texts: Block Cipher vs Hash Function to build a CSPRNG

texts:
It's widely accepted that both block ciphers and hash functions are great cryptographic primitives to build a CSPRNG.

I'm thinking of creating a protocol where, provided that there is a source of random to generate a root secret (which will become a key if used with a cipher or a seed if used with a hash function), this is used to feed an algorithm to generate an arbitrary amount of random data.

I have to decide on whether to use a block cipher (e.g. AES, or anyway any secure cipher with a block sie of 128-bit) or a secure hash function (e.g. SHA256).

I've made some considerations and I came up with a question that is blowing my mind.

First, let's see how both the approaches would be put in place.

If a block cipher is used, the root secret is used as the key and then a 128-bit counter is gradually incremented and encrypted to create a stream of random data, which is exactly how the CTR mode works.
If a hash function is used, the root secret is used either as a prefix which is then concatenated with counters, or used as the key of some construct such as HMAC (in this case the counters would be the data).

Now, a consideration needs to be done, and from this consideration originates my mind-blowing question.

With a block cipher, the same 128-bit sequence can never reappear again, until all the possible values of the counter are used (and hence the counter rewinds), which is impractical in any real-life scenario. Yes, if 128-bits of the random stream which originate from the block cipher are taken at a random offset which is not multiple of 128 bits (16 bytes) you will retrieve bits that are part of two distinct blocks and the same 128-bit sequence will appear more that once, but i'm not going to take in account this scenario for my question.

Which a hash function, instead, the same 128-bit (or 256-bit if we are using SHA256) can potentially reappear with two different nonces (and hence before the nonce rewinds). This probability is of course extremely unlikely and I believe that can be expressed with 1/2^N (where N is the bit-length), which is exactly the same "probability" that that value will naturally repeat with the block cipher construct.

Now, finally, my question:

With the block cipher construct, the same N-bit value cannot repeat, while with the hash function it may repeat, even though it's extremely unlikely.
In a mathematical sense I guess that both "probabilities" can be equated, but...

In which way the probability/entropy/security is affected by the impossibility of repetition of the block cipher construct over the hash function construct?
Which one would you choose?

And, another question:

What is the real entropy/security of any N-bit sequence of a random stream obtained by using one of the two constructs, provided that they originate from a fixed-length key?

Thank you for your attention and patience in reading all this :-)


texts: Does QUIC use a 96-bit MAC tag? If so, what are the implications?

texts: Does QUIC use a 96-bit MAC tag?  If so, what are the implications regarding forgery of messages?


texts: Can you help me understand some details about the attack using SSL3 POODLE bytes?

texts:
I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are:

From https://www.openssl.org/~bodo/ssl-poodle.pdf,

  Usually, the server will reject this record, and the attacker will simply try again with a new request.

My question is:

Because this paper doesn't mention the attacker how to try again, I guess the attacker need try to modify the last byte ($C_{n-1}[15]$, from 0x00 up to 0xFF) of $C_{n-1}$ to reveal the cookies’ first previously unknown byte. I want to make sure if my understanding is correct or not?
From Adam Langley's blog (https://www.imperialviolet.org/2014/10/14/poodle.html)

  The critical part of this attack is that SSLv3 doesn't specify the contents of padding bytes (the •s). TLS does and so this attack doesn't work because the attacker only has a $2^{-64}$ or $2^{-128}$ chance of a duplicated block being a valid padding block.

My question is:

How does Adam get the chance ($2^{-64}$ or $2^{-128}$) in TLS?


texts:
I have a hard time learning exactly how the elliptic curve equation is used in the ECC.

$$y^2 = x^3+ax+b$$

If someone knows and could explain to me in simple steps how this is done or a link to it that would just be amazing. I know how point addition is done, so I know the mathematical side to it.

This is a high school project so it does not have to be very specific, just like a general idea.


texts:
RFC 4880 describes the version 4 signature packet, tag 2, as

- One-octet signature type.
- One-octet public-key algorithm.
- One-octet hash algorithm.
- Two-octet scalar octet count for following hashed subpacket data.
Note that this is the length in octets of all of the hashed
subpackets; a pointer incremented by this number will skip over
the hashed subpackets.
- Hashed subpacket data set (zero or more subpackets).
- Two-octet scalar octet count for the following unhashed subpacket
data. Note that this is the length in octets of all of the
unhashed subpackets; a pointer incremented by this number will
skip over the unhashed subpackets.
- Unhashed subpacket data set (zero or more subpackets).
- Two-octet field holding the left 16 bits of the signed hash
value.
- One or more multiprecision integers comprising the signature.

and i assume that the second to last line means just take the string of the hashed subpacket and hash it with the hash algorithm and take its first 2 bytes. however, no matter what i do, i cannot seem to get it.

I generated this fake key a long time ago

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: BCPG v1.39

mQGiBE5B0h8RBAD533Z5bK1IpBx02QyQL0QoJE4uFRIMGDiwXuwmZzVl+R7Vlurd
GRLsCCbE6vOOh7XQVZGzLEBy9WNzZ9m+EbCfSVAYkjS6FhLws6hG6irrnS+b3JBf
gFJ8vNGF9Z7bhx+7y7NBk0IMyWkGnUkcnav73t5FQUI2faEBN4c/yAGJZwCgjcB7
3akWk9XVWvTCsiMXxpyvkukEALXsvB6cOoFEtQq9cQHjP63fBlvD94dhhMiM0cH6
hW9JotxdK+cxFGG9ZIWgoN2PWbMJka/H4W5EL6tS+YiNAR7I1Ozkt6X16GjnQUzZ
MlSpleK+KiKVN2anRaPEoOIinHrE3ZXd6QlJ/4+OJn4IVWmSEaJpFf4QNgvEu4rh
xinyBAD2RNzREOA+wpnFZ4lDt9NZXmXdxQME/l0J9XcvWhpGsxA/MATQKImy7N49
7GT/M38F+TrpBobag1O3buE99fOLyws4Tbc+sZMdHxoiGZDAIRNQS2rv475E6ktj
7vd5CYvOkA6+8sX1+hPcNlkHtHB1OFkJRsYp6k0zkyC9adjBM7QTYWJjIDxtYWtj
bUBhYWEuY29tPohGBBMRAgAGBQJOQdIfAAoJEDBSJUXPd92GRSQAoItbtbToOg7a
/hcg2sA/aBEQNwuxAKCGR69vmSoCWoBP5waPk0UsjM3BSbjMBE5B0h8QAgCUlP7A
lfO4XuKGVCs4NvyBpd0KA0m0wjndOHRNSIz44x24vLfTO0GrueWjPMqRRLHO8zLJ
S/BXO/BHo6ypjN87Af0VPV1hcq20MEW2iujh3hBwthNwBWhtKdPXOndJGZaB7lsh
LJuWv9z6WyDNXj/SBEiV1gnPm0ELeg8Syhy5pCjMAf9QHehP2eCFqfEwTAnaOlA6
CU+rYHKPZaI9NUwCA7qD2d93/l08/+ZtFvejZW1RWrJ8qfLDRtlPgRzigoF/CXbR
iEYEGBECAAYFAk5B0h8ACgkQMFIlRc933YZRrACfUnWTjHHN+QsEEoJrwRvFmvzj
bR4An24pTpeeN+I6R59O/sdmYsAhjULX
=sStS
-----END PGP PUBLIC KEY BLOCK-----

From pgpdump.net, i see that the left 2 bytes of the hash (SHA 1) value is 45 24 for the first signature packet and 51 ac for the second one. i am getting 52 f0 for both. obviously, im not including some information, but what is it? the hashed subpackets are identical, and all of the data before the hashed data are the same as well except they are different types of signature packets (0x13 / 0x18). i have been unable to get either of the correct hash values even when i add/take characters from the data packet. the key im generating is exactly the same as the key shown here except for the hash values.

what is the data that i should be hashing??

the key example up there is made up of packet 6 + packet 13 + packet 2 + packet 14 + packet 2. i have tried all sorts of combinations of packet 6, packet 13, and packet 2 (from version number to hashed data inclusive), but still cannot find the string that hashes to the correct values

EDIT: From Ilmari Karonen's suggestion that i read section 5.2.4, i still cannot get the answer

i have been using:

a = entire public key packet, header and all
b = entire user id packet, header and all
c = signature packet '\x04' ... '\x1f' (version ... end of hashed subpacket)

and hashing in all sorts of different ways. Depending on what hash context and data (for the user id: is it just the user info, or is it the entire packet? either way i try does not work) mean, the correct method can be anything, which i still cannot find.

how are the hashes of the body and two trailers combined? is that what hash context defines?


texts: Protocol/algorithms based on a variable-length input PRF

texts:
Are the proofs based on a PRF assumption still valid when using a variable-length input PRF ?

The answer might be obvious, but I have a doubt.


texts:
I'm new to cryptography, so please bear with me as I try to explain what's going in my head. I have an idea to write a program to generate one-time passwords for online conferences that are although password protected, due to their large scale, often passwords are widely circulated leading to uninvited attendees causing a mayhem of sorts, if you will. The solution in my head is to use cryptography to generate user-specific passwords.
A server-side API generates a password with 4 parameters
Leak_password <= some_hash_fn(original_password, Server_password, conference_id, user_email)
A server-side API can identify a user_email from Leak_password, Server_password, original_password
Leak_password ⊗ (Server_password, original_password) => user_email
A server-side API can identify a user_email from Leak_password, Server_password, original_password
Leak_password ⊗ (Server_password, user_email) => original_password
Anyone can verify if Leak_password was generated for conference_id
Leak_password ⊗ conference_id => true/false
My questions

Is there a name to the problem I am trying to solve? Keywords would help me narrow down my research.
Do you have ideas how this problem can be solved? Again, true to spirit of stack exchange, I'm not asking for an answer, but merely a direction.


texts: Is it possible to distinguish a securely-encrypted ciphertext from random noise?

texts:
Say I have a bunch of data encrypted with a secure block cipher (such as AES). An attacker has unlimited access to this encrypted data. The attacker doesn't know whether the data is encrypted or if it's just purely random bits. Is it possible (even theoretically) for the attacker to distinguish the encrypted data from purely random bits?

There seems to be many questions asking whether or not it's possible to identify a particular encryption scheme from the ciphertext, but what I want to know is if it's even possible to determine that the data is encrypted in the first place (as opposed to being random bits).


texts: What are the dangers of predictable (repeated) plaintext structures?

texts:
When using a "good", modern cipher (specifically one that provides ciphertext indistinguishability), is it a problem at all if there is some well-known structure in all plaintexts?

For example, consider a simple protocol that transmits many messages that all start with an identical, but secret string. All of the messages are encrypted with a different symmetric key, and the keys are in no way correlated (to either plaintext or previous keys).

Is there a way for an attacker to use his knowledge of the fact that the first n bytes of ciphertext always correspond to the same plaintext? Can those bytes even be decrypted? If so, is there a specific term for that kind of attack/cipher weakness? (Maybe something like "known identical plaintext"?)

My background for asking is section 5 of RFC 4345, which specifically advises against using RC4 in that kind of scenario. I know that RC4 has some known weaknesses regarding ciphertext indistinguishability, and it seems that my scenario is exactly one where those would allow the plaintext to be recovered.

