the question. Well to be able to pack not 512 but just 256+160 = 316 numbers would be enough. It can be done by storing every new element of  (it's initially empty) into the storage mapping its consecutive number $f(T)$ to the element of , but I'd prefer to do it without any persistent storage (that is not storing anything between invocations of $f$ and when adding a new element to $T$).


texts: Adversary model for malicious but selfish adversaries?

texts:
Covert adversaries have the property that they may deviate arbitrarily from the protocol specification in an attempt to cheat, but do not wish to be caught doing so.
Does this model includes also the case in which  adversaries do not cheat in case it does not maximize their utility function, e.g., they lost an escrow?


texts: Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

texts:
In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of the recommended ways described in NIST SP 800-38A, Appendix C, of generating an unpredictable IV for CBC mode encryption.

I further noted that this is, in fact, mathematically equivalent to using an all-zero IV and simply prepending the nonce (padded to a full cipher block) to the plaintext before applying CBC mode encryption.

However, in the comments to another answer, it was noted that this construction is trivially CPA-insecure (as noted e.g. in section 4 of this paper by Rogaway) if the nonce may be chosen by the attacker.  (Of course, it could be argued that, if your nonces may be controlled by an attacker, you really should be using a fully nonce-misuse resistant mode like SIV instead of CBC anyway.)

That said, let's take this opportunity to hopefully settle this issue once and for all:

Assuming that the nonce values are unique and generated according to some fixed public counter sequence that is not under the attacker's control, is the encryption scheme described above (i.e. pad the nonce to a full cipher block, prepend it to the plaintext, and encrypt the result using CBC mode with an all-zero IV) actually IND-CPA secure?
If so, is there a published proof of this?  If not, is there a known attack under the IND-CPA model that doesn't assume the attacker can choose the nonces?
How does the quantitative security (e.g. attacker's advantage as a function of the number of encryption oracle queries) compare to standard CBC mode with random IVs?  AFAICT, both are basically only secure up to the birthday bound, but a more detailed analysis could be useful.
As a bonus, what if the nonce is padded to some fixed length that is less than a full cipher block?  Is the resulting scheme still IND-CPA secure (assuming that the nonce doesn't overflow, of course) and if so, how does this affect the number of messages that can be safely encrypted?


texts: Why is a weakened AES is easy to crack with KPA?

texts:
I started to study a cryptographic course and I got stuck on a question about AES:
If we take the AES algorithem and only perform mixColumns and addRoundKey operations as well as only using one key instead of a round key. (so all keys are the initial key)
describe a "Known Plaintext Attack" on this circumstance.
What I know:
-That only by using the same key every bit is connected to the cypher text by the second round, even if we didn't take the first 2 operations of the AES.
-I need to find the number of operations required to brute force the code with this weakened algorithm.
My question: How "mixColumns" and the key works exactly to conceal the cypher, and how many operations it would take to brute force it if I had a message and a matching cypher.


texts:
Assume the case, that two participants have agreed on a key $K=g^{ab} \mod p$ via Diffie Hellman. I have the need to change the key every now and then. The first idea I had was to simply initiate a new agreement, so both chose another exponent, so the new key would be $K'=g^{a'b'}\mod p$.

I wonder if it would be also a secure method to just change the generator, so that $K'=h^{ab}\mod p$. Is there something I've overlooked (as I am a newbie to number theory), that would make this a bad approach?


texts: Can a repeated random sequence be considered random?

texts:
Imagine I have a 1000000 bit sequence that is considered random ( ie the output of a TRNG).

Now imagine I 'double' that sequence : I concatenate the same sequence 2 times :  " my 1000000 bits "concat" my same 1000000 bits "

Can we say that the resulting sequence is random ?? ( note that if someone know the construction structure of the concatenated sequence can know the bit 1000001 and following ones as they are the same ones as the beginning ones...)

I have been testing some setups like the one exposed with NIST test suite and seem to show the resulting sequence is random ( anyway im no real expert in NIST test suite so maybe I'm missing some crucial point)


texts: using Post-quantum asymmetric ciphers instead of RSA

texts: We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks break with 2^60.55 bit operations..


texts: Analysis of Repeatedly Enciphered Plaintext using Same Algorithm / Key?

texts:
Please forgive the impracticality of this question, but I'm curious about the behaviors of encryption algorithms applied to their own output.

Suppose I have an encryption algorithm E and (using the same key(s)) I repeatedly encrypt its output for a given plaintext: E(E(E(E(...E(plaintext)

Would a modern encryption algorithm, such as some variant of AES, display any kind of cycling with respect to its output for arbitrarily long compositions of itself?  Is there some known number of compositions where the final output is itself the plaintext?


texts: How long does it take a quantum computer to brute force AES?

texts:
I understand that using Grover's algorithm it only requires $2^{64}$ lookups for a 128 bit AES encryption, leading people to say we need to increase to 256 bit keys. But how long would it actually take a quantum computer to do $2^{64}$ lookups?

I can't say I fully understand quantum computers, but aren't people making the assumption that 128 bit is only unsafe to quantum computers because 64 bit (which 128 bit becomes using a quantum computer) can be broken through brute force on our current computers...? Even if a quantum computer only needs to do $2^{64}$ lookups, presumably it doesn't do them at the exact speed of current computers.

When people have asked in the past how long a quantum computer would take to break AES 128 bit, people always answer that it would take $2^{64}$ lookups (which some people take to mean the amount of time we currently take to break 64 bit), but there's never any indication of an actual time.

