texts:
I was reading about the differences between the GCM and the CBC more here and I have a follow up doubt on the same.

In the CBC mode the person who performs the encryption is the one who provides the IV for the encryption -- and the IV is required to decrypt the ciphertext.

However, in GCM i read that the nonce value is internal -- so is it a value which needs to be kept in track off by the person who encrypts / decrypts the values? I'm specifically referring to the Java BouncyCastle implementation of AES-GCM.

Is the nonce value effectively an IV supplied by the person who encrypts the data appended with an internal counter?


texts: Are the GPS coordinates a good source of entropy?

texts:
Are the GPS coordinates (latitude and longitude) a good source of entropy? If yes, why? If no, why?
The question would investigate on the fact if the GPS location data can be used as source of entropy in the cryptography field, in general. The question could be trivial or not, it depends by several factors (e.g. the scenario, the entity speed and so on).
But what do you think about it?


texts: Most efficient way to crack a monoalphabetic substitution cipher with spacing intact

texts:
I've got a cipher I've been challenged to crack by hand. It's a monoalphabetic substitution cipher, and the English spacing is intact, so all of the words are the right size.

Is there a more efficient way to crack this cipher than frequency analysis?


texts: Can AES GCM mode detect an incorrect key and refuse to decrypt?

texts:
I understand that AES in GCM mode produces an authentication tag that is used to ensure that a tampered with cipher text is not decrypted. However, if I pass the wrong key will AES in GCM mode detect that I am using the wrong key and give me an error message or will it give me back garbled data because I used the wrong decryption key?
Does the AES-GCM spec say that an error will be raised if the wrong key is used?
UPDATE The error does not have to indicate that the key was wrong, just that decryption should fail so incorrect clear text is not returned to the caller.


texts:
I have a Zip archive containing a single password-protected file file.txt.
The encryption is "ZIP 2.0 Default Encryption" (ZipCrypto).

I know what kind of text (sentences) the "file.txt" contains.

Is it possible to use known-plaintext in that case? Or,
Do I need exactly a second known encrypted file to use this type of attack?


texts: Security of Diffie-Hellman when one party has a flawed RNG (compared to TOFU)

texts:
Use case: We need to establish a long-lived key. In this phase, it is unlikely attacker will either sniff or the modify communication, but we want to cover even this case. So we use Diffie-Hellman or ECDH with some kind of authentication (in order to prevent MITM) for the initial key exchange. We can also assume that both parties don't reuse their DH keypairs. So far, pretty standard situation.

Now, let's assume that RNG of one peer is seriously flawed and attacker can guess (EC)DH private key of this peer. The other peer has unbreakable RNG. My intuition is this in not any worse than simple TOFU (Trust On First Use) key exchange where the party with a high-quality RNG generates the secret and transfers it in plain, hoping there is no attacker in the initial phase. (If we aren't confident about either party's RNG, we could xor random values provided by both parties.)

Note that a flawed RNG does not imply a complete failure. Consider a RNG that is OK for generating unique values (so nonces for encryption are good enough for some modes), but they can be predictable. For sake of simplicity, let's assume attacker can simply learn the key with 100% probability and full accuracy.

In other words, you can imagine a scenario: You have missed the initial (EC)DH key exchange, so you can neither read it nor influence it. You can capture and intercept any subsequent communication, which is encrypted and authenticated using the key exchanged in the handshake you have missed. You have an oracle that can give you the private key used by one party in the initial (EC)DH key exchange. Your task is to learn something about the key or the communication itself. Anything you can learn without knowledge of the oracle is not considered as a gain.

My reasoning about its security is pretty simple:

When the attacker has captured the initial phase, we are flawed in either case, so flawed DH is not worse than TOFU.
When the attacker does not have captured the initial phase, we are pretty secure in case of TOFU. In case of Diffie-Hellman, attacker might have the group, one party's private key (as one peer has a flawed RNG), but she doesn't have other party's public key, as it was present just in initial handshake. Without this, attacker should be unable to learn anything about the secret.

My intuition might be right, but it is far from a proof. Is there any proof of this?

Theoretically, if my intuition above is wrong, both parties can generate random nonces and xor both nonces with the secret. As at least one nonce is unknown for attacker that doesn't know the initial handshake, so the resulting secret is secure in the same way as with TOFU. This is something I can prove to be secure at least as TOFU even in case of flawed RNG on one peer, but it is also some non-standard (and probably unnecessary) addition to DH that requires collecting some additional entropy.


texts: Why is only one oracle + challenge-response phase sufficient for IND-CPA security?

texts:
The CRYPTUTOR wiki from UIUC uses the following definition of the IND-CPA game:

  We (privately) choose a key K according to the key generation
  algorithm: K $\gets \mathsf{KeyGen}$.
  We (privately) choose a random bit b $\gets \{0,1\}$.
  Repeatedly do:

  A is allowed (any number of times) to query an oracle that computes the functionality $\mathsf{Enc}_K$.
  Challenge: A outputs two messages, $m_0\, $and $m_1\,$.
  Response: We give A the ciphertext $\mathsf{Enc}_K(m_b)$

  A outputs $b'\,$ (i.e, a guess for our b).

  We say that the advantage of A in this experiment is $\Pr[ b = b' ] - 1/2$.

Later in the Modifications section it is stated as follows:

  Using an application of a hybrid argument, it can be shown that only one "challenge-response" phase is necessary. It does not affect the definition of security to remove the repeating loop (line 3).

I am not able to come up with any hybrid arguments to prove this.


texts: Blowfish, Sboxes and the digits of PI, and the P_Array

texts:
I am trying to use the Blowfish algorithm, however, I am trying to understand SBoxes that were used in the algorithm. I saw that it uses the hex digits of PI. I looked around in the web and found some codes that implements Blowfish and saw that they're using hardcoded SBox int arrays.

For example, in here:
https://www.schneier.com/code/constants.txt

Since it was stated that sboxes contain the digits of PI, so I am guessing that the first five entries of sbox0 correspond to 31416.

If so, how did 0xd1310ba6L came from 3?

I am asking this because I am experimenting if I can use a random set of integers for the sboxes. After all, I saw that sbox values were supposed to be random.

Also, if I did change the values of the sboxes, can I still use the same set for the P_Array?


texts: ABE Schemes - Access Structures & Performance

texts:
I'm reading this article, CP-ABE with constant-size keys for lightweight devices and in the Table 1, are there these access structure: Threshold, Tree, ($n$,$n$)-Threshold, LSSS, AND gates. I have 2 questions.

1) What are the differences between these access structures ?

2) How can i measure the performance of a scheme in a network ? (i.e scalability, number of users (producers and consumers) supported, number of contents supported) [If this question is off topic, i will remove it].


texts: Secret shared input for garbled circuit?

texts:
I’m curious about what the secret shared input for a garbled circuit is. Essentially, a garbled circuit is a two party computation framework where each of two players has each input as bit string. In this case where is secret shared input?

If there is a case when secret shared bit string is used as input, I want to know it’s mechanism and it’s reference material. Thanks


texts: Can zk-SNARKs prove satisfiability for NP-hard languages?

texts:
In general, I think of zk-SNARK circuits representing a language in NP, meaning it is "computationally easy" to verify. However I was reading about a recent zk-SNARK (Sonic) which has as goal "to provide zero-knowledge arguments for the satisfiability of constraint systems representing NP-hard languages".
Can someone explain how a zk-SNARK circuit can prove satisfiability of an NP-hard language?


texts: CBC related TLS cipher suites to be disabled in the server side

texts:
I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don't need padding.

However, in Java, SunJSSE provider by default enables many cipher suites that are using CBC. And whether those cipher suites will be used or not are determined by the client preference.

While using Chrome and FireFox latest versions, I noticed the cipher suite used is AES_128_GCM.

Now, is it advisable to disable all the CBC related cipher suites in the server to ensure only GCM is used regardless of the client preferences? Is there any limitation with this approach of using only GCM related cipher suites?


texts: I took  image from Simons Institute's presentation. Complexity classes of Approximate SVP problem according to approximation factors are given in the table. My question is, What is the meaning of blue arrow -Crypto- in this picture?


texts: Right way to hash elliptic curve points into finite field

texts:
I would like to know how I can implement several hash functions :

$H_1:\{0,1\}^* \rightarrow P $ with $P \in E(\mathbb{F}_q)$

and

$H_2:P \rightarrow \mathbb{Z_q}^*$

And others where the input data changes (for example $h:(P,\{0,1\}^* )\rightarrow \mathbb{Z_q}^*$)
With an elliptic curve of the form $y² = x³+ax+b$ over $\mathbb{F}_q $ where $q$ is a prime number, what is the correct way to construct those functions in my code ?

I planned to use some NIST or SECG recommended elliptic curves so I didn't generate all the elliptic curve points, thus for $H_1$ I can't just simply hash with an existing function and map the result to a point in a list (So I can't use this response ?) .
For the hash functions which take a point should I just hash the coordinates with a function like SHA-2 or another and apply a modulo on the output ?

I don't really know if my ideas are the right ways to go, I just want to implement these functions properly from a cryptographic standpoint, something that works without need to be perfectly optimized.

Thank you in advance


texts:
Where did SHAKE128 and SHAKE256 originate from?

I am trying to find them in the original Keccak documentation but can't find them.

Is it some special mode of Keccak referenced in the documentation? Or something invented by NIST and added to the SHA3 standard?

Any public cryptanalysis done on them?


texts:
I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option.

Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES specification uses the AES algorithm to encrypt the nonce, but also says "There is nothing special about AES here. One can replace AES with an arbitrary keyed function from an arbitrary set of nonces to 16-byte strings. This paper focuses on AES for concreteness."

Two questions:

Do all TLS cipher suites using "Chacha20-Poly1305" use Poly1305-AES? RFC7539 references AES as the nonce-encrypting algorithm, but also notes that other algorithms could be used.
Why is Chacha20 not used as the nonce-encrypting algorithm instead (Poly1305-Chacha20)?  Would this cause a security flaw?

Thank you!


texts: What is the difference between mutual authentication and unilateral authentication both ways?

texts:
I am currently reading Engineering Security by Peter Gutmann, on page 7 he states:

  proper
  mutual authentication is quite different from unilateral authentication in both directions

He references What is authentication by Dieter Gollmann which is a transcript of a discussion. The relevant part here is:

  Next point, if you scan the literature on entity authentication you will find, starting around 1991, comments that mutual authentication is something different from unilateral authentication going both ways.

Unfortunately I cannot follow the transcribed discussion. Can you explain the difference between bilateral authentication and double unilateral authentication both ways? Why is double unilateral authentication not sufficient?


texts: How large is the Playfair cipher keyspace?

texts: In the Playfair cipher, is the key space 5 x 5 = 25 or 25 x 25 = 625? I'm trying to work out the size of the key space if each set of equivalent keys is counted as one key.


texts:
I am currently learning Rijndael's Algorithm through this site where there is a slide show animation step-by-step.
I understand nearly all of the encryption process except part of Add Round Key.Looking at slides 16 & 17, it says:

    Applying the RotWord ... to the previous word Wi-1

What is the RotWord and how do we apply it? Is it the same transformation in all rounds?