So my question, in other words, is: Do other ciphers like AES share that weakness? If not, does resistance against that weakness, however it is called, follow from the fact that a cipher provides ciphertext indistinguishability?


texts: proof of correctness Ring-LWE cryptosystem

texts:
I've been studying Ring-LWE based crytposystems such as the one in this paper, but I can't seem to find/come up with a proof of correctness for this particular scheme.

The encryption goes as follows:

given a message $m \in R_2 $ and sampling a secret key $s$ from a distribution $\chi$, one samples $a$ from $R_q$ and $e \leftarrow \chi$, the ciphertext $c$ is a pair such that $c = ( c_0,c_1) = (a, as+2e+m)$.

To decrypt:

given $c=(c_0,c_1)$ one computes $c_0 + c_1s ~~mod~2$

Can someone please try and help me with that?

thanks in advance.


texts: OAEP Security: PKCS#1 v1.5 vs SHA1 vs SHA256

texts:
I'm looking at two major RSA encryption standards:

PKCS#1 ver. 1.5
RSA OAEP

The second one can use different hashing functions to create a hash of encoding parameters and then verify the hash at decoding step. PKCS 1.5 doesn't have this additional integrity check, and that's why security wise it's inferior to RSA OAEP/SHA1 and RSA OAEP/SHA256.

Is there a significant difference between latter two from a security point of view? How the fact that SHA1 has a collision problem can be practically exploited here? Can this SHA1 vulnerability be used, e.g. to facilitate known plain text attacks?

My impression is that using SHA1 is secure here, just like in PBKDF2/HMAC-SHA1 cases, but please share your thoughts.


texts: I want to know the hardness of computing a or b given $g^{b^{-1}}$ and ab in cyclic groups with large prime order

texts:
$G$ is a multiplicative cyclic group of a large prime order $p$ and $g$ is a generator of $G$

Theorem 1: Given $g^{b^{-1}}$ and $ab$, it's hard to compute $a$ or $b$, where $a$ and $b$ are randomly picked in $Z_p$
Theorem 2: It's hard to distinguish between the following distributions: $(g^{b^{-1}},ab)$ and $(g^{b^{-1}},z)$ where $a$, $b$, and $z$ are randomly picked in $Z_p$

Is there any proof that these two theorems hold or do not hold?


texts: Should AES.decrypt(ct, wrong_key) return blank or wrong result?

texts:
I am trying to use AES as cipher for an application I am building.
I am using a JavaScript library (https://code.google.com/p/crypto-js/) to perform encryption and decryption with AES.
When I perform decryption, this happens:

AES.decrypt(ct, right_key) == 'message decrypted !' //true

AES.decrypt(ct, wrong_key) == '' //true

The problem is that I am using this decryption in a process in which there shouldn't be any way to determine if the key was right or wrong. I would like something like this to happen:

log(AES.decrypt(msg, wrong_key)) // 'random string fsdijw'

So that the result is 'compliant' to the expected result but it's not the expected result, and there is no way to understand if the key was right or wrong depending on the result of the decryption.
I asked my professor and he told me that AES is probably bad implemented in that library, but he didn't understand my problem so clearly.

I wonder if the behavior described in the first snippet of code is expected or actually AES has been bad implemented in that library.
If it was expected, is there any other cipher algorithm that doesn't allow to understand if the key was right or wrong from the result of decryption?


texts: Difference between hierarchical and multi level secret sharing

texts:
In this paper, the definitions are simply as follows.

Multi-Level secret sharing: Higher level participants can help lower participants to get the secret.

Compartmented secret sharing: Each level participants has to get its own secret. (No help from higher level participants)

According to this paper

I found that Disjunctive Multi-Level secret sharing is identical to Multi-Level secret sharing and Conjunctive Multi-Level secret sharing is identical to Compartmented secret sharing.

Is above statement true?

My doubt is what is the difference between hierarchical secret sharing  and multi-level secret sharing?

Is hierarchical secret sharing same as Disjunctive Multi-Level secret sharing?

If I add a restriction to the compartmented secret sharing that 'participants at level $i$ can recover its secret only if participants at level $i-1$ recovers their secret', then what we can call this type of secret sharing?


texts: Hash function based on pseudorandom functions and security

texts: Are there hash functions that make use of pseudorandom functions. Precisely, I'm looking for a specification of a hash function based on PRF (and based on the security of such a primitive).


texts: Fast irreversible transformation/compression of short messages using a secret

texts:
I'm looking for a very fast function $f(m, k) $ that takes a 64-bit integer $m$ and a fixed secret key $k$ of virtually any size (generated by a CSPRNG) and turns them into a 64- or 32-bit integer $ r $, with a few additional requirements:

$ r $ must depend on both $m$ and $ k $ and be reasonably well-distributed
if a pair of $ m $ and $ r $ is known, it should not be possible to efficiently calculate $ k $ or produce $ f(m_1, k) = r_1 $
$ r $ will be used as a kind of a key or tag associated with $ m $, but it doesn't have to uniquely identify $ m $ (i.e. the existence of $ m_1 $, $ m_2 $ such that $f(m_1, k) = f(m_2, k) = r $ is completely normal), so I'm not too concerned about collisions

IOW, I need a way to quickly and irreversibly transform/compress/scramble a fixed-size integer (possibly shortening it) using a secret.
I think ideally this would be solved by a keyed cryptographic hash function like Blake* or Siphash. For example, Siphash was specifically
designed to work well on small inputs and maintain key secrecy, and it's currently used in CPython for hash table lookups.
Performance-wise Siphash-2-4 is maybe tolerable for my use case and seems to check all the boxes, but since I only need to process a 64-bit integer, it feels like an overkill and I'm still interested in anything more lightweight.
I've also looked at several non-cryptographic hash functions and their performance is very appealing, but I'm afraid many of them will fail the second requirement I listed (especially if I feed them $ k || m $, which simplifies brute-force attack in case of FNV-1A and Murmurhash3). XXH3 explicitly lets me provide a secret to customize hash values, and it seems to outperform any other decent hash function in existence, but it's also explicitly non-cryptographic, so unfortunately I'm not sure if it can provide the same level of security as Siphash, even for a use case as simple as mine.
I've also tried creating my own mixing/compression function (which most likely is not secure) and considered using a mixing/compression function from an existing algorithm (most likely not designed to be used separately from the original algorithm).
Am I missing a simpler way to do this?


texts: Diffie-Hellman: *assumed* largest prime factor of order of $g$?

texts:
I've read in several places:

some of my confusions about DDH assumption - comment by Thomas Pornin on his own post
Is there a key length definition for DH or DHE? - the answer by Tom Leek

that somehow the largest prime factor $q$ of $|g|$ (order of $g$) is assumed to be large enough without actually knowing $q$. How do they do that?

The only method I'm aware of is to start with a large enough prime $q$ and search for prime $p=nq+1$, then compute $g=a^{(p-1)/q}\pmod{p}$ for some random $a$. So the order of $g$ is $q$ if $g\neq 1$.


texts: Padding password before SHA-512 hashing to avoid info leak via timing

texts:
I've noticed that SHA-512 password hashing leaks some information about
the password length. There's a weak correlation between password length
and time to hash. It's roughly linear, but in steps of 64 or so, and
also dependent on salt length. I suppose a little extra length results
in one extra block of hash input for each round.

To avoid leaking even this small amount of information, we could pad the
password to a constant length before hashing it. The padding could be a
reproducible secure hash of the password, salt, and/or number of rounds.

Since hashing the long padded password would take longer per round, we
could use fewer rounds. Thus, overall, the hashing operation would not
take longer (except for a little time to generate the padding).

(Of course, with the padding being a function of the password, one could
dispense with the password and simply hash the padding instead. That
seems risky, though; entropy might somehow be lost in the process.)

Does anyone see a problem with this padding idea? Do any attacks come to
mind?

Edit: this is for a working system, but the target environment makes
it difficult to use anything but Python and the standard library;
there's no compiler, and adding precompiled libraries is problematic.
Thus, crypt(3) is available, but better algorithms such as bcrypt,
scrypt, and PBKDF2 are not — at least, not easily.

The idea with the padding is to pad with a constant string, hash that
with a small number of rounds, and use the output as the padding for the
full number of rounds.


texts: Can there be two hash functions without common collisions?

texts:
Is there a way to prove/create (or are there known hash functions) two hash functions that never have the same collision?   I mean, like provable in way that someone who took one cryptography class in university can prove.

For example, I want hash functions $A$ and $B$ such that if hash function $A$ collides on $X$ and $Y$, then $B$ will not collide on these $X$ and $Y$:

$$A(X) = A(Y) \quad \Rightarrow \quad B(X) \neq B(Y) $$


texts: Problem with the signature of message using ECDSA over GF(2^m)

texts:
I'm trying to set up an ECDSA with Elliptic Curves over $\operatorname{GF}(2^m)$ with an example of toy with the following values:
Using the Weierstrass equation on binary finite fields. $$E: y^2 + x*y - [x^3 + a x^2 + b]$$

Let $E$ be defined over the field $\operatorname{GF}(2^7)$ ($m = 7$) with the equation
$$E: y^2 + x*y - [x^3 + 0*x^2 + 1]$$ where $a = 0$ and $b = 1$, using the irreducible polynomial $P(z) = z^7 + z + 1 \bmod 2$
The points are in decimal which has a polynomial representation. Example; $(z^2 + z; z^2 + z + 1) = (0110; 0111)$ in its binary representation and $(6, 7)$ in its decimal representation.I am using wolframcloud software to validate operations.

$d = 17$
generator $G = (124, 68) = (z^6 + z^5 + z^4 + z^3 + z^2, z^6 + z^2)$, a point that lives on the curve
$Q = [d]G = (40, 19)$, a point that lives on the curve too.
$k = 13$
$P = [k]G = (82, 100)$
$r = x(P) = 82$
$e = SHA(m) = 19$
$k^{-1} = 79$
$S = k^{-1} (e + d*r) \pmod{P(z)}$
$S = 79 (19 + 17*82) \pmod{P(z)}$
$S = 11$

Finally I obtained the value r and S that is the signature of the message: $(r, S) = (82, 11)$

Verification, and then suppose that the second entity know the same parameters over the curve without know d nor k. The second entity will carry out:
$P = [(S^{-1} * e) * G] + [(S^{-1} * r) * Q] \pmod{P(z)}\\
S^{-1} = 74\\
P = (74 * 19) * G + (74 * 82) * Q \pmod{P(z)}\\
P = 102 * G  + 67 * Q \pmod{P(z)}\\
P = (80, 87) + (38, 35) \pmod{P(z)}\\
P = (30, 92) \pmod{P(z)}\\
P.x = 30$
which is different from $r=82$: $P.x$ should be equal to $r$, but, it's NOT.

Now, We suppose that the second entity knows $d$ such that $Q = d * G$ then:
$P = (102 * G)  + (67 * 17 * G) \pmod{P(z)}\\
P = (102 * G)  + (107 * G) \pmod{P(z)}\\
P = (102 + 107) * G \pmod{P(z)}\\
P = 13 * G\pmod{P(z)}\\
P = 13 * (124, 68)\\
P = (82, 100)\\
P.x = 82 = r$
which is correct but the second entity doesn't know $d$.
Could someone help me, please and tell me how I can solve this problem?

