texts: Is it feasible to design a crypto scheme for centralised reporting of anonymized data?

texts:
I would like to find out if it is feasible to design a cryptographic scheme that would allow several "reporting parties" to independently transfer information to the same centralised "authority", under the following constraints:

The "authority" should not receive the "original information" or be
able to infer the "original information", but it should receive
"derived information".
Without knowing the "original information", the "authority" should be
able to verify that "derived information" from two or more
"reporting parties" originates from the same "original information".
The number of "reporting parties" should be dynamic. Reporting parties
cannot work together and do not know if other "reporting parties" have
transmitted the same "original information" in a derived form.
BONUS: Two or more "reporting parties" should not be able to verify
that "derived information" from two or more "reporting
parties" originate from the same "original information".

The "original data" is arbitrarily short (e.g. significantly less than 40 bits).

I have a hunch that the first two constraints would somehow require hashing, random numbers and perhaps public-private keys, while the last constraint would definitely involve public-private keys... but have no idea as to how to design such a scheme or even if it would be feasible, given short data.

I can provide the exact use case if someone's interested; teaser: EU's MiFIR and Investor Privacy :)


texts: Why does bootstrapping (R)LWE homomorphic encryption produce small noise?

texts:
Why does homomorphic evaluation of the decryption circuit produce a ciphertext with "fresh" or small noise?
Rough description of bootstrapping homomorphic encryption:
Suppose we have a somewhat homomorphic encryption scheme that can only evaluate circuits of small depths including its own decryption circuit. In (R)LWE schemes, this is due to the growth of the noise in the ciphertext produced by homormorphic evaluation, which eventually makes the resulting ciphertext undecryptable.
Bootstrapping is the procedure that homomorphically evaluates the decryption of the current ciphertext, which produces a new ciphertext encrypting the same message. Supposedly, the new ciphertext should have smaller noise, which allows for further homomorphic evaluation.
I understand that bootstrapping produces a new ciphertext of the same message. But why does it have any smaller noise? It's still just evaluation of a circuit, which in general, increases the noise.


texts: How many points are there on the X25519 curves?

texts:
The order of the base point, $l$, is 2^252 + 27742317777372353535851937790883648493

However, the base point group is nested within other large groups, the largest of which is of size $8l$.

There are also nested small subgroups, the largest of which is a small subgroup of size $8$.

Is it therefore correct to say that the total number of possible points (on either Curve25519 or Ed25519), including the identity point that both the small and large subgroups share, is: $8l + 7$


texts: Downsides of not using deterministic ECDSA signatures for blockchain validation?

texts:
I've noticed that in many Bitcoin wallet implementations, as well as other blockchains, deterministic ECDSA signatures are being used (generally based on RFC 6979).

There seems to be some benefits to this:

Testing would be easier, as you can have known inputs and outputs.
There is no need for a good source of randomness at the time of signature generation
Some blockchain operations might be easier if signatures produce consistent output for the same data (e.g. identifying if the same blocks have been signed before)

I'm working in a constrained hardware environment where I don't have access to a deterministic ECDSA implementation, but I do have good entropy. Are there any security risks in participating in a blockchain network without deterministic signatures?


texts: Why AES 256 GCM is more preferred by email service providers / banks over the fast and efficient ChaCha20 - Poly1305?

texts:
This question is based on my recent observation of preferences of  certain email service providers and banks to use AES related symmetric ciphers over the more fast ChaCha20 Poly1305 . For example Google's Gmail browser version uses AES 128 GCM but Google's Search uses ChaCha20 Poly1305  ?

Is AES 128/256 GCM in any way more secure  than ChaCha20 Poly1305 ?

Despite the fact that ChaCha20-Poly1305 uses processor friendly instructions for mobile devices, and easy to implement in software, why banks or financial institutions are reluctant to adopt it ?

Is it because of specific AES instructions on processors (as far as servers / PC/ laptops are concerned) or because they are sticking to old convention ?


texts:
Two users A and B decided to share a file of same size and transfer data bit by bit. And at the end of exchange, A will have B's data and B will have A's data.

Assuming, A starts to transfer the first bit, is the protocol considered fair?
If both of them do not know in real world, should trust issue be put into consideration when we determine fairness in protocol?


texts: generate a hash and validate if subset of string belong to that hash

texts:
I am trying to find if I can generate some encoded data from set of string and compare if the subset belong to that encoded data.
Say
encoded data : 11187bcb32536890a9cb307865b027af565cb2f74b7d498fa4def5c3fde53721 (sha256)
keyitem : item1
item1 sha256 code is : 5f3c4f8580d392e422e7c2f6802674ac27966c98d95c39696e4b2490168e5488

is there any way to check if item1 is part of this encoded data without deciphering it ?
I do not want to use base64_encoding. Looking for little bit robust way of doing this.


texts: Why can the last block contain a full block of padding in CBC Encryption?

texts:
I'm trying to understand the SSL Poodle Attack and I'm wondering why the last block of a CBC Record can be full of padding? Wouldn't that mean that the useful data was already a multiple of the key size?

Maybe I'm misunderstanding something else here, as it would seem like you can pad by any number of full blocks of padding. Just don't see why an SSL Library would do that.

Thanks!


texts: Using OpenSSL to emulate LTO 4 tape encryption

texts:
I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 has no such facility. Ideally I'd like to use some encryption software that I can pipe the tar archive through while not having to expand my current key managment scheme  beyond tracking only 256 bit keys.

Assuming OpenSSL is the ideal way to do this, I'm hoping for advice on what the best way to do it would be. It can be assumed that a key will only be used once, when a tape is overwritten a new key is made and the old one destroyed.

I'm a little worried about using a salt since data loss on the tape could destroy it, rendering all the data lost as opposed to losing 1 file if the corruption is somewhere else.
With LTO 4 the 256 bit key is loaded directly as the key. In OpenSSL if I manually specify the key I have to worry about the IV too. Should the IV be derived from they (ie a hash), or should I use the key as the password and let OpenSSL derive a its own key/IV?


texts:
I've been looking at the definition of a PRG, here.  This is a broader notion than a cryptographically secure PRG ("CSPRG"), which is described here.  I am realizing that I am very confused by this first definition - which I want to understand before I get to the second.

Basically, my question is this:  If $f: \mathbb{Z}^+ \to \{0,1\}$ (where $\mathbb Z^+$ is the positive integers) what stops the following from being a PRG?

$$
f(x) = x \pmod 2
$$

Before you laugh, let me write a version of this in terms of the definition at that first link.  Notice that there, a PRG is defined mapping $\mathbb{Z}^+$ to the reals, $\mathbb R$.  So, I will modify my example using the definition of terms given there.

Assume that we start out with a function $g$ satisfying that definition of a PRG,  $g: \mathbb{Z}^+ \to \mathbb R$ and the distribution
$$
P(x) = \begin{cases}
   1 &x\in[0,1)
\\ 0 &x\notin[0,1)
\end{cases}
$$
That is, we have a uniform distribution on $[0,1)$.  Now, let's construct a new function $f$ from $g$, and I will show that $f$ also satisfies the definition of a PRG:
$$
f(x) =
\begin{cases}
   g(x)   & x\equiv 0 \pmod 2
\\ g(x)+1 & x\equiv 1 \pmod 2
\end{cases}
$$
Now, define the distribution $Q$ as
$$
Q(x) = P(x/2)/2 = \begin{cases}
   1/2 & x\in[0,2)
\\ 0 & \text{else}
\end{cases}$$

Thus $Q$ is a uniform distribution on $[0,2)$.

Consider a set $E \subseteq [0,2)$.  We want to show that the measure of the set $f^{-1}(E)$, restricted to the first $n$ elements of $\mathbb{Z}^+$ is close to the measure of $E$ in $[0,2)$, for $n$ large enough.  (Again, see the definition at that first link.)

Let's write $E = E_0 \sqcup E_1$ (meaning disjoint union),
where $E_i = E \cap [i,i+1)$

Then:
$$
f^{-1}(E) = f^{-1}(E_0) \sqcup f^{-1}(E_1).
$$
Since the output of $f$ looks like

$$g(0), g(0) + 1, g(1), g(1) + 1, g(2), g(2) + 1, \dots$$
We have that
$$
  f^{-1}(E_0) = 2 * g^{-1}(E_0)
\\f^{-1}(E_1) = [2 * g^{-1}(E_1 - 1)] + 1
$$
Where, for $S$ a subset of $\mathbb Z ^ +$ or $\mathbb R$, $2*S$ is the set consisting of each element of $S$ multiplied by $2$.  Similarly for $S \pm 1$.

Now, let's additionally allow $|S|$ to stand for the measure of the set $S$ and, when $S\subset \mathbb Z ^ +$, let $\#S$ be the number of elements in $S$.  Then:

$$
\# [f^{-1}(E) \cap [1,2n]] = \# [g^{-1}(E_0) \cap [1,n]] + \# [g^{-1}(E_1 - 1) \cap [1,n]]
$$
By definition of $g$ as a PRG, when $n$ is large enough:

$$
   \#[g^{-1}(E_0) \cap [1,n]]/n     \approx |E_0|
\\ \#[g^{-1}(E_1 - 1) \cap [1,n]]/n \approx |E_1 - 1|
$$
Here $\approx$ means within $\epsilon$, as described in the definition.  Also, the measures $|E_0|$, $|E_1 - 1|$ are taken with respect to the uniform distribution on the unit interval.

So therefore,
$$
\#\left[f^{-1}(E) \cap [1,2n]\right]/2n \approx (|E_0| + |E_1 - 1|)/2
$$

But the latter is just the measure of $E = (E_0 \sqcap E_1)$ taken with respect to the uniform distribution on the interval $[0,2)$.  Therefore, $f$ is a PRG.

How can this be?? $f$ is just jumping back and forth, regularly from one interval to the other.  While the even numbers have some randomness, the odd values just repeat it.


texts: How are Elliptic Curve private and public keys actually used to encrypt or sign data?

texts: I've read article after article about curve parameters, generator points, the dot operation, and how you dot the generator point priv times to get the pub point and voila you have ECC! That's where the articles all stop. But how are the number priv and the point pub used to modify data during encryption or signing?


texts: Building cryptographic primitives using additive maps?

texts: Suppose we have a one-way function F(x) that exhibits the property F(a + b) = F(a) + F(b). Such a function could be used as a cryptographic primitive, no?


texts:
What is the benefit of using HMAC over hash with key suffix? I realize that using key prefix is a bad idea because it allows message extension attacks. When adding key as a suffix such attack possibility is eliminated.

MAC = h(k||x) // key prefixing, bad idea
MAC = h(x||k) // key suffixing, much better idea

HMAC uses double hashing presumably to prevent extension attacks. Why is it better than just simple key suffixing?