I can deduct (from the result on slide 17) that the RotWord transformation has done a shift upwards by 1 on the word:

+----+                 +----+
| 09 |                 | CF |
+----+                 +----+
| CF |                 | 4F |
+----+ --- RotWord --> +----+
| 4F |                 | 3C |
+----+                 +----+
| 3C |                 | 09 |
+----+                 +----+

Is my assumption of this transformation correct?
If so, will the amount shifted by change every round or does it remain constant?


texts:
I'm an electrical engineering student and was doing a brief research regarding the round transformations of the AES-128 and came across the Wikipedia article describing the generation of the substitution box (https://en.wikipedia.org/wiki/Rijndael_S-box) from the mathematical point of view. In the corresponding article it was explained that a given element of the extension field GF(2^8) is initially inverted with respect to x^8+x^4+x^3+x+1. Subsequently, the result (inverse element) is undergoing an affine transformation. The transformation itself is actually comprehensible. However, I do not understand the corresponding C-implementation at all. My naive approach to understand the below shown implementation was to think of the matrix multiplication as a linear combination of the columns of this matrix weighted with the bits of the inverse element. Since the columns of this matrix seem to be cyclicly shifted this could somehow explain the execution of ROTL8 in the affine transformation. In the end, the addition with 0x63 is actually quite clear.
#define ROTL8(x,shift) ((uint8_t) ((x) << (shift)) | ((x) >> (8 - (shift))))

void initialize_aes_sbox(uint8_t sbox[256]) {
    uint8_t p = 1, q = 1;

    /* loop invariant: p * q == 1 in the Galois field */
    do {
        /* multiply p by 3 */
        p = p ^ (p << 1) ^ (p & 0x80 ? 0x11B : 0);

        /* divide q by 3 (equals multiplication by 0xf6) */
        q ^= q << 1;
        q ^= q << 2;
        q ^= q << 4;
        q ^= q & 0x80 ? 0x09 : 0;

        /* compute the affine transformation */
        uint8_t xformed = q ^ ROTL8(q, 1) ^ ROTL8(q, 2) ^ ROTL8(q, 3) ^ ROTL8(q, 4);

        sbox[p] = xformed ^ 0x63;
    } while (p != 1);

    /* 0 is a special case since it has no inverse */
    sbox[0] = 0x63;
}

Would it be possible to explain how the matrix multiplication in the affine transformation can be interpreted as the addition (XOR) of the rotated terms (ROTL8) of the inverse element?
Best regards
Ratbald


texts: How simple hash provide message authentication?

texts: This structure provides message authentication. My question is if someone finds the key he can simply change the message and compute new hash according new message and send it to the receiver. If so, how can hashing provide message authentication? This scheme totally depends on encryption algorithm than why do we add hash in this?


texts: ZKIP for Paillier public key correctness

texts:
I'm using the Paillier cryptosystem in a protocol similar to mental poker. In the beginning of the protocol, each player generates a Paillier public key $(n,g)$.

Later in the protocol, a player may reveal any message encrypted by his public key (by revealing both the message and the randomizer used). The other players can easily verify that this message+randomizer does indeed encrypt to the original ciphertext. However, they might not be assured that this is the unique decryption of that ciphertext.

For this, it is necessary that after generating his public key, each player proves that this is a correct Paillier public key (ie. that $\gcd(\text{L}(g^\lambda \!\!\!\mod n^2), n) = 1$, or any equivalent statement).

The only way I can think of is the following:

prover generates $k$ public keys $K_1, \dots, K_k$
verifier chooses a random $i \in \{1, \dots, k\}$
prover reveals the private key for all public keys except $K_i$
verifier checks that the condition is satisfied for all revealed keys, and if so, assumes that $K_i$ is also a valid key

However, the probability of cheating only decreases linearly ($1/k$) with this scheme (as opposed to exponentially ($1/2^k$) using most ZKIPs), so it is not feasible to achieve a very high security level.

It might also be possible to prove the uniqueness of decryption directly (without proving the correctness of the key), e.g. by the verifier encrypting $k$ random messages, and the prover decrypting them and proving that the result is the same (this can be done in zero-knowledge using the homomorphic property). Unfortunately, I was unable to determine what the probability of unique decryption is with an invalid key, so the security level of such scheme is unknown.

Any ideas?


texts: Performance of ECDSA, ECKCDSA and ECGDSA

texts:
It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter.

However, I would like to know the performance difference of the variants ECKCDSA and ECGDSA compared to either ECDSA or RSA. ECGDSA avoids the calculation of the inverse in the signing phase, but is there really a significant performance increase?

In the ECKCDSA algorithm, the public keys are validated by means of certificates. Does this step decrease the performance?


texts:
I have the following requirement for hashing using MD5.

H(A,B,C,X);

Where values A,B & C are given. However X is not given.

I would like to find out what value of X would give a hash beginning with 32 1's bits

meaning H(A,B,C,X) = Begin with 32 '1' bits

I can brute force by testing all kinds of characters of X till i get 32 '1' bits.

however is there a faster way rather than doing this?


texts: I have been reading about differential and linear cryptanalysis. They were mainly introduced by Adi Shamir and Biham to show weakness of DES. However, many of articles state that they have been considered as a technique to evaluate all other block ciphers. My question is, are they beneficial for public key cryptography? or are they limited to private key schemes ?


texts: What was the first MD5 collision ever constructed?

texts:
We all know that MD5's collision resistance is severly broken.

But when thinking of "random" strings with great cryptographic importance I've come up with NIST's curve seeds and MD5 collisions. But for this to really work out I'd need the most famous MD5 collision.

So I'm asking: What is the most famous MD5 collision?

As for the definition of famous: The very first published MD5 collision is considered "the most famous" with the only exception of one collision having occured a lot more often and having spread a lot more due to important historical events (Flame?) and being generally considered the most famous one.


texts: CP-ABE (Bethencourt): How KeyGen computes $D=g^{(\alpha+r)/\beta}$?

texts:
I have one doubt from CP-ABE KeyGen algorithm (paper).

In Setup, master key is $MK=(\beta, g^\alpha)$.

In KeyGen(MK, S), they say generate random number $r$ and compute $D=g^{(\alpha+r)/\beta}$.

How one calculates $D$ from $g^\alpha$ ? ($\alpha$ is not part of $MK$).

Does he calculate $1/\beta$ and computes $D$ as below?

$\qquad D = {(g^\alpha.g^r)}^{1/\beta}$

I am not sure I did this the right way? Am I missing something here. Please help me understand.

Thanks.


texts: How would we design a fast circuit to solve LCS35?

texts:
LCS35 is a time-lock puzzle, stated in Ronald L. Rivest's Description of the LCS35 Time Capsule Crypto-Puzzle [1] (April 1999). That instantiates a system in Ronald L. Rivest, Adi Shamir and David A. Wagner's Time-Lock puzzles and timed-release Crypto [2] (MIT technical report, 1996, revised March 1999).

Solving the puzzle boils down to computing $2^{(2^t)}\bmod n$ for $n$ a public 2046-bit RSA modulus of secret factorization, and $t\approx1.13\cdot2^{46}$. The reference method sequentially computes $w_i=2^{(2^i)}\bmod n$ for $i$ up to $t$, by iterating $w_{i+1}\gets w_i^2\bmod n$, starting from $w_0=2$, or perhaps $w_{10}=2^{1024}$.

How would we design a fast circuit for that purpose? And what speed (in equivalent modular squaring per second) could it achieve? I'm interested in

Mathematical techniques: e.g. would Montgomery arithmetic help?
Architectural tradeoffs: e.g. between circuit depth and size, both causing a slowdown.
Technology: I do not even know what technology is currently the state of the art when it comes to fast logic, much less what it could realistically achieve.

The design of LCS35 attempts to block attempts at massive parallelization, and mostly succeeds as far as we know. The question is about making the computation nevertheless.

The value of $t$ was chosen assuming 3000 squaremods/second in 1999, exponential grows to ×13 that per 2012, then again ×5 per 2034 (the challenge ends in 2033).

I propose to ignore:

Operating cost: it would be negligible compared to bitcoin mining, unless we find a way to parallelize, which would be a major breakthru.
Investment cost: it depends on too many factors, and evaluations are not falsifiable.
Computation errors, since we know how to deal with them:

Reference [1] suggests making the computation of $w'_i=2^{(2^i)}\bmod(c\,n)$ where $c$ is a moderate prime (50-bit). This allows a periodical check that $w'_i\bmod c\ =\ 2^{(2^i)\bmod (c'-1)}\bmod c$, backtracking if an error creeps, and getting $w_t\gets w'_t\bmod n$ in the end.
A variant is to compute both $w'_i=2^{(2^t)}\bmod(3n)$ and $w''_i=2^{(2^t)}\bmod(5n)$ on two independent engines (conveniently, both moduli are 2048-bit), and periodically check that $w'_i\bmod n=w''_i\bmod n$. That requires two independent implementations but little increase in the modulus size, hence (I guess) faster computation and smaller computing engines.

Attacks that essentially factor $n$, including using a Quantum Computer.
Alternatives to LCS35 for timed-release crypto, as asked in this other question.


texts:
I was wondering if the uniform distribution of hash values is a generally required criteria for cryptographic hash functions.

The english wikipedia article only mentions four main properties. But it looks like the commonly used algorithms show a nearly perfect uniform distribution. So my question(s) would be:

Are hash functions supposed to have uniform distributed values?
(If so) Is it an explicit requirement or an implication of the second and last property mentioned by wikipedia (irreversibility + collision resistance)?
Are there any hash functions, currently used, that do not show such distribution?
Is there a scientific paper or article addressing this issue? (Unfortunately I was unable to find one)


texts: How does Gilbert, MacWilliams, and Sloane's solution to “perfect integrity” work?

texts: Gilbert, MacWilliams, and Sloane defined a solution to "perfect integrity" in Codes Which Detect Deception, unconditionally secure message authentication, not vulnerable to any cryptanalysis on its own even by an adversary with unbounded computational power, provided you have a key chosen uniformly at random the same length as the message. It sounds counter-intuitive that a MAC could have perfect integrity, any hash function can be broken with enough computational power. How does their solution have "perfect integrity"?


texts: If two parties want to communicate with securely using OTP , how is the key ( that is lengthy as plain text) shared with other party for decryption ?


texts: Reduction from signatures to encryption?

texts:
Is it possible to construct an (asymmetric) encryption scheme from a signature scheme?

If the signature scheme is deterministic and allows existential forgery (e.g. RSA), then the answer is yes (create a forgery (m, sig); encrypt plaintexts using AES with sig as the key; send m in clear to the signer along with ciphertexts, who can then compute sig and decrypt these ciphertexts) .