Annex code in Wolfram language: To perform scalar multiplication through sum of points and doubling of a point I am using the following code with
; or just Try It Online!
(* Input example GF(2^7): *)
m=7;
k="10001"; (*BinaQy representation 10001 = 17 in decimal *)
lim = StringLength [k] + 1 ;
a=0;
Gx=z^6 + z^5 + z^4 + z^3 + z^2;  (* Gx = 124 *)
Gy=z^6 + z^2; (* Gy = 68 *)
IrreduciblePolynomialCCE= z^7 + z + 1;
Qx=Gx;
Qy=Gy;
For [i=2, i<lim , i++,
    c=StringTake [k ,{i}];
    (*Dubling*)
    {d, {inv, u}}=PolynomialMod[PolynomialExtendedGCD[Qx, IrreduciblePolynomialCCE],2];
    Lamda=PolynomialMod[(Qx + Qy*inv ), {IrreduciblePolynomialCCE, 2}] ;
    X3=PolynomialMod[(Lamda^2 + Lamda + a ), {IrreduciblePolynomialCCE, 2}] ;
    Y3=PolynomialMod [ (Qx^2 + Lamda*X3 + X3) , {IrreduciblePolynomialCCE, 2}] ;
    Qx = X3;
    Qy = Y3;
    If [c=="1",{
        (*Sum*)
        {d, {inv2, u}}=PolynomialMod[ PolynomialExtendedGCD[Gx + Qx, IrreduciblePolynomialCCE],2];
        Lamda2=PolynomialMod[(Gy + Qy) * inv2 , {IrreduciblePolynomialCCE, 2}] ;
        XX3=PolynomialMod [(Lamda2^2 + Lamda2 + Gx + Qx + a) , {IrreduciblePolynomialCCE, 2}] ;
        YY3=PolynomialMod [Lamda2*(Gx + XX3) + XX3 + Gy, {IrreduciblePolynomialCCE, 2}] ;
        Qx = XX3;
        Qy = YY3;
        },{0}
    ]
]
Print [Qx]
Print [Qy]

The result $Q = (z^5 + z^3, z^4 + z + 1) = (40, 19)$


texts: Gaussian distribution over ideal lattices

texts:
I am reading Lyubashevsky's paper [LPR10] about ideal lattices and R-LWE problem and I did not understand the following part:

"Using the canonical embedding also allows us to think of the distribution
$D_r$ (for $r \in (R^+)^n$) over $H$ as a distribution over $K$. Strictly speaking, the
distribution $D_r$ is not quite over $K$, but rather over the field $K_{\mathbb{R}} = K ⊗_{\mathbb{Q}}\mathbb{R}$,
which, roughly speaking, is to $K$ as $\mathbb{R}$ is to $\mathbb{Q}$."

Can someone please explain this?


texts: How to encrypt files using AES256-GCM cipher under Linux?

texts:
I'm struggling to implement AES256-GCM on a Linux machine to encrypt files outgoing to another party.

We're usually exchanging files using PKI, but this particular party insists on AES256-GCM and will not allow PKI.

However, I've been struggling to make it work. We'd like to implement it on a Linux machine and to be able to automate encryption. It seems like the other party is okay with doing this manually on a Windows desktop, but we'd like to avoid that possibility.

I tried to do it using openssl, but I get this:

$ openssl aes-256-gcm
AEAD ciphers not supported by the enc utility

When I tried GPG, I get:

$ gpg --version
...
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
...

The other party just suggested using what they have, which is some Windows EXE with BouncyCastle libraries, so I started investigating using BouncyCastle for this, but it's in Java, and I'd like to avoid using Java if possible.

I'd have to add a JDK to that particular server or set up another virtual machine just for the purpose of encrypting these files, which is completely non-optimal. Browsing BouncyCastle's documentation, it's not very helpful, at least I haven't found any real examples, and I must be doing something wrong, because even when I did a full text search looking for a reference to GCM, Galois Counter, or anything similar, I found nothing (do I have the wrong files?).

I figure I might work it out, but we've been given a tight deadline and we can't force them to use PKI. I hate to waste time looking in the wrong places, but I would really want to avoid using the simplistic manual process in Windows if it's at all possible.

Edit:
The expected format is IV+ciphertext(plus, I presume, tag). I received a copy of their Java source code for a simple encrypt/decrypt utility and it's very simplistic with no allowances for complex encoding routines or anything, it's just meant to encrypt (or decrypt) a single file or a single zip package of multiple files. That's all.

The worst thing is that I saw references to being able to encrypt using OpenSSL (which is just an interface for enc, after all, so it should also work with gpg, for instance), and the best one I found was this:
https://security.stackexchange.com/questions/128883/basic-question-regarding-openssl-and-aes-gcm

I guess I'll try that tomorrow and see if I can get it to work.


texts: Authentication mechanism for low memory, low computing power device

texts:
I am looking for an authentication mechanism that works best with low memory, low computing power devices. I came across a paper "A Practical Zero-Knowledge Protocol Fitted to Security Microprocessor Minimizing Both Transmission and Memory" which is released in 1988.

Couldnt find any recent papers. Is it the best one or am I missing some ?

UPDATE:

I have a case where I have few processors connected to a gateway processors. I can send upto 64 bits of data at a time. Computing power is low in the sense that I cant employ something like AES-128 algorithm in all chips. I also need to minimize the number of bits of data send for authentication


texts:
In ECRSA cryptosystem, I want to know the feasible attacks. For illustrations we have two prime $p$ and $q$ such that $p \equiv 2 \pmod 3$, $q \equiv 2 \pmod 3$ and generate key pair as follows:
$$n = pq, \quad \lambda = \operatorname{lcm}(p+1,q+1), \quad d = e^{-1} \pmod \lambda $$
Now $(n, e)$ is public and $(n, d)$ is private key.

For given message $m$, we present $m$ as a pair of integers $(m_1, m_2) \pmod n$ and regards it as a point $P$ on the elliptic curve $E$ given by $y^2 = x^3 + B \pmod n$, such that $B = - m_1^3 + m_2^2$.

For encrypt message $m$, add $P$ to itself $e$ times on E to obtain $C = e.P$

Source: Zhaohui Cheng's Simple Tutorial on Elliptic Curve Cryptography (December 2004).


texts:
Can we use Coppersmith's attack if we know a few ciphertexts of the same plaintext, but there is a short random bit padding in front of message? Formula:
$$(2^k \cdot r + m)^3 \bmod n = c$$


texts: Which asymmetric cipher provides the highest performance?

texts: To get the highest performance, which asymmetric cipher provides the fastest encryption/decryption? ECC or DH? What key size is recommended today?


texts: Key and signature sizes of NTRU and NTRU Prime?

texts:
I would have expected this info to be easier to Google Scholar for, but alas I'm asking here.

Partial answers:

NTRU key size (confused)

  the public key consists of one ring, and so it takes up $11 \times 439 = 4829$ bits, which compresses to 604 bytes.

what are the NTRU keysize and application in industry?

  For instance, with $N = 1171$ and $q = 2048$, which are recommended parameters, public and private keys are of size 1.57 KB.

So

Those don't agree.
What about the size of NTRUsign signatures?
Have Bernstein, Lange, Chuengsatiansup, and van Vredendaal published a signature variant of NTRU Prime yet? (I only see encryption [1]), but in the paper:

  Our public keys are field elements, easily squeezed into 1232 bytes.

Any idea what signature sizes of an NTRU Prime-based signature scheme would be?

[1]: NTRU Prime, 2016


texts: Threshold Signature with Accumulation Scheme?

texts:
Is there a threshold signature scheme that can be accumulated? That is, given a message $M$ signed by $k-1$ parties and the $(k-1)$-threshold signature $\sigma_{k-1}$, a party can verify $\sigma_{k-1}$ is indeed signed by $k-1$ distinct parties, and can add its partial signature to it to obtain a $k$-threshold signature $\sigma_k$.
I am aware that the standard multi-signature scheme can achieve this, but it needs to attach a list of signers with the signature, which costs $O(n)$. Is there a signature scheme that achieves this and only has sublinear communication cost? Any related reference would be appreciated!


texts: Are there popular and secure Authenticated Encryption schemes with Salsa20/Sosemanuk in CTR-mode with a Carter-Wegman MAC?

texts:
I read that AES/GCM is a good choice for authenticated encryption because:

AES has very strong heuristic security
Encrypt-then-MAC leaks no information about the plaintext
The CW-MAC in GCM can be hardware accelerated using the PCLMULQDQ instruction
AES can be hardware accelerated

I also read that Salsa20 and Sosemanuk are 5-6 times faster than AES.

This leads me to ask why the eStream ciphers like Salsa20 and Sosemanuk are not deployed with the IV-CTR-mode in Encrypt-then-MAC configuration for Authenticated Encryption?

I am definitely a beginner, so I hope you'll excuse me if the question is naive.


texts: Is it safe to operate over the prime sub-group of Curve25519?

texts:
Referring to D. J. Bernstein's paper Bernstein-Curve25519 on Curve25519, the group $\{\infty\} \cup (E(F_{p^2}) \cap (F_p \times F_p))$, where $p$ is the prime $2^{255}-19$ and $E$ is the elliptic curve $y^2 = x^3 + 486662x^2 + x$, has size $n = 8p_1$, where $p_1$ is the large prime $2^{252} + 27742317777372353535851937790883648493$.

In the same paper, he suggests clearing the 3 least significant bits of the 255-bit secret scalar $k \in [1, n-1]$ (for elliptic curve scalar multiplication over Curve25519), that is, making $k$ a multiple of 8, to prevent small sub-group attacks. Note that this also reduces the effective security level of the curve to $\approx 2^{252}$.

Instead, is it equally safe to choose the scalar $k$ from $[1, p_1-1]$, that is, operate over the prime sub-group of Curve25519? This does not change any of the curve operations, only the scalar is chosen differently. Also, small sub-group attacks are not possible since $k < p_1$ in this case, and the effective security level is again reduced to $\approx 2^{252}$.


texts: How many hex digits do I need to compare when manually checking hash functions?

texts:
I sometimes run sha256sum on large files after transferring them from one place to another, and will just skim the hash output to verify it's correct. But, I usually just look at the first/last 5 or 6 hex digits and call it good enough.

I know that the chances of collision are something like 1 / 2^64, but what are the chances of a "near collision"? E.g. only one or two hex digits are different.

As a related topic,
If you have a binary sequence and just change one bit, you get a completely different hash, correct? So is it possible for random errors to result in nearly identical hashes? I'm aware that MD5 is 'cracked' such that a malicious agent could append whatever necessary data to a file to make it have the same hash output- but is this within any reasonable realm of possibility to have happen stochastically?