HMAC scheme:


texts: What happens when a RC4 stream gets corrupted?

texts:
I want to encrypt a large file using RC4. But what happens if the encrypted file gets corrupted (bytes modified or lost)? Can I still decrypt the rest of the file correctly?

If not, what is the best solution? Split the file in X chunks, and encrypt those seperately?


texts: Is there an upper limit to plaintext size in XSalsa20Poly1305?

texts:
While fiddling with the NaCl implementation in Go, specifically SecretBox, a general crypto question came up after reading the documentation.

Quote:

  Package secretbox encrypts and authenticates small messages.

I haven't seen this before. Is there a maximum size? What constitutes as a small message?

I've looked for some paper or documentation explaining that line, and I even went through the source, but I can't find any related information anywhere which explains the noted limit when it comes to the size of the message.

Practically, I just successfully encrypted hundreds of megabytes of data. So, I am really puzzled as to why the docs say it was specified for small messages only. Currently, I am guessing that there is a cryptographic reason for this which I simply may not be able to find.

So – to recap – what I'm asking is: in Salsa20, is there a limit to the message size that is possible? If there is, can you additionally provide a hint where I can find a related reference/paper for me to look at?

Update:

The issue that I opened has been resolved, and the documentation updated to clarify the limits.


texts: persisting sensitive binary data encrypted (+integrity)

texts:
[#not_a_crypto_expert]

rather than forming the question by the techniques I'll describe the use case:

I'm persisting blocks of sensitive binary data in a remote store, the communication is secure (lets assume), but the store may not be.

The data needs to be sent and stay encrypted on the remote store - it doesn't get decrypted immediately, just stays encrypted until some time when it's needed.
The data needs to have proof that it was not altered
The data needs to have proof that it came from the source
block i+1 should have proof that it is the following block of block i

Putting the last requirement aside for a sec, what I have in mind it the following:

Encrypt the data with the user's private key (for authenticity)
Encrypt the data with the server's public key (for encryption) with symmetric encryption
MAC the ciphertext for integrity
Send the encryption + MAC

Thoughts about the above:

While I think it has the desired security properties it's an awkward use of symmetric encryption - as the data is not immediately decrypted on the other side, but instead remains encrypted for a long time which will require saving the symmetric secret for a very long time - which I think is not the typical case.
If I just replace AES symmetric encryption above with encryption with the server's public key - I'm not sure this preserves the security properties of the MAC then encrypt.

Thanks,
Z


texts:
I have a ciphertext $C$ encrypted with public key $pub_C$, which contains ciphertext $B$ and $pub_B$, $$C= E_{pub_C}(B\mathbin\|pub_B)$$

Ciphertext $B$ is encrypted with $pub_B$ and contains $pub_A$ only. $$ B = E_{pub_B}(pub_A)  $$

I already factorized $pub_C$ with Fermat obtaining ciphertext $B$ and $pub_B$ by decrypting ciphertext $C$. Now I'm stuck on factorizing the modulus of this public key so this is the question:

can I exploit this recursive encryption to factorize $pub_B$ modulus?


texts: Infer encoding mechanism from $n$-grams distance?

texts:
I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance – implying some encoding mechanism as opposed to an encryption procedure (or hash function) which would yield a high amount of variance across all strings; or a structure preserving cipher such as Vigenère (XOR).

I am looking for suggestions of tools and techniques for heuristics to try to identify underlying plaintext assuming this is some data encoding with English language portions (in the underlying “plaintext”).

I have considered a genetic algorithm to develop a decoding technique wherein the fitness function is “distance” of decoded text from an $n$-grams textual database. However, I would like other suggestions for solving this problem.

I have performed iterative xor brute-forcing using the tool XORtool and have bundled outputs by using the unix file command. However, this yields a high degree of false positives due to magic number matching and a large set of candidates are just “ASCII text”.

I have also used the Bletchley Tool for automatic encoding detection but have been unsatisfied with the results and general tool implementation.


texts: System of constraints in Sonic zk-SNARK protocol

texts:
I am reading up on Sonic: Zero Knowledge SNARKS from Linear - Sized Universal And Updateable Structured Reference Strings.

There is an example of representing $\ x^2 + y^2 = z $ constraint (page 7 of the paper):

Can somebody explain how the values for vectors a,b,c,u,v,w,k were obtained?


texts: AugPake implementation Doubt K computation

texts:
try to implement the AugPake protocol in java using BigInteger.

I am having some difficulty computing $K=Y^z \mod p$ because $z$ is always $0$, for $z={1\over x+(w*r)} \mod q$. Being a ratio between $1$ and a very large number $z$ will be always zero using the BigInteger.

Can help me to understand how to compute $z$? Maybe I misunderstood some of the document.

Thanks for your reponse.

To compute Z i use the extended Euclidean algorithm:
ax + qy = gdc(a,b)

Thanks a lot


texts:
I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain how the padding works. Just below that, they said :

  [...] Where the empty string counts as one block.

This is strange, because the block is empty and that cause me a problem. How could I use M[i] and Xor it with Y[i-1] if M[i] is empty ? (see the algorithm definition at page 8)

Following this question, should I pad the message to get a full block before working with M even if the padding is applied after the for-loop ? I think this would be logic but am I right with this logic ?

A clear explanation of that will be very appreciated. Thanks for all help I'll got.


texts: Why is public key cryptography not widely used in governments?

texts: Are there any practical limitations? Govt driving license, passport, SSN could be digitally signed making it easy for anyone to validate. They can have a qr code in them which can be easily validated using an android or ios app offline if the corresponding public key is pre installed. This will make fake ids impossible. Why is it not done even in developed countries like united states?


texts: Matrix cipher - symmetric or asymmetric cryptosystem?

texts:
Matrix cipher is defined by:
a) Encryption: $C = K \times Z$, where $C$ is a cryptogram vector, $Z$ is a message vector and $K$ is encryption matrix (encryption key)
b) Decryption: $Z = K^{-1} \times C$, where $K^{-1}$ is decryption matrix (decryption key), which is inverse to matrix $K$.
Is the matrix cipher symmetric or asymmetric cryptosystem?


texts: Can I update sha-256 digest chunk-wise instead of the whole array at once?

texts:
I'm not sure whether this questions is about SHA-256 algorithm itself or the particular implementation I'm using.

Usually, a hash algorithm implementation has functions, let us call them update and finalize. update feeds another chunk of data, finalize possibly feeds the last chunk and calculates the digest.

Should passing the whole array at once produce the same hash as passing it's chunks one by one? In other words, update(whole_array) vs update(1st_half); update(2nd_half)


texts:
I had a few questions in regards to certain practices used by JWT developers.
I'm relatively new to both encryption and JWTs and the context given is for developing a system on nodejs.

How should verification work? Should I look at the JWT's signature section and verify with the private key each time? Or should I store the token in a No-SQL database and see if it contains it for verification (checking expiration dates too)?
How many bits should each secret key be? Is 2048 too much? What's the 'good medium'?
Is RSA with the HMAC SHA256 signing method okay? What's the best method for key creation? Should keys be generated on multiple occasions (ie. per server startup)? Or is having it static fine?


texts:
I am studying Triple DES.

I have got two basic questions. One, why are we following a sequence like encrypt(decrypt(encrypt)); what is the problem using a sequence encrypt(encrypt(encrypt))?

Second, why are we not using a single long key (say 168 independent key bits) in lieu of three individual 56 bits keys?

Thanks.


texts:
Is there any way to encrypt the huge amount of data using RSA?
I was supposed it is possible but when I read some articles what I saw is that, this is bad practice or they say can only encrypt bit length/8 characters only i.e. if I use 1024 then I could able to encrypt 1024/8 = 128 characters and so on. So if I want to encrypt more data (characters) then my RSA bit length is to be increased.


texts: How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?

texts:
In both node.js and OpenSSL, I am seeing cipher "aes-256-gcm".

However, in NIST Special Publication 800-38D, that defines GCM, I am reading:

  The underlying block cipher shall be approved, the block size shall be 128 bits, and the key size shall be at least 128 bits.

How is this possible?

edit:

I see a similar question has been asked already - GCM encryption for 256-bit and 512-bit block ciphers - but that one is more theoretical question, while in openssl, there is a practical implementation.

Those answers imply that it might be insecure. Is it true, and are the openssl implementations inherently insecure?


texts: How DES/AES can guarantee by feeding different secret keys, the encrypted outputs are different?

texts:
I am learning the meet-in-the-middle on DES attack. I understood the basic logic behind how it is performed; however, one further question is: why can we guarantee to find one and only one pair of k1 and k2?

One step further, how DES guarantee that by taking the same plaintext and different secret key, the encrypted outputs can never be the same?


texts: Can the proof of elasped time (PoET) consensus algorithm be exploited by multiple nodes?

texts:
i recently learned about the Hyperledger Blockchain Project and the specific frameworks. In case of the Sawtooth framework, consensus is reached not by PoW but by PoET (Proof of elapsed Time).

When getting familiar with the proof-of-work (PoW) you usually hear that it's safe regarding participant exploits, because of the computation power which would be needed.

In regards of PoET where the leader for making the consensus is elected by the node with the shortest wait time, i am wondering if it would not be possible to exploit the system, when spaming the network with multiple nodes, so it's more likely to become the leader.

BR


texts: Is ECB mode safe to use with RSA encryption?

texts:
Firstly, bear with me, I'm relatively new to cryptography. In a recent static analysis scan of our application, one of the findings complained that we are using ECB:

  A mode of operation of a block cipher is an algorithm that describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block. Some of the modes of operation include ECB (Electronic Codebook), CBC (Cipher Block Chaining) and CFB (Cipher Feedback).  ECB mode is inherently weak, because it results in the same ciphertext for identical blocks of plaintext. CBC mode does not have this weakness, making it the superior choice.

We are using ECB with RSA.  Our understanding is that RSA doesn't support anything other than ECB as it doesn't permit a block size bigger than the size of the key's modulus, and therefore would only ever encrypt a single block (or throw an exception if breaching block size).   Our suspicion therefore is that the static code analysis tool is searching for 'ECB' in our code base irregardless of the crypto algorithm used.

Given our choice of an RSA crypto algorithm, is there an inherent weaknesses using ECB mode?


texts:
I got a question with the RFC of HKDF https://tools.ietf.org/html/rfc5869.

There is a maximum specified for the output keying material. The length of the OKM shall be <= 255*HashLen. What does it mean? For example there is a hashfunction with output of 32 byte. Is my maximum OKM then 255*32 = 8160 Byte? Or does it mean, my maximum repetition in the loop is smaller or equal than 8160? So that would mean, that you can generate 8160 (rounds) * 32 (per round output) 261120 Byte output.

I am a little bit confused...thanks for help.


texts: What is the purpose of four different secrets shared by client and server in SSL/TLS?

texts:
I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including

client write mac secret,
server write mac secret,
server write key,
client write key.