I understand that quantum computers are highly theoretical at this stage in terms of large scale implementation, but can anyone offer any ideas?


texts: Attack an stream cypher using 2 XORed LFSRs

texts:
We know that the Key were generated by 2 16Bit LFSRs (output of both is XORed together -> key)

I already extracted a 64 Bit key sequence, but how can I calculate the polynom of the LFSRs (and the initialisation vector)? Since we have 2 LFSRs XORed together which means its non-lineary I can't use a Matrix to calculate the coefficients, or am I wrong?

I hope somebody understands my problem and can give me some hint.

the known keystream: 1010 1110 0000 0011 1111 0010 1011 1001 0001 0100 1101 0111 1001 0011 1110 1101


texts:
I am thinking about to concatenate two hashes, but I was searched about this and I have questions, if some one should help me. Thank you

I have two strings str1 and str2 with variable large.
I need obtain a hash of these, but when I was searched I read about problems with collisions and I don't understand that.

In this moment I think that this is sufficient.

cipher = hash(str1) || hash(str2)

But according to other opinions is necessary add other injective function to prevent resistance collisions.
That approach looks like this:

cipher = hash(hash(str1) || hash(str2))

What do you think?

EDIT

I use murmur3 with 128.

I have many data and I need to represent this whit hashes, because that I use hash function.

With the time I use the first approach but many collisions have appeared and I don't understand why. I think because I use murmur3 of 128 to everything data or I don't know.


texts: Difference between one-way encryption, Transparent data encryption (TDE) and data encryption

texts:
What is the main difference between one-way encryption, Transparent data encryption (TDE) and data encryption? If one needs to store passwords or credit card details in the DB, which one is best to use?

What I have understood from my search is that an example of one-way is hash, in this case is the password encrypted at storage or just hidden from the DBA? And that with TDE the data is encrypted at storage only, so is it more applicable to use one-way encryption rather than TDE to hide details from the DBA/users?


texts: nonlinearity and autocorrelation of common s-boxes

texts: I cannot find publications comparing the properties of popular cipher s-boxes. First of all, I am interested in nonlinearity and autocorrelation of s-boxes, which are used in seed, cast-128, camellia and kuznechik. Can someone suggest publications or values for these s-box properties?


texts: TLS RSA Certificate with Elliptic Curve Negotiation

texts:
When I look at Google's Public Key in Firefox I get

  PKCS #1 SHA-256 With RSA Encryption

Yet according to SSL Labs Google has

  EC 256 bits / SHA256withRSA

and supports

  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

How can it when the public key it uses is RSA not a Elliptic Curve one? Does Google present both an EC and an RSA public key in their Certificate file some how?


texts: When a DER format RSA private key is extracted from an encrypted PEM file, is it still encrypted?

texts:
Let's pretend we create a passphrase protected PEM file using openssl:

$ openssl genrsa -aes256 -passout pass:password -out sample.pem 2048

And then extract the private key in DER format:

$ openssl rsa -in sample.pem -out sample.prv.der -outform DER

Is sample.prv.der still encrypted using the passphrase?


texts: Is RSA padding needed for single recipient, one-time, unique random message?

texts:
I want a way to encrypt files using this process: https://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the random password.

I can arrange for the password (= AES key) to be randomly generated every single time, and can arrange things so that doing so again with either the same or a different RSA key will result in a new AES password being generated. My question is whether I need to use padding when doing RSA encryption of the unique AES key.

I've read the answers to several closely related questions, especially Is RSA of a random nonce with no padding safe? and also Does RSA padding have to be unpredictable if the payload is?, which state that padding is necessary. But, as I read the replies, it seems to be necessary in the context of multiple recipients, in which there multiple RSA public keys, but only one random AES password (random but generated once only, not generated anew for each RSA key / recipient).

Basically, in my case, I don't see how padding an already known-to-be-uniquely-random message would make it any more random.

So: Am I just confused and missing something, or are the linked answers only emphasizing
the need for padding in multiple recipient cases (where the password stays the same)?


texts: What conditions does a provable secure cryptosystem satisfy?

texts:
A cryptosystem can be entirely dependent on its underlying problem or it can have a reduction to other known problems. Solvability can be affordable if there exists a reduction of the base problem to another problem, and the last is feasible.

I understand that a cryptosystem is provable secure if it has been well studied during years giving rigorous proofs on:

Cryptanalysis. By analyzing the base problem with existing techniques, measuring complexity (computational hardness), attempting to reduce to an affordable/easier problem.
Implementation. There is an efficient way to describe the cryptosystem in a resource bounded device, where security must be achieved.
Future expectation. Security facts based on theoretical cryptanalytic techniques, where the application of these methods is not feasible nowadays but theorized in the future.

Q: Is there any other condition for a cryptosystem to be stated as provable secure?

Q: Provable secure is not the same as probable secure. Does this last term has a broader definition in Cryptography?

Example, in maths a probable prime it's a pseudoprime (prime with probability threshold). And a provable prime is a prime that has been proved to be prime (i.e satisfies Fermat test and is not a Carmichael Number).


texts: Prove that two MACs with incremendal PRF application are not secure

texts:
How do I prove the following MACs are insecure?

                                            1

                                            2


texts: Finding a secret key corresponding to a public key

texts:
As far as I know, a secret key corresponding to a given public key is not unique. So, for example, there are actually multiple secret keys that can produce the same digital signature under RSA signature scheme.

What I wonder is, how can I compute the expected time to find a matching secret key of a given public key? I assume some details are given like the length of keys, the key generation algorithm etc.

Also, is there a public-key encryption scheme s.t. there's a unique secret key for each public key?