EDIT: This topic has spawned some discussion below that was just as (if not more!) informative than the scope of my original question. With that said- I am referring only to using hash functions as a file integrity check, not as protection against attacks.


texts:
Imagine we have a set $S$ of $m$ elements and we wants to permutes the set elements. Thus the original position of each element should be unknown after permuting. If we define a permutation function as $\pi: \{0,1\}^n \rightarrow \{0,1\}^n$, then the set elements are permuted securely if $n\le|S|$ where $n$ is the security parameter. So to permute $S$ we do $\pi (i)=r_i$, where $i$ is the original index of an element in the set, and $r_i$ is its new index.

However, if the set size is small ($|S|< n$) it seems the only way to securely permute it is to pad it first and then permute it, that increases storage cost.

Question: Is there any better and more cost effective way of permuting a set than the above scheme?


texts: If a cipher has key length shorter than plaintext, then it is not perfectly secure

texts:
I am trying to verify the statement above. So far I only know that a One-Time-Pad is the only “perfectly secure” cipher. It has a key length which is exactly the same as the plaintext. I think the statement is true but I don't know how to prove it…

Can anyone give me some hints or point me to an according reference or two?


texts: Keeping a backup of asymmetric keys with the help of a certificate authority without losing the privacy

texts:
First I'll explain the problem, then I will also give a solution(it might be wrong) I've found for it, you let me know what you think about this solution and whether you have a better one.

Assume a user loses their asymmetric keys, now they are receiving a lot of messages without being able to decrypt them, so they need to fix this problem using a backup of their keys. Let's say they have also already given a copy of their keys to the CA, so they will refer to that and they have their keys again. However, if the CA has our private key, it can fabricate messages with evil purposes and add our digital signature to hold us responsible afterwards. What can we do to both have the privacy and the backup?

We can generate two pairs of keys instead of one. Then we'll give the CA both keys in the first pair(pub1,prv1), but only the public key in the second pair(pub2). Now the CA has to provide everyone two public keys of us, and determine which one is for verifying digital signatures(pub2), and which one should be used when they want to send us their messages(pub1). Now anytime we lose our keys, we can take back (pub1,prv1) from the CA to decrypt messages, and also we can use (prv1) to make digital signatures and the CA cannot play our role(I hope the English I've written here isn't too much wrong)
(Also as a side question: Do real-world CAs also provide backup?)


texts: How to encrypt a message such when a certain condition is met it can be decrypted?

texts:
Assume, there is a certificate authority whose public key: $pk$, is known. Also, the certificate $c$ is known, but not the signed certificate.
I want to encrypt a message: $m$, such that whoever has a signed certificate can decrypt the message. Note that the signed certificate may not be present at encryption time. To clarify, the signed certificate must be valid and related to $c$ and $pk$.
Question: What encryption can support the above scenario?

I'm aware that witness encryption may help but it's so inefficient.

Edit
Application: assume, party $A$ has a message $m$, it encrypts it: $Enc(m)$, such that when he dies, whoever gets his death certificate (i.e. a signed messages from a certain authority that confirms his death) can decrypt the ciphertext: $Enc(m)$.
So the question is what encryption scheme can the encryptor use?


texts: How to implement division using Garbled Circuit

texts:
Implementing Addition, Subtraction and even N-bit Multiplication can be done fairly quickly and intuitively using garbled circuit, since no looping, control unit nor state machine is needed. One just has to give every wire two random labels and it's done.

However, I am unsure about how to implement N-bit division. Of course, one can build a gigantic truth table and figure out the logic expression, but this way the circuit size would be enormous and  it's neither reusable nor practical.

I have the following 32-bit division diagram, which is a very simple conceptual design:

Diagram is from here, p8

So it contains a control unit, which I assume contains a clock.

So my question takes three forms:

How to implement a N-bit division garbled circuit?
How to implement a control unit in GC?
How does GC work with clock?


texts: Full Boneh-Boyen signature scheme defines a pair of secret keys (SK) $a \in \mathbb{Z}_n$ and $b \in \mathbb{Z}_n$ and a pair of public keys (PK) $A = G^a \in \mathbb{G}$ and $B = G^b \in \mathbb{G}$. Can anybody point me out to some similar signature scheme where $SK \in \mathbb{Z}_n$ and $PK \in \mathbb{G}$?


texts: Encrypt a file for random access but only after an initial read of the whole file

texts:
I'm symmetrically encrypting a file (using a random salt and a user supplied password with PKCS5S2, i.e., nothing special) and I need to be able to access it randomly. Therefore I'm using a stream cipher. This works well, but it allows the attacker to verify a wrong password when reading only a tiny part of the file (garbled data are easy to recognize).

IIRC there's an encryption schema making it impossible to read any part of the data in isolation, you must read it all (I forgot how it's called). This seems to conflict with my random access requirement, however I always need to read the whole file first and then I need the random access.

Is there an encryption schema allowing this, i.e.,

to obtain any information, all data must be decrypted first
afterwards, any portion of the data can be decrypted in isolation


texts: Understanding multiplication in the AES specification

texts:
I am reading through the AES specification and am not able to wrap my head around the multiplication definition (section 4.2).

In section 4.2 why is the modulo chosen as {01}{1b} which is $283$ and not $255$? The irreducible polynomial is $m(x)=x^8 +x^4 +x^3 +x+1$. Is there a significance to this seemingly random choice? Later on in the explanation it also says the modulo operation produces values that can be represented in a single byte. How is that possible if the modulo is performed over $283$?
Later on the same section in the example {57} • {83} is computed to be $x^{13} +x^{11} +x^9 +x^8 +x^6 +x^5 +x^4 +x^3 +1$ - which is $11129$. Using a calculator it appears this is wrong. Its coming out to be $11397$. What am I missing?
In section 4.2.1 (multiplication by $x$) it says - It follows that multiplication by $x$ (i.e., {00000010} or {02}) can be implemented at the byte level as a left shift and a subsequent conditional bitwise XOR with {1b}.

Here again I don't get it. By my understanding it should be a left shift followed by modulo with {01}{1b}.

Can someone please explain this to me?


texts: Stick figure AES: what does "I take each column and mix the bits in it" do?

texts:
I've been reading A Stick Figure Guide to the Advanced Encryption Standard (AES) to help me understand how AES works. In this picture it says:

I take each column and mix the bits in it.

But then never explains how he mixes the bits. I've been searching for a while, but can find nothing about it. Can anyone explain what is happening in this step?


texts: Does the public key and private key for WhatsApp only remain within a WhatsApp account

texts:
The world of cryptography is starting to really intrigue me admittedly. I initially hated it because it looked too hard Mathematically but now it looks cool :)

Got a good question for the experts and nerds on this forum. I got like a feeling that WhatsApp works by making use of public keys and private keys encryption. That would mean that Sender A would send a message to Sender B using Sender Bs public key. My question is, where would the private key of this recipient be stored, like within their account?

Also, how would the whole key thing work in a WhatsApp group as there are multiple users involved?

Like I said, I am just interested and want to hear from the experts here


texts:
I'm reading "An Efficient CCA2-Secure Variant of the McEliece Cryptosystem in the standard model" by Rastaghi which states:

  As we know, in hybrid PKE schemes XOR alone cannot perfectly hide
  challenge bit to the CCA2 adversary

The author does not define hybrid PKE schemes. What is their definition?
Why is it that XOR alone cannot perfectly hide challenge bit to the CCA2 adversary in hybrid PKE schemes?


texts:
This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit block can have 2^128 different values. So if I have 128-bit key - then it seems to be natural to have every different key produce different ciphertext for a given plaintext - $P_1$. So let's take another plaintext - $P_2$, which also can be encrypted to $2^{128}$ different output blocks - but still the same values - we have the same binary 128-bit block - again $2^{128}$ values - the same values that $P_1$ used. How AES differentiate between the two?

The second question: what about AES-256? Here I have $2^{256}$ keys, but again for given plaintext - $P_1$ I can get no more than $2^{128}$ output blocks, is it that I only have $2^{128}$ unique keys even for AES-256? What about the previous situation - I can have only $2^{128}$ different output blocks- so what's the use of having $2^{256}$ key space? Shouldn't the block size be also increased for AES-256? Or am I making some terrible mistake here?


texts: RSA figuring out the recipient of a ciphertext

texts:
I have this question I am trying to figure out the answer about RSA. I'd be grateful if someone could actually help me understand how the procedure would work. I am new to cryptography and with all the maths in it, I am barely understanding it.

Assuming that we have a sender A and 2 recipients B and C. This sender wants to send 12 messages.

If A wants to send to B he'd use B's public key $(n_B,e_B)$. Meaning:
$$\text{ciphertext}_i = (\text{plaintext}_i)^{e_B} \bmod n_B$$

If A wants to send to C he'd use C's public key $(n_C,e_C)$. Meaning:
$$\text{ciphertext}_i = (\text{plaintext}_i)^{e_C} \bmod n_C$$

An attacker gets the 12 ciphertexts A encrypted. He also knows the public key of B and C.

How can he determine whether A sent her messages to B or C?


texts: Padding size with a CBC Block cipher in TLS

texts:
I'm currently looking at an encrypted Client Finished message in Wireshark from a TLS session. The cipher suite that was agreed on in previous messages was TLS_RSA_WITH_AES_256_CBC_SHA.

By my understanding, the encrypted message should have a Handshake Protocol header which is made up of the handshake type and the length. This should be 4 bytes in total. There should then be 12 bytes of verify_data, followed by a 20 byte MAC (SHA-1 digest size). This takes us to 36 bytes. Now according to RFC 2246 section 6.2.3.2, it should then be padded out so that the length in total is a multiple of the block length (in this case 16 for AES-256).

That means it should have 12 bytes of padding, where each padding value has a value of 12 (0x0C), followed by a padding length field which will also have a value of 12. What I don't understand is, if you add all that up, you get an encrypted length of 49 bytes, but the wireshark packet has 48 bytes.

Is anybody able to explain the difference?


texts: Looking at hash output – is Base64 encoding in any way better than HEX encoding?

texts:
I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded.

But most "secure" crypto hashes (KDF' ) like bcrypt and scrypt are Base64 encoded. Why?

somewhere I heared that Base64 shortend the string for like 20%. Isn't that extremely bad for password hashed during iterations and makes them less collision resistent?

And if Base64 is really for some reason more secure, then why does Argon2 output HEX encoding?


texts: Requirement for the exponent generation during DH protocol

texts:
The setting is classic DH protocol. Alice computes $A = g^a \bmod p$. Alice then sends $A$ to Bob. Then Bob will send $B = g^b \bmod p$ to Alice.

Are there any requirements for the values $a$ and $b$ besides they should be greater than $1$?


texts: How is Homomorphic Encryption secure (over integers)?

texts:
I have been reading a bit about homomorphic encryption, and have been intrigued by its properties.

If I have some cryptosystem that is homomorphic and supports addition, from my understanding, I can do this:

E(A) + E(B) = E(A+B)

...And then I can decrypt E(A+B) without knowing either A or B.

However, if A and B were something like salaries stored somewhere...