I couldn't found the use of these in the SSL protocol.

As I understood from reading, after having a handshake, SSL creates a 48 byte master secret, which is used in encryption and this secret is shared by both client and server.

For what are these four values used?


texts: How to extract message in Bleichenbacher 1998 attack

texts:
I'm trying to understand the Bleichenbacher 1998 attack, but I am having trouble wrapping my head around the bounds-part.
So as far as I understand, the idea is the following:
We have a ciphertext $c = m^e \bmod n$ and we are trying to find the message $m$. So we want to make use of the fact that: $s^e \cdot c \bmod n = s^{e} \times m^e \bmod n = (s \times m)^e \bmod n$, which decrypts to $m \cdot s$. Say our new modified ciphertext $c'$ decrypts to $ms$, knowing $s$, we can then extract $m$ by calculating $m = ms \cdot s^{-1}$.
So we try out a bunch of different $s$ until we find one so that $ms$ is PKCS compliant. Now we know that $ms$ starts with 00 02, but it doesn't tell us anything about the rest of the decrypted message.
I do not really understand the concept of trying different bounds and ranges and how we can obtain the whole $ms$ message from it and thus extract $m$.
Can someone please explain to me the concept of how we gain more information on $ms$ by modifying $s$ ?


texts: Two working decipher keys giving various, valid results for one ciphered message - is it possible?

texts:
Let's assume following scenario:

There's a ciphered message. Two decipher keys (let's name them A and B) are known.

Message deciphered with key A gives valid result - normal text but with no secret information. Let it be a poem or other meaningless content.

The same message deciphered with key B gives the right output, the real secret message revealed.

Please tell me, is it possible (or well-known and existing method/algorithm), or just a work of fiction? I've read about it in some novel a long time ago and tried to figure it out on my own, but with no result. But I'm rather ignorant in terms of cryptography so I might just miss something obvious.

Thank you in advance for any help - just a simple name of ciphering method or link to Wikipedia or something will be enough. I don't even dare to ask for the full and detailed explanation.


texts: Are Lagrange Multipliers necessary for Shamir's secret sharing?

texts:
What is the implication of not using the Lagrange multipliers in Shamir's secret sharing?

I mean each update will be $Poly(x_i) \bmod p$ where $p$ is a prime number instead of the original one that is $(Poly(x_i)* LPC_i) \bmod p$.
Assuming that the verifier has access to all secrets $x_i$s, it can re-do all the updates and check if the result is equal to the secret or not.

Is that less secure?


texts: How to calculate inverse affine transform in AES from forward affine transform?


texts:
Can the security of the encryption system be improved by using double encryption with two randomly chosen keys?

By double encryption I mean using two keys K1 and K2, each 20-bit long, to obtain ciphertext $C = ( M ⊕ K_1 ) ⊕ K_2$.


texts: I've been studying this article and since I'm not studying cryptography in English and it is not my native language, I don't understand some of the terminology. More precisely: what are diffusion matrices as mentioned on page 3 right at the beginning of chapter 2? Do they have something to do with diffusion defined in Shannon's theory?


texts: Zero knowledge proof for Paillier addition under multiple keys

texts:
Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower)

Under a Paillier cryptosystem, set

$e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$
$e_1 = E(m_1, r_1)$ for a public key $(g_1, n_1)$
$e_2 = E(m_2, r_2)$ for a public key $(g_2, n_2)$

Can I prove (to a 3rd party, the verifier) that $m_0 = m_1 + m_2$ (or rather the equation with its encrypted counterparts hold) without revealing either of $m_0, m_1, m_2$ nor the private keys?

I, the prover, know all $m_i$, all public keys $(g_i, n_i)$ (by extension, also all $e_i$) and finally the private key $(\lambda_0,  \mu_0)$ for $(g_0, n_0)$ but not for the rest. Also, I as the prover get to choose all $r_i$

If all $e_i$ where encrypted under the same pubkey $(g,n)$, then I know we could check if $e_0 \cdot (e_1 \cdot e_2)^{-1}$ is a power of $n^2$ (as that evaluates to the encryption of 0), but it is not the case under diferent $(g_i,n_i)$.

Take $(\cdot)^{-1}$ as the modular multiplicative inverse, thus emulating the subtraction in Paillier.

I might use other cryptosystems (ie. ElGamal) as long as they have homomorphic properties


texts:
Let's suppose our device performs ECDH with a fixed, unknown, private key $\text{prv}$.

It accepts as input any point $Q$ lying in the proper subgroup of the proper elliptic curve, then computes: $P = \mathit{prv}*Q$ and outputs $P$.

An attacker who:

has access to $P$
can choose any valid $Q$ as input
can call ECDH many times

can gain any information about the private key $\mathit{prv}$ ?

If not, then why a KDF is usually used on the x-coordinate of $P$ ?

Is it just to better distribute the possible outputs (since about half of possible x-coordinate won't be valid points on the curve) ?

NOTE: no smallgroups/invalid curve attacks or bad elliptic curves are considered here.


texts:
Suppose integer $m$ has $\phi(m)=2pq^5r^2$ where $p,q,r$ are primes.

Hellman-Pohlig says that finding discrete log $z\bmod p$, $z\bmod q^5$, $z\bmod r^2$ and $z\bmod 2$ suffices to find $z\bmod\phi(m)$ in $g^z=h\bmod m$.

It could be that $p,q^5,r^2$ are still very large and there is a Big-step-small-step which is still exponential.

Can we apply sieve techniques to each of $z\bmod p$, $z\bmod q^5$, $z\bmod r^2$ and $z\bmod 2$ cases separately?


texts: Why XOFs are more convenient than Hash Functions in modeling Random Oracles

texts:
In this answer, it is mentioned that

  Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd use some artificial construction around a fixed-size hash function to get the desired output size, but with XOFs you can just plug them right in without having to fear any mistakes on your side potentially breaking the proofs (most people don't know/understand in many cases, me included).

and NIST.FIPS.202 says

  Extendable-output functions are different from hash functions, but it is possible to use them in similar ways, with the flexibility to be adapted directly to the requirements of individual applications, subject to additional security considerations.

Is it just the fixed-size problem of hash functions? Like in this question  Can MGF1 within OAEP and PSS be replaced by a XOF?

Actually, we can create arbitrary length from the hash functions by $h_0 = H(m)$ then $h_i = H(h|i), i>0$ and the output is $h_0\|h_1\|\ldots$ - I'm not claiming this is collision-free.

At page 24 of the NIST document, however, with the section titled as Additional Consideration for Extendable-Output Functions;

  XOFs have the potential for generating related outputs—a property that designers of security applications/protocols/systems may not expect of
  hash functions.

So;

Why XOFs are better than Hash Functions in modeling Random oracles?


texts: Open source code about the basic Quisquater-Piret DFA of AES-128

texts: Where can i find open source code about the basic Quisquater-Piret DFA of AES-128? Are there any websites sharing the code about such physical attacks?


texts: Is it bad practice to use the message digest of the plaintext as the initialization vector?

texts: Data is being encrypted in a database.  A message digest is being created for deduplication purposes.  Is it ok to use the message digest that will be the key of the table that houses the encrypted data as the initialization vector?  Since the data is not being transmitted, just archived and retrieved locally, is this a no-no?  Since the message digest should theoretically be unique for every record, I'd expect the concern of using the same IV would not be a problem.


texts: Why does openssl derive IVs from a password?

texts:
From https://wiki.openssl.org/index.php/Manual:Enc(1):

  When a password is being specified using one of the other options, the IV is generated from this password.

Why does OpenSSL do this? My expectation would be that an unique IV is generated and encoded in the output message every time you invoke OpenSSL. When decrypting, OpenSSL extracts the IV and uses it.

Is there any reason to derive an IV from a password instead? Is that even safe to do? Aren't you using the same IV each time you use the password? What even is the point of using an IV if it's going to be paired to the encryption key?


texts: Is there any concrete reason to call BLAKE more secure than BLAKE2?

texts:
I read a blog article which discussed SHA-3. I noticed it mention that security was often compromised in the name of speed (not always a bad thing, of course). It gave some examples:

  What I'm saying is that although they care deeply about security, they are also looking for compromises to gain speed. This can be seen with the push for 0-RTT in TLS, but I believe we're seeing it here as well with a push for either KangarooTwelve (K12) or BLAKE2 instead of SHA-3/SHAKE and BLAKE (which are more secure versions of K12 and BLAKE2).

This is explicitly claiming that BLAKE is more secure than BLAKE2. I wasn't able to find anyone else claiming that, so I went to read the actual paper to see what changes it made to the original:

Fewer constants used. The original argument was that the constants improve diffusion.
Fewer rounds used (from 14 to 10 for 256-bit digests and from 16 to 12 for 512-bit digests).
Fancy features such as hash trees and personalization values added.
Some generic security trade-offs made (in regards to salt and IV processing).
Extensive speed and memory optimizations for implementations in software.

The first two points do not increase security at all, and arguably reduce security. Reducing the rounds was done because the best preimage attack was only found against a 2.5 round variant. This improves speed considerably at the expense of security (at least on a theoretical level). The reduced number of round constants reduce diffusion in the name of a lower ROM footprint.

It's possible that the author of the blog post mentioned simply read about it using fewer rounds and claimed the security was meaningfully reduced as a result, or it could be that it may have practical implications. My question is whether or not there is any concrete reason to consider BLAKE2 to be less secure than BLAKE and to use the latter instead for that reason (when speed is not an issue).


texts: Modular reduction for NIST prime P256-- understanding the data

texts:
I am working on a project where I need to implement elliptic curve cryptography, I am struggling from a long time in order to understand the working and the process.

Modular finite field arithmetic, I understood the initial concept, now I am looking at this document from NIST

https://www.nsa.gov/ia/_files/nist-routines.pdf

However, I cannot understand, that if I need to check my modular adder or multiplier, what data should I use.

What is A,B and mod(P) in this document for P-256.
I want to implement montgomery reduction however I am not understanding it. I have a 512 bit value that is A*B. How should I move further from here.

IMP--Using the Fast reduction given by NIST ... how do we do it .... just add and subtract them and then find mod or find mod after every add or subtract?

REDUCTION--- While reducing ... suppose I did all those 256 bit additions and subtractions, Should I use 512 bit adder? as carry may be much more than 1 bit.

I have very very less time left to design the whole system. Please help me understand it is that I could implement it as soon as possible.
I am implementing the design on FPGA using VHDL.


texts:
I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the only way used to crack it is brute force. I submitted these theories to my teacher, but he claims that a double encryption doesn't make it any safer. I didn't follow his arguments entirely, so I decided to ask here.

So, if I encrypt a message with one key once, and the encrypt the resulting cipher text once more with a different key, does this make the encryption simpler?