I am interested in similar reductions for probabilistic signature schemes.

What should the properties of a probabilistic signature scheme be so that it can be used for encryption?


texts: Security of key bits under indistinguishability for randomized encryption

texts: My question is about symmetric randomized encryption. Let c=E(k,m,r) be a randomized block encryption function where r denotes a random input chosen for each message block m. k and c denote the symmetric key and ciphertext respectively. If E has indistinguishability of m0, m1 for any chosen plaintexts by an adversary given a chphertext c of mb for a randomly chosen bit b, how does this translate to security of key k given ci for any chosen plaintexts mi by allowing oracle access to the adversary? In the deterministic encryption there is the security condition that the computation of k given p,c is infeasible. How is this property assured by indistinguishability?


texts:
I'm working on a firmware for a platform with limited resources with C as programming language.

There are a set of cryptographic primitives to be implemented, including AES, GCM/GMAC, ECDSA, ECDH. Our hardware allows to handle all these algorithms (it is more or less a crypto controller) and all the mentioned things beside ECDH are already implemented and tested.

For a future firmware release certificate handling (only for ECC with P256/SHA256, including also certificates in the validation chain) is needed as an additional requirement.

What is the best approach to parse certificates into its atomic constituents. E.g. I need access to public key material, like expiration date, issuer, subject , ...

Of course, I know about openSSL, but this is too heavy and would blow up far too much. So I tested mbedSSL (under Apache license). This open source project would do it, but I'm not allowed to use it because of internal reasons. Similar for woolfSSL. Anyway, I would only use a very small part of such library (just parsing of certificates)...

Is there some recommended way to parse a PEM X.509 certificate? Any third party product I can use? Is it complicated to write such parser on my own? Where is the structure described? My biggest concern is about writing a good ANS1 parser together with a base64 decoder on my ow, but maybe it is not that complicated as I expect from now.


texts: Is there decisional version of module-SIS problem?

texts:
We have a challenger who computes and gives the adversary the following:

random matrix A sampled from the ring $R^{k \times l}_q$
random vector b from the ring $R^{l}_q$
random vector x from the ring $R^{k}_q$

How can we compute the advantage of the adversary of distinguishing between (A, x) and (A, Ab)? Does the leftover hash lemma apply here?


texts: I've got a homework question asking to explain challenge-response in reference to RSA encryption and signatures. There really doesnt seem to be much or any explanations online. can anyone help me out.


texts: Modify basic CBC-MAC construction using a keyed function

texts:
Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily pseudorandom. For example, the generated tag of this secure MAC can be the output of a pseudorandom function (F) appended by a string of 0s, i.e., $F_k(message)||0^n$.

My question: how do we construct a secure MAC and use it to replace the pseudorandom random function in the CBC-MAC, such that CBC-MAC is NOT secure anymore for fixed length messages? Any hints or clues?

This question is found in "Introduction to Modern Cryptography" by Katz and Lindell.


texts: Have these compositions of block ciphers the same security?

texts:
I'm interested by the compositions of the block cipher DES, instantiated with independent keys $k_1$, $k_2$ and $k_3$.

Are these 3 compositions equivalent in terms of security?
$$DES_{k_1}(DES_{k_2}(DES_{k_3}(.)))$$
$$DES_{k_1}(DES_{k_2}(DES^{-1}_{k_3}(.)))$$
$$DES_{k_1}(DES^{-1}_{k_2}(DES^{-1}_{k_3}(.)))$$

I'm also interested in the same question with two iterations (instead of 3). Are these equivalent in security?
$$DES_{k_1}(DES^{-1}_{k_2}(.))$$
$$DES_{k_1}(DES_{k_2}(.))$$


texts:
Why does TLS as used in https need DHKE? Since the server presents a certificate with a public key, can that not be used for session key establishment? The client (browser) can generate a session key, encrypt it using the server's public key & then send it to the server & that can be used for encrypting all future messages from client to server & from server to client.
So why is DHKE required in TLS at all?


texts: Detecting steganography in the stream of short messages

texts:
I have stream of millions of short n-bit (n<30) messages generated by some random number generator. The source of random number generator is not available to me.

I suspect there are messages used to convey information generated by some third parties and injected into the stream. I what to test the hypothesis of such messages existing.

As far as I understand, the injecting of such messages would lead to the existence of at least two different sources of randomness: the one from original random number generator and the rest from encryption algorithms used by third parties. So testing my hypothesis is equivalent to detecting those modes.

My knowledge of random number generation is very limited and I would appreciate all kind of hints, pointers, ideas and references to the relevant literature.

Adding twist on this question.
Suppose I control the PNRG of the source (source sending only random messages without payload). Third party wants to hide their messages in my stream.

The new questions:

Can I identify those messages injected if PRNG of the source (algorithm) in given to me?
Can I choose or modify PRNG in such way to allow injected messages to be identified?
Can third party identify the PRNG of the stream being modified in such way to allow for easy detection of non-source originating messages?


texts: What is the role of IV in Stream Cipher? Why is it needed and what is it's importance?

texts:
I ran into this problem when I read the stream ciphers and did not find a satisfactory answer.

Why is an IV needed in stream ciphers, and what is the importance of using it?


texts: Blum primes [x=3(mod 4)] zero knowledge proof?

texts:
Lets say we have 2 primes, $p \equiv q \equiv 3 \pmod{4}$, and we make $n=p \times q$ public.

I can, without revealing factors, show that $n$ has two prime factors. How can i zero knowledge prove that those are Blum primes, as described before?


texts:
One-way accumulators are built upon a (quasi)-commutative one-way function. With quasi-commutativity, I refer to the following property:

For $f : X \times Y \to X$, it is true that $f(f(x, y_1), y_2) = f(f(x, y_2), y_1)$.

Although accumulators seem like a very useful cryptographic building block, I don't see them often in practical applications (in fact I can only think of Zerocoin). I suspect that this is because the scheme has certain disadvantages.

I wonder what these disadvantages are (if this is indeed the reason): is the function $f$ weak in terms of eg. collision-resistance, is it not efficient enough...?

The accumulators that I know of (note: I don't really know a lot about them, so this doesn't say much), seem to be based on number-theory (unlike conventional hash functions). This makes them a lot slower.

For example, Wikipedia describes the following function:

  One trivial example is how large composite numbers accumulate their
  prime factors, as it's currently impractical to factor the composite
  number, but relatively easy to find a product and therefore check if a
  specific prime is one of the factors. New members may be added or
  subtracted to the set of factors simply by multiplying or factoring
  out the number respectively. More practical accumulators use a quasi-commutative hash function where the size (number of bits) of the accumulator does not grow with the number of members.

As they mention, this is clearly not practical because of the size of the output values.

Another example I have seen is $f(x, y) = x^y \pmod n$ where $n = pq$ (with $p$ and $q$ both safe primes). Even though this doesn't have the problem of the Wikipedia example, it is still not very efficient (even though you can do the exponentiations using the square-and-multiply method).


texts: how long does the cycle length have to be in stream ciphers?

texts:
could someone tell me how long the cycle length must be in stream ciphers, so a security exists. how to compare the cycle length to the state space?

I investigate the algorithm spritz and I have the attainability of the states under investigation with key lengths of 1 - 10 and n = 6. now I have the values but I still do not know how to interpret them. the maximum cycle length for N = 6 is 660.390 and the smallest 12. But how should I evaluate this with regard to the safety? I hope I have described it somewhat better.


texts: For perfect secrecy, does the keyspace need to be uniform?

texts:
The definition of perfect security is just that:
$Pr(M =m | C=c) = Pr(M=m)$. We can prove that one time pad is perfectly secure for any distribution on a message space $M$, and it happens to be that the keyspace $K$ has a uniform distribution. Does that have to be true?

For example, let's say $M= \{0 \}$, $K=\{ 0,1 \}$ where $0$ is chosen with probability $p$ and $1$ chosen with probability $1-p$. Then we could have $c = m \oplus  k$, and $c=0$ with probability $p$ and $c=1$ with probability $1-p$. Is this perfectly secure if $p \neq \frac12$?


texts: How can I determine the Hill cipher key in this case?

texts:
I have been struggling with a Hill cipher problem for many days, without any luck.

I have the following ciphertext, which I know is an encrypted excerpt from an Edgar Allan Poe story:

hcrjrg--dizj lt mcne lmisne dsdi sqqznbld bvt idyl ry dlt vftpj df dbbrf
omydb, (vl np oag utg cuudij) lmv txms bvh anaoxzie, iltc xt clmfmzj
hcfjlmg idp jd bvy ulmw, lby di nau koessyd jd tvxjxw bvi shjilqslndie
yxxy dbvx cwmyd--ffq zk ezgp pn n jzmj, nam nuusket, wfuusirsu kq zzg
y’wlrui, di utt cbone jly ef dbbrf omydv, rmv veznm ty wboiaeofjvbgc jd
vnl nj dwx jd utg cuudiu.
Bltsq dcztldimzgzf kszn, ssv zna xe ffisdpwk pvydc or hwxgas kn n
pvvnfjihp ilqltk jvrn n pbrycgnnihy oiekjpi xe utx wagy. Dltpv si
rhutlmh gi mtkl ogczhsqn evri bpvvlhjw. “Eltpv utpis ky uqsp nzld,”
 eg csmn, “eltpv si sqgfmo naf abvld bbrf ginba fbqlmj”--lr hxrpilzlndi
degap nl wdntvveoxa ofgpvwkgc bvh anaoxzio’g pbvbf, avrz flt ksuec o
jfvbdy auomztmvek xe jc tvkjfpjcb, vc xpi vymgm fwgdyl Epgxz, di utd
adnzi ksxjlm xe uth Udnbbqng ij Xvumodi.
Utz gnyz fvlz hn eq icppilnsq, hwvlt pmog cqsc nuwbvdi uw utsi, lm uth
ufxvbtafm ffisdpwk ism-dzgtrgc xe utu ujcf--alt jfanooc opv gcvawelo uw
rhi “lgcjfrgruxz”--naj lb wimnappld tdqqzgm ftk fmh xcppilnsqauydi sn
ncpnaws. Ssv zna xe ffisdpwk zlgfi sf jc o xxlmj de lsi pbjcg hvrp htky
yzlnqw lfkpi tx tdxu tvb dyddy nfdp.
“OUYDLO--Utm gcppilnsqtp, txlms whptu jd kkgyzgws nyvlhjrqd acalmgcg
ijfztlndii sy dbvk cjce, idyk zyooipv utg cpirdwsg ia rytci tk tvlg
lmvlmjwczgf jmv kkfgxwzgn xxznln, ea gzlk s nbtxztb tfmdce idyy rh

U

In order to decrypt this text I tried the following method:

1) Removed all spaces, dashes, commas, etc.
2) Divided the text into digrams.
3) Found the most common digrams, which are shown in the picture below:

4) Knowing that the most common digrams in English are "th" and "he", I tried mapping different combinations of ciphertext digrams to "th" and "he" (for example, "th" -> "ut" & "he" -> "lm"), which gave me a 2x2 plaintext matrix and a 2x2 ciphertext matrix.