E($120k) + E($100k) = E($120k + $100k) = E($220k)

From what I understand, I may not be able to decrypt A or B, but I can calculate A or B given some math. For example:

D(E(A+B)) = $220k (since I can decrypt the result without knowing the individual encryptions)
X = E(-$220k) (since I can encrypt any values myself)
X + E(A) = E(-$220k) + E($120k) = E(-$100k) (this gives me the negative of B... but I can negate that to get B)

Am I understanding this correctly? If so, how is homomorphic encryption secure?


texts:
According to http://www.secg.org/sec1-v2.pdf#page=13 ,

  Rule to add two points with the same x-coordinates when the points are
  either distinct or have y-coordinate 0:

  (x, y) + (x, −y) = O for all (x, y) ∈ E(Fp)

  — i.e. the negative of the point (x, y) is −(x, y) = (x, −y).

The fact that it says "when the points are distinct" makes it sound like it applies when the x coordinates of both points match but the y coordinates do not.But if that's the case then it seems to me that that'd make the "or have y-coordinate 0" bit redundant? y is not equal to -y so it seems to me that that's redundant? I mean, I guess y is equal to -y over mod p but in ECC is it even worthwhile to handle the use case where x or y are greater than p?

And what about adding (x, 0) to itself? At that point do we do point doubling, since the points are the same or do we just return 0 because of the "or have y-coordinate 0" bit?

If y was 0 I guess you'd be doing $\frac{\mathbb{3x}_{1}^2 + a}{2y_1}$ or $\frac{\mathbb{3x}_{1}^2 + a}{0}$ so it seems like it might be good to avoid it all together by returning $\mathcal O$ but idk.

And plus, using that rationale then what is supposed to be done for when the two coordinates are different? At that point $\lambda$ is $\frac{y_2 - y_1}{x_2 - x_1}$ so what if both x coordinates match whilst the y coordinates didn't? At that point you'd have another division by zero error..


texts:
The finite field $GF(256)$ is usually implemented $mod$ 0x11b to keep the numbers inside that field.
I understand that 0x11b was picked as it is the smallest irreducible polynomial that is greater than any number of $GF(256)$. This is sufficient for multiplication as any element of the field can be reached by multiplying two other elements from the same field and the result will also be inside that field.

Now I stumbled over powers in finite fields. By trying it myself I noticed that with $g=2$ not every element of $GF(256)$ could be expressed as $g^x$ when using $mod$ 0x11b. 0x11d has to be used instead for example. But when using $g=3$ I can use 0x11b again. And for $g=6$ I can use both. For $g=7$ I can't use either. So the choice of the irreducible polynomial depends on the generator $g$.

Does this mean unless you have tested the choice of irreducible polynomial $p$ throughly, you cannot use it for key exchange as proposed by Diffie-Hellman but you can use it for Elliptic Curves?

Is it even feasible to do both on a finite field?


texts:
I'am working on searchable encryption.

First I create an index for a set of files. The index is B+ tree. The leaf of this tree is a bloom filter which represents the words in each file. Each bloom filter represents one file. Inner nodes represent XOR of these leaf nodes.

Last but not least: to encrypt this tree, I'ld like to encrypt each leaf node separately, but I'm confused which techniqe should be used to encrypt the inner nodes – while keeping it easy to do searches in this tree. What is the best technique I can use to encrypt inner nodes in B+tree?


texts: What is the importance of 1 < d < φ(n) and 0 ≤ m < n in RSA?

texts:
I'm a first year Maths undergraduate and we have recently gone onto RSA. I understand the majority of the algorithm using Fermat's Theorem etc.

From the algorithm stated on Wikipedia:

  4) Choose an integer $d$ such that $1 \lt d \lt φ(n)$ and $\gcd(d, φ(n)) = 1$; i.e., $d$ and $φ(n)$ are coprime.

  5) Determine $e$ as $e ≡ d^{−1} \mod {φ(n)}$; i.e., $e$ is the modular multiplicative inverse of $d \mod {φ(n)}$.

I don't understand the importance of $1 < d < φ(n)$.

Also why must the message $M$ to be encrypted be an integer $m$ such that $0 ≤ m < n$ (here $n$ is the product of two distinct primes $p$ and $q$)?


texts: How does the probabilty for universal hashing work out?

texts:
Hey for universal hashing we say the following:
Definition:
A randomized algorithm $H$ for constructing hash functions $h\colon U \to \{1,\ldots,M\}$
is universal if for all $x \neq y$ in $U$, we have
$\Pr_{h\gets H} [h(x) = h(y)] \leq 1/M$
I actually just can´t understand how the probability can be $1/M$ in any case. I alway try to think about any random function mod M as example and compare it with rolling a dice, but with a dice we have for every instance a probabilty of 1/6 as we have 1/M for mod M. But when I roll a dice two times after I have at least $\frac{1}{6}^2$ but saying we have binomial probabilty it looks even worse thinking that the dice would be thrown y times.
Can you help me understand how 1/m could be reached within this context?


texts: When a game between an adversary $A$ and a challenger $CH$ is used in the security model of a scheme, and oracles are defined, does the adversary only have access to those oracles in the attack or does he also have access to the "real" algorithms of the scheme?


texts:
I want to create a Server S1, that publish a different value every 10 minutes on the internet. The value looks something like f7826da6-4fa2-4e98-8024-bc5b71e0893e.

I want a create another server, S2 able to verify at anytime if a value is generated by S1 or not.

Everyone on the internet can see and collect the values generated by S1 so the rotation/encryption function has to be more or less secure and for example not increasing the original value by 1 every 10 minutes.

maybe sharing a key between the two servers and than use it to encrypt the value at each time is one solution but I have a very basic knowledge in cryptography and don't know how to start. Is there a name for the mechanism I want to do ? Do you know what are the different mechanism to achieve it ?


texts: Given the classical scheme Playfair, say, for 5*5 matrices, I am interested to determine its unicity-distance. How should one proceed to properly do that? I should appreciate it, if I could obtain a very terse recipe, listing the kind of computations such that I could effectively compute that value myself. (I am attempting to determine the unicity-distance of a suggested variant of Playfair.)


texts:
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?

From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to hear what the community here has to say about this and why it is happening.


texts: Understanding Public key and Private key

texts:
I try to understand the private and the public key concept, and need some validation about my statements:

If I encrypt a message with public key, I can only decrypt with private key.
If I encrypt a message with private key, I can only decrypt with public key.
I can generate public key (derived key) from private key(base key).
I can not generate private key from public key.
Private key name comes how I handle the key: I keep it in secret, so I call it private key.
Public key name comes how handle the key: I publish it, anybody can use it, so this is the public key.
If I publish the base key, I can call it public key
If I keep in secret the derived key, I can call it private key.


texts: calculating beta for elgamal elliptic curves

texts:
Suppose we use elgamal elliptic curves for secure communication. Bob selects a prime $p$, an elliptic curve $E$, a point $\alpha$ on $E \pmod p$, and a secret integer $f$. Suppose that Bob has selected $p =8115633240307$; $E: y^2 = x^3 + 45x + 1$; $\alpha = (1728910711, 274151521448)$, $f=7$;
How would we calculate $\beta = [f]\alpha = [7](1728910711, 274151521448)$?.


texts: Does this proof sketch show that finding a SHA-1 preimage is NP-hard?

texts:
Jutla & Patthak wrote "Is SHA-1 conceptually sound?" back in 2005, in which they provide a proof sketch (Appendix A) to show that finding a preimage for SHA-1 is NP-hard.  Now, there are some issues with the proof sketch (as far as I can see).  It does not take into account the additional constraints introduced by linear message-expansion; and it does not handle the CHOICE function and is therefore applicable to rounds >20.  At a somewhat more pedantic level, the constructions look a bit artificial, but perhaps that's just aesthetics.

Nevertheless, it seems that if the proof sketch does hold true, then this provides a NP-hard model for two-thirds of SHA-1 preimage-finding, which seems like it should be a big deal.  The paper has never been published in conference proceedings or journals, nor is it cited by the most significant SHA-1 preimage work in recent years (i.e., Knellwolf & Khovratovich ; Rechberger; and Aoki & Sasaki).  I assume that there's something more important that's wrong with the proof as a whole, but I'm not sure what it could be.

So my questions is: what's wrong with it?


texts: which en/decrypt algorithm should use for small byte array that result have same length

texts:
I wanted to use Rijndael for encrypting big array of bytes, as you know this algorithm will add up to 15 byte to result (if you use block with length equal to 16). It is acceptable in most cases but in this case I can not afford such a thing (result length should be same as given length). So I think about using this algorithm for encryption but for a few remaining bytes use another algorithm. Which algorithm is proper for this conditions:

data can be small byte array with length less than 16.
result have same length as input array
be reserve able (decryption)(it is not password)
be safe enough (not out of date)

It also will be great if this algorithm work with small key (I prefer do not use all password/iv for this part).

(I use C#)


texts: Can AES be considered as Perfectly Secure?

texts:
I am studying about the AES encryption standard, and as I know from the theory there is no known weaknesses today about this block-cipher.

I would like to find out or at least to understand what "classification" of secureness is AES.

As I know there are several classifications:

Perfectly secure. Which is not able to break and an example is the One-Time-Pad.
Provably secure that is we can proof that the complexity of the algorithm is closed to a known theoretical assumption like the NP-hard.
Practically secure when an encryption algorithm is tested for long time and there is no sucesful attack so far.

With this in mind I will say that the AES is provably secure because as I know (correct me if I am wrong) the AES is able to crack but to test all the possible keys will take trillion (?) years to achieve that so that my answer.

So I am wrong?


texts: Is it possible to execute elliptic curve encryption on small sensor-tags CC2650?

texts: I am working on a project wherein ECC needs to be implemented on small devices, namely, CC2650 sensor-tags for authentication. The ECC implementation should be on Contiki OS. I have read some articles which suggest it is possible to implement ECC on tiny devices. I want to know is it viable practically considering the memory and CPU processing overhead or one should only use Symmetric encryption, AES on these devices? I would also appreciate if someone can give me feedback on the choice of preferrable library among, RELIC, TinyECC, and OpenSSL.


texts: What are the quantum relations of four-particle GHZ states?

texts: How to represent a four particle GHZ states in quantum cryptography and what is the relation between them?


texts:
There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk Encryption (FDE).

Now most FDE applications just don't bother with authentication. TrueCrypt for example has no authentication mechanism in place for authenticating the bulk data. However it uses CRC-32 (!) to ensure integrity of the data encryption keys in the header. The advantage this provides is that the ciphertext may be completely indistuingishable from random.

Now I want to create a data container format with the same property (complete file is random-looking) but want to perform strong authentication of the data encryption keys. This means I need to use authenticated encryption (AE).

Most of the AE schemes append a tag to the ciphertext and to ensure pseudorandomness of the whole file this tag also has to be random looking. The desired notion for this would be IND-CPA.

So my question:
Are the output tags of the common MACs / AE-modes indistinguishable from random data under chosen plaintext (or eavesdropper?) attacks?

What is considered common MACs / AE-modes:

GCM
EAX
CWC
HMAC
CMAC / CCM


texts:
I am not getting whole idea behind Public Key Encryption technique.

As according to fact, public key encryption method uses two keys a public key known to everyone private key known only to recipient of the message

For an instance let assume, John wants to send a secure message to Jane, He uses Jane's public key to encrypt the message. Jane then uses her private key to decrypt it.