EDIT:
My teacher said that "it doesn't get safer with a double encryption, at least not if n is the same and e is different.". This is the part I don't follow, since you'd still need both p and q to derive the two different private keys that this would produce. I have made a few calculations and I do not quite understand. Why would the particular statement my teacher sent me mean that it doesn't get safer?


texts:
I am creating software tokens for future request authentication, and I want to use an HMAC for the token to make them tamper-resistant. To ensure I can check the HMAC later I need a secret, persistent key. Is there a security concern in using a private RSA key as the HMAC key? If not, what would the best values be from the key? This link says:

  The security of RSA derives from the fact that, given the public key { e, n }, it is computationally infeasible to calculate d, either directly or by factoring n into p and q. Therefore, any part of the key related to d, p, or q must be kept secret.

I would expect it to be the private exponent (D) then, but I am not sure if some other combination of values would offer strong security (like P,Q, and D concatenated).

Edit: clarification

The reason I am asking about the RSA private key is the HMAC key needs to be stored so that the HMAC can be validated by the server on future requests. An RSA private key is an easy to manage, persistent value. I am not using the public key, or performing any aspect of public key crypto. I need a way to securely manage the HMAC key, and I am wondering if there are any good reasons not to use an RSA Private Key for this purpose.


texts: does increasing the number of rounds in feistel increase the security

texts:
In feistel cipher , does it matter that number of rounds ? is using more rounds will give the best result?
or it's all about the key size ?


texts: Is there a computational security of public-key encryption which is similar to the one of symmetric key encryption

texts:
We say a symmetric key encryption scheme $\Pi_{1} = (\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ is computational security if for every PPT algorithm $A$ and every $x_{0}, x_{1}$ ($|x_{0}| = |x_{1}|$),
$$ \left\vert \Pr\left[\mathrm{Gen}(1^{n})=k; A (\mathrm{Enc}_{k}(x_{0})) = 1\right] - \Pr\left[\mathrm{Gen}(1^{n})=k; A (\mathrm{Enc}_{k}(x_{1})) = 1\right] \right\vert < \varepsilon(n) $$

Is there a definition of computational security of public-key encryption as following？

We say a public-key encryption scheme $\Pi_{2} = (\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ is computational security if for every PPT algorithm $A$ and every $x_{0}, x_{1}$ ($|x_{0}| = |x_{1}|$),
$$ \left\vert \Pr\left[\mathrm{Gen}(1^{n})= (pk, sk); A (pk, \mathrm{Enc}_{pk}(x_{0})) = 1\right] - \\
\Pr\left[\mathrm{Gen}(1^{n})= (pk, sk); A (pk, \mathrm{Enc}_{pk}(x_{1})) = 1\right] \right\vert < \varepsilon(n) $$

Is it equivalence to IND-CPA?


texts: DES hardware implementation of substitution lookup table [ ReWorked ]

texts:
I'm a crypto enthusiastic and student of cryptography.
I'm developing a project with other students titled "A hardware implementation of a DES cryptography for educational purposes", our idea was to make a simple version of DES encryption in a piece of hardware to help students that are learning cryptography understand better how this complex encryption method is implemented in hardware.

First, we started the system with an input of 8 bits to simplify the complexity and save space. Them, we created all the parts of DES cryptosystem (Initial Permutation, Feistel, XOR, Final Permutation).

Here is a image of our main system:

One of the important parts of the system is the Feistel Function. The Feistel part were divided in 4 parts, Expansion, Mixing, Substitution, Permutation.
Each of these parts are implemented as following:

The expansion CI just take the bits and duplicate them putting the new bit in the adjacent output, this CI receive 4 bits of the right part of the input and outputs 8 bits. Mixing just take the first bit of the output of expansion and XOR with the first bit of the key(8 bits) and so on... the output is 8 bits.
Now we have the most important part and the part that I personally think we're missing something.
The Substitution in witch is the S-Box, this CI has an 8 bits input and these 8 bits are divided in two parts(because we developed only 4 bits S-Boxes) these parts enter the S-Box and the S-Box output is of 2 bits, when you see the S-boxes of DES, all of them uses a lookup table, we've the idea of using the Karnaught map for implementing this table.

Our table :

And here is where we stopped, because we implemented all of this and had fail results like this:

The S-Box works like a lookup table on software but the system does not work, is there any specific way that these look up tables are created ? We couldn't see any pattern in the outputs of the table, do you guys have any material to help us ? I feel like this is the last thing to work on.

Thank you for reading it all. Please leave a comment! :)
Thank you again!


texts: Passwords with same SALT. What does this mean?

texts:
If the same SALT is used for many passwords on a Linux server, in what way is that a security risk?

Does the mean, that a user (which can change his own password) can calculate other users passwords?

Or is brute forcing a rainbow table still required?


texts: Is OMEMO vulnerable in case of compromised jabber server?

texts:
As I've understand OMEMO protocol specification, the initial key exchange between Alice and Bob can be stored on server and in future used for message decryption.

Also the phrase from Conversations, Jabber Android client, official site:

  This way, not only your messages are safe but more importantly it is impossible for an outside attacker to intercept your meta data (with whom you are chatting) without attacking your server first.

So, does this means that OMEMO is secure only if server and its administration can be 100% trusted?

Does this mean that OTR with its worse usability has better security?


texts: Whats wrong with my El Gamal signature example

texts:
I'm trying to digitally sign a message m using El Gamal. So far I've been unable to verify the digital signature ive made using El Gamal.

I am using prime number, p = 8369. prime root g = 3031. Private key parameter x = 61. and the message m = 9876

I am calculating y and r to be:

y = 3031^61 mod 8369 = 3400
r = 3031^11 mod 8369 = 2954

Signed message s, s = k^-1 (m – xr) mod (p-1)

s = 11^-1(9876 – 61*2954) mod 8368
s = 13788/11 which cannot be right

I then tried removing the inverse power from 11 which I had seen in another example which produced the following

s = 11(9876 – 61*2954) mod 8368 = 934

When i used v = g^m mod p and w = y^r r^s mod p I got

v = 3031^9876 mod 8369 = 6346
w = 3400^2954 * 2954^934 mod 8369 = 855

V and W dont match meaning the signature is invalid and I've made a mistake in my verification. Where did I go wrong and am i on the right track?


texts: Computing cost for a trillionaire to compute GNFS in RFC 3766

texts:
RFC 3766, Section 4.1 discusses picking $n$ to achieve some target cost for employing the GNFS, i.e., $T$ is known and $N$ is unknown in the below equation:

$$T = \kappa \cdot \exp{\left(c \cdot (\ln{N})^{1/3} (\ln{\ln{N}})^{2/3}\right)}$$

In the RFC, the authors use $c = 1.92$. By using their empirically-derived coefficient $\kappa= 0.02$, the authors effectively make the units for $T$ to be "instructions."

The authors give an example in Sec 4.1, solving for $N$ given target cost $T = 5 \cdot 10^{33}$, employing an approximation that is not described:

5*10^33 = (6*10^-16)*e^(1.92*cubrt(ln(n)*(ln(ln(n)))^2))

Solving this approximately for n yields:

 n = 10^(625) = 2^(2077)

How did they get this equation, and does the approximation seem reasonable?

The perceived discrepancy.

Using Wolfram Alpha:

the equation is solved as $n=7.667...\times10^{1354}$ (which is quite different than $10^{625}$)
substituting $n=10^{625}$ into the equation yields $T = 1.29917...\times10^{20}$ (which is quite different than $5 \cdot 10^{33}$)

Showing my work.

Well, the equation can be copy-pasted into Alpha without modification; but, I suspect that the discrepancy may be due to a typo, or the approximation is pretty loose, or some combo:

the coefficient 6*10^-16 is (per Sec. 2.2) used to adjust the equation to relate to an adversary doing 1 MIPS years of instructions, or $10^6$ instructions/sec, calculated as:
$$0.02\cdot \frac{1}{10^{6}} \frac{1}{86400} \frac{1}{365} \approx 6 \cdot 10^{-6}$$
But the trillionaire adversary in Sec 4.1 can do 5e12 MIPs of instructions per year.
Also, they state "50 year resistance against a trillionaire is assumed to be the minimum security requirement"

Thus, perhaps this is just a typo and the real equation is more like the work accomplished by the trillionaire over 50 years, when it can do 5e12 instructions per year:

5*10^33 = 0.02 / (5 * 10^12 * 50) * e^(1.92*cubrt(ln(n)*(ln(ln(n)))^2))

But this doesn't get me any closer to the results they report.


texts: Do key collisions for symmetric ciphers exist?

texts:
I'm not sure if I'm calling the thing (key collisions) correctly, and that's probably why I couldn't find any information about it on Google. Still, my question is as follows. Note that I don't work with encryption right now and I'm not going to implement anything based on this knowledge; this is a purely theoretical question which I found very interesting.

Suppose that you have a key K and a plain text P. Then you use some symmetric algorithm A like one of AES variants to obtain a ciphertext C = A_encrypt(P, K). Is it possible that some key K* != K exists which can be used to get back the plain text out of the same ciphertext, i.e. P = A_decrypt(C, K*)? How it depends, if it does, on the type of the cipher (block vs stream), on the exact algorithm and on the size of the key and the size of the plain text? My intuition suggests that impossibility or, at least, improbability of such thing is the reason of existence of symmetric ciphers, but still this is not stated explicitly anywhere I could find.

What surprises me that I couldn't find anything which answers such question directly; moreover, I couldn't find anyone asking such question. All I could find are questions like this which seem to be related but not exactly the same as my question, and questions like "how to generate two keys to decipher the same data" which are somewhat opposite to my question.


texts:
I'm interested in a proof-of-work system that works well on standard computers without using the GPU.

Properties the system should have:

Seed based proof-of-work.
There is no distinguished challenger who can solve the problem efficiently. A typical seed is a 256 bit hash of a public key.
Minimize the advantage an attacker gains from specialized hardware.
The legitimate worker has a standard desktop or notebook. He's willing to commit about 1GB of memory and his CPU to calculate the proof. The time he spends is a few minutes to a few hours, depending what grade the proof should have.
The attacker can use specialized hardware including GPU, FPGA and ASIC. The amount of money he spends for hardware and electricity to calculate the proof should be maximal.
Efficient verification
Verifying the proof should be cheap. For example taking 1ms and 1MB of memory.
Small proof
A 16 byte proof would be ideal, but a few kilobytes would be OK too.
Predictable duration
For many proof systems each attempt is independent, making it hard to predict when you succeed. Success peaking around the average time would be nice. This is just a nice-to-have feature, and I'd be content with a system that only satisfies 1 to 4.

Systems I know, but that don't satisfy my requirements:

Hash prefixes for standard hash functions such as SHA-2. This fulfills 1, 3 and 4, but utterly fails 2. Specialized hardware is much more efficient than the target hardware.
Hash prefixes for scrypt. This fulfills 1, 2 and 4. But it fails 3, because verification requires just as much memory as working, and verification time is a bit long too.

