texts: Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

texts:
The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components:

The keyed function $F_k:\{0,1\}^{8n}\mapsto\{0,1\}^{16n}$ based on vectors with randomized padding multiplied with a key dependent matrix as described in a previous question. Let $E_k$ be the $2n\times 2n$ encoding matrix and $D_k$ be the $n\times 2n$ decoding matrix.
A permutation $Perm_0:\{0,1\}^{8n}\mapsto\{0,1\}^{8n}$.
A permutation $Perm_1:\{0,1\}^{16n}\mapsto\{0,1\}^{16n}$.
A function $Stretch:\{0,1\}^{8n}\mapsto\{0,1\}^*$.

Divide the (padded) input plain text $PT$ into $p$ blocks each $8n$ bits long. Insert a random $8n$ bit block after every $n-1$ block.

Generate $16n$ bits random $IV$ and set $ct_0=IV$.
for each $i$ from 1 to $p + \lfloor{p/(n-1)}\rfloor$:

a. if $i\mod8=0$,

i. Use $Stretch(pt_i)$ for generating an invertible $2n\times2n$ matrix A.

ii. Let $E_k = E_kA$.

b. Let $h_i = Perm_1(ct_{i-1})$.

c. Let $m_i = MSB_{8n}(h_i)\oplus Perm_0(LSB_{8n}(h_i)\oplus pt_i)$

d. Let $ct_i = F_k(m_i)$.

Now, it ought to be provable that this cipher is secure if the functions $Perm_0$, $Perm_1$ and $Stretch$ are secretly keyed and pseudo random, but do they have to be? Does it suffice that they are "non-linear" or "weakly pseudo random" and how should those terms in such case be defined?

Note: This is a purely hypothetical cipher, but it is interesting mostly because the randomized padding could be used as a covert channel. If the randomized padding is used as a covert channel, an attacker who is given access to the decryption key will not be able to determine if that key decrypts the actual plain text or the alternative plain text. In that sense the scheme would be an example of deniable encryption. Because of that, the question could be understood as whether anyone in their right mind would have any rational reason for using this cipher for anything except deniable encryption. For instance, would it be plausible that anyone would use it with AES, SHACAL-2 and PBKDF2, and claim the purpose is to preserve long term confidentiality?


texts: What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?

texts:
For the purposes of signing and verifying signatures, what is the value of the hash function?

Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process is still used, is SHA1 only a utility to create smaller data to sign?

The data itself is also sent in the clear most of the time.


texts: curve25519 weak points for contributory behaviour

texts:
The Diffie-Hellman on curve25519 is usually calculated using the base point $(9,…)$ which induces a cyclic subgroup of $G:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times F_p))$ with index 8, i.e. there is a prime $p_1$ such that $|G|=8p_1$ and the order of $(9,…)$ is $p_1$. An attacker does not have to use a multiple of $(9,…)$ though and can even choose an element in the twist group $T:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times \sqrt 2 F_p))$ which has order $|T|=4p_2$ for a prime $p_2$.

Contributory behaviour (afaik) describes the property that none of the participants of the Diffie-Hellman exchange can force the outcome to be one of a small set of values. Such a property is for example interesting to defend against something like the triple handshake attack. The website on curve25519 lists 12 values to reject to assure contributory behaviour.

I understand where eleven of these come from, namely the elements of the subgroups of order 8 and 4 of $G$ and $T$ respectively. As they both share the same identity element ($\infty$) there are $8+4-1=11$ of those elements.

(If an element is not in those subgroups of order 8 and 4, then its order is $\geq \min(p_1,p_2)$ and thus the set of possible values that result out of the multiplication with the private scalar of the other party is large.)

Which of the 12 elements listed on the website is not one of the above eleven and why is it there?


texts:
I am trying to understand why the constants differ in this SHA1 implementation:

https://code.google.com/p/crypto-js/source/browse/tags/3.1.2/src/sha1.js

this._hash = new WordArray.init([
    0x67452301, 0xefcdab89,
    0x98badcfe, 0x10325476,
    0xc3d2e1f0
]);

https://code.google.com/p/google-authenticator/source/browse/libpam/totp.html

V = 0x67452301,
W = 0x88888888,
Y = 271733878,
X = Y ^ W,
Z = 0xC3D2E1F0;

You'll notice the constants in [1] and [2] are different. Is this the result of an optimization, or is there another reason why those constants are different?


texts: Can RSA signing be implemented on top of RSA encryption/decryption?

texts:
I need to use RSA-SHA256 signing. Unfortunately not all Microsoft CryptoAPI providers support that. It's possible that I might get a handle to a CryptoAPI provider that can just encrypt/decrypt with RSA, and maybe sign with SHA1, but not SHA256. Also, the private key might be unavailable (say, it could be in a smart card or some such device).

Is it then possible for me to "fill the gaps" myself? I can, after all, calculate the SHA256 hash of the data myself. Can I then somehow encrypt it with the provider and get a valid signature? Simply encrypting the hash doesn't seem to work (it produces the wrong result).

Or is the signing algorithm a modification of the encryption algorithm, and if the provider doesn't support it, then there's physically nothing that I can do?


texts: How does a backdoor in the RNG enable an attacker to break encryption protocols?

texts:
I'm wondering how a backdoor in a random-number generator (as rumored the NSA have placed), actually compromises the security of things like VPNs or TSL/SSL.

What I understand is that, if such a backdoor exists, then after observing a certain number of pseudorandom bits, the attacker can then predict the rest of the pseudorandom sequence.

Can someone walk through the steps of how this allows an attacker to actually read encrypted packets?  For example, how would an attacker get access to the first N random bits of a pseudo-randomly generated key in the first place.  Is the problem that any random key is effectively only N bits long because if an attacker guesses the first N correctly, he can generate the rest of the key using the backdoor?  Or is it something more complicated.


texts: Information leakage in real-time voice encryption

texts: I saw some time ago a post discussing the issues surrounding encryption of speech/voice in VoIP and how it can leak information (can't find it now). Can someone provide an insight into some of the issues and how to mitigate them if one wants to use symmetric encryption to encrypt voice between two devices? Is asymmetric encryption possible (give the processing time required)?


texts:
I'm writing a TLS 1.2 implementation (in C#) using a custom protocol.
My question is how to generate the IV attached to each message, I don't want to use RandonNumberGenerator because I've heard it is slow.  Instead, I would like to use some PRNG. I'm only going to suppport AES-128/-256.
From reading around I understand that using a random IV and encrypting a counter (should start at a random number) and use that as the IV is OK.  Is that true? After how many uses should I use a new random IV? Can I use the same key for generating the IV and encrypting the message?
Is using .Net's Random class with a seed from RNGCryptoServiceProvider can do the work? After how many uses should I use a new seed?


texts: In Paillier homomorphism how do you substract?

texts:
I'm trying to learn homomorphism so the problem may also be in my code (which I will include).

I want to compute $a - b$ where $a$ is bigger then $b$. In order to do this I tried to compute $\frac{a}{b}$. However when I decrypt this I get garbage. Or ciphertext $c$ is not in $\mathbb{Z}^{*}_{n^2}$.

Now because the problem may also be in my code here it is:

import java.math.BigInteger;
public class Main {
    public static void main(String[] args) throws Exception{
        Paillier pp = new Paillier (2048);
        BigInteger a=pp.encrypt(BigInteger.valueOf(100000));
        BigInteger b=pp.encrypt(BigInteger.valueOf(10000));
        BigInteger c=a.divide(b);
        c=c.remainder(pp.getNsquare());
        BigInteger res=pp.decrypt(c);
        System.out.println("res = "+ res);
    }
}

And I used this library

I also tried to see what happens if you multiply $b$ with $-1$ but that just gave me garbage. Anyone know how to do this?

So so far I tried

$c = \frac{a}{b}$ which tends to result in $c=0$ and unable to retrieve $c$
$c+2^{2047}=\frac{a \times 2^{2047}}{b}$ which results in $c$ is a large number
and $c$ is negative some larger number
$c+2^{2047}=\frac{a \times 2^{2047}}{b}$ inverse mod $N^2$ which results in $c$ is a
large number and $c$ is negative some larger number
$c+2^{2047}=\frac{a \times 2^{2047}}{b}$ remainder $N^2$ which didn't decrypt.

Is this a problem in my code or in my understanding of crypto?


texts: Cryptanalysis to reverse engineer a hash?

texts:
I understand this may not be the best place to ask a question like this, but I believe that this community may be the  best/only place I can ask such a question.

I have inputs and outputs from an in-house hash developed years ago and the developer is no longer working with us any more. I need to determine the process that is the hash. Before you mention how this may be impossible, it appears to be a relatively simple hash and I have a few theories that appear to get me started in the right direction. First, the data:

 Input   Hash
1293239 EHELKHE
1331487 ILZXFZF
1320709 IKYJXWH
1328166 GUVUMMY
1156693 HFXLFYZ
1313273 ELHZLZV
1287367 GKDMWGM
1318623 EHDHYYF

This does not appear to be a very good hash, in my opinion. For starters, the output length matches the input length, this may be coincidence though. The main thing that catches my eye is that the output characters seem to all exist in a particular pool of possibilities. Here's a list of unique output characters: DEFGHIJKLMUVWXYZ. This lines up exactly with the hex values of 0123456789ABCDEF, in fact, in ASCII values, the two sets are 20 off from eachother. So I hypothesis:

D = 0
E = 1
F = 2
G = 3
H = 4
I = 5
J = 6
K = 7
L = 8
M = 9
U = A
V = B
W = C
X = D
Y = E
Z = F

From there, I'm out of ideas. I've compared the hash results with many standard hashes and have seen no correlation and have determined that it is most likely an original process. I've played with the numbers as best as I can and I have made no progress. What techniques are available to analyze this hash?


texts: Request for a zero-knowledge proof (or hint)

texts:
I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key.
More specifically:
Let ek be an encryption key (e.g., ElGamal) and dk the corresponding decryption key.
Let sk be a signing key (say DSA or Schnorr) and vk the corresponding verification key.
Alice wants to prove that she knows private values x, s such that public values
e, vk, ek  satisfy e = Enc_ek(x) and Verify_vk(x, s) = True.
(Here, x is a plaintext value, s is the signature on x, e is the encryption of x. Perhaps I also need a private value for the randomness in the encryption. Alice does not know dk or sk. I suggested using ElGamal/Schnorr, but I'd also be happy if it is in the  RSA framework, or a different one.)


texts: Is it considered good security to give your variables unhelpful names?

texts:
I was exploring my company's codebase yesterday and I noticed one class which had three variables named m_p1, m_p2, and m_p3. These variables are used very often in this class and each has a different, specialized type. (By "specialized," I mean something specific like "EmailSender" or "DateFormatter," not something generic like "int" or "std::vector").
I asked a coworker about this and he said this was a security feature: If our code fell into the wrong hands, it would be harder for a hacker to understand. Thus, our code is more secure.
My first response is that this does make our code harder to understand, but it's only a very minor inconvenience from a hacker's perspective and a minor, but constant, inconvenience for the developers working on the code. This behavior is actually only limited to two classes I could find, so it seems very half-heartedly implemented. I can work around the odd variable names and just try to memorize what corresponds to what, but I'm looking for others' perspective on this issue. Am I underestimating the security benefits or failing to think of something?
EDIT:
Thanks to the comments, I've discovered this question is off-topic for this site. That lead me to look for where it would be on-topic, and I found Security.StackExchange. Furthermore, I found this question which appears to be a near-duplicate of mine. The general consensus is that it does provide some security, but it should not be counted on and confusion to programmers should be considered.
I'm sorry to be off-topic.


texts: Private Information Retrieval and Writing at the same time possible?

texts:
Are there any (possibly multiserver) private information retrieval (PIR) schemes that support private reads and writes (so called PIR Writing) at the same time, while having sublinear (in the database size) communication overhead?
The most recent, very efficient, PIR scheme I could find is the one based on distributed point functions, but it seems to only support one operation at a time. That is, I can either outsource a database, where I have private reads or I can outsource a database, where I have private writes, but not both on one database. Preferably I am looking for something that is not based on heavy tools like FHE.


texts:
if you know the result of a hash, for this example the resulting hash is: ec664d1d65fd8a58c59b337b11c37a4d

And you also know the hash has been made like this:

const salt = "asdjbsdhal"
const password = unknown; // only thing we don't know
const hash = md5(salt + password);

So we know that md5(salt + password) == "ec664d1d65fd8a58c59b337b11c37a4d".