The thing i am not getting is, as far as i know if we want to encrypt any message using a key, from that same key only we can decrypt that particular message.

But in public key encryption case both keys are different than how it is possible to decrypt the message.

Please clarify my issue and guide me through if i am going anywhere wrong in understanding the whole concept


texts: Hashing or encrypting twice to increase security?

texts:
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has disappeared--seems to be that from a security standpoint it could be sort-of analogous to upping the number of rounds in SHA-256 from 64 to 128, thereby providing a margin of safety as it is probable that the first preimage attack against SHA-256 (if such a thing exists) wouldn't work against SHA-256(SHA-256(x)), giving time to transition to a new hash function.

First of all, is that true? Would hashing twice make it any more difficult to mount a preimage attack, at least for certain types of attacks?

If the answer is yes, my related question is: is there a mode for encrypting twice to provide a similar increase in security? How would one feed the result of the 1st round of encryption into the setup of the 2nd (or 3rd)? Would you use the same key twice? Would you derive the 2nd key from (a hash of) the ciphertext of the first round (and the 3rd round from the 2nd, etc.)? Would you need an odd number of rounds and alternate Encrypt(Decrypt(Encrypt())) like Triple-DES does to prevent a meet-in-the-middle attack? How would this interact with the various modes of symmetric key encryption? Anything else I'm not thinking of that I would have to know about this if I were to implement it in a real product?


texts: Secret sharing in different groups; Rounding down of elements

texts:
I have the following problem:

A secret $x \in \mathbb{Z}_q$ is secret shared (additive secret sharing) between $n$ parties, now is it possible to compute the secret shares of $y = \lfloor x \rfloor _p $ without reconstructing the secret $x$.

$ y = \lfloor x \cdot \frac{p}{q} \rfloor \in \mathbb{Z}_p  \text{    } p < q $. Essentially I need the shares of rounded down version of $x$, is there a way to do that?


texts: Largest message size for XChaCha20-Poly1305

texts:
libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size.

However, the only specification available (still a draft) explains that under the hood the IETF version of ChaCha20-Poly1305 is used (in combination with HChaCha20 for key derivation), which implies at the very least a hard limit of 256GB because of the 32 bit counter.

Who is right, and how large can a message be at most to be safely encrypted with XChaCha20-Poly1305?

And what about the authenticated data?


texts: McEliece information set decoding attack vulnerability

texts:
Wikipedia states that McEliece is open to "information set decoding attack". What is an "information set decoding attack" and how serious is the vulnerability? (is it just a matter of choosing proper padding/parameters or is the issue deeper)

(motivated by Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?)


texts: How to compute result in last step of Socialist millionaires problem?

texts:
I was trying to understand Socialist millionaires problem and solution in OTR protocol, but I'm stuck at figuring out how and who computes $(Q_{a}Q_b{}^{-1})^{\alpha\beta}$.
If I'm Bob then I received $Q_{a}$, I can compute $Q_{b}^{-1}$ and I know my $\beta$. However I don't know $\alpha$. How is it computed then?
I'm uploading screenshot of wikipedia page, which I'm reffering to, in case it get's modified in future


texts:
I am looking for cipher mode to encrypt disk at a sector level 512B/4K
Performance-wise CMC is not a problem here.
There is no possibility to store additional data.
Is there any other option without known weaknesses or is CMC the best choice?


texts: Absorbing r + c bits in first round of a sponge function

texts:
In the standard sponge construction, r bits are consumed in each absorption step, and they get concatenated with c capacity bits. In the first round, the capacity bits are 0, so the r input bits just get zero-extended. Can we instead consume r + c bits in the first round, while maintaining the security properties of a random sponge?

Intuitively, it seems like the capacity bits serve no purpose in the first step, since there's no state from a previous round that needs to be propagated. My intuition could be wrong though.

If it's valid, this optimization would be particularly helpful in SNARK programming. If we're compressing two field elements to one, for example, this would let us use a state width of two field elements instead of three.


texts: how to let other people respond to emails only decrypt-able with my private key

texts:
First of all I have to say it's a homework question but since I have no one to consult with, I ended up here :)

Suppose a case in which you are the manager of a company and all employees encrypt their messages with your public key and send them to you.You can decrypt them with your private key and read them.

Now suppose you're leaving for a vacation and want your secretary to be able to read the emails but you don't want her to have your private key.

How would you go at solving this issue?

Any hint or suggestion is greatly appreciated :)


texts: I don't understand how to append the length of 128 bits exactly? First, we pad bits to make the length ($n*1024-128$) but then I need to append 128 bit of the plain text length. I find the problem to append 128 bits.


texts:
Below the Wireshark snapshot of the handshake compliant to the TLS 1.2.
The position 1 displays the enum ServerECDHParams where I can use any curve having the own ID RFC8422. I'm free for example to use Edwards, Brainpool or NIST curves having an ID assigned by IANA.
Please correct me when I'm wrong but at the position 2 I have to provide the value from the enum SignatureScheme which defines not only the signature algorithm (ECDSA in this case) but also the hash and the curve.
What value should I then use if the ECDSA certificate contains a signed public key based on for example brainpoolP256?
The migration to TLS1.3 is not an option because the task was to extend the proprietary legacy server side TLS1.2 stack implementation to use the ECC.
Not using of brainpool is also not an option as this is a customer requirement.
Full specification of the domain parameters in the Server Key Exchage is hardly supported by any embedded TLS 1.2 client.
Thank you in advance


texts: What does K stand for in frequency analysis

texts:
It was from frequency analysis lecture and the professor mentioned but I cannot recall.
The K value for English was .067, German was .076. The lowest K was Russian which was .056. When the frequency is uniform among 26 letters, then K is .038.
What is the complete word that K stands for?


texts: What's going on with the complicated implementations for map_to_curve in draft-irtf-cfrg-hash-to-curve?

texts:
I've been looking into implementing cPace, and I saw that two cipher suites defined for it refered to draft-irtf-cfrg-hash-to-curve for its protocol definition. Part of cPace requires mapping a string hash to a point on the elliptic curve, so it uses the other standard's methods for doing that, in particular its choice of map_to_curve for each curve.
Looking through draft-irtf-cfrg-hash-to-curve, its provided options for map_to_curve, such as Simplified SWU and Elligator 2, seem rather complicated to me. It seems to me that, for example, Elligator 2 is performing a lot of steps to be able to perform this mapping. There is also the issues of (some implementations of) map_to_curve that require additional steps, such as summing two calls to map_to_curve to even the distribution and having to remove the cofactor from the result.
It seems to me that it should be simple enough to map an integer/field element $u$ to a curve point by just using $uG$ with $G$ being the generator for the curve. I can't figure out why this method wasn't used instead. Through my research into Elligator 2, I found that it was originally designed to be a two-way mapping, but the (draft) specification is using it in a one-way context.
What is (or might be) the reason why algorithms like Elligator 2 are being used for this instead of just using $uG$? My best guess so far is for efficiency because Elligator 2 is faster than computing $uG$, but I haven't found any evidence that was the consideration, and I don't know if it even is faster.
As a follow-up question, would it be wrong to replace Elligator 2 with $uG$? I.E. would it result in making the protocol cryptographically weaker? I was looking to implement cPace, but the library I'm using (OpenSSL) doesn't provide an implementation of Elligator 2 nor provide an interface for working directly with curve points on X25519 to help with my own implementation, but it does provide access to performing $uG$ as part of its DH implementation.


texts: Modes of operation that allow padding oracle attacks

texts:
It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why?

There was some discussion in the comments section of this answer with regards to ECB, but it didn't reach a conclusion. It would be a surprise to me if ECB would allow padding oracle attacks that give more information than the length of the plaintext, but I'd rather be sure.

The answers only have to address symmetric block ciphers and the modes of operation mentioned on the Wikipedia page.


texts:
I am currently developing a service that calculates statistics (currently only sum/average) on homomorphically encrypted user data, and then gives the results to a third party. Because encryption is computationally expensive, and user devices are routers or small SoCs, I want to blind the data (e.g. add a random big number to the data value), use a blind for multiple data values, and encrypt only the blind.

Now the question is, how big does this blind have to be compared to the actual data so that it can be considered secure? For example, if I have temperature values between -20°C and +40°C, how big would I have to choose the blinds? If I take extremely big blinds, I will run into the issue of overflows, which will probably be hard to deal with, since I am summing up encrypted numbers.


texts:
Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125):

  We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to authenticate a message $m$, we first compute the basic CBC-MAC of $m$ using $k_1$ and call the resulting tag $t$. Then we let the output tag be $t' = F_{k_2}(t)$.

My question is why do we need to use two keys? That is, why is the scheme insecure if we compute the output tag $t'$ using $F_{k_1}$?


texts: Birthday attack on hash functions derived from a collision-resistant hash function

texts:
$H_1$ is a collision-resistant hash function with an $L$-bit output. 2 hash functions are created based on it as follows:

$$H_2((k_1,k_2);m) = (H_1(k_1;m), \space H_1(k_2;m))$$

$$H_3((k_1,k_2);(m_1,m_2)) = (H_1(k_1;m_1), \space H_1(k_2;m_2))$$

Notation: $k1$, $k2$ are keys. $m$, $m_1$, $m_2$ messages. $(m_1,m_2)$ is simply the concatenation of $m_1$ and $m_2$. What would the smallest number of evaluations (based on $H_1$) be to successfully do a birthday attack on $H_2$ and $H_3$ with at least 1/2 probability? Could you please explain along with the attack that you build against $H_2$ and $H_3$?

This is a past practice question and I do have a solution (spoiler: see bottom of post) but do not understand how to get to it myself. I understand that to find a collision in $H_1$ I have to do $2^{L/2}$ number of evaluations where $L$ would be the output length.

Bonus help would be any variations of the given hashes to help solidify my understanding of the concept further.

The final answer is: $O(2^L)$ for $H_2$ and $O(2^{L/2})$ for $H_3$


texts: Given one message encrypted repeatedly with the same 'n' but different 'e's, is it possible to decrypt the ciphertext without simply bruteforcing n?

texts:
I'm trying to solve a problem where I've been provided with a few public keys and the ciphertext, and I've been told that the plaintext was encrypted repeatedly using all of these keys. However, all of the keys have the same $n$ and a multitude of $e$s, varying from 2 to 126 digits. All of the other attacks involving matching $n$s only seem to work for multiple plaintexts encrypted with multiple keys, where in this case it's one plaintext encrypted with multiple keys. Is there any attack other than brute factoring that could allow me to find the plaintext?

As a better example:
Bob is concerned about his security, so he asks Alice to produce 3 keypairs, $(n, e_1), (n,e_2), (n,e_3)$ and then encrypts his plaintext, $M$, with each of the 3 keys, feeding the ciphertext $C$ from each into the next, so that by the time he's done, $M$ has been encrypted with all three keys in series to produce one final $C$ which is sent to Alice.


texts: Collecting entropy from a stream to a file

texts:
I have a potentially infinite stream of data originating in some physical phenomena that may expose random behavior (due to quantum effects, thermal noise, the butterfly effect in chaotic dynamical systems, etc). The stream may carry some amount of entropy (true randomness), but it may be distributed unevenly throughout the stream and its density is unknown.