5) I solved the equation $K = C*P^{-1}$ (mod 26)

I repeated these steps for many different mappings to "th" and "he". Sometimes I could not invert $P$ and sometimes the $K$ was invalid. Looking at the ciphertext I believe it is very likely that "th" -> "ut", since it appears at the beginning of so many 3-letter words.

Could anyone please help me with this? Is there something I am doing wrong? Is the way to solve it to just keep mindlessly trying new combinations?


texts: Tools for modelling and analysis of cryptographic protocols

texts:
I am designing some cryptographic protocols and I am new to it.
Are there any well-known tools that can be used to model and design these protocols?
And also verify or analyze their validity?

If not a tool, is there any popular approach or formal method to design and analyze crypto protocols that are  widely accepted?

I am searching for some tools like NRL Protocol Analyzer. Are there any other popular such tools that are considered more sophisticated?


texts: Same certificate for server authentication and authorizatoin in other system

texts:
I have a program which acts as a node in a larger system. Those nodes can be connected to form a tree. TLS with mutual authentication is required, which means that each node has it's own certificate. Is it safe to use the same certification for both server authentication (when someone connects to the node) and client authentication plus authorization (when node connects to someone else)?

Also all my nodes require unique IDs within the system. This ID is similar to URI, but in "reverse notation" (so top most element is at the beginning). Should I put this value into subjAltName (and if so, as what value?) and put node's domain name into CN in DN, or should I put this ID into CN in DN and node's domain name into subjAltName?


texts:
Are there ANY text strings that will generate the same SHA-512 Hash output? Please provide an example, and how you came to that conclusion.

I've tried thousands of variations, including ".." vs. "." and "..." vs "..,". I believe it IS possible, I just don't know HOW I can find those 2 magic text strings.


texts: Can we efficiently factor if we are given a Pocklington certificate of one of the prime factors?

texts:
I recently read Squeamish Ossifrage's answer on generating RSA keys from (short) randomness where they make the following comment:

  (You might want to keep the certificate secret too.)

As the answer talks about multiple primality tests, let's start with a simpler one: The Pocklington-Lehmer test.

So my question:
Assuming we are given a semiprime $n$ of unknown factorization and a Pocklington Certificate of primality for either one of $n$'s prime factors. Can we efficiently factor $n$?

Here's a summary of Pocklington's theorem / criterion:

Let $n$ be the number of which we want to prove primality. Then a list of pairs pair $(a_i,p_i)$ is  the pocklington-lehmer certificate for the primality of $n$ if

$\prod_i p_i>\sqrt n$ that is the product of the $p_i$ is larger than the square root of $n$
$\exists B: n-1=B\cdot \prod_i p_i$, that is the product of the $p_i$ is a factor of $n-1$
$\forall i: p_i\in\mathbb P$, that is, every single $p_i$ is a prime itself (this primality can be proven recursively using this theorem or a list of known primes)
$\forall i:a_i^{p_i}\equiv 1\pmod n$
$\forall i:\gcd(a^{(n-1)/p_i}_i-1,n)=1$


texts: Identifying and attacking a proposed cipher (multiple substitution)

texts:
I'm just beginning to dip my toes into cryptography and a friend has proposed a cipher and challenged me to figure out how to attack it.  I know the process used to encrypt, but am having a hard time wrapping my head around a way to go about attacking it.

The cipher is a simple substitution cipher (26 characters possible, each character directly mapping to one other character) and the text is evidently plain ole English.  The complicating (at least to me) factor is that in his process he performs this substitution N times where N is the index of the character.

ex.
plain text = "test"
  alphabet = "abcdefghijklmnopqrstuvwxyz"
       key = "bdfhjlnprtvxzywusqomkigeca" (permutation of alphabet)

plain[0] = 't'                       (1st char subs 0 times, so remains 't')
plain[1] = 'e' -> 'j'                (2nd char subs 1 time, becomes 'j')
plain[2] = 's' -> 'o' -> 'w'         (3rd char subs 2 times, becomes 'w')
plain[3] = 't' -> 'm' -> 'z' -> 'a'  (4th char subs 3 times, becomes 'a')

encoded = "tjwa"

Does this cipher have a name?  I'm having a hard time finding one online if it does.

As for attacking it, he has given me a large encoded string (100k+ chars).  I wrote up a simple Java program to perform encode/decode given a known key, but 26! keys are too many to brute force.  So I looked at the letter frequency and noted that a single letter (in my case 'x') appears a disproportionately low number of times (much closer to it's expected English frequency the the other characters), which leads me to believe that perhaps it maps to itself. But obviously that would still leave 25! keys.

I'm genuinely interested in figuring out other techniques to attack this, and am not asking for a single simple solution, but does anyone have any ideas of other ways to go about attacking it?  I know the first letter of the plain text, and possibly the positions of a single other letter, but possible "cycles" or "loops" (sorry, I don't know if there's a better word for this) within the key (a->b->c->a) are thus far stumping me as to how to attack it.  I at first thought I'd know every 26th character, but that would only be true if there were no "cycles" created by the key.

Any help/direction/pointers/suggestions would be appreciated. Thanks.


texts: When is each key used when encrypting an email using OpenPGP?

texts:
When you send an email using PGP to encrypt emails, is the recipients public key used to encrypt the email, or is your private key used? Are they both used?

At what points do each of the four keys from the two key pairs get used?


texts: is a MAC defined by a pseudo random generator secure?

texts:
Let $ G:\{0,1\}^*\rightarrow\{0,1\}^*$ be a length doubling PRG, and let $ \Pi=(Gen,Mac,Vrfy)$ be the following MAC scheme:

  $ Gen $ on input $ 1^n$ uniformly samples and outputs $ k\leftarrow \{0,1\}^n $.

  $ Mac $ on input $k\in\{0,1\}^n$ and message $m\in \{0,1\}^n$ outputs
  $ t=G(k||m) $.

  $ Vrfy $ on input $k\in\{0,1\}^n$, message $m\in \{0,1\}^n$ and a tag
  $ t\in \{0,1\} ^{4n}$outputs 1 if $ t=G(k||m) $ and outputs 0
  otherwirse.

Is $ \Pi $ necessarily a secure MAC scheme?


texts: Can we encrypt part of the XChaCha/XSalsa nonce?

texts:
The xChaCha cipher detailed here extends the nonce 192bits and works as follows (from the link):

Pass the key and the first 16 bytes of the 24-byte nonce to HChaCha20 to obtain the subkey.
Use the subkey and remaining 8 byte nonce with ChaCha20 as normal (prefixed by 4 NUL bytes, since [RFC8439] specifies a 12-byte nonce).

My question is could we encrypt the 2nd part of the nonce by running an additional initial round (HChaCha20) with the 16 bytes of the nonce and the key?
We could use one of the two parts of the nonce as a counter by incrementing them, given they occupy the usual counter slots.  I suppose the same question applies to XSalsa20.
I presume this would compromise something somewhere.  It seems like a very simple and cheap way to make a brute force more difficult.  The additional round(s) would take about 10ms.
EDIT - hopefully the below makes the idea (somewhat) clearer.  My impoverished code is in javascript.
Note:
HChaCha20 is initialized the same way as the ChaCha cipher, except that HChaCha20 uses a 128-bit nonce and has no counter.  Instead, the block counter is replaced by the first 32 bits of the nonce.
//Encrypt
 subkey = hchacha20(key, nonce[0:15]);
 nonce[0]+=1; //or any part which occupies the usual counter block, nonce[0-4]?
 subkey2 = hchacha20(key, nonce[0:15]);
 nonce[0]-=1; //or..etc
 subnonce = subkey2 ^ nonce[16:23];
 chacha20_nonce = "\x00\x00\x00\x00" + nonce[16:23];
 //Run ChaCha20
 output = ciphertext + nonce[0:15] + subnonce);

//Decrypt
 subkey = hchacha20(key, nonce[0:15]);
  nonce[0]+=1; //or any part which occupies the usual counter block, nonce[0-4]?
 subkey2 = hchacha20(key, nonce[0:15]);
 subnonce = subkey2 ^ nonce[16:23];
 chacha20_nonce = "\x00\x00\x00\x00" + subnonce;
 //Run ChaCha20
 output = plaintext;


texts: Typically, in public-key settings, sign-then-encrypt has been used to provide confidentiality and integrity. However, most public-key cryptosystems use hybrid encryption. I've been searching around online for best practices for signing data, but I haven't found any. How should signatures work in a hybrid cryptosystem? Do you sign after you encrypt the data and the symmetric key or before? All the literature is about public key cryptosystems and signatures but it's not clear this extends to hybrid cryptosystems.


texts:
How do I find the differential characteristics using techniques Shrinking ?

How do I extract the key on Differential Cryptanalysis using the technique Shrinking in Blockcipher Algorithm?

Shrinking technique is a technique that was made by Eli Biham for cryptanalysis Skipjack 1998.


texts: Same private key for signing and decryption

texts: I am designing a service which identifies records with public keys. All other fields are encrypted with that public key and protected by a HMAC. For authentication, I am thinking about signing requests to the service with the same (RSA?) private key which is also used for decryption (a timestamp will also be included in every request to avoid replay attacks). Since every record only contains a small number of fields and every record has its own key pair, I would like to keep the overhead reasonably low, meaning that I would like to avoid storing an additional key pair for signing for each record and instead re-use the en-/decryption key pair for signing. Which security implications could this lead to?


texts:
I am studying a research paper "Complete Attack on RLWE Key Exchange with reused keys, without signal leakage" . On page number 21 to 28, there is toy example explaining the scheme.

I am unable to get the desired value of $ \mathcal B$ as described in column 3 of table 1 on page number 22. My calculation is as follows:

$s_B=(2,3,0,0,-5,2,3,1), \qquad e_B=(0,0,0,0,0,0,0,1)$

$e_B \cdot s_B=(x^7)\cdot(2+3x-5x^4+2x^5+3x^6+x^7)$

$e_B \cdot s_B=-3+5x^3-2x^4-3x^5-x^6+2x^7$

So, coefficient of $k_B[n-1]=k_B[7]=2 \cdot e_B \cdot s_B=2 \cdot 2=4$.