Is there a more efficient way to break this password than brute-force?
The brute-force I'm trying right now is this:

const md5 = require("md5");

const expectedHash = "ec664d1d65fd8a58c59b337b11c37a4d";
const salt = "asdjbsdhal";
let nonce = 0;
let result = "";

while (result != expectedHash) {
  nonce++;
  result = md5(salt + nonce);
}

console.log("Password: ", nonce);


texts: Security model scalar multiplication in NaCl

texts:
I'm having trouble understanding what the “security model” for “scalar multiplication” in NaCl is.

  Security model

  crypto_scalarmult is designed to be strong as a component of various well-known "hashed Diffie–Hellman" applications. In particular, it is designed to make the "computational Diffie–Hellman" problem (CDH) difficult with respect to the standard base.

  crypto_scalarmult is also designed to make CDH difficult with respect to other nontrivial bases. In particular, if a represented group element has small order, then it is annihilated by all represented scalars. This feature allows protocols to avoid validating membership in the subgroup generated by the standard base.

  NaCl does not make any promises regarding the "decisional Diffie–Hellman" problem (DDH), the "static Diffie–Hellman" problem (SDH), etc. Users are responsible for hashing group elements.

Since “crypto_scalarmult is the function crypto_scalarmult_curve25519”, does this mean that Curve25519 does not provide any guarantees for the DDH problem to be hard?

If so, how can one—as suggested—hash group elements to achieve this? E.g., how does one implement elliptic curve El-Gamal in a semantically secure way using this implementation, if possible at all?


texts: Why would my certificate's signature algorithm differ from its keys' signature algorithms?

texts:
I have a signing certificate that I'm loading into an X509Certificate2 object in Visual Studio. I can't get my head around why the certificate itself has one signature algorithm, while the same certificate's public and private keys have a different signature algorithm.

Specifically:

x509Certificate.SignatureAlgorithm.FriendlyName = "sha256RSA"
x509Certificate.PrivateKey.SignatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1"

Does it matter that the former is SHA-256 and the latter is SHA-1?


texts: BOOLEAN FUNCTIONS: generate a function $f: \{0, 1\}^n \rightarrow \{0, 1\}$ from a $n \times n$ S-Box

texts:
I want to calculate the hamming weight of a S-Box using this formula:
$\text{hw}(f) = \sum_{x=0}^{2^n-1} f(x)$.
Where $f: \{0, 1\}^n \rightarrow \{0, 1\}$

My problem is that I don't know how to get the $f$-function.

I found that helpful paper: THE DESIGN OF S-BOXES. At Page 9 (18) boolean functions are described. But she only prints the truth table (Table 2.1) without describing her $f$-function. She only says $f$
is a linear function, therefore I think $f$ depends on my S-Box?

For example, if I have this $2 \times 2$ S-Box:

0    1    2    3
1    3    0    2

$00 \rightarrow 01\\
01  \rightarrow 11\\
10  \rightarrow 00\\
11  \rightarrow 10$

What are the $f$-functions and what is the hamming weight?


texts: Is the cipher "Kalyna" with a 512-bit key length more secure AES with a 256-bit key?

texts: Recently I have found out that Ukraine has its own symmetric encryption algorithm "Kalyna". Developers of this algorithm said that their algorithm is more secure than AES because of longer key length and lack of any vulnerabilities by hardware acceleration (like AES-NI in modern processors). Is it the truth, or is AES better?


texts: Finding the Input if Hash Value, Hash Function, and Key are known

texts:
Let's assume that we have a hash value $h$ is calculated by using HMAC-SHA256.

We have the key $k$. We also know some information about the input:

It contains a pattern like 15 numbers where first 7 are known;

Question: Is it possible to find at least one input $m$ such that $h = \operatorname{HMAC-SHA256}(k,m)$ without generating all possible patterns?


texts: Is an elliptic curve over $\mathbb{F}_p$ order preserving for the points $(x,y) \in \mathbb{Z}_p$?

texts:
Let $E\colon y^2=x^3+ax+b$ be an elliptic curve, and consider its realisation over the finite field of prime order $p$: $E(\mathbb{F}_{p})$.

Then if $0<a,b$ is the following true?

$$\forall x,y\in[0,p) \text{ s.t. }E(x)=y \text{ : }(x_i<x_j)\implies E(x_i)<E(x_j)$$


texts: Link between openssl 'req' command and 'unable to get local issuer certificate'?

texts:
I was using the following command to build a self-signed certificate after creating a private key:

openssl x509 -in "server.csr" -out "server.crt" -req -signkey "myprivate.key" -days 365

After some ensuing troubles, and lots of googling I cobbled together a script, which culminated in:

openssl req -config ${CONFIGFILE} -new -x509 -sha256 -newkey rsa:2048 -nodes -keyout "server.key" -days 365 -out "server.crt"

How does this work, given I'm no longer passing it my "myprivate.key" to actually self-sign the cert?

Is "server.key" now being used to do the signing, and do I need to somehow combine this new key with the original "myprivate.key" to create a keychain? I ask since commandline tools don't seem to like the resulting certificate (e.g. curl says: 'SSL certificate problem: unable to get local issuer certificate').


texts: Single theorem adaptive vs non-adaptive non-interactive zero-knowledge proofs

texts:
I am trying to understand non-interactive zero-knowledge protocols (NIZK). But, I encountered single theorem adaptive and non-adaptive NIZK protocols. According to my understanding,

In adaptive NIZK protocols, simulator ($S$) is divided into two stages ($S_1,S_2$) where in first stage it generates the common reference string and in second stage, it generates the proof for any input using common reference string generated in first phase.

In non-adaptive NIZK protocols, given an input, simulator outputs common reference string along with the proof.

Is this understanding correct?

Is there any way to covert a non-adaptive NIZK protocol to adaptive NIZK?

What is difference between single-theorem and multi-theorem NIZK?


texts: Cryptopals challenge 2.11: Distinguish ECB and CBC encryption

texts:
I'm going through the Matasano crypto challenges (also known as cryptopals) and I recently got stuck in the following challenge: http://cryptopals.com/sets/2/challenges/11

The goal of the challenge is detecting the block cipher mode in AES encryption: ECB or CBC.

I saw the following post that discusses this matter, but it doesn't truly solves the problem: https://stackoverflow.com/questions/17382438/how-to-detect-block-cipher-mode

The only flaw that I know of that can help detecting the mode of operation is that ECB is stateless, i.e. similar plaintext blocks convert to similar ciphertext blocks. But in the challenge it is specified that we need to add a random number of bytes (between 5 and 10) before and after the plaintext, which causes similar blocks to slide a bit so the ciphertext result doesn't necessarily contain similar blocks. Does anyone have any hint or solution to this problem?


texts:
I have a 256bit fully random entropy source from dices, which is probably not cryptographically secure. I have read that it's customary to take the hash of the entropy source in order to generate a safe key.

My goal is to generate a 256bit secure key for cryptographic purposes.

Somebody suggested to me to take the SHA-256 of the entropy source, but wouldn't that cut the entropy in half,as the SHA-256 actually has only 128 bit entropy? So shouldn't I use SHA-512.
Shouldn't I use the SHA3 variant instead of SHA2 as it's newer and more recommended?
Would the resulting key be truly cryptographically secure, unbiased, and uniform?
What happens if I cram more entropy into the hash function, say 270 bits.
What happens if the hash function's output is of more bits than the entropy source (hash 256 bits, but entropy source only 250 bits), what happens then to the security of the key?


texts: What are the advantages of mutual private set intersection methods over finding the intersection of hashed lists?

texts:
I can understand the usefulness of one-way private set intersection methods. Where Alice and Bob both have listed but only Alice learns the intersection of those lists while Bob learns nothing.

I don't understand the usefulness of two-way private set intersection protocols though. If Alice and Bob both learn the intersection of their lists, can't the same result be achieved by a much more simpler method of using a one way hash on the lists, exchanging them and allowing each party to compute the intersection?

What are the privacy advantages of more complicated protocols? I feel like I'm missing something simple here...

I found this related question, however, none of the answers seem to address the question of whether these more sophisticated protocols offer security advantages over the matching hashes method.
Private set intersection, using a semi-trusted server


texts: How much less secure is an algorithm that gives feedback that the password is one character off?

texts:
If we had a stupid login procedure (SLP for short) like in this comic; it gives feedback on login, if the submitted password is one character off.

Would a longer password be less secure? What would the break-even point?

If I had a password with length 1, I would always get feedback, that I am one off, so the SLP would not make the password less secure. If I have length 2, I would get feedback half the time, so the SLP would make a password with length 2 as secure as a password with length 1?

The algorithm I would use to hash those password would be:

hash(password)
for(i=0; i++; i < len(password)
  hash(password.deleteChar(i))

For login:

if(hashAndMatch(password)){
  login()
} else {
  for(i=0; i++; i < len(password){
    if(hashAndMatch(password.deleteChar(i))){
      giveFeedBack()
      break;
    }
   }
   error('Wrong password or username')
 }


texts: Can we use PHE or SWHE instead of bilinear pairings in ZK-SNARKS?

texts: In ZK Snarks bilinear pairings are used to do "encrypted computation". I was wondering if we can use Partial Homomorphic Encryption or Somewhat Homomorphic Encryption instead of bilinear pairings. Can you please elaborate on why they should or should not be used?


texts: How big an RSA key is considered secure today?

texts:
I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the meanwhile?