I believe it is possible to create a system that fulfills the four main requirements. My idea is solving a problem which in principle can be solved with little memory, but the chance of success is small, and thus the amount of work is very large, in that case. But if you are willing to commit significant amounts of RAM, you can run a different algorithm, that solves the problem efficiently.


texts: Attacking Double DES (OFB Mode) given the initialization vector and not much else?

texts:
I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited resources, so brute-forcing a Meet-in-the-Middle attack of complexity $2^{56}$ is unfeasible. What other options do I have for attacking OFB Mode?

EDIT: It has now been revealed to me that both $K_1$ and $K_2$ are weak keys. Hopefully this gives enough info to crack it, however I'm unfamiliar with how to approach weak keys, what do I do with them?


texts: Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

texts:
I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the other party. Client A wants the fB and client B wants fA.

How can I make an algorithm were it is not possible for them to screw the other player.

For example:
    A encrypts fA and send the file to B.
    B encrypts fB and sends it to A.

Now, both A and B have an encrypted version of the file they want.
How can they both share the decryption key at the same time... or what?

Is this even possible? This is breaking my mind.

Since each client will try to rip the other party, Client A cannot send the file fA to client B and expect client B to send back its file. If client A sends it first "with no guarantees", client B will simply run off with the file.

In real life a person holds the pot in one hand, the other holds the cash in the other. They both trade each hand at the same time. The guy with the cash now ends up with the pot and vice versa. How can I do something similar with computer bits. (client A and B are on a network at different locations).

EDIT: Please note that each party has a hash of the file they are supposed to get. Therefore, the parties cannot send a junk file to the other guy whit-out him knowing. A trusted third party will provide the hash.


texts: About the Rijndael/AES sbox polynomial (subBytes)

texts:
I've recently read a question about the irreducible polynomial behind the subBytes() operation in the Rijndael that has awakened and old curiosity I have:

Why $\,m(x)$ was chosen as $\,x^8+x^4+x^3+x+1$?

In the comments in the referenced question it has been mention that it was the first that fulfilled the task (be irreducible to have a finite field instead of a ring, isn't it?). Yes, it's true, but was this that simple? Would be useful any other property?

Let's say, one binary curiosity it has, is a Hamming Weight of $\,\lceil\frac{n}{2}\rceil$ where $n$ is the length in bits. This is a balanced weight that perhaps means nothing or maybe something.

Thinking in the maths behind this operation, with other sizes ($w$) than 8 bits (per word), let's say $w=7$ the first that does the job is $x^7+x+1$ and the first with a balanced hamming weight $(x^7+x^4+x^3+x^2+1)$ is the fifth that does the job.

I'm not seeing any particularity between the two field that they build, but exists?


texts:
I have a short question.

Besides PKI, Web of Trust or secure out of band communication. Is there any other way to verify the public key of a communicating party?

In other words, let's assume an active adversary with MiTM capabilities. When we are doing a public key exchange, you have to rely on a trusted third party or any other out of band secure channel to verify to authenticity of the public key. There is no way of using the same channel that you just exchanged the keys.


texts:
I am trying to understand what is the cost of non-membership verification for a universal accumulator?

More specifically, how can I compute it?

Whether using an accumulator is more efficient than the Merkle Hash tree?


texts: Where can I begin to study the math behind modern cryptography?

texts:
Why do I start the word buffers in MD5 with those values specifically? What in the world motivated the decision to use the numbers 1, 1, 2, 3 for the mix columns stagein AES? And what kind of witchcraft is going on in SHA when I call the sigma_x functions?

What kind of math should I be starting with, assuming I only know how to add, subtract, multiply, divide, and mod?


texts: Elliptic Curve Cryptography insecure when input does not lie on the curve?

texts:
I am new to Elliptic Curve Cryptography and I was reading up on it online when I came across this link. It stated the following.

  Unfortunately, there is a gap between ECDLP difficulty and ECC security. None of these standards do a good job of ensuring ECC security. There are many attacks that break real-world ECC without solving ECDLP. The core problem is that if you implement the standard curves, chances are you're doing it wrong:

  Your implementation produces incorrect results for some rare curve points.
  Your implementation leaks secret data when the input isn't a curve point.
  Your implementation leaks secret data through branch timing.
  Your implementation leaks secret data through cache timing.

So, I was curious about the second point. How is it possible to leak secret data when the input isn't a curve point. I am assuming it means the base point(P) is not on the curve, but then how would P+P be calculated and how would it make the implementation insecure?


texts: iSeries (AS/400) Database File: password encryption

texts:
I am helping with a project in which an old software system on an iSeries is having a brand new .NET UI applied to it.  It's going well... except...

In order to allow users to login and maintain compatibility with the existing software installation, we need to figure out what encryption/hashing method the previous vendor was using without access to their source code.

I have a file with an ID and Password column.  The password column appears to contains only 16 characters per record, all binary.

Part of the previous vendor system was written in native green screen on the 400, and part of it was written in Microsoft ASP.Net.

What type of encryption or hash would be:

Used by an AS/400 or iSeries Green Screen app, and
Used by a Microsoft .NET app, and
Output a consistent 16 binary bytes, regardless of input length

Pointers much appreciated.  Thanks!


texts: Proving set membership in less than $\log{N}$ bandwidth

texts:
I have an unchanging set of unique items, and I want my server to show one of those items to a client, then cryptographically prove that the item is part of the set.

How I do this currently:

Generate a Merkle tree containing all of the items.
Give the client the Merkle root, (32 bytes) out of band.
Give the client the item, then the branch leading to the Merkle root.
The client hashes the item, then hashes each Merkle branch, starting at the bottom.
If the hash at the end equals the Merkle root, the item is in the set.

The problem with this is that it takes $2\cdot 32 \cdot \log_2{N}$ bytes of bandwidth (where $N$ is the number of items in the set.) Is it possible to do this is in a smaller space?

The scheme needs one additional property, which is that once you have all of the items, it must be possible to determine that you have all of the items in the set.

Other factors:

The set isn't private - it's okay if the scheme reveals information about other members of the set.


texts:
I am trying to use the ecdsaSign function in ecdsa.c of https://github.com/kvhnuke/Ethereum-Arduino/tree/master/Ethereum-Arduino/libs which is based on the files in the repo https://github.com/someone42/hardware-bitcoin-wallet
The signature that I generate using the above function
ea9c02e96049f6e0ca1ddbcb1ef4ab122ab1d42fb52e537456b446c281cc72342caeec1d88d2ed67d14a06358148468e61a4e5a499cc7972be39e9f46c2cf06a
To crosscheck it I am using the ecdsa_sign function from the repo https://github.com/trezor/trezor-firmware/tree/master/crypto which I know generates the desired signature -
f388ade4a3ef1f44ff31e860ca8e92c6d0fa77562b274f59a8b82af3e7c3177a5851f9720efe77b1872e23a2545b71aed5451ed4ff1c0fc2cac093fc084b99d6
msg used : 1020212013102021201310202120131020212013102021201310202120131020
privkey used : 8000238ac88eef15f5dae0c5ec08525f26ebe36a23fb81255a1595098b559c02
can someone please help me understand what I am missing here?


texts: PBKDF2 output size vs internal hashing algorithm

texts:
PBKDF2 allows you to choose an output size as well as the internal hashing function used.

My question is, do these two sizes need to match?

For example, if I'm using PBKDF2 with SHA512, does my output size need to be 512 bits?

I'm a little confused because WebCrypto and CryptoJS allow you to specify SHA512 as the hashing algorithm, but then limit the output key size to the AES max output size, which is 256.

Why is AES even used to generate the final key, and not just a SHA hash of the derived key?


texts: Shor algorithm and schnorr signature in ed25519

texts: Does the application of Shor's algorithm in any way relate/affect the schnorr signature in ed25519?


texts: What does $x^{1/e}$ mean in cryptography in this open butterfly structure?

texts:
I am currently reading a research paper that introduces this thing called a butterfly structure.

I am confused about the structure of the open butterfly in this paper which has the equation $H^{\alpha}_{e}(x,y)=(R^{-1}_{R_y[e,\alpha](x)}(y),R_y[e,\alpha](x))$ where $R_k[e,\alpha](x)=(x+\alpha k)^e+k^e$ and a corresponding structure as seen below:

I am confused as to how the structure of the butterfly above, relates to the equation. Furthermore, I don't really understand what $x^{1/e}$ in the butterfly structure means. It would be great if someone could explain this. The paper is Cryptanalysis of a Theorem Decomposing the only Known solution to the big APN problem.


texts: Does it matter if IV is used as the first block of data before the encryption and then some fixed value is used for the actual IV?

texts:
Usually the IV for the crypto operations is chosen randomly and is sent together with the encrypted data [at the first block]. For decryption, the IV is first extracted from data and set separately in the crypto components (functions or HW peripherals) and then feed the crypto operation with data.

The other case is to set the IV always to fixed value but the first block of data is chosen randomly. In this case after decryption the first block will be just ignored!

In terms of result, I understand that the encrypted text are different but in terms of security does anybody know if it matters or not?


texts: Identification Schemes and Internet of Things

texts:
I was reading an article titled "A Novel Method for Polar Form of Any Degree of
Multivariate Polynomials with Applications in IoT" (doi:10.3390/s19040903)
I read the following statement:

"Identification schemes are the most important elements for many area, such as devices connected to the Internet"

I do not fully understand that statement. Why not other schemes? What makes Identification Scheme so useful for IoT?


texts:
The following theorem is the description of one-more unforgeability in the paper lattice based blind signatures. I want to ask if the time $t^{'}$ is an exponential time since the $q_{H}$ and  $q_{Sign}$ are about $2^{60}$. If the time $t^{'}$ is an exponential time then the adversary acturally cannot solve the hard problem, namely there is no contradiction exist.