Now, calculating $sk_B[n-1]=sk_B[7]=\mathsf{Mod}_2(k_B[n-1],w_B[n-1])$

$=\mathsf{Mod}_2(4,1)= \left( 4+1 \cdot \dfrac{257-1}{2}  \mod  257 \right) \mod  2=\left(4+128 \mod \ 257 \right) \mod  2=0$

Thus, $sk_A=sk_B$ and value of oracle $\mathcal B$ must be $1$ (as keys get matched) but it is given $0$ (in column 3 of table 1 on page number 22).


texts: Hill Cipher how to encrypt and decrypt when both "I" and "J" are in plaintext

texts:
In Hill Cipher, let's assume the key is "KEYWORD" and I want to encrypt "JUICE", so after encryption, I get "GXLBWU", and when decrypt ciphertext I get back "IUICEX" not "JUICE". So my questions are:

So how do a receiver know where to put "J" after decryption?
Does he just have to guess it?


texts:
what should I do if my original message is greater than 64 bits? what is the process of padding in MD5?

As described in Internet Security: Cryptographic Principles, Algorithms and Protocols, page 138, the second step in MD5 is to append the length of the message:

Can someone help me understand exactly what happens when the message length is greater than $2^{64}$ bits?


texts: Randomization attack in voting protocols

texts:
I'm looking into coercion-resistant voting schemes and one of the key elements of coercion-resistance is resistance to randomization attacks.

Juels et al. define a randomization attack as one where adversary coerces the voter to vote for a random candidate (as drawn from some distribution). Many other articles have since repeated this as a requirement for coercion-resistant voting schemes, so it seems to be important.

Since coercion-resistance is an extension of receipt-freeness, and receipt-freeness already guarantees that a voter can't be coerced to vote for a particular candidate, I'm having a lot of difficulty imagining a scenario where both of the following properties hold:

Adversary is unable to force a voter to vote for a particular candidate
Adversary is able to force a voter to vote for a random candidate

Can you provide an example of such a scenario?


texts: Basic explanation of Elliptic Curve Cryptography?

texts:
I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but I'm having a hard time understanding all of the theory involved in ECC.

I'm looking for an explanation suitable for someone who has studied at undergraduate level in computer science. Can anyone explain how elliptic curve cryptography works in a simple, straightforward manner?


texts: I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

texts:
People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply telling me where I'm wrong.

Okay, let's say I'm Google and want to hash my user's passwords in the most secure way possible. Currently some of the most recommended ways are PBKDF2 (with SHA512 for example) and scrypt.

I want each password to take around 1 second to hash.

I look into PBKDF2 and see that the most efficient way to calculate hashes for it are using an ASIC.

I then look at Scrypt and see that the most efficient way to calculate hashes for it are through a balanced combination of CPU, RAM, and GPU.

Since I'm a webserver, I mostly just need CPU. I don't really need a GPU at all, only some RAM, but yeah, mostly CPU. Unfortunately, I can't even use that much CPU because I need it for serving all my concurrent requests. As a result my hashing will be weaker unless I purchase additional hardware.

In the case of PBKDF2, you will need to buy an ASIC to be ideal, and with Scrypt you will need to buy a GPU, RAM, and have a really strong CPU (yikes recent Intel security issues) to be ideal.

Is there a difference is between having X input rounds with PBKDF2 with ideal hardware (ASIC) vs having Y input rounds with Scrypt with ideal hardware (Proper balance of CPU, RAM, and GPU)? Assuming both operations take 1 second with the given input parameters, at that point aren't you mostly just guessing which will be harder in the future?

Also, it looks like either way you'll need to spend money on additional hardware.

Okay, now for my additional arguments in favor of PBKDF2:

It's been around longer and is thus more time-tested and scrutinized
It's NIST and FIPS compliant
There is more native support for it (For example, node crypto has PBKDF2 and not scrypt)

Also, an insane amount of financial incentive has lead to the development of specialized hardware for grinding PBKDF2 hashes because of the cryptocurrency phenomena. As a result, I'd imagine that not only is SHA extremely secure, but that ASICs are near the asymptote for potential performance.

Comparably, Scrypt may yet have specialized hardware developed that will allow for much more efficient computation in the future.

Lastly, is it not the case that Scrypt databases can be cracked by a botnet? Since the ideal hardware for the Scrypt hashing algorithm is pretty close to consumer hardware (CPU, GPU, RAM), is there not a risk that an Scrypt database could be be parallelized across the Botnet? For example, it is currently a concern of some cryptocurrencies that use Scrypt-adjacent algorithms that a botnet may be able to someday near a 51% attack.

Thoughts?


texts:
Assuming I'm using bcrypt to digest passwords, is any additional security gained by either encrypting or HMACing the resulting digests? By requiring a key to compare password hashes, I would expect that this would prevent any attempt at brute forcing sans the key.

The keys for this operation are actually stored somewhere other than our application servers, and all cryptographic operations are performed there via API calls. The service is designed to never divulge keys themselves, and only operate on keys by an opaque ID. So it should be considered somewhat less likely that our keys would be compromised in an attack than in typical webapp scenarios. Keys are also unique per customer of our application.

I would normally only consider HMAC for this operation, but this would require extracting (and storing separately) the salt from the bcrypt digest. So simply encrypting the crypt digests seems to be the simplest approach, and intuitively should produce the same desired security properties.

Is this approach reasonable and sane? We already have the cryptography infrastructure in place, so it's not considerably more difficult to encrypt/HMAC our hashes than it is to compute them in the first place. Is there a reason to prefer an HMAC over AES-128-GCM?


texts: Why Nonces and timestamps are used in Public key authority?

texts: why the nonces(N1 and N2) and Timestamps(T1 and T2) are used in Public key Authority? which of them prevent replay attack?


texts:
I'm Encrypting the data using AES-128 bit Encryption. I need to check whether the key is correct at the receiver side. How can I do that?

Suppose At the receiver The user is asked to enter the KEY for decrypting. As far as I know giving a wrong key generates some gibberish data. How can I prevent that and report back to user that the key provided is incorrect?


texts:
I'm one of the developers of an application which uses SRP-6 as the authentication mechanism. The authentication part of the code is very old and uses N with only 256 bits (all arithmetic is done in modulo N). After receiving reports of stolen passwords we upgraded to SRP-6a with the size of N 1024 bits.

We are still investigating (both on the client and server side) how the passwords were stolen/broken. I know that SRP-6 with such a low N value is vulnerable to man-in-the-middle attacks and "two-for-one" guessing (SRP-6 Improvements and Refinements paper by Thomas Wu). The attacks were probably made only on the client side, but this made me very curious.

Would it be possible for an attacker to launch an offline dictionary/brute-force attack on the B public key:

  B = (k*v + g^b % N) % N
  N - 256 bits long
  b - 152 bits long (random private key - generated using OpenSSL library)

Is it possible with modern technology? Could the attacker somehow predict or find out the random value b, extract v=g^x % N, then perform a discrete logarithm and find x?


texts: Number of PBKDF2 iterations for modern computing devices

texts:
I know the question of "how many iterations should I use with PBKDF2" is asked quite often, and the answer is typically "test and see what's practical."

However, my key derivation will be taking place on theoretically any client, and does not happen on the server side. So it could be on an iPhone, Android, PC, Mac, Web, etc.

On my Mac, using WebCrypto and Chrome, 1,000,000 iterations takes less than a second. However, I can't test this on other clients not in front of me.

I know the best answer will be "test on every client you plan to support."

However, if we were to establish some baselines for what a "modern computing device" would be, how can we calculate an optimal number of iterations?

Assume here that we define the minimum for what constitutes a modern computing device as: Any smartphone released in or after 2015.


texts: Safe and computationally efficient way to verify a curve25519 identity?

texts:
A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which approach could be regarded to be “the most recommendable” from a safety point of view, while keeping it computationally efficient?

The community seems unsure whether curve25519 can be used for ECDSA. It should be safe to authenticate a nonce using a secret-key agreed with ECDH, but wouldn't ECDH itself be enough? The server sends a one-time use public key, the client returns a hash of the ECDH shared key and the server compares it.


texts: Adding new share (Shamir Secret Shares )

texts:
I am using this https://github.com/gburca/ssss-js Shamir implementation. I generated 4 shares from secret (threshold of 2).

I am wondering if I can recreate (interpolate) original polynomial from these shares (polynomial which was generated from random numbers)  and base on it create a new point (share). In normal cases (not GF(2) fields) is will be an easy task, because after I get pair of points $(x,y)$ I can easily interpolate linear function.


texts: Perfect Secrecy -> One Time Semantic Security -> Secure PRG

texts:
I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) by going through the first two.

The basic idea that leads to the notion of Perfect Security, as I understand it, is that given a ciphertext $c$, and a message $m$, there are a certain number of keys that might turn $m$ into $c$.  If someone shows me $c,$ and tells me that keys are chosen uniformly in some space, then a message $m$ that has many keys that will encrypt it into $c$ is far more likely to be the original than a message $m'$ that has few keys that will turn it into $c$.  In this way, some probabilistic information might be leaked about the nature of the original message.  Perfect secrecy rules out this leak by saying that given a $c$, the number of keys must always be the same regardless of $m$.

One time "Semantic Security" codifies this as a game.  I give you $m$ and $m'$, you give me $c$, and I try to guess whether it's more likely that you encrypted $m$ or $m'$.  If lots of keys would change $m$ into $c$, but only few would change it into $m'$, then I have an advantage in my guess of which one you encrypted.

So now let's suppose we have a function $G$ that takes a seed and gives me a key, and I want to use this as a stream cypher, calculating $c = G(s) \oplus m$.  Let's play the semantic security game with $m$, $m'$.  Once given $c$, the attacker now knows that the key was either $m \oplus c$ or $m' \oplus c$.  So the question the attacker will ask himself is:

Are there more seeds $s$, such that $G(s) = m \oplus c$?  Or, $G(s) = m' \oplus c$?

If they can answer this question, then they might be able to get an advantage.  The question I want to answer now is: what characteristics does $G$ have to have so that the attacker can not get an advantage?

Well, suppose it was $m$ that was encrypted, but the attacker doesn't yet know this.  Then:

$$s = G^{-1}(m \oplus c)$$

At the same time, the attacker is going to be inspecting $G^{-1}(m' \oplus c)$ to see if it's possible that this could be a seed.  Since the key space is the message space is the ciphertext space, and all are much larger than the seed space, $m' \oplus c$ is going to range over things that are not mapped to by $G$.  So there are choices of $m'$, even a lot of choices, for which $G^{-1}(m' \oplus c) = \emptyset$.  Therefore, we can not hope to find, as we did in the case of perfect security, that the number of seeds is invariant as we change the message.

The only other option I can see is that we must hope that there is no effective means of inverting the function $G$.  If there is, then we're lost, as the attacker has an effective way of finding out whether they have a seed or not; and for a lot of choices of $m'$ s/he won't.  That will give the attacker a very large advantage.

So, my question is how we relate this requirement for the lack of an effective inverse, into the usual definition of a Cryptographically Secure PRG? And indeed, what is the definition of a CSPRG?  Dan Boneh describes it as a kind of "computational indistiguishability" of two measures (the uniform measure on the key space and the push forward of the uniform measure on the seed space).  And he claims that by Yao it's equivalent to a notion of "unpredictability".  Could someone hash these three different things together for me?  Finally, in this question, D.W. mentions an "asymptotic" (and not very good) definition of a PRG vs. a "concrete security" definition.  Could he, or someone, clarify what these are?