Edit: Lets assume an appropriate padding strategy. Also, I'm asking both about security of signatures and security of data encryption.


texts: What are the requirements from a Round function in Feistel network?

texts:
Let's assume a balanced network with many (dozens?) rounds. And a simple (selecting key bits) key schedule.
What does it take from the round F function to make a secure block cipher? obviously we need non linearity and some avalanche. But is this sufficient, how can this still fail?
Does a high round count compensate for any mild weaknesses in the F function?


texts: Is there an implemented Id-based key exchange protocol?

texts:
I need to use some kind of authentication of the client during my key exchange process.
During my research, in this article I learned about identity-based key exchange and authentication, and I was very interested in the idea.
However, when I started to search for some protocols I could not find anything further than the Wikipedia page and the most recent solution seems to date from 2001.
Is there anything I am missing? Or am I just searching for the wrong keywords?


texts: Is timing attack practical in a web developer's perspective?

texts: Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within 1 millisecond (I've tried to compare two strings that are both 1000 characters long). Not to mention the variance in time for the network speed. So does it mean timing attack is not practical? What do web developers have to be aware of regarding timing attack?


texts: Is using /dev/hwrng for raw key material secure?

texts:
Is using /dev/hwrng for raw key material secure (as long as you trust the hardware)?
I tested it using the rngtest tool and it has good output.


texts: Is BBS used for generation of keys for any modern cryptosystem?

texts: Is there any (current) cryptosystem or digital signature or cryptographic primitive that uses the BBS PRG in order to generate its secret keys?


texts: Having two messages and a result ciphertext, is it possible to know which one was encrypted using One Time Pad?

texts: I have two messages $m_1$ and $m_2$ and a result ciphertext $c$, one-time pad was used to create the ciphertext $c$, is it possible to know which message was used to generate the ciphertext $c$?


texts: Finding AES ciphertext stealing test vectors?

texts:
I am unable to find any test vector document for AES CTS (ciphertext stealing).

Can you help me to find some by pointing me into the right direction or at an according reference? Do they exist at all?


texts:
Let's say Alice has access only to a value $a$ and Bob has access to both $a$ and $b$. I need Alice to be able to check whether $a<b$ holds, like a relaxed version of the Yao's Millionaire Problem, given that one of them knows both values. The challenge is that the comparison result cannot be trusted if done by Bob, as he may be biased.

Therefore, I thought of two approaches for this problem:

Check whether Bob was honest in his evaluation of $a<b$, maybe by
using ZK-proof; or
Somehow enable Alice to do the comparison
herself without exposing $b$, so that:
$$a < enc_{pk}(b) \iff a<b $$

Which one do you think it would be better to tackle and how?

EDIT: You can assume that both $a$ and $b$ are well defined by a commitment scheme before the evaluation is done.


texts: An attack an encrypted classified data in a theoretical situation

texts:
Lets say for some reason you carry AES-256-XTS encrypted data with using Whirlpool as the KDF. The data is in a 100 MB encrypted container format.

You get caught on the airport by the police. The data is so important to the country that it is the #1 priority of the intelligence service to crack it. However, no social engineering can be applied by the party that takes you in custody.

The computer on which the encryption was done has been overwritten using DoD-5220.22-M. The other party has infinite money and electricity and the best data center available.

How would they attack the file ? Would it be possible in reasonable time (less than 2 years?). If they use some kind of special attack, how would it work?


texts: Proving security of $\Pi' = E_k(E_k(m))$ knowing $\Pi = E_k(m)$ is secure

texts:
I recently started studying cryptography but I am not sure I quite understand the concept of proof by reduction. Question I am trying to solve is as follow:
Suppose $\Pi$ is a symmetric encryption scheme which $ C \subseteq M$ ($M$ is message space and $C$ is ciphertext space). then we have $\Pi'$ with same key generation and decryption algorithm as $\Pi$ ($K' = K , D' = D$) with encryption algorithm as follow
$$E_k'(m) = E_k(E_k(m)).$$
I am trying to proof or reject:
a ) if $\Pi$ is indistinguishable in presence of an eavesdropper (simplest case when attacker can only see a ciphertext) then $\Pi'$ is indistinguishable.
b ) if $\Pi$ is CPA-secure then $\Pi'$ is CPA-scure.
for case a using proof by reduction i came up with solution

$ C \subseteq M $ implies a bijection between $M$ and $C$ so whenever $A'$ guess the chosen bit correctly $A$ will do as well so we have
$$Advantage\: of\:  A \geq Advantage\: of\:  A'$$
So if $A'$ be a attacker with non negligible advantage $A$ will be as well so a is true.
Am I using reduction correctly? What bout part b? Can we use almost same reasoning or there is an attacker for this case to prove $\Pi'$ is not CPA-secure?
EDIT :  regarding @Ievgeni answer for part a one time pad is a counterexample and regarding @Mikero comment i think reduction for part b might be something like below

conclusion :
part a : wrong . and one time pad is an counterexample and first picture is totally wrong.
part b : right . and proof is by reduction(picture two). for this reduction we have
$$Advantage\: of\:  A = Advantage\: of\:  A'$$
so if advantage of $A'$ be non-negligible advantage of $A$ will be too.


texts:
The definition I have is:

Two probability ensembles $X = \{X_n\}_{n \in \mathbf{N}}$ and $X = \{Y_n\}_{n \in \mathbf{N}}$ are computationally indistinguishable if for every probabilistic polynomial-time algorithm $D$, every positive polynomial $p(\cdot)$,
and all sufficiently large $n$ we have
$$
|P(D(X_n, 1^n) = 1) -  P(D(Y_n, 1^n) = 1) | < \frac{1}{p(n)}.
$$

I'm having trouble digesting some ideas and the notation here.

Does $X = \{X_n\}_{n \in \mathbf{N}}$ mean $X = X_1, X_2, \ldots$
where each $X_i$ comes from the same distribution? So if our $X$ distribution is $0-1$ coin flips, then $X$ is an infinite sequences of $0$s and $1$s ?

A note says "typically, each $X_n$ ranges over strings of length $poly(n)$". What does this mean? The distribution will take $n$ as some sort of input? In my coin-flipping example each $X_i$  gives us back just one bit...

I also want to ask why the $1^n$ is necessary as input to the distinguisher $D$, but I should probably understand the answers to my above questions first.


texts: Does XChaCha20 exist with similar properties to XSalsa20?

texts: Does XChaCha20 (built from ChaCha20 just like XSalsa20 is built from Salsa20) exist and have XSalsa20's desirable properties?


texts: Why is a "Signed Digest" different from a "Digest which has been Signed"

texts:
I want to understand why creating a signed-digest of a file is different from creating a digest and then signing it. IE. If I do the latter, the verify fails.

Here is my test script. Can someone please explain why I get "Verify Failed" on the last line please.

#!/bin/bash

set -x

# A file to sign
truncate  --size=2000  test.zip

# Generate a keypair, and extract the public key
openssl  genrsa -aes128  -out keyTest -passout pass:123  1024
openssl  rsa    -pubout  -in  keyTest -passin  pass:123  -out pubTest

# generate a signed digest
openssl  dgst   -sha512 -binary  -sign keyTest  -passin pass:123  -out test.sig  test.zip

# generate a digest, then sign it
openssl  dgst   -sha512 -binary                                   -out test.dgst  test.zip
openssl  rsautl -sign            -inkey keyTest -passin pass:123  -in test.dgst  -out test.sig_dgst

openssl  dgst -sha512 -binary  -verify pubTest  -signature test.sig       test.zip
#Verified OK

openssl  dgst -sha512 -binary  -verify pubTest  -signature test.sig_dgst  test.zip
#Verification Failure  <-- Why does this fail?


texts: how does the simulator work when the corrupted party has no input?

texts:
"the only thing the simulator can do in the ideal model is to choose the corrupted parties' inputs." Yehuda Lindell said.

1- what will happen when the corrupted parties have no inputs to the protocol? e.g. in cases that the corrupted party/parties are just some computing servers with no input.

2- in these cases, is it any relationship between security against malicious and semi-honest adversaries. As I am thinking that, as the corrupted party has no input, anything that a malicious adversary is able to do is also possible for the semi-honest adversary.

if not,

is it possible in any way to conclude security against malicious adversaries in these cases when we have proved security against semi-honest adversaries?


texts: NACL with public key encryption and authentication

texts:
As suggested in this answer i can use nacl for public key encryption with:

ephemeral_pk ‖ box( m, recipient_pk, ephemeral_sk,
           nonce=blake2b(ephemeral_pk ‖ recipient_pk))

But if i want also the sender to verify that it is him. Would the practice to use HMAC with preshared key or using a box as nonce be safe?

Something like:

ephemeral_pk ‖ box( m, recipient_pk, ephemeral_sk,
           nonce=HMAC(ephemeral_pk ‖ recipient_pk, hmac_key))

or like:

ephemeral_pk ‖ box( m, recipient_pk, ephemeral_sk,
           nonce=box(ephermal_pk ‖ recipient_pk,
           nonce=blake2b(ephemeral_pk ‖ recipient_pk),recipient_pk, sender_sk))

I was looking into the tweetnacl implementation. And there it appeared to me that the nonce length is 24 bytes. So i would have to truncate the nonces created with HMAC or box. Would this impact the overall security in an negative way?
The third possibility would be to sign the secret with sender_sign_sk and provide sender_sign_pk to the recipient.
From my trials i got the speed of the hmac solution to be on par with the normal hashing solution. The box solution is about 1.5 times slower and the solution with additional signing is about 3 times slower.


texts: Why do we use (pseudo) random permutations and not (pseudo) random functions for en- and decryption?

texts: Why do we use pseudo random permutations and not pseudo random functions for encryption an decryption?


texts: Crypto USB Devices - where is the PIN/Password stored?

texts:
I am currently looking at the security of cryto USB drives for storing x509 certificates. I have one in possession currently. It can be read/written to using the Microsoft Crypto APIs. Anytime one reads/writes to/from the device it prompts for a PIN. The PIN can be changed using a UI which installs with the device.

I was wondering how exactly this PIN is stored/used?.
Does the device store the PIN on the device itself? Or is the PIN used to generate a symmetric encryption key which is then used to encrypt the contents of the device. Which will mean that only the right PIN will allow you to read from the device and also the PIN is not available on the device itself.

So I was wondering if there is a standard way in which device vendors do this. If so, what is it?

This is what the PKCS#11 standard says

  If a device does not have a tamper-proof environment or protected
  memory in which to store private and sensitive objects, the device may
  encrypt the objects with a master key which is perhaps derived from
  the user’s PIN. The particular mechanism for protecting private
  objects is left to the device implementation, however.

It's not clear what's a tamper-proof environment or protected memory in case of a USB crypto device.


texts: looking for BKZ earliest algorithm and its application in cryptography

texts:
I am reading lattice based cryptography for my master thesis,
I am looking for the earliest version of BKZ algorithm, and its applications in cryptography, to understand it very well, I already know about LLL algorithm.
and thanks in advance


texts: How is the message digest related to Signatures and Encryption?

texts:
I was studying about 'Data Security' and I found out this one thing confusing.

