texts: A question about fully homomorphic SIMD operations

texts:
I'm going through Gentry, Halevi and Smart's paper "Fully Homomorphic Encryption with Polylog Overhead" and have a question about the permutation operations.

Background:

The cyclotomic polynomial can be factored modulo $ p $, i.e. $\Phi_m(X)=\Pi_{i=0}^{l-1}F_i(X)\mod{p}$. According to CRT (Chinese Remainder Theorem), we have $ \mathbb{Z}_p[X]/(\Phi_m(X))\cong \mathbb{Z}_p[X]/(F_0(X))\times\cdots\times\mathbb{Z}_p[X]/(F_{l-1}(X)) $.

If I have a message vector $ (m_0(X),m_1(X),...,m_{l-1}(X)) $ where $ m_i(X)\in\mathbb{Z}_p[X]/(F_i(X))$, then I can get the aggregate message $ m(X) $ which satisfies $ m(X)\mod({F_i(X)},p)=m_i(X) $.

In this paper, they argue that by simply replacing $ X $ with $ X^i $ inside $ m(X) $, for some exponent $ i\in\mathbb{Z}^*_m $, we can obtain a new message $ m(X^i)$.

On the end of 11th page:

  But how does this new aggregate plaintext $ m(X^i) $ relate to the
  original $ m(X) $? Here we apply to Galois theory, which tells us that
  decoding the aggregate $ m(X^i) $(which we do roughly by setting $
> z_j(X)\leftarrow m(X^i)\mod{(F_j(X),p)} $), the set of $ z_j(X) $'s
  that we get is exactly the same as when decoding the original
  aggregate $ m(X) $, albeit in different order.

I tried to find out some specific examples to prove this, but failed. I find that the $ (z_0(X),...,z_{l-1}(X)) $ is exactly reordered, but $ z_j(X) $ corresponds to $ m_k(X^i) $ rather than $ m_k(X) $.

Example:

$ \Phi_{31}(x)=(1+x^2+x^5)(1+x^3+x^5)(1+x+x^2+x^3+x^5)(1+x+x^2+x^4+x^5)(1+x+x^3+x^4+x^5)(1+x^2+x^3+x^4+x^5)\mod{2} $.

Suppose the message vector is $ (m_0(x),m_1(x),m_2(x),m_3(x),m_4(x),m_5(x))=(1+x, 2+x, 3+x, 4+x, 5+x, 6+x) $, its corresponding aggregate message $ m(x) $ is $ x^2 + x^4 + x^7 + x^8 + x^{11} + x^{13} + x^{14} + x^{16} + x^{19} + x^{21} + x^{22} + x^{25} + x^{26} + x^{28} $.

Then replacing $ x $ by $ x^6 $, we have $ m(x^6)=x + x^2 + x^3 + x^4 + x^8 + x^{11} + x^{12} + x^{13} + x^{16} + x^{17} + x^{21} + x^{22} + x^{24} + x^{26} $.

$ m(x^6)\mod{(1+x^2+x^5)}=x+x^3=m_5(x^6) $

$ m(x^6)\mod{(1+x^3+x^5)}=1+x+x^4=m_0(x^6) $

$ m(x^6)\mod{(1+x+x^2+x^3+x^5)}=1+x+x^2+x^3+x^4=m_2(x^6) $

$ m(x^6)\mod{(1+x+x^2+x^4+x^5)}=1+x^3+x^4=m_3(x^6) $

$ m(x^6)\mod{(1+x+x^3+x^4+x^5)}=x^2+x^3=m_4(x^6) $

$ m(x^6)\mod{(1+x^2+x^3+x^4+x^5)}=1+x+x^2=m_1(x^6) $


texts: RSA 1024 bit forge a new matching signature from a chosen message

texts:
I have an RSA signature scheme with 1024-bit key where I know the following:

Public modulus $N$
Public exponent $e=3$
A lot of signatures

Summary:

To compute a signature, an MD5 hash is calculated from a collection of byte and the textbook RSA private key function is applied to that. The verification procedure for a signature $S$ is to check that $S^e\bmod N$ is the MD5 hash of the alleged message.

Our teacher give us more than one signature.