Theorem 3.8 (One-more unforgeability. Let $\text{Sign}$ be the signature oracle. Let $T_{\text{Sign}}$ and $T_\text{H}$ be the cost functions for simulating the oracles $\text{Sign}$ and $\text{H}$, and let $c \lt 1$ be the probability for a restart in the protocol. $\text{BS}$ is $(t, q_\text{Sign}, q_\text{H}, \delta)$-one-more unforgeable if $\text{com}$ is $(t', \delta / 2)$-binding and $Col(\mathcal{H}(\mathcal{R}, m), D)$ is $(t', \delta / 2)$-hard with $t' = t + q_{\text{H}}^{q_\text{Sign}}(q_\text{Sign}T_\text{Sign} + q_\text{H}T_\text{H})$ and non-negligible $\delta'$ if $\delta$ is non-negligible.


texts: Using HMAC with AES modes that do NOT require padding

texts:
I'm trying to use HMAC with AES modes that do not require any sort of padding.
Although I am aware that modes like AES-GCM and AES-EAX already provide
authentication, I want to know if HMAC is suitable with the modes that do not
provide any authentication. This is what I tried:
The code
from Cryptodome.Cipher import AES
import hmac

class DecryptionError(Exception):
    pass

class AESNonAEAD:
    def __init__(self, is_encrypting, key, mode, iv_or_nonce, digestmod='sha256'):
        self._is_encrypting = is_encrypting

        # Use KDF to derive key material from given key:
        # length of crp == length of key
        # length of authkey == (digest size of hashalgo for HMAC // 8)
        crpkey, authkey = derive_key_material(key, digestmod)

        self._auth = hmac.new(authkey, digestmod=digestmod)
        self._cipher = AES.new(key, mode, iv_or_nonce)
        if is_encrypting:
            self._update = self._cipher.encrypt
        else:
            self._update = self._cipher.decrypt

        self._auth.update(iv_or_nonce)

        self._updated = False
        self._len_ct = 0
        self._len_aad = 0

    def authenticate(self, data):
        if self._updated:
            raise ValueError('update has already been called')
        self._auth.update(data)
        self._len_aad += len(data)

    def _pad_aad(self):
        # pad to a multiple of 16 bytes
        if self._len_aad & 0x0F:
            self._auth.update(bytes(16 - (self._len_aad & 0x0F)))

    def update(self):
        if not self._updated:
            self._pad_aad()
            self._updated = True

        if not self._is_encrypting:
            self._auth.update(data)

        res = self._update(data)
        self._len_ct += len(res)

        if self._is_encrypting:
            self._auth.update(res)
        return res

    def finalize(self, tag=None):
        if not self._is_encrypting and tag is None:
            raise ValueError('tag is required')

        # pad to a multiple of 16 bytes
        if self._len_ct & 0x0F:
           self._auth.update(bytes(16 - (self._len_ct & 0x0F)))
        # include length of aad and ciphertext
        self._auth.update(self._len_aad.to_bytes(8, 'little'))
        self._auth.update(self._len_ct.to_bytes(8, 'little'))

        if self._is_encrypting:
            return
        if not hmac.compare_digest(tag, self._auth.digest()):
            raise DecryptionError

    def calcuate_tag(self):
        if self._is_encrypting:
            return self._hmac.digest()

Usage
Encryption
from Cryptodome.Cipher import AES

key = os.urandom(32)
iv = os.urandom(16)
enc = AESNonAEAD(True, key, AES.MODE_CFB, iv)  # or MODE_CTR

enc.authenticate(b'yes this')
encdata = enc.update(b'no not this')
enc.finalize()
tag = enc.calculate_tag()

Decryption
dec = AESNonAEAD(False, key, AES.MODE_CFB, iv)  # or MODE_CTR

dec.authenticate(b'yes this')
decdata = dec.update(encdata)

Questions:

Is this implementation acceptable?
Is this the proper way of using HMAC? Is it necessary to pad the HMAC for non padded cipher modes?
Can this very same scheme be used with Camellia cipher?


texts: How to calculate random factor in Paillier cryptosystem?

texts:
I am currently learning paillier cryptosystem,and have two questions about random r.I use the characteristics of homomorphic addition to obtain the product of two ciphertexts C and the corresponding plaintext P.

Assuming I know the private key,how can I calculate r？(I want to know more details about how to calculate r)
If I get r and send it to another person who only knows the public key, can he use (P,r) encryption to get ciphertext C to prove that my decryption operation is correct?


texts: Showing the decrypted sum of encrypted values

texts:
Is there a system that would allow to encrypt values with one or more keys, sum the encrypted values, and reveal a key which could only decrypt the sum.

Essentially would be able to show encrypted values where anyone could verify the sum by adding all of the encrypted values, then decrypting it.


texts: RSA attack, 1 message with different keys?

texts:
There is 1 message, it is encrypted with 6 different keys, each has E = 5.
I tried various attacks, but they do not seem to work.

Is it possible to receive a private key / encrypted message? Is it safe to use a small E?


texts: Overview of relations between cryptographic primitives?

texts:
Is there a web page that gives a graphical (or, alternatively, a textual) overview of known implications and separations between cryptographic primitives?

More specifically, I am looking for something like the following, but more comprehensive and with references to the respective works.
(The following graphic is taken from a set of slides by Danny Harnik and Moni Naor that I found on the Internet.)


texts: ECDSA vulnerability related to recovering private key using same r

texts:
I'm considering this for bitcoin transaction as it uses ECDSA so if the signer generates two signatures suppose s1 and s2.
where:

I get it that any attacker who have s1 and s2 can recover its private key x.
But the question is can the signer use a different private key x1 for instance to generate s2..in such a way even if he uses same k but still its private key will be safe.??(cryptocurrency like bitcoin allows multiple public private key pair of a user)
Am i getting something wrong otherwise this would have been not a well known ECDSA vulnerability in bitcoin.
Please explain the contradiction. Thanks in advance


texts: Understanding padding oracles - is an attack plausible in my scenario?

texts:
I have a scheme that, long story short, uses AES in CBC mode to encrypt third-party credentials for user accounts with a password-derived key. It's been mentioned that the use of CBC mode is a vulnerability because it is susceptible to "padding oracle attacks"; the cipher, after being initialized by the legitimate user with the proper key/IV, can be used by an attacker to execute a chosen-ciphertext attack to recover the plaintext without ever discovering the key.

The question is, do I actually have to worry about this type of attack given the way my system uses the cipher, specifically the fact that the cipher instance is only in existence for some seconds before its internal state is erased and it goes out of scope?

Perhaps more background is necessary. The basic scheme is that the user enters their username and password. The password is "stretched" by hashing it with SHA-512, and then that digest is split in half; one side is BCrypted for password verification by the server, the other half is the AES key used to decrypt the user credentials retrieved from the server.

So, the AES cipher isn't being used to maintain an open secure channel with a remote party; it's created, initialized, does its job on one message, and is then cleaned, disposed and garbage collected. This takes less than a second. To my way of thinking, this would make a POA infeasible, because the attacker would need an open, initialized instance of the cipher to bounce his chosen ciphertexts off of, which would take far longer than the second or two that the cipher instance is doing its job. Further, the cipher instance isn't being exposed to anyone outside the computer; if an attacker's in the computer, he has the user's password plain and simple, but an attacker can't even make a network request of the client computer that would involve the cipher in any way.

There are much easier attacks on this scheme as implemented, perhaps the simplest being that the AES key is derived rather simply from a user-chosen password (and we know how much entropy those have).

So, should I worry about the vulnerability of CBC mode to padding oracle attacks in my specific circumstance, or am I reasonably safe from that particular vector and should concentrate on other areas of weakness?


texts: Problem with Fiat-shamir on poly-round interactive protocol?

texts: I have read in many places that Fiat Shamir technique is used to convert constant round interactive protocols to non-interactive arguments. What would be the problem in applying Fiat Shamir to poly-round protocols?


texts: Why is RSA encryption performed in mod n, but computation of inverse in $\bmod \varphi(n)$

texts:
I am studying the principles of RSA and have come across some unintuitive statements. Lets revisit the RSA algorithm:

RSA Key Generation

Output: public key: $k_{pub} = (n,e)$ and private key: $k_{pr} = (d)$

Choose two large primes $p$ and $q$.
Compute $n$ = $pq$.
Compute $\varphi(n) = (p−1)(q−1)$.
Select the public exponent $e \in \{1,2,\ldots,\varphi(n)−1\}$ such that
$\gcd(e,\varphi(n)) = 1.$
Compute the private key $d$ such that
$d\cdot e \equiv 1 \bmod \varphi(n)$

Decryption:
$x=d_{kpr}(y)\equiv y^{d} \bmod n$

Encryption:
$y=e_{kpub}(x)\equiv x^{e} \bmod n$

I don't find intuitive on why we perform encryption and decryption in modulus $n$, but compute the inverse of $e$ in modulus $\varphi(n)$. Any help is appreciated.


texts: How big does M need to be in Blum Blum Shub?

texts:
I've read that Blum Blum Shub is a CSPRNG, defined by x_n+1 = x_n^2 mod M. I didn't understand that, and couldn't find any sources on how big should M be.
Are 32 bits enough? 64 bits? Or are even more bits required?


texts: Why is the polynomial of an LFSR called so?

texts:
As far as I understand, the "polynomial" of the LFSR tells us the positions of the register where taps are situated.

However, the natural way to look at the positions would be to think of them as $x_1, x_2, x_3,\cdots$. But we instead identify them as powers of something and call them $x, x^2, x^3, \cdots$

My question is, what are they powers of? And why do we add a 1 to the polynomial?


texts: Affine Cipher: what to do if the number isnt invertible over mod n?

texts:
I am currently solving a simple cryptanalysis problem where I need to decrypt a text file using frequency analysis. The text has been encrypted using an affine cipher over a 68 character alphabet which includes lower and upper case English letters, digits from 0 to 1, as well as those characters: ". , ; : _ \n" where _ denotes space.
Going over the frequency histogram of the text, the most frequent character is "," followed by "z". According to what I know, the most frequent character for the 68 character alphabet is space followed by "e".
Thus I end up with those two equations:
$$66a + b = 63 \bmod 68$$
$$4a + b = 25 \bmod 68$$
Which gives me:
$$62a = 38 \bmod 68$$
$a = 38 \cdot 62^{-1}  \bmod 68$
However, 62 isn't invertible mod 68. I am quite new to cryptography so I am quite unsure if there is some method to solve this issue.


texts:
I am an amateur teaching myself, so please don't expect too much professional knowledge. I have some things that are not clear to me about salts.

For example I wondered if a "too strong" salt could weaken a crypto hash.

If you got an hash algo and you take a password of only one digit and then you fill the rest of the string with a salt til the maximum length of the hash is reached; example: the hash has 128 bit, the pass has 4bit (one ascii char) and the salt has 124 bit and salt and pass are merged together; Would the extreamly strong salt weaken the hash? If the hash got iterated (rehashed)  with the same salt lets say 100-200 times how much of the final result would be "corrupted" by the salt?
Why does a salt need to be long in file encryption?

This question is not related to Databases with thousands of hashed passes for obvious reasons. I saw people suggestiong a min. slat of 128 bits (32 digits!)

Let's say you have a 20 GB veracrypt container ore some stuff like that (does not matter as long as it is only one file). And you want to protect from rainbow tables and precomputation attacks, then why not use a 1 charakter long salt? I mean nobody will generate a RT for a single hash so 1 digit salt = problem solved right? (as long as there are not multiple files).
Why does a salt need to be true random?