What is a message digest? I got it is the hash of the message.

Is the message here referring to the plaintext or cipher text? I believe when using Digital Signatures, the message itself is also encrypted with a public key.


texts: Words having weight near to minimum distance

texts:
I am studying the NP-Problem of the codes Syndrome Decoding. The formulation is show below.

Input: a binary matrix $H$ of dimension $r \times n$ and a bit string $S$ of length $r$.

Property: there exists a set of $w'$ columns of $H$ adding to $S$ (with $0 < w'  \leq w$).

I understand that this problem is hard if the code is unknown. But if the code was know (i.e. we know its construction), for example a Goppa code where we know the support of the code and the polynomial that generates that code. Is there some class of codes where it is easy to generate several words, of certain class of codes, with the same weight and the same syndrome and the problem above is still hard?


texts: Is the one-time-pad a secure system according to modern definitions?

texts:
Occasionally I hear people say that one-time pads are "useless" or even "broken".

  "modern cryptography knows more security definitions, under some of
  which the one-time pad is completely broken."
  -- How do we know a cryptographic primitive won't fail suddenly?

...

  One time pad: why is it useless in practice?

...

  "we don’t need (and shouldn’t want) to use one-time pads"

...

  "The one-time pad is not a semantically secure encryption
  algorithm."

...

  "One-time pads may be theoretically secure, but they are not secure in
  a practical sense."
  -- Bruce Schneier

What specifically are these "modern ... security definitions", and how exactly is the one-time pad completely broken?


texts: RSA-based encryption scheme and random oracle

texts:
I don't really get how this problem should be solved. My main issue is with the random oracle generally, a short explanation of ROs and how they are used in such proofs maybe with this example will hopefully clear that up.

Consider the RSA-based encryption scheme in which a user encrypts a message
$m ∈ \{0,1\}^{l}$ with respect to the public key $(N, e)$ by  computing $$m':= H(m)\|m$$
and  outputting  the  ciphertext $$c:=m'^{e} \mod N.$$ (Here,let $H:=\{0,1\}^{l}→ \{0,1\}^{n}$ and assume $l+n<\|N\|$, the bit-length of $N$). The receiver recovers m'
in the usual way and verifies that it has the correct form before outputting
the $l$ least-significant bits as $m$. Prove or disprove that this scheme is CCA-secure if H is modeled as a random oracle.


texts:
I have read the paper Differential Power Analysis of HMAC SHA-2
in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written:

  The  last  remaining parts H$^{(0)}$ and C$^{(0)}$ can be recovered by making substitutions in Alg. 1:  in Step 7 of round 1, where
  H$^{(0)}$ is the only unknown variable, and similarly in Step 8 of round 1 where C$^{(0)}$ is the only unknown variable.

The substitution for $H^{(0)}$ is clear to me:

$T_1^{(1)} = \delta^{(0)} \boxplus W_1$ (1)
$T_1^{(1)} = H^{(0)} \boxplus \sum_1(E^{(0)}) \boxplus Ch(E^{(0)},F^{(0)},G^{(0)}) \boxplus K_1 \boxplus W_1$ (2)
(1) = (2):
$\delta^{(0)} \boxplus W_1 = H^{(0)} \boxplus \sum_1(E_0) \boxplus Ch(E^{(0)},F^{(0)},G^{(0)}) \boxplus K_1 \boxplus W_1$
$\delta^{(0)} = H^{(0)} \boxplus \sum_1(E^{(0)}) \boxplus Ch(E^{(0)},F^{(0)},G^{(0)}) \boxplus K_1$
$H^{(0)} = \delta^{(0)} \boxminus \sum_1(E^{(0)}) \boxminus Ch(E^{(0)},F^{(0)},G^{(0)}) \boxminus K_1$

But for $C^{(0)}$ I don't know how to start and my other problem is that I don't know how to substitute in the function Maj?


texts: Questions regarding parallel AES CTR with merkle trees

texts:
I'm planning to implement a parallelizable variant of AES to end-to-end-encrypt files in a web application.

As a mode of operation I'm most likely gonna use CTR mode with a 64 bit IV and 64 bit counter, since that allows for easy parallelization.

Now it would also be great to be able to verify that the message wasn't manipulated, so I have to hash it somehow. However, most "normal" hash methods don't work in parallel, which is why I want to use a merkle tree.

From my understanding, it should be possible to encrypt, decrypt and verify the data completely in parallel, is that true?

In addition to that, I've seen that a lot of hashing methods (like GCM) verify the length of the ciphertext. Is that necessary with a merkle tree? I'd assume that the way such a tree builds the hash, it would be really hard to manipulate the length.

Also, should I hash the plaintext or ciphertext? and how should I encrypt the hash value?

Note: I'd like to avoid GCM, since it performs quite poorly on some devices I have to support.


texts: Understanding hybrid arguments in detail

texts:
Assume we are given three distributions $H_{1}$, $H_{2}$ and $H_{3}$ and the following security games:

$Game_{1}$: Distinguish between $H_{1}$ and $H_{3}$.
$Game_{2}$: Distinguish between $H_{1}$ and $H_{2}$.
$Game_{3}$: Distinguish between $H_{2}$ and $H_{3}$.

I am trying to prove that for every adversary A, $Adv_{Game_{1}}(A)\leq Adv_{Game_{2}}(A)+Adv_{Game_{3}}(A)$.

Starting the proof, from the definition of the advantage, $Adv_{Game_{1}}(A)=|\Pr(A$ guesses $H_{1}|H_{1})-\Pr(A$ guesses $H_{3}|H_{1})|=|\Pr(A$ guesses $H_{1}|H_{1})-|Pr(A$ guesses $H_{2}|H_{1})+\Pr(A$ guesses $H_{2}|H_{1})-\Pr(A$ guesses $H_{3}|H_{1})|$.

The problem is that when I attempt to use the triangle inequality, I will need to be able to write $\Pr(A$ guesses $H_{3}|H_{2})$ in terms of $\Pr(A$ guesses $H_{3}|H_{1})$ and also $\Pr(A$ guesses $H_{2}|H_{1})$ in terms of $\Pr(A$ guesses $H_{2}|H_{2})$. Any idea on how to do this?


texts: If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

texts:
Say we construct a pseudo-random generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back into the PRF to produce a new block of pseudo-random bits. That is, $B_{i+1} = f_k(B_i)$. Is that backtracking-resistant?

I thought it would be backtracking resistant because if we compromise the internal state of the PRG at time $t+1$ (meaning the adversary gets $k$ and $B_{i+1}$), then we can't find any of the previous blocks $B_i$ (for $i < t+1$), since the PRF is hard to invert.
That is, $B_{i+1} = f_k(B_i)$, so we want to find $B_i$ by doing $B_i = f^{-1}_k(B_{i+1})$, but we can't invert it.

Am I missing something? Apparently it's not backtracking-resistant because the key isn't being changed, whereas other PRGs such as HMAC-DRBG are, because they update the key.


texts: What is the relationship between entropy conditioning and final output bias in a TRNG?

texts:
This question concerns the conditioning and output of true random number generators.  It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It defines an $ n $ length bit string as having full entropy (ideally random) as:-

  ...if that bit string is estimated to contain at least
  $ (1-\epsilon) n $ bits of entropy, where $ 0 \leq \epsilon \leq 2^{-64} $.

Now to obtain a bit string containing full entropy, the document recommends a conditioning operation listed in Appendix C.  The smallest internal block width of any of these functions is 64 bits for treble DES.

And the document also says that if you follow this recommendation, you'll get a full entropy $ t $ length bit string from the conditioner's output:-

  If $ t \leq \frac{n}{2} $, then the output string has full entropy output .

This is the common rule of thumb for outputting half of the hashed input entropy in a TRNG.  My question therefore is what is the relationship between $ \frac{n}{2} $ and $ 2^{-64} $?  More specifically, what would the maximum of $ \epsilon $ be for $ \frac{n}{4} $?


texts:
Please note I am new to Cryptography in general. Sorry if I do not use the correct terminology/my question has some fundamental flaw.

Alice and Bob want to communicate securely over an insecure channel. They decide to use Ed25519 with both an identity key (IdkAlice & IdkBob) and an ephemeral key (EpkAlice & EpkBob) for forward secrecy. Then both compute

SK1 = ECDH( IdkAlice, IdkBob )
SK2 = ECDH( EpkAlice, EpkBob )

SKEY = SHA256( SK1 | SK2 )

and use SKEY as the key in some symmetric cipher.

My question is: How many bits of security is provided in this key exchange?

My assumption is that because Ed25519 provides ~128bits the attacker would need to try $2 \cdot 2^{128}$-times but I'm not sure. (Ignoring active attacks on the key exchange)


texts: do koblitz curves over $\mathbb{F}_{P}$ as generalized in SEC2 always have $a$ as 0?

texts:
I reviewed all the curves in http://www.secg.org/SEC2-Ver-1.0.pdf . All the secp*k* curves have the $a$ parameters as 0 and those are the only ones with the $a$ as 0.

Is this a defining requirement of a Koblitz curve - that the $a$ parameter must be 0?

http://www.secg.org/SEC2-Ver-1.0.pdf#page=10 says the following:

  The name Koblitz curve is best-known when used to describe binary anomalous curves over $\mathbb{F}_{2^m}$ which have $a, b \in {0, 1}$. Here it is generalized to refer also to curves over $\mathbb{F}_{P}$ which possess an efficiently computable endomorphism

While $a, b \in {0, 1}$ appears to be true for $\mathbb{F}_{2^m}$ it does not appear to be true for $\mathbb{F}_{P}$. In particular, $b$ is not $1$ in any of these curves. In secp224k1 it's $5$. In secp256k1 it's $7$. Maybe the generalization allows for $a \in {0, 1}$ whilst requiring $b = 0$ in $\mathbb{F}_{P}$? Maybe in the generalization $a = 0$ is a requirement? Or maybe the fact that $b = 0$ in all these curves is still, despite the generalization, is none-the-less by random happenstance?


texts: Does Rabin function lose its one-way property if squaring mod a prime?

texts:
I am looking into various one way functions and I stumbled upon a Rabin function, which is squaring modulo an RSA modulus $N=pq$, where $p,q$ are prime: $R_N(x) = x^2 \mod N$.
Would it lose the one-way property if $N$ is prime and not a product of two primes?
UPD: Also, is Rabin function still one-way if factorization of $N=pq$ is known?


texts: Keccak padding implementation, and bit ordering

texts:
I am trying to implement Keccak in Java for my school work. And I am getting stuck in two places:

On the summary page the padding is shown as

  P = M || 0x01 || 0x00 || … || 0x00
  P = P xor (0x00 || … || 0x00 || 0x80)

However on the specification page section 1.1.2 they mention the variable rate padding as 10*1.