And also, does anyone have the reference to Yao?


texts: Can you compress an elliptic curve private key in half?

texts:
According to this, an $n$-bit key offers about $n/2$ bits of security. That got me wondering, can you compress the key in half?
At first blush, no, because the key is essentially a random number, and so cannot be compressed.
But let's look at the private key relative to the public key. From an information theory standpoint, the private key has zero entropy relative to the public key.
So, given an $n$-bit private key $x$, can you produce a $n/2$ secret $s$, such that using $s$ and the public key $X$, you can efficiently calculate the private key?


texts:
I am a bit stuck there and trying to figure out the approach for given problem.

What is the maximim period of a pseudo-random sequence generated by the
8-bit LFSR with connection polynomial C(X) = 1+X^2 +X^4 +X^5 +X^6 +X^7 +X^8?

Any help would be highly apreciated...


texts: How to find the base point given public and private key and EC parameters except the base point

texts:
I'm working on the curve secp256k1 and I've private key $k$ and public key $P = [k]G$. I look for solutions to the following problems;

What is the inverse of a scalar $k$ in ECC?

If I'm only missing $G$ but know all parameters of the curve can I find $G$ from $k$ and $P$?


texts:
Consider the following scenario:

The Information Security Department (ISD) of an organization issues each of the organization's employees, domestic and abroad, with an individual RSA key. To simplify the PKI maintenance for the organization, it was decided that a single modulus n will be generated by the ISD and each employee will be issued a personalized public encryption exponent e, and corresponding private decryption exponent d. All key-generating computations will be done by the ISD. This way the organization will also have a copy of each employee's RSA key-set. The reasons for this were given as:

When an employee loses a key, the ISD can always reissue a key.
When an internal security leak is suspected, the ISD will have all keys available to investigate the incident.
When law enforcement obtains a "supina" for a perticular employee's RSA keys, a central office - the ISD - can see to it that the "supina" is honored.

Suppose further that the ISD decides that the encryption exponents will be chosen so that the gcd of any pair is 1; for example, to speed up selecting values of encryption exponent e, the ISD selects from a database of prime numbers.

An eavesdropper can under certain circumstances decrypt messages sent in this system without needing access to any private keys.

Suppose that the CEO dispatches the same message M to two different offcie managers whose encryption exponents respectively are $e_1$ and $e_2$. The encrypted messages are:

$E = M^{e_1} \bmod{n}$ and $F = M^{e_2} \bmod{n}$

An eavesdropper has access to the public keys n, e1 and e2, and the encrypted messages E and F. Since gcd($e_1$, $e_2$)=$1$, the eavesdropper applies the extended Euclidean algorithm to compute integers x and y such that $x \cdot e_1 + y \cdot e_2 = 1$. Then with x and y in hand, the eavesdropper computes

$E^x \cdot F^y \bmod{n} = M$ (original message)

But unfortunately I don't understand why it makes sense that $E^x \cdot F^y \bmod{n} = M$ (original message). Is anyone here able to drop some ideas to me?


texts: Comparing Diffie Hellman and EC Diffie Hellman sizes

texts:
So, I am currently trying to understand the differences between DH and ECDH. I understand the basics between how the two algorithms work, however, I do not clearly understand how to compare the security of one to another, meaning the size of the DH key used vs the EC curve size used.
The question thus is, what DH key sizes correspond to which EC curve sizes?, and how can we effectively compare these two sizes?


texts: Checking if discrete logarithm is $\geq\frac{\varphi(p)}2$ in polynomial time?

texts:
Given $p$ a prime, $g$ generator of $\Bbb Z_p^*$, and $h\in\Bbb Z_p^*$, that uniquely defines some $z\in[0,\varphi(p)[$ such that $g^z\equiv h\pmod p$.

Is it possible to determine in polynomial time if $\displaystyle z\geq\frac{\varphi(p)}2$ ?


texts:
I'm learning DES, but I have a question.
When the plain text input, it gets a permutation by a table.

But, I don't know why 01 -> 58 / 02 -> 50. Is there any special rule or principle of it? or was it just set by the creator of DES?


texts: What is the current security level of an algorithm?

texts:
I was reading a paper of some years ago about a cryptography and a phrase got my attention.

  We want to ensure a security level of at least $2^{80}$

I know that $2^{80}$ was used as rule of thumb rule, that's probably why they wrote that sentence.

But reading this I think that $2^{100}$ may also be too low.
Considering for example the resource that a state like US can have what is a reasonable security level?

EDIT:
I'm considering only the security level for a bruteforce attack, other algorithm can have a solution that require less computational force.


texts: Can not use big prime number for pair of key of RSA Algorithm

texts: I'm new to cryptography. I have a binary image with 64x64 pixel in size. I perform an encryption to the image using RSA Algorithm. I wanna ask something bothering me, why can I not use big prime numbers as a pair of key for the RSA algorithm? Thank you in advance.


texts: Using AES for smaller blocks in a Feistel network

texts:
I was wondering how decryption would work for FPE in the case of cycled Feistel ciphers. I understand that simply reiterating through the networks with reversed key order will generate the ciphertext inputted at the beginning of the network.

The ciphertext is a bit representation of some number, so I'm just expanding the number to search for correct length before stopping.

However, the question that I have is that I am using AES as my round function. However, I need significant padding (0s), as the AES block size is 128 and the block size (of each half) is significantly smaller at 10-30 bits. I am simply appending these 0s to the end of my string, then using AES to get an encrypted 128 bit output.

At this point, I am not too sure what to do. I truncate by removing the last ~100 bits and only taking the beginning of the string. However, this seems to me as if I am losing data, and I cannot understand how I would be able to decrypt using this same method.

Is this simple method of truncating actually the correct way of implementing AES for smaller blocks, or should I be padding/truncating in a different way? Also, if it is correct, could someone explain why it is or link me to some relevant literature?

Cheers!

I have seen the related link Recover plaintext from truncated ciphertext using AES for FPE , but I either don't understand the comments or a solution was never posted.


texts: Why SHA-512/256 when we already have SHA-384?

texts: Both of them are just SHA-512 with different IV's and truncation. What's the point of having 2 of them? (Actually we have 3 of them as SHA-512/224 is the exact same thing.)


texts: Moving a monero wallet+ node from a disk to another one

texts:
I dont know where to put this question, and the most appropriate would be here i guess, i found no criptocurrency stack, if its not here i would apreciate a link to post this
I've downloaded a monero node on my laptop which roughtly took 105GB and a full night even though it said it was only 5 hours of work
And since im running out of space i thought of moving the node elsewhere, i know that you can use a remote one but i would like to help out
But then i remembered "wait i could kill 2 birds with one stone", the other bird being the future expenses of keeping a server open most of the time, so i was thinking of mining in a pool to cover the electricity expenses of the server(which is just an old desktop with barely nothing in it)
Now for the relevant part, is it possible to just copy the files related to the monero wallet+ node to the server so that i don't have to spend 5+ hours putting it in the server?
From what I've gathered, the ledger should be equal so copying shouldnt cause problem, the problem would be the wallet im not shure if it might have some input/hash related to the computer its running?
Both Computers run Arch Linux


texts:
Situation:-
I am using Python.
I am using RSA and I am using two 64 bit keys. I am not an cryptographer .
I can provide you the RSA code if needed but i am not posting it as it doesn't have to do anything with the problem. I have to give the private key to a human to remember well 64bit key cannot be remembered by normal humans as far as know.
Problem: -
I want a method to compress my 64bit key to at least an integer of 10 digits and a method when those 10 digits are entered they decompress back to 64bit key.
Solution I have tried: -
Converting my 64 digit integer sequence to an string phrase or a string (the worst Idea wasted a lot of time do not try yourself).
Using basic math operations such as 'division', 'subtraction', etc. This proved to be not a good practice as it is easily readable in the code.
Note

I need not to change the private key whenever programs run but whenever client wishes to.


texts: Does encryption of data/information take place in peer to peer networks like Gnutella, Bittorrent?

texts: Do peer to peer networks like Gnutella, Bittorrent have any encryption system to secure the users privacy or encrypt the file/data being shared? Elaborate please.


texts: How to handle the GCD(V,P) != 1 case when doing point addition or point doubling in elliptic curve cryptography

texts:
The equation for a finite field Elliptic Curve is of this form:

$$y^2 \equiv x^3 + a * x + b \pmod{P}$$

When we do common EC operations like point doubling or point addition we need to calculate the inverse of a number.

For example this is the formula to calculate the slope for the point addition.

$$(Y_1 - Y_2) * ( X_1 - X_2 )^{-1}$$

Now here is the thing. If the $\mathop{GCD}(X_1 - X_2 , P) \neq 1$ , then there is no solution for the inverse (Basic finite field math rule).

First I thought that this could never happen because P was a primary number, but then I discovered that in the cryptography libraries the GCD was tested and if it was not equal to 1 the resulting point would be a virtual point : the point at infinity.

So here Are my questions : Is $P$ a primary number for all the standard Curves Nist,Secp... and by the way if I just want to use this standard curves do I need to test the GCD?

Secondly, if P is not a primary number and if I decide to use this point at infinity "Technic" and I encounter a $\mathop{GCD} \neq 1$, will the public key resulting be a weaker one? (Knowing that the point at infinity has some tricky properties).


texts: How vulnerable is the C rand() in public cryptography protocols?

texts:
I just learned about the basics of public cryptography a few weeks ago and I am curious as to why the C rand() function should not be used for crypto schemes. For example, say I want to generate a private key using the C rand() function, along with srand(). Lets say srand() generates a seed based on system time (as in example http://www.cplusplus.com/reference/cstdlib/rand/). Is rand() therefore not acceptably pseudo random because the system time is not random (what if I based the seed on something more random)?

If this is the case, then how does OpenSSL generate random private keys? Moreover, how could an attacker exploit an OpenSSL implementation that uses C rand() the way I specified above?

Thank you.


texts:
I am aware of this attack that applies to PHE (partially homomorphic encryption) given the attacker has access to a trusted oracle that can Convert (i.e decrypt and re-encrypt) between AHE (additive, e.g. Paillier) and DET (deterministic) schemes.

Pseudocode:

1. Get ciphertexts E(0) in DET and E(1) in AHE
2. i = 0
3. Convert E(x) to DET encryption
4. Compare E(x) to E(0)
5. If equal, print i and exit
6. Convert E(x) to AHE encryption
7. Add E(x) and E(1) using homomorphic property
8. i = i + 1
9. Goto 3

My question is how is this attack avoided in FHE (fully homomorphic encryption) which allows arbitrary computations (e.g adding and comparing) on ciphertexts.


texts: What algorithm does PGP use to encrypt email?

texts: I know it uses RSA/DSA to create keys, but does it use that same algorithm for the actual cipher?


texts: converting finite field elements to octet strings

texts:
I need to convert elements of the finite field $GF(p^k)$, where $p$ is an odd prime, to octet strings.