Question:

Can someone give advice to find a practical way to find a new matching signature from a chosen message?


texts: Do I need two keys for AES CBC and HMAC or can I use the same key for both operations?

texts:
I am setting up a Python program to encipher messages on the following basis:

-from my password, generate 32-byte key from SHA256(password)

-generate a 16-byte IV from a PRNG

-measure the length of the plaintext and express as 2 bytes (my plaintext will be shorter than 2^16 characters)

-pad the plaintext to be a multiple of 16 bytes

-make an instance of the encryptor = AES.new(key, CBC, IV)

-generate ciphertext = encryptor.encrypt(plaintext)

-make string of concatenated  length pt before padding||IV||ciphertext and send to recipient

-also send to recipient the tag from    HMAC(key,concatenated string)

My question is whether for security I should use a different key for the AES encryption and for the HMAC tagging?

This seems to me unnecessary, in the sense that with a strong password the chance of finding the key by reverse engineering either the ciphertext or the tag is negligible. Or is it?


texts: Say I use AES. If I insert the message the way the key normally is used and vice-versa, would this be equivalent secure to the intended encryption?


texts: Is it possible to calculate the random factor $r$ from a encrypted message and the private key in a Paillier cryptosystem?

texts:
I have already done my research and found various sources that state that it is possible but there are also a lot of them that says it is not possible to recover $r$. This Q/A on this site for example even states the formula to get it. I don't know if it is wrong or I am missing something since I was not able to make a working implementation of it.

Some friends told me it is impossible to get $r$ back since it was raised during encryption to the $n$-th power and ended up in a smaller subgroup which results in a loss of information that renders it unable to be recovered.

I asked on reddit and got told the following:

$r$ is choosen to be between 0 and $n^2$. The plaintext can be between $0$ and $n$. The Ciphertext is however also between $0$ and $n^2$. Since the plaintext is fully preserved, the same is impossible for the randomness, as this would otherwise violate the theorem that lossless compression is impossible.

I would like to know whether it is possible to calculate $r$ and how it is computed given that I have:

$C \to$ ciphertext
$P \to$ plaintext
$N \to$ public key modulo $(p\cdot q)$

Also if it is not possible for all $r$ values to be recovered I would like to know if it would be possible to recover $r$ values smaller than $m$ bits (I know that reducing $r$ bit length makes the encryption less secure)


texts: I need to send an Excel file to someone, normally I would use encrypted e-mail, however, this is not an option with this individual. What is the minimum length password I can apply to this file to get a decent level of protection and is there a way to mathematically compute the strength of a password?


texts: Are hardware encryption chips safer than their software counterparts for desktop apps?

texts:
Wouldn't accessing the hardware encryption chip be safer than relying on an encryption library?

My question is prompted as a response to @SqueamishOssifrage replying on the "Properly securing a private key for remote storage" post, item #6 (I don't have enough points to reply to their comment).

Quote:

  it takes a lot of effort to audit your software stack well enough to guarantee it is reliably using the hardware AES support on all
  platforms that may be of interest to you.

If my desktop application is signed, wouldn't it be safer to use the chip?

Clarification based on answer received

yeah I'm basically looking for a secure solution to storing private keys. Your point #2, storing the key in the chip where the key never sees the light of day seems like the obvious solution. Thinking through what to do for potential problems (supporting different chips, a new vulnerability being found, etc.) makes that impractical for a small-time developer. At this point, implementing a software solution where keys perhaps are signed by multiple remote servers seems the way to go (you may compromise one remote server but can you compromise them all?). If there's a better design pattern than that, I would be interested in pursuing that. As it is, I don't trust a software implementation on a single computer to do it.


texts: What do $0^n$ and $1^n$ mean in cryptography?

texts:
Let $f$ = $\{f_k\}$ be a pseudorandom function family.
Let $G(x)$ be a pseudo-random generator such that:
$G(x) = f_x(0^k)f_x(1^k)$ where $k=|x|$.

I don't understand the meaning of $1^n$  and $0^n$, and the differences between them, in that context.
What do they represent?
What is the special role / effect they have on the above context? And how?
Why $1^n$ and $0^n$, and not other combinations?


texts:
I have some questions about the Hill cipher.

There is a rule for key K:
Determinant of matrix and number of characters of the alphabet must be coprime. What does this rule say? Why it must be like this? So If I had determinant 5 and characters 30, it would not work?

Let's assume I have key K which should be 3x3. I would get the key: ENCRYPT. I would create trigrams like ENC RYP T?? - now the last trigraph is missing two characters. Should this input key be REFUSED by application for example or should I fill it with some values like #?(# alphabet must contain this char). Or how should the application behave when this happens?

Let's assume I have plain text T which is: textabcd - again the same question (as 2.). I have TEX TAB CD? - (should I again insert something in that empty space (?) (for instance #) ?