The way I read it, to prepare message for absorption phase, you cut your message into pieces of size r (bit rate). To get message length multiple of r you would append or concatenate the message with just, (for simplicity I am considering just bytes) in case just 1 byte padding required it will be 0x81. And if more than one byte required then it would be 0x80...0x01. So my padding implementation would be something like

  P = M || 0x80...01

Where am I reading the specification in wrong way?
How is the placement of the bits in the state? I mean if I have a message of say 2 bits, then my bit goes to state position S[0][0][0], but then where should I place the next bit in the same row that is S[0][1][0] or in the same lane that is S[0][0][1]. I would have assumed to go with placing the bit in next cell in the row, and then when you are finished with bits from one slice, then you again start with [0][0] position in next slice. But the way most of the functions are defined with respect to slices, makes me think, it could be other way around. I am unable to find in specification, where they clearly mention this.

Please just point me to places in specification which can resolve my confusion. Thanks.


texts: Unsure of syntax used in Searchable Encryption

texts:
This image is taken from Algorithm 1 from "Σoφoς – Forward Secure Searchable Encryption, CCS '16".

On line 4 there seems to be a new variable, M, that is never defined throughout the rest of the paper. Should I attain a random byte[] and set that as the value of ST_0?

This is being implemented on a Java programme.


texts: Symmetric cipher key size vs number of rounds. Longer key = more secure cipher?

texts:
I would have questions related to discussion under this article.
Bruce Schneier answered questions regarding key size vs number or rounds:

  Why do you need more rounds with longer keys? And how did you come up with these seemingly arbitrary numbers for more rounds?

  When block ciphers get broken, they're invariably broken due to
  diffusion failures. What more rounds give you is more diffusions ...
  the key is twice as long, so it takes more rounds to get complete
  diffusion of the key.

  As to your second question, choosing the number of rounds for a cipher
  is a combination of experience and guesswork.

For example Threefish 512 has 72 rounds and Threefish 1024 has 80 rounds.

I would like to know your opinion on theses questions:

If Threefish 1024 would have only 72 rounds (as Threefish 512), could it be in some way less secure than Threefish 512?
If the number of rounds is a "guesswork", could Threefish 1024 (full 80 rounds) be still less secure than Threefish 512 (72 rounds), because of "incorrect guesswork" (8 additional rounds wouldn't be enough to provide more diffusion to maintain the longer key)?


texts: How HMAC is calculated for TLS AES_128_CBC_SHA

texts:
The RFC 5246 defines generic block cipher as follow:

struct {
          opaque IV[SecurityParameters.record_iv_length];

      block-ciphered struct {
          opaque content[TLSCompressed.length];
          opaque MAC[SecurityParameters.mac_length];
          uint8 padding[GenericBlockCipher.padding_length];
          uint8 padding_length;
      };
  } GenericBlockCipher;

The MAC is generated as described in Section 6.2.3.1.

Does HMAC cover IV, padding and padding_length fields ?


texts:
I am implementing shake in 32-bits microcontroller, so I would like to use bit interleaving.
I checked the code in: https://github.com/floodyberry/supercop/blob/master/crypto_hash/keccak/simple32bi/Keccak-simple32BI.c but I do not understand how is the bit interleaving transformation done in this code. Could anyone give an insight for understanding this.

Also, I compare the results of the function KeccakF for previous link and the 64-bit implementation (https://github.com/floodyberry/supercop/blob/master/crypto_hash/keccak/simple/Keccak-simple.c) and the result is not the same. they are supposed to be same or aren't they?

Thank you


texts:
I am working on Ciphertext-Policy Attribute based Encryption (CP-ABE) and I need to understand how a secret key looks like.

For example, assume that the universe of attributes is defined to be {A,B,C,D} and user 1 receives a secret key (SK) to attributes {A,B} such that: A="NY" and B="Computer". My question is: Does SK have a certain structure or is it a bit-string? More specifically:
- Does it leak the name of attributes the user have (in this case A and B)?
- Does it leak information about "NY" and "Computer"?
- If I generate another secret key for attributes A, B and C, can I distinguish between the two secret keys by just looking at them?


texts: Which AES modes can decrypt from anywhere in the ciphertext

texts:
CTR is amenable to parallelization because you can split the message into chunks, each chunk having a range of counter values associated with it, and encrypt (or decrypt) each chunk independently. What I would like to know is if any other modes can do this?

EDIT:

My reason for wanting to know this is that I have a class with and encrypt function, and if you encrypted two plaintexts with CBC mode for example, it encrypts them from scratch. If I'm using a mode in which that doesn't matter, CTR for example, then I won't raise an error if the user tries to encrypt another block.


texts: security for PRF when key is changed often

texts:
Here's the situation. Suppose I have a secure PRF $F$ and use $F$ in the following way:

for equal size message $m_i$ in $\{m_j\}^{q}_{j=1}$( $q=poly(n)$, $n$ is security parameter ), randomly select $k_i \xleftarrow{\$}K$ and compute $c_i=F(k_i, m_i)$, where $K$ is key space. All previous computation results $\{(k_j, m_j, c_j)\}^{i-1}_{j=1}$ are revealed to adversary $A$ when using ($k_i$, $m_i$) to evaluate $F$. The main point is that the key is changed and some previous keys revealed, which is different to traditional pseudo-randomness definition of $PRF$. My security goal is adversary $A$ cannot distinguish $c_i$ from a random string $r_i$ using any $PPT$ distinguisher $D$. Intuitively, I think $F$ is secure in this setting. Is there any formal security model for this situation? and under what situation is it secure or insecure?


texts:
We know a standard way (cf. RFC 6979) to derandomize ECDSA signatures, i.e., to generate ECDSA signature without an external source of randomness.

Is there any similar standard way, or academic-proof way, to derandomize RSA-OAEP encryption?


texts: Multiplication under different keys in BGV

texts:
I have a question about BGV homomorphic encryption. If we have ciphertexts c1 and c2 under the same key s, the tensor product c3 of c1 and c2 can be decrypted by the tensor product of s and s. If c1 is under key s1, and c2 is under key s2, can we decrypt c3 with the tensor product of s1 and s2?
The paper of BGV I have read is Fully Homomorphic Encryption without Bootstrapping.


texts: How does the key size per data bit influence the security?

texts:
The likelihood of breaking, for instance, an AES-128 cipher is 100% after $2^{128}$ tries in brute force, meaning that I've got to try $2^{128}$ keys to certainly break it.

What if I (hypothetically) had recorded $2^{128}$ bits of data encrypted with the same AES-128 key? How does this help in cryptoanalysis?

And how is the situation differently if or if not a part of this data (e.g. word file headers, specific telnet handshakes, whatever) was known plaintext?


texts:
Are these distributions computationally indistinguishable ?

$f:\{0,1\}^n \to \{0,1\}^n $

$\{X_n\}_{n\in N}$ : uniform distribution for function which $f(0^n)=0^n$  and for other function probability is zero.

$\{Y_n\}_{n\in N}$ : uniform distribution for function which $f(0^n) \neq 0^n$  and for other function probability is zero.


texts: Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

texts:
The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices”  (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital signature scheme based on lattices.

However, it worries me for two reasons:

There is no proof of post-quantum security.
There is no proof that the running time does not depend on the secret key.

The first appears to be a technical limitation of the proof technique and unlikely to lead to a practical attack, but the second one is definitely exploitable if my fear is real.

Does the running time actually depend on the secret key?


texts: The RSA-2048 Crypto Ransom Virus has devastated me, I tried the backup method, the previous version, the Shadow Explorer, it deleted all my restore points, Its took out 5 HDs and my USB pen that happened to be plugged in, everything is encrypted, all my kids pictures and videos, spreadsheets, PDF's, Music and more. I need to know if I should pay these bastards? or is it possible to decrypt? I have attached a picture of the DECRYPT_INSTRUCTION.HTML. I also tried TeslaDecoder with no luck. Can someone please help? I also can send you one of my encrypted files.


texts:
Is there any algorithm that allows to set up a VRF (Verifiable Random Function) from a set of Keypairs such that the knowledge of one private key and all the other public keys is enough to compute the VRF output as well as the Proof and the knowledge of all public keys allows verifying the output?

A search on my side has yielded no results but I'm not sure that I use the right keywords. I found threshold variants which when setting the threshold to 1 would work but they require a setup phase for generating the secret keys but I need to generate the group's ad hoc and I would like to avoid a high communication complexity.


texts: Differences between methods of hardware random number generators

texts:
I'm reading about various hardware random number generators which - among others - implement the following approaches:

Analog-to-digital converter noise
Johnson–Nyquist noise
Reverse biased semiconductor junction
Avalanche diode with optional atmospheric noise
Edit: Modular entropy multiplication

What are the practical pros and cons of these approaches? Is any of these methods "better", more reliable, or more resistant to physical attacks than the others?


texts: Generating RSA signature, by manipulating shorter message signatures?

texts:
Given a server that can return me RSA sign for any plaintext shorter or equal length of the given plaintext (excluding the given plaintext), how can I fraud/get the sign of the given?

$$sign = M^{d} \pmod{N}$$

$m$ is 63 bytes, if not it is left-padded with zeroes
$M = \mathtt{0x00}\mathbin\|m\mathbin\|\mathtt{0x00}\mathbin\|m$, which is always 128 bytes
$(e,N)$ is public key
$(d,N)$ is private key
$N$ is 128 bytes long


texts: What is the purpose of multiple key addition layers in AES?

texts:
I understand the purpose of the SubBytes layer (confusion) and the ShiftRows and MixColumns layers (diffusion).

But I don't see the purpose of having more than one key addition layer. What I've been able to find is that it can mitigate side channel attacks if the AES implementation leaks information, but I don't see the connection there.


texts: Advanced Access Content System (AACS) and Subset Difference techniques for Broadcast Encryption

texts:
I'm trying to get a grasp on AACS and Subset Difference (archived version with images) for a project I'm working on and am having a hard time coming up with a technically valid layman explanation, let alone implementation.

Is it fair to say that the content is encrypted once per public key (device key), resulting in several copies of the movie on the same DVD?...  given that a DVD player can only read one (singular) copy of each of those encrypted streams?

What s a better explanation?


texts: Extractability of random oracle in simulation-based proof

texts:
I am working on the simulation-based proof, where Random Oracle (RO) is used to extract malicious parties' input. In particular, the RO considered in the proof has a small range (whose size is independent of any security parameter and is a constant). Such a small range can result in a non-negligible collision rate.
The proof can be simplified as follows. The malicious $P_1$ has access to RO and queries RO with its (maliciously-chosen) input $x$. Now, the simulator wants to extract $x$ by observing the RO queries that $P_1$ has made. However, given that (probabilistic polynomial-time) $P_1$ can query RO for polynomially many times before the simulator's extraction, there may be several distinct inputs corresponding to the same RO response due to collision. That is, the list of RO queries is long and each possible response may have several pre-images in this list. How can the simulator successfully extract the exact $x$ in this case? Is it reasonable to conclude that RO can be used to extract inputs only if it has a negligible collision rate?


texts: How to protect from Silver–Pohlig–Hellman algorithm

texts:
I read that Silver–Pohlig–Hellman algorithm solves the discrete logarithm with prime module $p$ in $O(\log^2(p))$ if $p-1$ is a smooth number. This seems pretty fatal for cryptography, since it is a polynomial over the key length, right?