To be more precise, I want to include elliptic curve points over $GF(p^2)$ in a Subject Public Key Info of an X.509 certificate.
In the document IEEE P1363 there is a FE2OSP function which is probably not usable for that case.

Do you know of any well accepted standard which describes that encoding?


texts: The existing approaches based on machine learning for cryptography

texts:
i'm working on a paper about Machine learning and Deep Learning and i'm wondring about the uses of this domain in cryptography!!
so what are these application of Ml that we use in cryptography and the tecniques for that !


texts: Can we replace IV increasing from addition to XOR in CTR mode?

texts:
In CTR mode (not nonce-based), if we have ${IV}\stackrel{\$}{\leftarrow}\{0,1\}^{128}$ and want to encrypt message blocks $M_1, M_2, ..., M_\ell \in\{0,1\}^{128}$:

The ciphertext is $IV\parallel C_1\parallel C_2\parallel...\parallel C_\ell$, where $C_i=AES_k(IV+i-1)\oplus M_i$.

Note that $IV$ is random here.

How about changing the CTR mode into the following algorithm?

The ciphertext is $IV\parallel C_1\parallel C_2\parallel...\parallel C_\ell$, where $C_i=AES_k(\boxed{IV\oplus(i-1)_{128}})\oplus M_i$.

Here, $(i-1)_{128}$ means a 128-bit block that has $(i-1)$ in its lower bits.

Such a change has a benefit: it is easier to implement $(IV\oplus1)$ than implement $(IV+1)$ using CPU instructions or in garbled circuits.

I wonder whether there is any security proof showing such a construction is equal to CTR. Currently, I don't even find the good keyword for that.

Note: one answer How do we compute IV+1 in CTR mode? mentions this change. I feel some security discussion is needed.


texts: Is there a way to tell if a given string is a sha256 hash?

texts: Just like, for instance, we can easily check if a given number is a visa card number, by verifying prefix and checksum - can we do anything similar for hash?


texts: Efficiently prove the correctness of Paillier encryption in or "outside" a zk-SNARK

texts:
I'm working with a zk-SNARK library [1] that allows me to prove the correctness of arbitrary arithmetic circuits, and I now want to use these zk-SNARKs to prove that some Paillier [2] ciphertext $c$ was generated by correctly encrypting some secret plaintext $m$ with randomness $r$ (as well as that some other properties hold on $m$).
To prove this, I encoded Paillier encryption in the arithmetic circuit, i.e. I'm checking that $c = g^m \cdot r^n \mod n^2$ holds. This works fine for small key sizes, but for cryptographically secure keys where $n$ and $r$ are 2048 bits long, especially the modular exponentiation to compute $r^n$ (using [3]) takes too long (> 2 hours) and requires too much RAM (~ 260 GB) to prove, way too much to be practical.
Is there a way to efficiently prove the correctness of the ciphertext $c$ outside the zk-SNARK circuit and -- more importantly -- "connect" that proof with the zk-SNARK such that I'm able to use both the plaintext $m$ and the ciphertext $c$ inside the zk-SNARK circuit without users being able to break the secrecy or soundness of the scheme?
Considering that the higher residuosity problem [4] is considered to be hard, I don't think that there's an easier way to prove that $r^n$ is actually an n-th power without performing that modular exponentiation, which I can't practically do in the circuit, so it seems that my only option to make this work is to move the Paillier encryption outside the circuit.

[1] https://github.com/akosba/jsnark
[2] https://en.wikipedia.org/wiki/Paillier_cryptosystem
[3] https://en.wikipedia.org/wiki/Exponentiation_by_squaring
[4] https://en.wikipedia.org/wiki/Higher_residuosity_problem


texts: How to calculate RSA Key Size correctly starting from 384 bits to 15360 bits or beyond 15360 bits

texts:
Hello fellow experts here, I am new to cryptography.

Recently I looked into RSA Key Size (Microsoft RSA library), it actually describes that the minimal key length required is 384 bits and maximum key length accepted was 15360 bits.

I really do have question here is that how can I properly calculate the key size that is between the range of 384 bits to 15360 bits easily without little to no error?

For example, currently from what i know, the possible key length in between 384 bits and 15360 bits contains the common key length of 1024, 2048, 3072 bits.

Is there any formula or calculations that other people used to know these key length? If yes, does this specific formula can be applied to calculate all possible key length between the minimal key length and maximum key length?


texts:
For a full-disk encryption setup, with a physical disk X and the induced logical volume X_crypt, there are several ways to initially fill the disk:

(A): Fill X with zeros;
(B): Fill X with random data;
(C): Fill X_crypt with zeros;
(D): Fill X_crypt with random data.

All theses methods have advantages and disadvantages:

(i): (B), (C) and (D) allow you to hide which parts of the disk are used, while (A) does not.
(ii): (A) and (C) allow you to prove that you have fully decrypted the disk, which (B) and (D) do not.
(iii): (C) would be slightly easier to attack if a known plaintext attack was discovered for your cypher.

It looks to me like (ii) is necessary if you ever plan on traveling to countries that value security a lot more than they value privacy, which only leaves (A) and (C). Then, since I don't really see any danger to (i), and with (iii) in mind, I would be tempted to choose (A). However, most tutorial seem to recommend either (C) or (D).

Is there something I'm missing?


texts:
Given is a DHKE algorithm. The modulus  has 1024 bit and  is a generator of a subgroup where ()≈2160.
Assuming the public keys have already been computed, how many number of modular multiplication and modular squaring are there in the session key.
Using the square and multiply algorithm on $2^{160}$ :
160 = 10100000 in Binary
1 First One list Number           2
0 Zero calls for Square          $(2){^2}$
1 One calls for Square + Multiply $((2){^2}){^2}$ * 2
0 Zero calls for Square            $(((2){^2}){^2}$ * 2)${^2}$
0 Zero calls for Square           $((((2){^2}){^2}$ * 2)${^2}$)${^2}$
0 Zero calls for Square       $(((((2){^2}){^2}$ * 2)${^2}$)${^2}$)${^2}$
0 Zero calls for Square $((((((2){^2}){^2}$ * 2)${^2}$)${^2}$)${^2}$)${^2}$
0 Zero calls for Square  $(((((((2){^2}){^2}$ * 2)${^2}$)${^2}$)${^2}$)${^2}$)${^2}$
Thus, there should be a total of 7 squares and 1 multiplication for exponent of 160.
Similarly, if we assume now that α is such a short element (e.g., a 16-bit
integer).
Using the square-and-multiply algorithm we should get that there is a total of 4 squares and 0 multiplications for exponent of 16.
Is this a correct understanding of number of modular multiplication and squaring using square-and-multiply algorithm for the session key?


texts: El-Gamal like encryption, how can i guess the key?

texts:
There is $p$ (large prime number), $g$ (generator of $p$),
and $x_a$, $x_b$, $r$ (which are between $1$ and $p-1$).

I know $g^{x_a}$, $g^{x_b}$, $g^r$, $g^{x_a\cdot x_b\cdot r} \bmod p$.

How can I get $g^{x_a\cdot r}$?


texts: minimal trading amount per transaction, looking for exchange

texts: I currently developed crypto bot with support of low transaction estimate to buy/sell. Now I am looking for exchange allowing to buy all possible pairs for under a \$1 or even less. Let's say BTC/USDT and I will be able to buy BTC for $1 or less. With same example follow for all pairs.


texts: Encrypting more than ~64GiB with AES-GCM - Integrity

texts:
I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is bothering me. I need to keep also integrity of order of ~64GiB blocks, to disable block swaps. I was thinking about adding previous auth tag as AAD to next block. Is it enough? I can't find answer for this question anywere.

Thanks for help


texts:
I know this is usually frowned upon, but supposing you were to roll your own encryption cipher (completely on your own or with a small group of friends, with no peer review possible), what could you do to make your custom algorithm as safe as possible (or rather, to keep the danger of using it to a minimum)? Similarly, what would you do for something like a hash function to make the probability of it having some trivial collision or preimage attack as low as possible?

I understand that there would be no way to approach the security of algorithms like AES, and I have no plans to use custom algorithms for anything important, but I thought it would be informative to think of what some best practices would be for rolling your own cryptosystem if you were to do so.


texts: Efficiency of oblivious algorithms vs non-oblivious algorithms?

texts:
Recently, plenty of researchers are looking at designing efficient data-oblivious algorithms. Roughly speaking, an algorithm is said to be data-oblivious if its data access patterns are independednt of the input i.e. the data access pattern of the algorithm does not leak any information about the input of the algorithm. Few of the algorithms already looked at include sorting, BFS, minimum spanning tree and convex-hull. These oblivious algorithms have various applications for the cloud and efficient secure computation. My queires regarding the same are as follows:

Is ORAM a generic method to transform any non-oblivious algorithm to its oblivious counterpart?
Is it always possible to construct a oblivious algorithm with the same asymptotic complexity as that of its non-oblivious counterpart? Please provide me with pointers to works which discuss on the same.


texts:
If we have two elliptic curves $E$ and $E'$ and the points of both elliptic curves are same. Then all the points of $E$ map to all the points of another elliptic curve $E'$.

For example $E$  has seven points and $E`$ also have seven points then would isogeny make this possible?

Is the reverse $r$ possible by dual isogeny mapping? In other words, could all the points of $E'$ map to all the points of $E$?


texts: Can length extension attacks be avoided by a single bit flip?

texts:
It always seemed to me that length extensions are possible simply because no special operation is performed after the last operation - for instance in a Merkle-Damgård construction. Basically the MD construction makes sure that the hash state is secure after processing each block, and therefore the hash state can be directly used as the output of the hash function.

All the bits in the state should depend on all the input bits. That should mean that it will be as hard to find a hash with a short Hamming distance to an existing hash value as to find a hash with a much larger Hamming distance.

So if this reasoning is correct then any operation that:

doesn't affect the security of the hash;
cannot be reduced to the operation performed on each block;

should be able to turn a hash that allows length extension attacks to a hash that doesn't allow length extension attacks.

Questions:

Any problem with my reasoning? Is any bit flip enough for the full output of the hash (see note below)?
If it is that simple, is there any reason why it hasn't been performed on SHA-2? Were length extension attacks unknown or not seen as a problem?
Would such a stupidly simple construction be an viable alternative to HMAC (with $K \| M$ as input message and a static size of $K$)?

Note: Flipping a single bit could do the trick if my reasoning is correct, but it has the drawback that partial hashes may not be affected. Flipping every bit - to get the complement of the hash value - should work as well - I think.


texts: Why public host key still need be sent in SSH_MSG_KEX_DH_GEX_REPLY?

texts:
RFC 4251(https://tools.ietf.org/html/rfc4251) states,
[page 4]

The protocol provides the option that the server name - host key
association is not checked when connecting to the host for the first
time.