I have a limited storage space (say, 1GB). I need a procedure that can collect as much entropy as possible from the stream to the storage provided, and, when required, generate (in a reasonable time) a single file containing the collected entropy. It is preferable to make the resulting file as small as possible without reducing the amount of entropy it contains.

How can I implement such a procedure?


texts: Stream Cipher Key Stream from Successive Hashes

texts:
I'm currently studying crypto and wondered what would be wrong with the following process...
I want to encrypt a long message $M$ with a short symmetric key $K$ and a public nonce $X$.
The idea is to increase the length of $K$ with successive hashes
$$K' = H(X\mathbin\|K) \mathbin\| H(H(X\mathbin\|K)) \mathbin\| \cdots$$
until $length(K') = length(M)$.
Then encrypt with
$$M' = X \mathbin\| (M \oplus K').$$
I'm not suggesting that I would use that instead of using something like libsodium.
But I would like to have some intuition about stream ciphers with something that I can understand completely.
Is there anything fundamentally broken with this approach?
Is it possible to adjust this approach with minimal changes to make it not broken?


texts: Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?

texts:
It is given two RSA moduli $N_1$ and $N_2$, known to be of the form $N_i=p_i\cdot q_i$, with $p_i$ and $q_i$ unknown primes, and such that $p_2=p_1+2$. Can we make use of that relation to factor the moduli much more efficiently than if it did not held?

If that helps, add extra assumptions if they are plausible for common RSA moduli, such as:

$p_1<p_2<q_1<q_2$
$p_1\equiv1\pmod 4\;$ so that $p_1$ and $p_2$ differ only by their second lowest-order bit
$2^{(k-1)/2}<p_i<q_i<2^{k/2}$ with $k=1024$

This is a minimal subset of this more general question.


texts:
1. Alternative Cryptographic Primitives

For quite a while, I've been thinking is it possible to "craft" a cryptographic primitive (like ECC) suitable for the purposes of post-quantum cryptography, and today (2017-05-20) I've came to the following conclusion:

There are two classes of primitives that may be used to construct cryptographic protocol:

Groups: whose elements are equipped with addition with each other, and multiplication only with scalars.
Rings: whose elements are equipped with addition and multiplication with them selves.

The first kind would almost certainly be vulnerable to cryptanalysis by Shor's Algorithm, because they'd most likely be cyclic.

And most primitives of the second kind would be representable with a matrix, since they're probably going to be linear. And this is exactly where we're progressing with lattice-base crypto.

2. CryptoPrimitive Size-Security Efficiency and My Question

Take ECC for example, an ECDSA signature of 192-bit security has 384*2 = 768-bit signature, therefore, it has an size-security ratio of about 4:1.

However, take the currently (2017-05-20) most efficient signature scheme BLISS, instantiated using the procedure described by Rebeca Staffas, we have a 128-bit security instance (512-A) with a signature size of about 6471 bits, that's a size-security ratio of about 50:1.

Yet, BLISS is the composition of several primitives - from sampling bimodal discrete Gaussian, to using Huffman or Arithmetic Coding.

This got me wonder, and this is my question: Is there a single primitive that offers the best post-quantum size-security efficiency, or we don't get to enjoy one such in a post-quantum world anymore?


texts: Encryption method that reduces the cipher text to a single byte

texts: Has anyone encountered an encryption method that compresses the cipher text to a single byte at the expense of inflating the key. If yes does it have a practical use?


texts: becoming a cryptographer after math studies

texts:
After studying philosophy and being a philosophy teacher, I took back studies 4 years ago and I did a bachelor in maths. I'm in maths grad school now (I'm 32), and I would like to work in cryptography. (I took as many algebra and arithmetic and logic courses as I could, and I'm studying Galois theory this semester.)

I have two questions:

First, how do people who have a background in pure mathematics convert into cryptographers ? For instance, I know very few programming languages (I only know some Python and Matlab, and know next to nothing in C and in object programming). Is it necessary to have knowledge and experience in a lot of languages, and in programming in general, to work in the field of cryptography?

My second question is : is my project realistic? Meaning, is there a chance some company will ever hire a guy who started studying maths with 28, and has no working experience in this field, or even computer science in general?

Thanks in advance for any answers, tips, suggestions, or even encouragements :)

Supplement question: is it necessary to have a PhD to work in cryptography, or is it possible with just a masters. If so, what are the differences between the jobs of someone who has a PhD and someone who hasn't?


texts: Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of parallel composition?  (Ideally, one that doesn't require understanding zero-knowledge proofs or multiparty secure computation?)


texts: Algebraic Attack on Mix Mode Modular Arithmetic

texts:
I have a toy cipher that comprises of Mix Mode Modular Arithmetic (bit similar to IDEA including, Addition Modulo $2^{n}$ ,   Multiplication Modulo $2^{n}$ ,  Subtraction Modulo $2^{n}$ and circular shifts). I want to apply Algebraic Cryptanalysis on my toy cipher. For this purpose, i want to estimate System of Equations of my cipher. How to estimate number of equations (quadratic, linear etc) and terms (linear, quadratic etc)?
Reference to any paper for Algebraic Cryptanalysis of Mixed Mode Modular Arithmetic based Crypto Algorithms will also be helpful.


texts: Output of using the same key in all 3 boxes of 3DES

texts:
I am trying to figure this one out: What would be the encrypted output for an input x if the same key K is used in all three boxes of 3DES?

The encryption scheme for 3DES with three different keys, and $k_3 = k_1$, is
$y=ek_3(ek_2(ek_1(x)))$. So, if the key is the same 3 times, then the encrypted output of x would be $y = k(k(k(x))) = ?$

Can someone let me know if what I have done here is correct?


texts: Is there an efficient way to verify the union of two RSA accumulators?

texts:
More specifically, say we have one RSA accumulator $A_{S_1}$ accumulating set $S_1$ and another RSA accumulator $A_{S_2}$ accumulating set $S_2$. Does there exist a sublinear method to securely verify that another RSA accumulator $B$ accumulates the set $S_1 \cup S_2$, given only $A_{S_1}$ and $A_{S_2}$? All accumulators would be modulo the same $N$.

I suspect that billinear maps over composite groups may be enough, but I am not sure if building an RSA accumulator over one of these groups breaks its security.

For a definition of the RSA accumulator, refer to section 2.2 of this paper: https://eprint.iacr.org/2009/625.pdf.


texts: Point halving on elliptic curves of even order

texts:
I am trying to understand how point halving on elliptic curves of even order works. Specifically: suppose $g$ is an elliptic curve, and $G$ is a generator point on this curve. The order of group generated by $G$ is even and equal to $q$. Suppose also that $A = x \cdot G$. I know $A$ but I don't know $x$.

My questions are:

What algorithm(s) could I use to calculate $A' = \frac{A}{2}$ such that $2 \cdot A' = A$?
When $x$ is odd, is the division undefined? Would the halving algorithm detect odd points?
When $x$ is even, my understanding is that there are two solutions $A' =\frac{x}{2} \cdot G =\frac{x + q}{2} \cdot G$. Is there an algorithm that would consistently differentiate between the first and second solutions?


texts: Why isn't the IND-CCA property inherited when sending redundant ciphertext?

texts:
Suppose that in order to avoid loss in transmission, a secret key encryption scheme $(Gen, Enc, Dec)$ is modified to be $(Gen, Enc', Dec')$, such that the message m is encrypted independently three times as $Enc'(m)=(c_1,c_2,c_3)$, each $c_i=Enc(m)$.

For decryption, the 3 transmitted ciphertexts are decrypted using $Dec$. If at least 2 recover to the same message, that message is output as the decryption. Otherwise, an error message will be output.

So, I am wondering if $(Gen, Enc, Dec)$ is indistinguishable under a chosen-ciphertext-attack (IND-CCA), why isn't $(Gen, Enc', Dec')$ IND-CCA, too? Is that because there is the possibility that we may receive the error message? I mean $(Gen, Enc', Dec')$ uses the same $Enc$ and $Dec$, why doesn't it inherit the IND-CCA property?


texts: Would LWE problem be still secure if error were like this $e=2e_1$?

texts: In the Learning with error problem, if the error term $e$ from equation $b=<a,s>/q+e$ were of this kind $e=2e_1$, where $e_1$ is chosen according to the probability distribution for the LWE problem, it would weaken the problem significantly or the security insured would remain the same ?


texts: Does MD5 hash have quasi commutative property?

texts: I am implementing a one-way accumulator using MD5 hash, wondering wheather it has quasi commutative property or not.


texts: Do test vectors ensure a cipher is free of backdoors?

texts:
If a cipher implementation passes unit tests using test vectors from some trusted source (these for AES, for example), then can we say that it is fully conforming to the specification, and must have been implemented correctly?

Is it possible to backdoor a cipher (or hash function, I suppose) in such a way that it still appears to be correct and is compatible with different implementations of the same cipher?

This question was motivated by the advice given by figlesquidge in his answer to the question AES column mixing and S-Box confusion, where he says:

  Standard AES disclaimer: Given the questions you've asked, you should
  not implement AES yourself in a real-world system because there are
  lots of security considerations when implementing ciphers.


texts: Why this isn't second preimage resistance?

texts:
I've been reading on preimage resistance and trying out few examples for the same and I'm trying to figure out why the following hash function does not have the second preimage resistance and any suggestions would be appreciated.
$$h(M) = \operatorname{AES-Enc}\big(M[0\ldots n], M[(n+1)\ldots 2n]\big) \oplus M[0\ldots n]$$
For the given hash function, since we XOR the output of AES with the first half of the input message, if I consider a message all bits zero then my hash-function would simply resolve to $\operatorname{AES-Enc}(0^n, 0^n)$. Now to show it doesn't have second preimage resistance I understand, that I need to find another message $M' != M $. But, if I consider another message $M'$ which is an all bit 0 except last bit flipped then the hash function will be $AES(0^n, 0^{n{-1}}1)$ but the output, in this case, won't be the same as $h(M)$ and so on.. so I'm a bit confused at this point and any hint would be greatly appreciated!


texts: Is the 'Padding Oracle attack' deterministic?

texts:
I'm thinking about the example of Padding Oracle attack in CBC mode with PKCS7 padding given in Wikipedia.

It says about the guess of the last byte in the plain text:

  In the worst case, they need to make 255 attempts to find the right
  value of z_1 (one guess for every possible byte).

But what will happen if the last but one byte of P2 happens to be 0x02. In this case it is obvious that we may have two possible values of z_1 which will result in correct padding: the first one will cause the last byte to be equal to 0x01 (valid padding) and the second one will cause the last byte to be equal to 0x02 (again a valid padding).

So is it guaranteed that the attacker will decrypt the message. Or the attacker may decrypt the message with high probability?

EDIT: How the attacker may distinguish between these sample plain text blocks (PT2) with different length of the padding:

... ... ... 68 02 02
... ... ... 68 02 01

The first plain text is with length 14 and 2 bytes padding.
The second plain text is with length 15, last byte but one is 2 and padding 1.