So my questions are:

How probable is this to happen?
(How) can it be prevented?


texts: Does this block cipher mode allow for decryption?

texts:
Is there's a way for someone (with the key) to decrypt a message encrypted with the cipher mode shown?

$$ P_0 = IV $$
$$ C_i = P_{i-1} \oplus E_K(P_i) \oplus P_i $$


texts:
I am looking towards using NSS in a Linux application that makes use of a TPM (HSM). So, I am checking the support of PKCS 11 in NSS, at least for the management of Elliptic Curve keys, signature with EC keys, RNG.

I read contradictory things. First, on the NSS site, it is said that only a subset of PKCS #11 is supported, and elsewhere, that it supports it natively as a mandatory layer. Then a software TPM is available for the case a hardware one is not available.

What is the status here? Does NSS fully implement PKCS 11, or only partially? If partially, is there a list of supported features somewhere, more friendly than reading the code?


texts:
Let's try to solve a discrete logarithm:

  $\beta \equiv \alpha ^{x} \bmod \,\, p$

using the Pohlig-Hellman algorithm. Let's suppose that $p-1=tq$, where $q$ is a large prime number. This means that the resolution is probable infeasible, however, if $t$ is factorizable with small prime numbers the algorithm
can determine the discrete logs $\bmod t$ in an efficient way.
But at this point, what i do with the discrete logs $\bmod t$?

I am also having trouble understanding this passage:

  Note that even if $p - 1 = tq$ has a large prime factor $q$, the algorithm can determine discrete logs mod $t$ if $t$ is composed of small prime factors.  For this reason, often $\beta$ is chosen to be a power of $\alpha^t$.  Then the discrete log is automatically $0$ mod $t$, so the discrete log hides only mod $q$ information, which the algorithm cannot find.  If the discrete log $x$ represents a secret (or better, $t$ times a secret), this means that an attacker does not obtain partial information by determining $x \bmod t$, since there is no information hidden this way.  This idea is used in the Digital Signature Algorithm, which we discuss in Chapter 9.


texts: Is my block cipher ready for the real world if it passes all AESAVS tests?

texts: If I validate my  implementation(s) of Rijndael against the  Advanced Encryption Standard Algorithm Validation System (AESAVS) specified validation testing requirements is it fit for purpose and real world use cases? Can I then state as much? What about other ciphers and their test vectors that lack NIST authority?


texts:
I know that for Poly1305-ChaCha20 reusing the key does reveal information about the plaintext. How it is for the Poly1305 MAC algorithm? Revealing information about the plaintext is not a problem at all, as it is available in plaintext anyways.

Question: Does a reuse of the Mac key reveal information about the key itself ?

Source: https://tools.ietf.org/html/rfc8103


texts: Cryptography behind the Turing Imitation Key (TIK)

texts:
When browsing the internet I found out about this amazing phone. Well, it would be amazing if it was actually obtainable. It's called the Turing Phone, and it is supposed to come with as good as unbreakable cryptography:
http://www.ibtimes.co.uk/turing-phone-liquid-metal-smartphone-impossible-hack-offering-true-offline-encryption-1498003
Warning: ads, crashing Adobe plugins and the like

"We have what we call a master public key and a master private key, and instead of hosting the keys on a server, we bundle these two keys into a hardware chip on the Turing Key that we call the Turing Imitation Key (TIK)," he explained.
"Basically, the technology allows users to exchange crypto keys in an offline setting, which is called a static key exchange. This means that when I send you information like email, an SMS text message or files, I would first obtain your identity and then the key can be created and authenticated prior to any sort of communication, so you know the information will safely and securely reach only the device intended."

and further

In addition, Chao and his colleagues' work on the TIK has been certified by the International Telecommunication Union (ITU) to become a new global security standard – the ISO 29181-5.
"It's literally impossible to hack the phone as the keys reside inside the hardware chip. Whenever you have a hardware key it locks down the system, and the TIK can issue 10^48 pairs of master public keys and master private keys, which is infinite," said Chao.

So it's supposed to be described in ISO/IEC TR 29181-5:2014 but as I haven't seen a single reference to that document, which makes me a bit reluctant to download it. It's only 6 pages, 38 Swiss Franks and it says that it just contains a problem statement / requirements.
Note that he also mentioned this piece of bull:

"Today, we have [security technologies like] Public Key Infrastructure (PKI) and Identity based Encryption (IBE). You submit a private key to a public server where a public certificate is issued to sender and receiver, so we refer to that as a centralised third-party certificate issuer," TRI's chief executive SYL Chao told IBTimes UK.

The phone would carry a Turing Coin too, but I have seen even less information about that piece of technology.

If this is real tech, then I would guess something based on static-static DH key exchange.

So the question is: Does anyone know the underlying cryptographic principles behind this phone and the Turing Imitation Key?


texts:
What would be a minimalist memory-hard function, reasonably conjecturable to

require $\approx2^k$ bits of memory per running evaluation, $k\approx32$;
require $\approx2^n$ R/W accesses to $2^w$-bit words per evaluation, $w\approx6$ (likely $n\ge k-w+3$ or something on that tune);
be practically impossible to significantly optimize using a much smaller cache memory or a different word width so as to lower the above number of accesses?

My purpose is convincing a hardware designer that speeding-up a full-blown memory-hard function, much beyond the cost of main memory accesses, is doomed; see comments there. I thus don't care about proof of the conjectures, that auxiliary functions (as used for computing addresses and data) offer more than basic cryptographic strength, resistance to hypothetical optimizations requiring at least twice as much more main memory, side-channel resistance..


texts: Shanks's Babystep Giantstep Algorithm running time BigO

texts:
I am working through Introduction to Mathematical Cryptography and am not in school anymore, so I don't have any advisers or peers to ask (my background is a BS in math). In the text they present the Shanks's BS-GS Algotrithm with a proof. I am having trouble figuring out how the total running time of the algorithm follows from the running time its parts.

The algorithm says to create two lists which each have length $n$. I understand how this ends up being about $2 \cdot n$ multiplications. Then they say comparing the lists takes $\operatorname{BigO}[\log(n)]$ steps and then jump straight to "hence the total running time is $\operatorname{BigO}[n \cdot \log(n)]$." Since the steps are done separately, why do we multiply instead of add the running times?


texts: How hard are discrete logarithms problems in $\mathbb Z^{*}_{n}$ and $\mathbb Z^{*}_{n^2}$, where $n$ is the RSA $n=pq$

texts:
Use the notations form the Wikipedia article Paillier Cryptosystem
, assume that the chipertext $c$ and $c^{\lambda} \mod n^2$ are both given, is it possible to compute $\lambda$ easily?


texts: Uniformly distributed secure floating point numbers in [0,1)

texts:
Is there any way to generate

cryptographically secure
uniformly distributed

floating point numbers in the interval [0,1)?

For example, in Javascript, there is Math.random(), which yields these (pseudo-random) numbers, yet not cryptographically secure.

There are several algorithms at https://stackoverflow.com/questions/686353/c-random-float-number-generation, yet at https://stackoverflow.com/questions/34575635/cryptographically-secure-float, the problem of denormal numbers was pointed out.
Inversion sampling as of Wikipedia requires a uniformly distributed [0,1) number to start, so this is seemingly not trivial to apply.

What is a good approach?


texts: Is a collision attack possible on MD5 if message is known partially

texts:
Is it possible to find $m'$ such that $\operatorname{MD5}(m'||m_1)=\operatorname{MD5}(m_1||m_2)$ if I know $m_2$ and $\operatorname{MD5}(m_1||m_2)$? Is this a collision or a preimage attack?

Also in this case is it possible to find $m'$ and $H$ such that $\operatorname{MD5}(m_1||m')=H$ if I know $\operatorname{MD5}(m_1||m_2)$ and $m_2$?

Basically a message like $(M,\operatorname{MD5}(M||m1))$ is sent from server to client (only client and server know $m_1$). So is there an attack in this scenario?


texts:
I have this textbook definition, I shall include below.

GenModulus denotes a ppt algorithm that, on input $1^n$, outputs $(N, p, q)$ where $N = p\,q$ and (except with negligible probability) $p$ and $q$ are $n$-bit primes.

A few pages back in the book, it did say $1^n$ was the security parameter, which I assume applies above.
My first question is, what exactly is an $n$-bit number? I assume, to use an example with decimals, that $3$-bit would be a number no greater than $111$ in binary which is $7$ in decimal.
My next question is, what do they mean by negligible probability within the context of this question? I assume it means the two prime numbers $p$ and $q$ are guessable by an adversary with negligible probability.


texts: Curve25519 - Alice can decrypt her own message to Bob?

texts:
I'm developing an application with multiple clients and one server.  All clients will have the same hard-coded Curve25519 key pair as well as the server's public key.  The server will have its own key pair as well as the clients' public key.

The idea was to allow communication between server and clients without any concern that the data from one client could be intercepted and decrypted by an attacker possessing the client key pair, nor could they originate messages that appeared to be from the server in order to control other clients.

I'm using libsodium and the crypto_box functions, and noticed that the following scenario works, which really puzzles me:

Alice has a key pair, pKa and sKa.
Bob has a key pair, pKb and sKb.
Each also have each other's public key (pKa and pKb)

Alice wants to send a message to Bob, so she passes pKb and sKa to crypto_box.
Bob can decrypt the message by passing pKa and sKb to crypto_box_open.
However, Eve has a copy of Alice's key pair and intercepted the outgoing message.  She uses crypto_box_open and passes in pKb and sKa, the same keys that were used to encrypt the message. This yields the plain text message.  She changes the message, re-encrypts it, and sends it on to Bob.

I'm relatively new to crypto, so I'm sure I must be doing something wrong or just misunderstanding the application of the technology.  If someone could help me out, that would be awesome.


texts: Is Elliptic Curve Diffie-Hellman (ECDH) still secure if I use the public key more than one time?

texts:
Elliptic Curve Diffie-Hellman (ECDH) with

Public parameters: Ep (a,b) and G  = (x, y)
Private Keys: Na, Nb
Public Key: Pa = Na x G, Pb = Nb x G
Secret key: k = Na x Pb = Nb x Pa

Is the algorithm still secure if public key Pb is used more than once with different private keys Nb? Or are there any requirements to use use a public key more than once in a secure way?


texts: Why is it that researchers prefer finding secure software solutions over secure hardware solutions?

texts: My understanding is crypto researchers tend to prefer solving a problem in software without the need for secure hardware.  Why is this? What is the big problem with using secure hardware if the hardware components are cheap and can be easily made?


texts:
I see sometimes signatures schemes with appendix. This is about signatures schemes in which the message is needed in the verification algorithm, that is, the ouput of the signature algorithm is of the form $(M,s)$

The appendix is referred to the message or the signature ?

Thank you.


texts: Extracting RC4 and 3DES keys from system memory

texts:
I have read papers [1], [2] that have presented techniques on extracting symmetric encryption keys from memory during the process of encryption. There are tools [3] that can extract AES keys from memory.