[page 3]

The client has a local database that associates each host name (as
typed by the user) with the corresponding public host key.

RFC 4419(https://tools.ietf.org/html/rfc4419) states,
[page 3]

The server responds with:
 byte    SSH_MSG_KEX_DH_GEX_REPLY
 string  server public host key and certificates (K_S)
 mpint   f
 string  signature of H

My question is,
After the first time connecting, the client has got server's public host key.
Why does the server still send its host key to the client in SSH_MSG_KEX_DH_GEX_REPLY (K_S) ?


texts: Need help with NFC Tags and cryptography

texts:
I have some NFC-Tags, which will be added to my devices. These NFC Tags are basically EEPROMs with an unique UUID (7-Byte, readonly, public) and some constant parameters (approx. 7-15 Bytes, read and writeable, also public) in it.

Can I use a digital signature in order to tell if a given NFC-Tag belongs to my devices and if the parameters haven't been changed by an evil user?  (Message for signing algorithm would be UUID + Parameters)
I'm using an 8-bit microcontroller with very limited resources on the NFC-Reader side for the verification process. Therefore the verification step should be as easy as possible (signing the tags can be done on a powerful PC). Which Algorithm would you use for this application?


texts: What is the difference between various modes in FPE?

texts: Format preserving encryption has three modes FE1( FFX) , FE2(VAES) , FE3(BPS) . All of them are based on Feistel Networks .Can somebody explain  how they differ from each other ?


texts: Crack linear congruential generator knowing every other word in sequence

texts:
I need to crack one of the example of linear congruential generator.

I have $X_{n+1} = (a \cdot X_n + b) \bmod m$

and I know every other word in the output sequence:

..., 3158, ..., 1888, ..., 1285, ..., 1744, ..., 253, ..., 722, ...

The question is how to get the generator parameters ($a$, $b$, $m$) ?
I have read Cracking a linear congruential generator
but still don't know how to break it.


texts:
Is there a cost model for each curve model and their conversions?

For example:

Take the curve models: Projective, Completed, Extended, Affine.

Is there a table which shows how many multiplications, additions and divisions it costs to do point addition and point doubling for example?

Maybe a guide on when to choose each curve model over the other and or when the conversion to another model is worth it in terms of cost. I do not have any references, however I remember some programs always converting back to either a completed point or an extended point.


texts: Is the CONF key sharing Problem equivalent to discrete log problem?

texts:
If there a proof in the literature which says the CONF Problem is equivalent to solving the discrete log ?

Let $g$ be a generator of a cyclic group $\mathbb{G}$ of prime order $q$

CONF problem: given $q,g, g^a, g^{ab}$ find $g^b$

Discrete log problem:  given $q, g, g^x$ find $x$


texts: How can I prove that it is impossible to find a cheater in shamir secret sharing?

texts: Three participants Quadratic polynomial, one cheater. The Cheater discloses a false (x,y) pair I need to prove that any one of the truth-telling participants can't tell which of the others is the liar. I do realize that any pair of participants have a linear subspace of possible solutions since they don't know the secret they can't tell if it is a member of their subspace, but I don't think it is a proof just an intuition as to why this claim is true.


texts:
I'm creating a prototype for a messaging queue with some custom logic (can't re-use any existing solution).

One requirement is to have all messages encrypted. There are three classes of nodes subscribing to the queue with the following permissions:

Read/Write access
Read-only access
Buffer/forwarder with no access to the message content

The first and obvious thought was to use an RSA private key for group 1. This would allow to encrypt with the private key and decrypt with the public key.

Group 2 would receive the corresponding public key and would be able to only decrypt the content.

Group 3 would have no key and just handles the messages without access to the content.

After doing some further reading, there seem to be a number of problems with this approach (apart from the simple fact that the keys are used in "reverse" in relation to the intended mechanism).

Now the question: Is there some common approach to get this pattern to work? I have searched, but so far have not found anything.

I will have access to someone with more experience in this matter at a later point, but for purposes of the prototype, I just want to get something done that won't make me look like an idiot later. ;-)


texts: How can one share information using the 'host-proof' paradigm?

texts:
I am attempting to make a web-based secure password management and sharing utility, both as an academic exercise and to fully understand and feel safe about using it.

I really like the idea of a "host-proof" application, where encryption/decryption is done on the client side using javascript and only encrypted information ever leaves the browser, much like PassPack or Clipperz. What I cannot figure out is how Passpack manages to allow people to share passwords. I cannot see how it can be done without either plain text or an encryption key being transferred to the other user via the server, making that process inherently break the "host-proof" paradigm.

Can anyone point me towards a solution?


texts: is there a way to specify the encrypted message length when using private and public keys? mainly I want the encrypted message to be 32 bytes? as I'm currently using RSA but that results in a length that is equal to the modulus Length.


texts: Construct a random permutation from a random function?

texts:
How can we construct a (pseudo) random permutation from a (pseudo) random function ?

I've seen a method from Luby-Rackoff which allows to construct a PRP of length $2N$ from a PRF of input/output length $N$. Is there a method to keep the same length $N$ ?

I'm looking for a method that has better security bounds than truncating the output of a $N$-bits output pseudorandom function to obtain an output of $N/2$-bits and using the Luby-Rackoff construction.


texts: Is there a kind of OS entropy pool on Windows systems?

texts: I am wondering if Windows provides an equivalent of /dev/urandom from linux ? Or any kind of system entropy pool ?


texts: E-voting: public tallying vs. vote selling

texts:
There are many design goals for an e-voting system. My question concerns a conflict between 2 particular goals:

A voter should be able to verify that their vote was correctly tallied
A voter should not be able to prove how they voted (to prevent vote selling)

I've looked into various e-voting systems and none of them appear to be able to satisfy these 2 goals simultaneously.

  Some researchers argue that end-to-end auditability and receipt-freeness should be considered to be orthogonal properties. (Wikipedia)

Is this an unsolved problem?


texts:
There was a question on my final exam, but I could not get a point. I really want to know the right answer.

Question is:

  Suppose a cryptosystem has perfect secrecy.
    Prove that H(P|C) = H(P)

H(P|C) is conditional entropy.


texts: Is the GOST cipher broken or known to be weak and insecure? Please try to simplify your answer since I am a programmer and not a cryptographer and please consider this web page and tell me if the claims made there are true.


texts: ECDH - when are the domain parameters shared and how?

texts:
I'm trying to understand Diffie–Hellman based on Elliptic-curves.
Can one explain at which point of time the domain parameters are shared? Are they shared trough a public channel and can they be always the same? Are they shared at a specific different point of time?
Literature doesn't clearly answer my question...
I'd like to create a concept to establish a secure communication channel between two devices that "don't know each other but want to establish a secure channel"


texts: Threshold signature without revealing id of signers to the recombiner

texts: I want a threshold signature t out of n algorithm where set of t signers are not known before hand and want to remain anonymous after signing. How is recombination possible if id of signer is not revealed (i.e. lagrange interpolation will be a problem) ?


texts: RSA key such that pi deciphers to your name per RSA-OAEP

texts:
Can you efficiently construct an RSA public/private key pair with $8k$-bit public modulus such that $C=\left\lfloor\pi\,2^{8k-2}\right\rfloor$ deciphers per RSA-OAEP to your name as a bytestring in ASCII or UTF-8?

The decryption must be per RSAES-OAEP of PKCS#1v2.2, SHA-256 hash, no label, MGF1 with SHA-256, and sucessful. The key pair must conform¹ to section 3. It could come as $n$, $e$, $d$, or as a PEM text encoding of the private key per the format of section A.1.2 acceptable by an ASN.1 decoder. Kudos if it passes² OpenSSL's RSA_check_key, more kudos if $8k\ge1024$, the higher the better.

$C$ is the first $k$ bytes of these (in hex) for $8k$ up to $2^{16}$ bits.

Update: this answers in the affirmative, for whatever usual $k$, with $p$ and $q$ equal-size primes, and $N$ hard to factor. The next frontier is a low $e$, say in $[3,2^{256})$, ideally $65537$.

Further stunts are possible, like having $C$ or $2$ the signature of anything per any usual RSA signature scheme, even deterministic and/or with message recovery.

As a consequence: verifying a signature of a file against Alice's RSA public key (including, certified and used for other purposes) is proof neither that the file is unchanged since signature, nor that Alice was the signer.

Example where that matters: the signature of a file is on a trusted site, the file is not. Alice manages to get her public key (which she uses normally) in the verifier's keystore (with the key identifier of the legitimate signer, if there is such thing in the signature). The verifier, who just uses crypto as a magic tool, sees that the signature verifies, and (rightly) trusts the secure site to hold only trusted signatures of trusted files. There is a chance that a file alteration by Alice goes uncaught, or/and that she can wrongly convince the verifier that she made the signature at the date notarized by the trusted site.

Update 2: Some consequences of the same possibility are discussed in Dennis Jackson, Cas Cremers, Katriel Cohn-Gordon and Ralf Sasse's Seems Legit: Automated Analysis of Subtle Attacks on Protocols that Use Signatures, originally in proceedings of CCS 2019.

¹ That is: public modulus $n$ must be the product of $u\ge2$ distinct odd primes, odd public exponent $e$ with $3\le e<n$, private exponent $d$ with $0<d<n$ and $e\,d\equiv1\pmod{r-1}$ for each prime $r$ divisor of $n$.

² For keys otherwise per the above, it limits $u$ (including $u=2$ for $n$ less than 1024-bit, $u\le3$ for $n$ less than 4096-bit, see rsa_multip_cap). It also requires the full factorization of $n$ to be given, as well as reduced exponents and multiplicative inverses.


texts: With a true random number generator at hand, how to implement one-time pad?

texts:
I have a Raspberry Pi single-board computer that happened to have an hardware true random number generator, based on some quantum effects on the processor silicon, baked into its BCM2835 chip and I can pump its randomness by dumping bits from /dev/hwrng device in Raspbian, its Debian-based Linux operating system.

Now let's say I want to implement some sort of one-time pad scheme using this little piece of hardware as a randomness generator. How?


texts: Why encrypt symmetric keys first with RSA and then the private-key with a PW?

texts: In for example the Microsoft Encrypting File System, the SYM-Key is first encrypted with a RSA-Pub-key and its corresponding private-key is then encrypted using a users password. Why not encrypt the SYM-key directly with the PW?


texts: Is it possible to use an algorithm to generate an OTP?

texts:
I am a software developer, not a cryptologist.

I like the idea of perfect secrecy and would like to use a one-time pad (OTP) to encrypt/decrypt files up to, say, 50Mb.  Is there a way that I can use random number generators and seeds to do this, rather than creating the (very large) pad in advance?

For example, if I used a CSPRNG to create two numbers, then used the first number to seed a (predictable) PRNG, and the second number to determine which number in the sequence to use as the first in the pad, would this still give me perfect secrecy?