Another edit:

By following the advice in the accepted answer I managed to quickly build an app which demonstrates a successful padding oracle attack. Available here.


texts: Homomorphic/Paillier crypto system for use case?: overflow for multiple counter exponent possible? Different cipher factor needed all the time?

texts:
Recently I read about homomorphic cryptosystem. They might solve a problem. To do this there need to be some modifications from standard version.

Using Paillier here but a solution for other also fine.

E.g. given two cipher text $c_1,c_2$ with generator $g$ and factors $r_i$:
$c_i = g^{m_i} r_i^n \mod n^2$
$n=p\cdot q$, with $p,q$ primes

Now if they get multiplied
$c_1 \cdot c_2 \equiv g^{m_1} r_1^n \cdot g^{m_2} r_2^n = g^{m_1+m_2} (r_1r_2)^n \equiv g^{m_1+m_2} r^n \mod n$
The factors $m_1, m_2$ get added. If they get $n$ or larger they start over again. In normal use case that is prohibit by selecting a larger $n$.

Now I'm looking for a way to get this overflow for a special kind of $m$. Image an election with 3 candidates and their votes counted in one exponent.
E.g. candidate 1 has 5 votes, 2 has 6 and 3rd 42 votes, exponent of $g$ could be ${005006042}$. In another region it's ${133700123}$. If ciphers multiplied those exponents get added and sum up all votes for each single candidate. This exponent form only allows up to $999$ total votes for each candidate (assuming the total exponent number is $<n$).

In my use case there will always be some exponent overflow, no matter how big $n$ is. But instead the whole exponent it should be one for each candidate.
E.g. $700.800.900$ and $400.100.200$ should add up to $100.900.100$ instead of $1100.901.100$.
Is there a way to have multiple overflows in exponent? Or an alternative way for multiple counters?

Elements also get subtracted, so there need to be an underflow as well.

As far as I understood each cipher can(should?) have its own $r$. For my use case it need to be associative in some way. It need to be the same cipher independent of order and direction. E.g. adding 5 votes to a cipher should result in same ciphertext as adding 5 times one vote to the same cipher. That should work if there is only one $r$ (for each candidate)(+$r^{-1}$ for subtraction). But a single $r$ works against security, or?
You know another way to achieve this? Some way to check if two different $c_1\not= c_2$ have the same exponent without encrypting it would also work.


texts: Open-source usb TRNG and US standards - Help choosing

texts:
I came across the ChaosKey and I remember the time I came accros the entrypy key that was always out of stock. I would really want one to play with, I would like the best open source I can get for under 80 USD.

According to Wikipedia, ChaosKey is FIPS-140-2 and FST-01 (NeuG) is NIST SP800-22 certified.

Now, I must say I don't care about US standard as I'm sure they lower them to make sure everything is NSA friendly. I would rather trust EU standard or something but it's not the norm apparently.

ChaosKey have an output of 10Mbit/s while NeuG (promoted by the Free Software Foundation) have an output of 602 kbit/s.

Now one could say better output mean weaker random numbers, or one is older than the other. So I'm a little bit lost here.

There is also the OneRNG, which output at 350 kbit/s and the BitBabbler White at 2.5Mbit/s.

I'm lost guys, help please.

Sorry if this isn't the right SE to post this, a the time it looked right.


texts: Quantum algorithm encrypting classical data

texts: Are there schemes for encrypting classical ciphertext using quantum algorithms? Specifically, if a public key system exists for classical data, and classical ciphertexts, can this scheme be implemented by quantum algorithms (A quantum algorithm implementing classical public key algorithms)?


texts: Help me describe/identify this challenge-response protocol/algorithm?

texts:
My area of expertise is reverse engineering, specifically embedded systems. I do attack cryptographic systems, but this largely involves key recovery or exploiting the implementation.

I was asked to reverse engineer a simple Windows executable used as part of a challenge-response protocol used for intruder alarm systems. This was trivially easy. I would like some assistance in describing the protocol/algorithm, so that I can look into the security of the system more.

The protocol

The protocol is designed to stop users resetting their alarm without contacting their alarm receiving centre.

When the alarm is triggered, a message is displayed:

CONTACT ARC
QUOTE 83647

This is called the "quote code" and is always numeric and 5 digits long. I don't know how it is chosen, but it appears random.
The alarm user calls the alarm receiving centre and informs them of the quote code.
The alarm receiving centre inputs the quote code into a piece of software (the "decoder") which returns the numeric 5 digit "reset code".
The user is informed of the "reset code" and inputs it into the alarm. It is accepted and the alarm is disarmed.

The alarm and alarm receiving center share a secret which is a number from 0-255, this is called the "version".

So at a superficial level, both the alarm and alarm receiving centre are doing:

ResetCode = F(QuoteCode, Version)

Where the QuoteCode and ResetCode are integers in the range 00000-99999 and the Version is a number between 0-255.

Algorithm implementation

This is my basic implementation of the algorithm used to generate the reset code given the quote code. The vector at the top is altered, but the rest is the same.

# Taken from the data in the exe
vector = [3,3,5,5,8,1,3,9,8,0,5,9,3,9,4,1,1,0,9,4,3,0,2,2,8,4,3,2,8,4,9,4,1,3,3,3,3,8,5,3,0,2,4,3,2,1,8,9,0,5,4,3,9,5,8,3,9,9,1,0,0,9,9,3,3,8,2,
         1,4,9,1,4,9,2,9,0,9,5,3,9,5,3,3,5,9,1,0,2,9,3,2,1,2,9,8,0,4,9,4,2,3,9,4,0,1,8,5,3,3,9,9,1,0,5,9,3,8,9,4,8,4,2,3,1,0,3,9,4,8,2,0,4,3,3,
         1,0,5,2,8,3,3,5,2,8,3,2,9,5,2,1,2,4,4,3,0,4,2,3,4,1,8,2,9,1,0,5,1,8,2,4,3,5,1,0,3,8,5,3,2,1,1,3,9,3,2,3,5,8,3,9,0,3,2,3,5,3,8,4,0,3,9,
         1,9,3,0,2,9,3,8,1,4,2,8,4,0,1,9,1,0,1,2,1,3,5,3,3,9,0,2,1,4,1,2,3,4,3,4,9,5,3,5,9,3,1,3,9,4,0,3,2,3,3,4,4,2,1]

def generate_reset(quote, version):
    i = 0
    tens = 0
    reset = []

    while i <= 4 :
        j = 0
        result = 0

        while j <= 4:
            offset = (version + tens + quote[j]) % 256
            result = result + vector[offset]
            tens = tens + 10
            j = j + 1

        reset.append(result%10)
        i = i + 1

    return reset

print(generate_reset(quote = [0,0,0,0,2], version=131))

I have run several simulations (simply by looping through all combinations of inputs), and noted the following:

The coverage of reset codes for any given version number across all quote codes is ~63%. This means that you have a higher than 1/100000 chance of guessing the correct reset code randomly.
Given a quote code and reset code, most of the time there is only a single valid version number. At most, two pairs of quote and reset codes are needed to derive the version number. The "version" isn't very secret as a result.

Questions

I hope these aren't too vague, or broad.

What would you call the type of algorithm? To me it looks like a hash with a key - does this make it a MAC?
Does this specific implementation have a name? It looks very "roll your own" but the vendor uses the phrase "military grade".
Are there any glaring issues with this algorithm? (I'm not expecting someone to do a full analysis, just some pointers would be great). My gut feeling is that the secret "version number" is not long enough to provide adequate secrecy.


texts:
If we use upper and lower case letters, and 10 digits, we get
  approximately 6 bits per character. Then, strings of 13 characters
  should work.

I saw above explanation in the material, but I cannot understand how 13 characters are appeared. How can I compute?


texts:
if i calculate a AES_CMAC for 64 Bytes, i get a 16 Byte CMAC.

Is it ok to use only the first 4 Bytes for authentication?

Can i assume that if the first 4 bytes are correct, the other bytes must be ok too?

Thank you!


texts: Given that $f$ is a OWF and $|f(x)|=|x|$ for all $x$, is $g(x)=f(x)\oplus x$ necessarily also a OWF?


texts: How close is AES to random oracle model?

texts:
I'm wondering if there are any guarantees about AES's randomness in comparison to Random Oracle, but I couldn't find any papers nor publications about it.

Let's say I have a blackbox B which for any input returns either encryption or random data

B(input){
  if(hasBeenEncryptedBefore(input)){
     fail();
  }
  with prob. 0.5 returns: "truly random bits from ROM" OR "f(input)"
}

where:

f(input){
  IV := randomIV();
  key := getKey();
  return IV, AES_ENC(IV, key, input);
}

let's assume that getKey() returns the same key for each encyption and randomIV() returns truly random bits from ROM

Is the adversary interacting with B able to determine whether the result comes from ROM or AES?


texts: What is the probability that a random function is invertible?

texts:
Having a random function - $R\in{}\mathcal{R}$

s.t.
$R:\{0,1\}^n\rightarrow{}\{0,1\}^n$.

What is the probability that $R$ is invertible?

I know calculating it suppose to be straight forward, but I'm struggling with it a bit.


texts: Key establishment protocols other than Diffie-Hellman

texts:
Are there any key agreement/exchange/establishment protocols which are NOT based around the Diffie-Hellman protocol or handshakes using public key cryptograaphy? DH seems to form the basis of this single class and I'd rather use something different than this stale, old one.

Update #1: I've found Algebraic Eraser seems to be the one key establishment algorithm that is not based on Diffie-Hellman, but I am finding references to an "AEDH".


texts: Encryption of 7 byte of data, output must be 7 byte

texts: I'm looking for a cryptographic algorithm that inputs and outputs are both 7 bytes. Is there any such algorithm?


texts: Get points of an Elliptic Curve defined over a Finite Field on Twisted Edwards Extended Coordinates

texts:
I'm working on a crypto library, and I need to perform some tests for the implementation of:

Point Addition.
Point Subtraction.
Point Doubling.
Scalar Mul Point.

The operations are performed on Twisted Edwards Extended Coordinates so (X, Y, Z, T).

The problem is that apart of the Identity point which is: (0,1,1,0), It's being hard for me to get other points to test the operations.

So being the Eq of the curve: -x²+y²=1-$\frac{86649}{86650}$x²y² over the Finite Field modulo P = 2^252 + 27742317777372353535851937790883648493.

  (So a = -1 and d = 86649/86650 (mod P).

My idea was to pick random X values and get it's corresponding Y values. Then find T is trivial. But the problem is that I end up with things like:

For whatever X,

Y = +- (sqrt(-x^2 -1)) / (sqrt(d*x^2 -1))

My question is if this approach of getting random points over the curve is correct.
And in that case:
Since I cannot get decimal values over a Finite Field, how should I treat the sqrts?

  With division we know that a/b = a * inverse_mod(b, P).

But what about the SQRT operator? How can I deal with it?


texts: Upper bound on r* on page 7 in the Scale Invariant Fully Homomorphic Encryption over the Integers paper

texts:
I was hoping to get some clarification on how the bound on r* was calculated (bottom of page #7). I'm trying to reproduce the results that have been shown, however I keep getting a slightly smaller bound for r* . It would be really helpful if anyone could tell me which components were added from the previous equation to get r* .

Thank you!