These techniques look for round keys in the memory using a sliding window approach. However, I have only seen them implemented for AES keys. Does that mean that for other symmetric ciphers, such as 3DES or RC4, we cannot feasibly locate the encryption keys in memory during encryption using similar techniques? Do other symmetric encryption algorithms have such patterns that can help locate keys in memory?

  [1] Halderman, J. A., Schoen, S. D., Heninger, N., Clarkson, W., Paul,
  W., Calandrino, J. A., ... & Felten, E. W. (2009). Lest we remember:
  cold-boot attacks on encryption keys. Communications of the ACM,
  52(5), 91-98.

  [2] Kaplan, B. (2007). RAM is Key Extracting Disk Encryption Keys From
  Volatile Memory.

  [3] https://github.com/makomk/aeskeyfind


texts: Solving Quadratic equations in Galois Field (2^163)

texts:
Hello I am working on implementing a message to elliptic curve point mapping hardware circuit
I have done some research and found out the koblitz mapping method:
I will be using a field of binary polynomials F(2^163) the equation will be of the form of :
$$
    y^2 + xy = x^3 + x^2 + 1
$$

The given algorithm consists of checking the Tr "Trace of polynomial" at first and then solving the quadratic equation based on the chosen coordinate "x" that satisfied the needed trace conditions and obtain "y" the second coordinate
I have given to understand that finding the trace of any polynomial C in field 163 is XORing(bit0,bit157) of the given polynomial

But after calculating the Trace and finding the x coordinates I do not understand how to solve the quadratic equation in hardware and how to implement it
I have found some reading material suggesting of calculating the H(C) which is the half trace of the polynomial C
but my questions are:

1.What is trace of a polynomial and how it is calculated? is it by
    xoring all bit together from 0 to m-1 ?

what is half trace ? and    how does it relate to trace? and why is
it used to solving quadratic    equation isn't it a 1 -bit answer
how can I solve the given
       equation to obtain the y coordinate and if there are 2 Y answers
       which one will be chosen?

Thank you I really appreciate the help. I could not find clear reading material on this matter with a simplified and easy to read algorithm/pseudo-code

Added:
I found the following algorithm but I do not know what it's name? and how are the parameters a2n and a2n+1 computed and how they vary for different fields lets say (163)

algorithm for solving the equation taken from:
A Low-Power Design for an Elliptic Curve Digital Signature Chip (Rich Schroeppel, Tim Draelos, Russell Miller, Rita Gonzales, Cheryl Beaver)


texts: Why public key has two parts in my secure messaging client similar to signal

texts: I am working on a Golang code similar to Signal protocol. I need to modify it. I am confused on tripartite Diffie-Hellman handshake part of code, i.e. why public key has two separate parts as compared to private key which has only one part in bytes as shown below. I can more info if needed. Thanks.


texts: How to decrypt / break enigma-encrypted ciphertext with given configuraton?

texts:
I'm new here--seriously I don't know anything, but my close friend sending me a code and I must solve it.

The code uses Rotor III, V, VIII;  starting point ABC; reflector BB; and pair OA LU.

Can someone give me an example and its procedure about solving a question/code using those rules?

Thank you.


texts: Is it possible to encrypt a message with two different keys (or maybe a public key) such that ciphertext will be decrypted with either of the keys?

texts:
I have an app that I store sensitive user data which requires user to set a password to login the app and I use this password as key to encrypt the data.

Now, I want to add an option to login the app with PIN. My problem is if user adds a PIN obviously I can't use it to decrypt the data. The only solution comes to my mind is to encrypt the password with PIN and store it locally. So when user enters the PIN, I can decrypt the password by using PIN then decrypt the data with this password.

Is it secure?
Is there another way to achieve this problem? Is it
possible to encrypt the data such that I can decrypt it with
password or PIN only?


texts: Can insecure algorithms be combined to form a secure algorithm?

texts:
This is hypothetical as I can't think of any reason to do this, but out of curiosity...

Could I, for example, take the MD5 digest of a message and concatenate it with the SHA-1 digest (not quite broken, but getting close), to form a secure concatenated digest? Intuitively, I would think the chances of finding a collision that crossed the two algorithms would be low enough to make this secure, but I'm not sure how to verify that.


texts:
Should you pad messages encrypted with stream ciphers?
The obvious answer seems to be yes, right? It obviously leaks the exact length of the plaintext.
Consider a situation where an adversary knows a user will send either $m_0$ or $m_1$. Suppose further that the adversary  observes  the decryption of $m_0$ and $m_1$-- namely, now they know the length of each message. It is now trivial to see how the adversary could differentiate  $Enc(m_0)$ from $Enc(m_1)$
From what I have seen though, padding messages encrypted with stream ciphers doesn't seem super common/ isn't done automatically in libraries like monocypher.


texts:
The title mostly explains it;

CBC-MAC variable-length weakness with MAC size greater than the encryption block size

I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a third message $M'$ whose CBC-MAC will also be $T_n$ by simply doing $M'=M \mathbin\| ((n_1 \oplus T_m) \mathbin\| n_2 \ldots n_x)$
My question is how does this work when the MAC is of greater size than the block size used during encryption? In my specific case, the MAC is 20 bytes while the encryption blocks are 16 bytes. So far I have not seen any ways of dealing with this


texts: Why is asymmetric cryptography bad for huge data?

texts:
I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length.
Why is this?

I know about hybrid encryption, which uses symmetric encryption to resolve this problem.
But I still want to know why public-key cryptography needs the data to be shorter than the key length.


texts: Diffie hellman key exchange on elliptic curve over an extension field

texts: I am attempting to do a final semester project where I implement Diffie-Hellman key exchange on an elliptic curve over an extension field (2^256). Can anybody help me to generate the extension field for this project?


texts: Decentralized consent over a random number

texts:
Maybe, some of you remember having to pick one person during playing as kids. That person would than have to catch the others for example. The methods to pick given person often would either depend on a "random" number one of the kids picked or on other factors like the shoe size.

Inspiried by some children playing, I started thinking about a secure decentralized method to create a consent about a pseudorandom number which everyone can influence but not predict or be manipulated to give an attacker an advantage e.g. force the method to always pick one person.

The very first idea I came up with was that every party shares a random number. Now, everyone can combine the numbers by appending, calculate a hash and then choose the person who would have to catch the others based on the hash.

To do so we define the function $f(x)$ which can reduce an input of an arbitrary length to a number between 0 and n, for example $f(x) = x\ mod\ n$.

There is a very obvious attack to this scheme: The last person to share it's random number can manipulate force the output to any output he want's by choosing random numbers for $x$ until $f(H(r_0\ ||\ r_1\ ||\ ...\ ||\ r_{n-2}\ ||\ x))$ equals the desired output.

The only way I can come up with to prevent such an attack is preventing one can be in hold of every other random number but binding everyone to their random number. This can be archieved by following protocol:

Every party chooses a random number $r$ and shares $H(r)$ thus binding itself to $r$ since any modification to $r$ can be detected unless $H$ has
easily findable collisions.
After every party has shared it's $H(r)$, the $r$'s are exchanged. While doing so, the $r$'s are validated to match with the hashes.
The output is $f(H(r_0\ ||\ r_1\ ||\ ...\ ||\ r_{n-1}))$.

This protocol has no extra security if the random numbers are small enough to be bruteforced and / or have been precomputed. Given $r$ is in a range of $2^n$ an attacker can run through every $i$ in $[0\ ...\ 2^8]$ and store $H(i)$. The attacker then can lookup these hashes during step one and then choose an arbitrary $r$ which matches his needs. That's why I suggest that the number should be at least 128 bit big.

Have I missed something? Are there other ways for an attacker to set the outcome of the algorithm to a greater extend than just "adding it's entropy"?


texts:
In “Randomness Condensers for Efficiently Samplable,
Seed-Dependent Sources” by Dodis, Ristenpart, and Vadhan (PDF), I have seen the statement that:

  any tuple of distributions $(X,Z)$ is $\varepsilon$-close
  to $(X′, Z)$ such that $$H_\infty(X′\mid Z) ≥ H_2(X\mid Z) − \log (1/\varepsilon)$$ offering a bound on min-entropy which may be better than $H_\infty(X′\mid Z) ≥ H_2(X\mid Z)/2$.

I can not see why this is the case. Could anyone please shed some light? Does it involve the Leftover Hash Lemma!?


texts: Can homomorphic encryption achieve program integrity (verification) in the cloud?

texts:
As I understand it, homomorphic encryption can be used to keep data confidential while still allowing computations over the data. From another question, I found out that one can also verify the integrity of the computation, (by which I mean one can verify that a returned value is indeed the result of the requested computation) by re-computing the result.

I am interested in a scenario where re-computing is not possible. For example, the original data might not be available anymore or the original data is very large and re-computing is too expensive. Are there other ways to verify that a result corresponds to the required computation?

That is, say I want to perform the operation r = a + b + c using homomorphic encryption, in the cloud. Once the cloud returns the result r, how can I verify that r is the result of a + b + c and not, say, the result of a + b or some other computation?


texts: Security Proof in Fuzzy Identity Based Encryption?

texts:
Been having a great deal of difficulty understanding the use of simulators to prove security of ABE schemes so I though I would start from the first ABE paper (Fuzzy Identity Based Encryption) to try and understand it better.

From my understanding of the use of simulators, the idea is to show that a simulator can be created which is acting in the ideal world but through the view of the Adversary who is acting in the real world and showing that they both learn the same amount of information and have the same advantage (Correct me here if I am wrong!)

My other question is basically an explanation of what the author has done in Phase 1 (Most confusing part is the highlighted section). Are there any predetermined guidelines that the author has followed that I need to familiarize myself with? or is it at the discretion of the author to have used the procedures he used in that phase?

Also how did the author get the final advantage of the simulator?


texts: Is there a way to optimize a linear scan while preserving anonymity?

texts:
I've been wrestling with a problem, and I was hoping if someone else had a bright idea.

Here's the problem: I have two sides, Alice and Bob.  Alice has a single high entropy string $A$, and Bob has a number of high entropy strings $B_i$, one of which may be $A$.  What we would like to do is have Alice send a single randomized message $F(A, r)$ to Bob so that:

Bob can determine in sublinear time which $B_i$ is equal to $A$ (or if none is)
Someone listening into two such exchanges (and who doesn't know either string) cannot determine if the two exchanges had the same string or not.

It's easy with only one of those constraints; it's easy to do if we let Bob take linear time (by having Alice send $r, Hash(A || r)$ to Bob, and have Bob compute each $Hash(B_i || r)$ value and look for a match.  And, it's easy to do if we don't care if someone listening in can check if two exchanges have the same string (just have Alice send $A$ in the clear).

I've tried to think of ways for Alice to include a hint that would allow Bob to skip over sections of his list; however every way I thought of would allow an attacker some advantage in determining whether two different exchanges had the same string.