Would it not be enough if the salt is pseudo random? It is not even a secret value, so does it have to be random? If it was pseudo random like lets say time in milliseconds then why is that not safe enough? even if the attacker would know the pttern of how the salts where generated, he would not have any advantage right? Like abcd1, abcd2, abcd3, abcd4. Why would that knowledge be an advantage?


texts: Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?

texts:
We have a multiplicative cyclic group $G$ which is a subgroup of $(\mathbb{Z}/n\mathbb{Z})∗$. There are two parties, Alice and Bob:

If:

Alice knows: $b$ and $x$ such that $x^x = b$;
Bob knows: $b$.

Then what's the easiest non-interactive way Alice can prove to Bob the knowledge of $x$ without leaking $x$?


texts: How do I recover RSA primes from the modulus and the coefficient?

texts:
The RSA private key contains 2 primes (of about 4096 bits each), and I only know their product (called modulus) and the modular inverse (called coefficient).

How do I recover the RSA primes from the modulus and the coefficient, i.e. how do I implement get_primes below?

def get_modulus_and_coefficient(prime1, prime2):
  assert prime1 > prime2
  coefficient = modinv(prime2, prime1)  # Modular inverse of prime2 modulo prime1.
  assert coefficient * prime2 % prime1 == 1
  modulus = prime1 * prime2
  return modulus, coefficient

def get_primes(modulus, coefficient):
  ... prime1, prime2 = ...
  assert get_modulus_and_coefficient(prime1, prime2) == (modulus, coefficient)
  return prime1, prime2

Is there a well known-recovery method published for this?

FYI This question is different from https://crypto.stackexchange.com/a/25910 . The other question asks for recovery of the primes $p_1$ and $p_2$ from $n$, $e$, $d$. This question asks for recovery of the primes $p_1$ and $p_2$ from $n$ and $q_\mathrm{inv}=p_2^{-1}\mod p_1$. The answer for the other question doesn't help at all with this question.


texts: Capital passphrases with rainbow tables?

texts:
I'm currently trying to learn how rainbow tables work for a personal project of mine, but I am a little bit confused on how passphrases can be found. Here are the steps that seem do this, from the sources I have looked up online:

Take words, in this case passphrases, and hash them using a hash function
Reduce the hash, possibly to the first 5 characters
Repeat that possibly 100,000 times.
Keep the original "passphrase" and the last hash and store it
Repeat that for a certain amount of words/passphrases
For a given hash with an unknown plaintext passphrase, check if any of the hashes stored matches, if it does, start from the stored plaintext passphrase and keep hashing until you reach the passphrase hash (the one given without a plain text passphrase) and you're done. If the given hash (the one given without a plain text passphrase) does not match with any of the stored hashes, reduce the hash to 5 characters, rehash and try again.

If I got anything wrong or mixed up, clarification would be EXTREMELY appreciated. My question is how can rainbow tables find plain text passphrases, such as Password123, with a capital letter along with lowercase letters; since from my understanding hashes would look something like cb27b615a8a4e29fdf3e7c52cb09e5ef, with either all uppercase or lowercase letters? Thanks!


texts: argon2i hashes with GPU using JTR or any other tool please help!

texts: I have been working on an assignment to solve argon2i hashes but unfortunately. I am not able to use GPU with JTR i.e. no opencl mode for argon2. Thus the speed is very slow. Any suggestion how to proceed using GPU based attack?


texts: Is the HNF basis the worst basis for a lattice?

texts:
I am researching lattice problems and some methods for solving them. I read some books that mentioned Babai's algorithm for finding the Closest Vector Problem (CVP) cannot be successful with a "bad" basis for a lattice.

Which begs a question: what is the worst basis for a lattice?

Is the HNF basis the worst basis for finding CVP in a lattice?


texts: LFSR: finding the period for an irreducible Polynomial

texts:
From what I understand an LFSR produces a maximal length sequence if its characteristic  polynomial $p(x)$ of degree $n$ is irreducible, i.e. if it cannot be factored and the smallest integer $k$ for which $p(x)$ divides $x^k – 1$ is $2^n – 1.$

I understand $2^n -1$ has to do with the period, but how is it calculated whether the polynomial is irreducible? Thank you.


texts: Is it hard to determine whether a given matrix is the square of another matrix?

texts:
Given a matrix $A\in M_d(\mathbb Z_N)$, is it hard to determine whether there exists another matrix $B\in M_d(\mathbb Z_N)$ such that $A=B^2\bmod N$? Suppose the factorization of $N$ is unknown and intractable.

More generally, how to find $B=\sqrt{A}\bmod N$ for given matrix $A$ such that $B=A^TA$?


texts: What is the significance of i^Q mod P = 1 and are there any special properties to be aware of?

texts:
I'm studying UProve, and one of the fundamental components of this technology is based upon the relationship between

  i^Q mod P = 1

Lacking a specific name I can call this mathematical relationship, where can I learn more about this equation?

I've heard that not only will the equation equal one, but there are instances it may equal P.

PS - I'm not sure how to tag this so your feedback is welcome, or let me know if this is better on the math.SE


texts: Number of bits specified in standards implementation?

texts:
Currently deployed RSA and discrete logarithm implementation uses $1024$ to $2048$ bits.

Hypothetically speaking if a crypto team produces a faster algorithm that moves current factoring and discrete logarithm capability to say $8192$ bits (four times today's recommendations) is there any provisions in the standard to increase the implementation to beyond $8192$ bits?

Can corporations and banks solve the issue in a matter of days?


texts:
I'm looking at using the XXTEA algorithm to encrypt a small amount of data (say, less than 32KB) in the context of a software licensing algorithm. That is, we wish to make it difficult (not impossible) for our customers to forge (encrypted) license files of their own.

Our intent is that our software will read the encrypted license file when it starts up. It will decrypt it with a key that is embedded in the executable. The license file will be read from disk and decrypted. The results of the decryption are then copied into a set of C language structures that contain licensing information.

We are looking to create something that prevents casual attempts to defeat the licensing mechanism. We are not trying to create a system that stands up to someone willing to invest a significant amount of time and effort in defeating the system.

The encrypting algorithm I'd like to use is XXTEA, using the "clarified" code from the bottom of the XXTEA Wikipedia page without modification: http://en.wikipedia.org/wiki/XXTEA

Our Intellectual Property lawyer is questioning this decision. He claims that the algorithm is weak and that we should find a better one. I disagree, since there are other, simpler ways to defeat the licensing mechanism than launching a cryptographic attack on the license file data.

However, I'm not a cryptographer and so I don't know how to interpret statements like these:

  XXTEA is vulnerable to a chosen-plaintext attack requiring 2**59 queries and negligible work. See cryptanalysis below.

and

  However, due to the incomplete nature of the round function, two large
  ciphertexts of 53 or more 32-bit words identical in all but 12 words
  can be found by a simple brute-force collision search requiring
  2*(96−N) memory, 2*N time and 2*N+2*(96−N) chosen plaintexts, in
  other words with a total time*memory complexity of 296, which is
  actually 2**(wordsize*fullcycles/2) for any such cipher. It is
  currently unknown if such partial collisions pose any threat to the
  security of the cipher. Eight full cycles would raise the bar for such
  collision search above complexity of parallel brute-force attacks.

I would be grateful for any advice on the vulnerabilities and/or reasonableness of what we are proposing to do.


texts: How feasible is word-level frequency analysis over English (or any language)?

texts:
Say I have some black box which, given any English word, deterministically outputs a token for that word. Assume our black box is implemented using strong cryptography, i.e. the hardness of reversing a token to its word is reducible to some known assumption.

Now, assume I have a document corpus where a document is some list of English words. I run every word in every document through my black box and create a new document set of tokenized documents. I then give the documents to some attacker who then carries out a ciphertext-only attack to try to guess what the documents say.

I'm curious as to how successful this attacker will be in recovering partial information about the documents. He'll try to use statistical attacks to fit the frequency curve of the tokens to the frequency curve of English words. This will allow him to guess the preimages of more frequent words with high confidence, but will he be able to guess less frequently-used words? Are there more advanced attacks he could use?


texts: Why does WPA2-PSK use 4-way handshake instead of 2-way handshake

texts:
I don't seem to grasp why is the handshake for PTK in WPA2-PSK 4-way and not 2-way. Isn't it enough to just have these two steps:

First party sends Nonce1 to the other party
Second party sends to first party Nonce2 and the HMAC(Nonce1, Nonce2, other parameters) using KCK.

I don't understand why does first party have to confirm that it received the nonce and that it knows the shared secret.
In fact, even HMAC(Nonce1, Nonce2, etc.) computation is not extremely necessary. Or is it? I mean even if they don't share the same secret, they wouldn't be able to read each other's messages. Of course, communication wouldn't happen, but there's no information leakage either. Or is there?


texts: Security proof of FO(Fujisaki-Okamoto) hybrid encryption

texts:
The proof of FO hybrid encryption is hard to understand. $\:$ Especially, how does the challenger

respond to the decryption queries when the challenger can only have some encryption queries?


texts: Security considerations on "expand 32-byte k"-magic number in the Salsa20 family of stream ciphers?

texts:
I'm currently examining the NaCl library written by Daniel J. Bernstein and I noticed that the library hard codes the sigma:

static const unsigned char sigma[16] = "expand 32-byte k";

In all the salsa stream implementations:

crypto_stream_xsalsa20
crypto_stream_salsa20
crypto_stream_salsa2012
crypto_stream_salsa208

and the crypto_box library wrapper:

static const unsigned char sigma[16] = "expand 32-byte k";
static const unsigned char n[16] = {0};

int crypto_box_beforenm(
  unsigned char *k,
  const unsigned char *pk,
  const unsigned char *sk
)
{
  unsigned char s[32];
  crypto_scalarmult_curve25519(s,sk,pk);
  return crypto_core_hsalsa20(k,n,s,sigma);
}

As far as I understand from the paper the constant is used to expand the Stream Cipher.

Now:

Why is this variable hardcoded in the library?
Would it make sense to change this magic string to a different value?
Edit: What are the security considerations of using the sigma as provided in the library?

Implementations can be found in the files:

crypto_box/curve25519xsalsa20poly1305/ref/before.c
crypto_stream/salsa2012/ref/xor.c
crypto_stream/salsa2012/ref/stream.c
crypto_stream/salsa20/ref/xor.c
crypto_stream/salsa20/ref/stream.c
crypto_stream/salsa208/ref/xor.c
crypto_stream/salsa208/ref/stream.c
crypto_stream/xsalsa20/ref/xor.c
crypto_stream/xsalsa20/ref/stream.c

Edit: I found the reference to this constant in the paper referenced above as "Salsa20" constant:

  (x0; x5; x10; x15) = (0x61707865; 0x3320646e; 0x79622d32; 0x6b206574);
  in other words, (x0; x5; x10; x15) is the Salsa20 constant.

which is "expand 32-byte k" considering endianness.


texts: What is a 'secret key factory'? What precisely is it doing?

texts:
I have found a Java implementation of AES CBC mode that runs in Netbeans. The lines below appear to create the key from password and salt:

SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
KeySpec spec = new PBEKeySpec(password.toCharArray(), salt.getBytes(), 65536, 128);
SecretKey tmp = factory.generateSecret(spec);
SecretKey secret = new SecretKeySpec(tmp.getEncoded(), "AES");

The key produced looks strange, here's an example:

secret key : javax.crypto.spec.SecretKeySpec@fffe8a18

I would expect 128 bit key like fffe8a1829ac45ed  If I enter such key of my own making the program crashes.

I would appreciate an idiot's guide as to what is going on.


texts: Does Terra Quantum AG break AES and Hash Algorithms?

texts:
According to this Bloomberg article:

A Swiss Company Says It Found Weakness That Imperils Encryption
Terra Quantum AG has a team of about 80 quantum physicists, cryptographers and mathematicians, who are based in Switzerland, Russia, Finland and the U.S. “What currently is viewed as being post-quantum secure is not post-quantum secure,” said Markus Pflitsch, chief executive officer and founder of Terra Quantum, in an interview. “We can show and have proven that it isn’t secure and is hackable.”
The company said that its research found vulnerabilities that affect symmetric encryption ciphers, including the Advanced Encryption Standard, or AES, which is widely used to secure data transmitted over the internet and to encrypt files. Using a method known as quantum annealing, the company said its research found that even the strongest versions of AES encryption may be decipherable by quantum computers that could be available in a few years from now.
Vinokur said in an interview that Terra Quantum’s team made the discovery after figuring out how to invert what’s called a “hash function,” a mathematical algorithm that converts a message or portion of data into a numerical value.

We have already had limitations due to Grover's Algorithm that are asymptotically optimal. Are we going to have another snake oil sale like Treadwell Stanton DuPont?

Update: It turns out a product advertisement that we don't buy it!

Businesswire: Terra Quantum Makes Electronically Transmitted Communications Unbreakable After Revealing Weakness in ‘post-quantum Cryptography


texts: AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

texts:
I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is basically (enc-)decrypted separately from one another, using their individual (randomly generated) IV and Tag:

The encryption process of such segment is done as follows:

While decryption & auth would be carried out as such:

So let me explain my dilemma.

I'm trying to optimize the situation when one of those segments (pictured above) is deleted. The head-on approach would be to zero it out on disk. But, for the purpose of optimization, I was thinking to delete only its IV and Tag, thus hoping to make decryption of that segment's data computationally infeasible. But this brings up two points:

IV size of 12 bytes seems kinda low for that. I know that that is the default size of the IV for AES-GCM. But would I benefit in this scenario if I increase the IV size to 32 bytes? So that way if I remove a 256-bit IV, will it render the encrypted data "safe to discard"?
Tag itself. Is it used for decryption or just for authentication? In other words if I clear it out for my purpose of discarding the encrypted data, will it even matter. I was playing with the actual function that does AES-GCM decryption (implemented using Crypto++ function named CryptoPP::GCM<CryptoPP::AES>::Decryption::DecryptAndVerify()) and it seems to return different plaintext if I alter the tag, but I'm not 100% sure about it.


texts: Practical attack on an impractical implementation of Rijndael (AES?)

texts:
My understanding of the cryptanalysis of AES, is based on what I've read on Wikipedia and my intuition, I have nothing but self-taught education on the subject.

So I want you to imagine: I have only TWO blocks of 128-bit cipher text.

The input was 256bits, we did not use any padding, we also ignored IVs and Salts, when implementing our "demonstration of Rijndael". Finally and most importantly, the two blocks of cipher text, are different by just one bit (in an arbitrary space), however: When presented with the two 128-bit blocks (and just a 128-bit key, both in same), we can come under two conditions:

Condition one:
We know none of the weaknesses and similar plain-texts in these two blocks, I just mentioned, how easily could we discover it?

Condition two:
We know everything I just mentioned above, apart from which bit is flipped and what the two plain texts and the key (let's keep it simple and make the key, only 128 bits). Can we discover much here? How do we go about it?

I said in the title, this is about "practical attacks", I don't know if even with all these conditions knowingly been met, there is much we can do, however since we've used Rijndael, so grossly incorrectly, I assume we're on our way to be able to deduce some information... In which of either, both or none, does an "attacker" learn anything about these two blocks, they weren't told?


texts: Can any block cipher in CTR mode be used as a CSPRNG?

texts:
I have been learning about block ciphers, modes of operations, and csprngs by myself for a few days and there are some things I'm unsure about.

Assuming we only talk about cryptographically secure block ciphers; can any block cipher in CTR mode be used as a CSPRNG? Or are there specifc characteristics a block cipher should have to be used as such?
Can such a CSPRNG be used to produce key material, or do I have to specifically use a key generation/derivation algorithm for that purpose?


texts: What key exchange do OpenSSL and CryptoAPI prefer by default?

texts:
Here is what I know.

When I connect to a brand-new Linux Web server with Chrome and click the "lock" icon, the key exchange algorithm is described as "ECDHE_RSA". (Yes I know what that is.)

When I connect with Internet Explorer 8 on Windows 7, the key exchange is described as "RSA with 2048 bit exchange". I know what that is, too.

With Firefox, it says I am secured by "AES-256, 256 bit keys". Which is (a) redundant and (b) tells me nothing about the key exchange algorithm.

When I run openssl ciphers on my brand-new Linux machine, the output starts with:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:...

(I suspect these are listed in order of OpenSSL's preference, but I do not know where this is documented.)

ECDHE stands for "elliptic curve Diffie-Hellman, ephemeral". That's great, but I want to know the actual key exchange algorithm, including the specific elliptic curve.

Here is what I really want: A big table, containing all possible pairs of SSL client and server (all versions), telling me what specific key exchange algorithm (including the actual elliptic curve) would be negotiated between them. Or enough information to construct that table.

I would settle for simply knowing how the latest versions of OpenSSL and CryptoAPI behave by default, and where this is documented.


texts: How to construct a zero-knowledge proof of a number of the form $n=p^a q^b$

texts:
Let $n = p^a$$q^b$ where p and q are distinct primes and a and b are positive integers. How to construct a zero knowledge proof that n is of such form?

This is actually a homework problem with a hint that if a $n = p^a$$q^b$ then exactly half of the elements in $Z_n$ with jacobi symbol +1 are quadratic residues mod n and we assume that initially verifier knows a quadratic non-residue x with jacobi symbol +1.

I stuck there because it seems extremely difficult to convince Verifier that n is of given form. It is not simply like after Verfier sends a challenge number to Prover and Prover shows that he knows the fact that if the challenge number is QNR or QR. For me to convince Verfier all jacobi +1 elements have to be generated in $Z_n$ and Prover has show that exactly half of them are QR. (Assume that Verifier can generate with x itself thus it does not violate Zero knowledge. But I am not sure if it is easy(polynomial time consuming) to generate all Jacobi +1 elements yet. Well it is true that if we let $z = r^2$ for a randomly picked r from $Z_n$ then $y = r^2x$ is also a QNR with jacobi symbol +1... So finding another QNR with jacobi symbol +1 is easy for verifier... ) But To show "exactly half" then Prover will need to show which one is QR and which is are QNR then it will violate Zero knowledge property since V is not suppose know that. But any other way to show "exactly half"?

Any hint or help is greatly appreciated. Thanks!


texts: Reason(s) for using a KDF for encryption keys

texts:
Assuming I already have a 256-key (32 char password) for AES encryption, comprised of random alpha-numeric characters and punctuation (95 possible ascii chars), generated by a decent PRNG, is there any reason to use a KDF to convert this into another key of the same length?  Is a derivative hash in some way stronger?

Obviously if a password was shorter than the intended key-length, or if the password was predictable (ie, memorizable), I can see how a KDF would be useful. But given the above circumstances, I reason that a KDF (like BCrypt of PBKDF2) would actually reduce the character-range of the key (to 64 chars in bcrypt, and 16 chars in PBKDF2), effectively increasing the chance of a brute-force attack (however unlikely).  Any insights?


texts:
I have seen this question on MD5 replacement for 128 bit digests. It is said numerous times that having a 128 bit digest is impossible today because finding a collision would only require $2^{64}$ operations, which is in the means of big organisations nowadays. However, I think that these answers miss a fairly important point.
The time to bruteforce a hash function does not only depend on the number of security bits of its digest, but it also depends on the time needed to compute a single hash. This is why slow hashing functions such as bcrypt (184 bit) can afford to have a shorter digest size compared to fast hashing ones such as SHA-256 (256 bit).
In this case, would it not be possible to have a collision-resistant 128-bit slow-hashing function to replace MD5?
Thank you for your help.


texts: Shannon entropy of string, not same in Binary form? But just as good as a password?

texts:
This string, "Au+u1hvsvJeEXxky" has a Shannon entropy of 3.75 and a length of 16.

The binary form of the string ( derived from Ascii-table ) is:

01000001 01110101 00101011 01110101 00110001 01101000 01110110 01110011 01110110 01001010 01100101 01000101 01011000 01111000 01101011 01111001

This string has a Shannon entropy of 1.39 and a length of 128.

So while both strings are interchangeable, their entropy differs. Why is
that? And are both strings evenly strong in resisting a brute force guessing attack?

thnx.


texts: Find the generators of multiplicative group of units efficiently?

texts:
Say you're give some prime numbers $p_{1},p_{2},p_{3}, p = 2p_{1}p_{2}p_{3} + 1$ (which is assumed to be also prime) and a list of numbers $L$ and you're asked to find the generators of the multiplicative group of units of $Z_p$.

What would be an efficient way to do so?

This question comes from a cryptography course so that the prime numbers are really big and also the list of numbers is formed by big numbers so that I'm having trouble to apply this kind of method.


texts:
As far as I know QKD needs a quantum channel to send the photons. If anyone measures the photons they are useless.

It sounds as if Alice needs a fiber optic cable all the way to Bob - or at least line-of-sight to Bob. So no wifi through walls.

One of the things that really makes the internet work is packet switching done in routers. If every sender would need a cable to every receiver then the internet would never have been such a success.

How would you build routers that can route photons from Alice to Bob for QKD? Will they work, if Bob is using his tablet under a blanket on a cruise in the middle of the ocean?

Background

I have attended a few talks on quantum computing breaking currently used asymmetric ciphers. Usually the presenter then mentions that quantum encryption will solve this. The presenter mentions this as if we can use the existing infrastructure, which I feel certain is wrong. So I am wondering if I am missing some obvious way to be able roll out QKD to every computer.


texts:
Given a standard LCG output, let's say 3 consecutive numbers, I'm wondering how I could get $a$ and $c$ if I already know $m$

LCG formula:

Sn+1 = ( aSn + c ) mod m

I've seen this posted in a lot of places but no one is really giving a math explanation I could understand.