And, in case you're wondering:

We can't assume that Alice and Bob had any preexisting shared secrets (other than the joint value of $A$ and some $B_i$).
We can't have Bob send a message to Alice first (which, again, would make it easy; Bob would send his public encryption key).  This limitation is because this exchange piggybacks on an existing protocol, and we can't add messages to that.

So, any bright ideas???


texts: Why using hash trees instead using a single hash value?

texts: If one have files $x_1, x_2, .., x_n$. What are the benefits of using hashing trees $-$ also known as Merkle trees $-$ (for example in git) instead of computing one hash value $h(x_1,x_2,..,x_n)$ ?


texts: Constant time arithmetic implementation in DSA

texts:
I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have specialized constant time ECC curve-specific implementation for NIST curves which are optimized per architecture. Similarly, EverCrypt and fiat-crypto have formally verified constant time arithmetic implementation specific to the curve.
This is particularly interesting in the case of applying nonce padding as a remote timing side-channel countermeasure for EC(DSA). While fixing the nonce bit length does fix timing attack vulnerability in the case of ECDSA, a curve-specific constant-time implementation if done properly does not actually require a nonce padding. In the case of DSA, I am trying to understand, why we cannot have group-specific arithmetic and only stuck with nonce padding as the solution. I can understand the fundamental difference that they operate on different groups, but why DSA groups are stuck with a generic implementation when compared to ECC groups?


texts: How can PUF hardware be proportional to the number of challenge/response bits?

texts:
Wikipedia article claims that physical unclonable functions are superior to ROM because they require less hardware:

  Unlike a ROM containing a table of responses to all possible challenges, which would require hardware exponential in the number of challenge bits, a PUF can be constructed in hardware proportional to the number of challenge and response bits.

Then, examples of PUFs are given, such as reading a device-specific signature present in DRAM upon startup, which indeed requires exponential hardware. Other kinds of PUFs are based on different physical principles (optical, mechanical, magnetic) which encode the device-specific differences, but I fail to see how using a different physical principle could lead to linear (rather than exponential) hardware requirements.

Could someone provide an example of such hardware or explain how such low hardware requirements are possible in PUFs?


texts: The advantages of Merkle Signature and One time Signature

texts:
In Merkle Signature, it also requires one-time signature to be used once for a message. The signature in Merkle scheme is even longer compared to Lamport one time signature. The verifier also has more work to do.

Hence, what is the advantages of Merkle compared the one-time (Lamport) signature?


texts: Do simulator based proofs still rely on the random oracle model?

texts:
I have seen many game based proofs using the random oracle model (ROM), do simulator based proofs require it? Is it possible to do a simulator based proof for every game based proof?

For context: What are the differences between proofs based on simulation and proofs based on games?


texts:
I'm writing a web service that gives a unique token per client connection.  And the following are the desired properties.  I'm assuming server's issued token db is lost and untrustable client presents the token to the server.

Server should be able to tell if the token is previously issued by the server or not.
Server should be able to tell when the token was issued.

So I'm thinking generating tokens based on timestamp & count using Poly1305 so that server can see the timestamp without maintaining token db.  For example:

token1 = Poly1305("2017-04-25T21:12:32Z 1")
token2 = Poly1305("2017-04-25T21:12:40Z 2")
token3 = Poly1305("2017-04-30T22:12:32Z 3")

My questions are:

Is this safe? (including reusing key & nonce for all the tokens)
Am I doing something dumb or is there a better way?

Thank you.


texts: Why does CNG only (seem to) support FIPS-approved AES-GCM decryption but not encryption?

texts:
The Security Policy Document: Microsoft Windows FIPS 140 Validation (version 1.4
dated May 7, 2020) mentions in section 2.2:

2.2 FIPS 140-2 Approved Algorithms
Cryptographic Primitives Library implements the following FIPS-140-2 Approved algorithms:

NIST SP 800-38D AES-128, AES- 192, and AES-256 GCM decryption and GMAC

Note the explicit use of decryption and not encryption. Furthermore, section 2.3 says the following (where the meaning or purpose of the word Mode is unclear to me in this context ):

2.3 Non-Approved Algorithms
Mode Cryptographic Primitives Library implements the following non-approved algorithms:

NIST SP 800-38D AES-128, AES-192, and AES-256 GCM encryption

Apparently a FIPS-approved version of AES-GCM encryption is not available. Trying to confirm this from NIST's Cryptographic Algorithm Validation Program (CAVP) certificates directly is not easy though. For example, taking #C211 as the starting point, there are several references to AES-GCM but no distinction between encryption and decryption.
This lack of availability of encryption comes across as a severe restriction. For example it seems not possible to implement an encrypted two-way session with AES-GCM when operating in FIPS Mode. Is this really the case? If yes, what could be the rationale for such limitation?

Update: after a lot more searching, I found confirmation in actual NIST CMVP certificate pages that older versions of Windows did indeed only have AES-GCM decryption validated and not encryption. My conclusion is that the security policy document associated with the newer validations is an evolution of an older policy document and that it was never properly updated to reflect the validation of the encryption side.
I am fairly convinced that this is a documentation error but I think only Microsoft can confirm that.


texts: AES vs AES-CMAC for session key derivation

texts:
Assume two parties have exchanged a secret 128-bit Master Key, MK.
When the two parties want to communicate, one of them generates a random 128-bit value, R, which is then sent in plaintext to the other party. Then, a KDF is used to generate a 128-bit Session Key, SK.

SK = KDF(MK, R)

SK is then used to encrypt communication between the parties. Let's say an authenticated encryption algorithm as AES-CCM is used with SK as input.

The question is: is there any difference between choosing a simple AES primitive and the more complex AES-CMAC as KDF?


texts: Is RSA provably secure in the sense of Douglas Stinson's ``provable security''?

texts:
Here's a quote from Douglas Stinson:

  “[i]f a cryptosystem can be ‘broken’ in some specific way, then it
  would be possible to efficiently solve some well-studied problem that
  is thought to be difficult. For example, it may be possible to prove a
  statement of the type “a given cryptosystem is secure if a given
  integer n cannot be factored.” [...] [B]ut it must be understood that
  this approach only provides a proof of security relative to some other
  problem, not an absolute proof of security. This is a similar
  situation to proving that a problem is NP-complete [...].”

Source: Stinson, D. R. (2006). Cryptography, Theory and Practice. Chapman
and Hall, CRC, 3rd edition. Chapter 2, section 2.1, page 45.

Does this apply to RSA?  Suppose I find the private exponent by some other way other than factoring $n$.  Then I would have broken RSA without factoring.

So although Stinson's example mentions factoring, we can't immediately think of RSA here because there's no proof that factoring is the only way to recover a private key.  What do you say?


texts: An efficient SPEKE protocol with curve25519

texts:
SPEKE is a very simple and elegant PAKE protocol.
I think one of the reasons why PACE was invented and is now the ICAO protocol is that SPEKE was patented. Fortunately, the SPEKE patent expired in March 2017 and therefore we can now freely use it.

In SPEKE, one needs to hash a password into an elliptic curve. That can be done by hashing into the x-coordinate and the calculate the corresponding y-coordinate. The tricky part is that not every x-coordinate has an y-coordinate in the base field. So, the following or a related method is used.

Search an integer value $c$ starting from zero, such that  $\operatorname{Hash}(\pi \mathbin\| c)$ is an appropriate x-coordinate on the curve.
Calculate the corresponding y-coordinate.

With curve25519 we can simplify both steps, because

Every x-coordinate is defined
y-coordinates are not necessary

SPEKE with curve25519

\begin{array}{lcr}
\mathit{Terminal} & & \mathit{Passport} \\
s = \operatorname{Hash}(\pi) & &  s = \operatorname{Hash}(\pi) \\
x' \xleftarrow{$} \{0,1\}^{252} & & y' \xleftarrow{$} \{0,1\}^{252}\\
x \leftarrow x' \mathbin\| (000)_b & & y \leftarrow y' \mathbin\| (000)_b\\
h_x = s^x & \xrightarrow{\quad h_x\quad} &  h_y = s^y \\
z \leftarrow h_y^x & \xleftarrow{\quad h_y\quad}  & z \leftarrow h_x^y  \\
\end{array}

One small issue is that it can be detected if the x-coordinate lives on the base curve or on its twist. That means, one loses 1 bit of entropy from the password. I think one can live with that small loss.

Does that make sense regarding security and efficiency?

Updated according to comments from Thomas and poncho.


texts: Attack RSA with very big module ($n$) and very small $e$ (7)

texts:
As an exercise I'm given an RSA to attack. I have the module ($n$), the public exponent ($e$) and a single ciphertext ($c$).

For this particular case, $n$ is VERY big (5 thousand digits more or less), but the public exponent is small ($e=7$).

I know that, as $m \ll n$, this can cause no use of the module operation ($m^7\bmod n = m^7$). I tried reversing it doing $c^{1/7}=m^{7\cdot1/7}=m$ but this is not working.
It might be that $m^7 \bmod n \neq m^7$. What can I do in this case?

What am I missing/misunderstanding?

EDIT

I was given an hint: "Big $n$ is useless with small $e$". I assume it has more to do with the exponent rather then $n$.


texts:
ECDSA keys are much shorter than RSA keys, but typically only used for signing, not encryption.

Is there an accepted way of doing this?

(https://bitcointalk.org/index.php?topic=196378.0 deliberately says don't use it.)

Note: I'm only looking at encrypting tens of bytes of data, so no AES suggestions please.


texts: Given a ciphertext in RSA which is not comprime with our N, can we get the secret key?

texts:
If we are given a ciphertext which is not coprime with our N (N = p*q), is there any way to get the secret key from this information in RSA?

I first thought you could divide the N by our ciphertext C, giving us a non-trivial factorization of N i.e. C * (N/C). But then we would be stuck trying to find $\phi(C)$ and $\phi(N/C)$, which I suppose is not easier than factoring N in the first place, if they are not primes. Can it be done?


texts:
What is the minimal angle between two LLL reduced vectors?
It seems it should be 60 degree as $|\mu_{i,j}| \leq \frac{1}{2}$.
If we make the upper bound of $\mu_{i,j}$ by 1/3, can we get better reduction?


texts: Perfect Secrecy and Message distributions

texts:
It is know that for a perfect secrecy scheme, for all m1,m2 and c:
$Pr[C=c | M=m1] = Pr[C=c | M=m2]$

I also know that for all distributions of M, m1,m2 and c:
$Pr[M=m1 | C=c] = Pr[M=m2 | C=c]$
Does not imply perfect secrecy (by counter example).

My question is, how does the "for all distributions of M" affect the answer?
1. If I removed the "for all distributions of M" would it imply perfect secrecy?
2. If I added the first condition "for all distributions of M" would it change anything?


texts: Relationship between Elliptic Curve Discrete Log, Integer Discrete Log, and Integer Factorization

texts:
I am trying to look into a relation between the following three problems which are widely used to build public crypto systems:

Integer Discrete log
Elliptic Curve Discrete log
Integer Factorization

Can any of these problems be reduced to another such that an efficient solution to one of them yields an efficient solution to the another?