Should HILL cipher accept MATRICES (input as matrices) or as alphabet key like ABCD?


texts: Zero-knowledge proof for Paillier parameters

texts: For RSA one can give a non-interactive zero-knowledge proof that RSA with parameters $(e,N)$ form a permutation and a proof of knowledge of the associated RSA secret key. For example, such a proof can be given using Poupard and Stern. I was wondering whether there exists a similar proof for Paillier. In a sense that to prove that the parameters are valid, and that one posses the associated Paillier secret key. Any ideas?


texts:
I am writing an exercise in cryptography about anonymous communication. One of the systems I have looked into is the mix net protocol. I want to prove that this is secure. I have seen many different ways of doing this, i.e. using a zero knowledge proof, but I don´t completely understand this.

Is there anyone who has a good explanation of why the mix net is secure?


texts: Why AES based encryption is not recommended for encrypting images with high redundancy in their content? for example, the encryption of an image which shows a bird in the blue sky. Most of the pixels are blue in that case.


texts: How many polynomials are used in Secure Multiparty Computation?

texts:
Secure Multiparty Computation based on Samir Secret sharing methods rely on Polynomials. Imagine corpus of data should be outsourced to bunch of untrusted servers for any computations. Now the data could be split by a trusted client using Secret Sharing and distributed among the multiple untrusted servers. Subsequently any operations on the data could done using Secure Multiparty Computation protocols such that no single untrusted server has access to complete data in clear.

If the corpus of data are confidential documents and the client tokenizes them into each word then secret shares those words into say three shares. Distribute them to three untrusted servers. So that subsequently the client could search the documents for keyword using some SMC protocol.

Should the client use different polynomials for each word (or collection of words) or same polynomial could be used for entire corpus of document

Precisely,

If same polynomial is used for secret sharing all the words then searching the corpus with the share of keyword would be easy. But then the secret shares of each word would be pretty deterministic and frequency analysis could be launched to identify the words.
If different polynomial is used then how is the search for keywords work on the entire corpus ?

The same might hold good not only for search , for any other operation including arithmetic. Any help ?


texts: Extractor for Oblivious Transfer Protocol

texts:
In a paper that I have been reading (https://cs.nyu.edu/~ganesh/zk.pdf), in one of the proofs, this has been said:

  The simulator works as follows: It uses the OT simulator to extract the prover’s input $x_0$ to the OT.

How exactly does this work? There's nothing defined in the paper itself, and I couldn't find anything related to an extractor for an oblivious transfer protocol. (The paper also uses extractors for ZKPOK, but that has been defined)


texts:
I have a library which implements AES GCM algorithm. However, as you know even a single nonce reuse can have catastrophic results.
As we can't guarantee a unique IV every time, I would like to run the SIV (Synthetic Initialization Vector) on the nonce every time.
I want to implement the SIV outside of the AES GCM. As, I am not a fan of mathematics, I really find it hard to understand the AES-GCM-SIV spec.
However, I can't find any sample implementation of the SIV anywhere. Can you please kindly help me in understanding and in implementation of SIV?


texts: What is the purpose of update() in popular hash APIs?

texts:
E.g., in Python's hashlib, update() basically merges in string buffer functionality into the object. Several other digest APIs I've seen have this pattern.

Considering this adds functionality that arguably doesn't belong here, why is this pattern popular?


texts: Text cipher option that can decrypt the same ciphertext to two DIFFERENT and DESIRED outputs given DIFFERENT keys (and/or alphabet)

texts:
I have a pen pal that I discuss with. In our latest discussion it was proposed to write a short message that is ciphered and have the other one find what it is, given some clues.
I would like to ask if its possible to have the same ciphertext that when decrypted with key "his_name" gives a result and if decrypted with key "my_name" gives a different result, but, obviously, I suppose that both results must be constricted to the same number of letters.
I am not versed into computer ciphers or AES or RSA or other mathematical difficulties, so I'd like to ask if there is a possibility to have something that does not involve having to own a piece of software to do hundreds of computations in order to find the cipher.
I was thinking that I can have the same ciphertext that, when used with two different ciphers, offers two distinct messages. If this can be possible, is there a way for me to get the 2nd cipher working after getting a ciphertext from using the 1ts cipher? Like, I use simple caesarian shift and get a ciphertext. Then I have this ciphertext to also be decrypted to whatever text I want to have by juggling with some property of the 2nd cipher?
I was also thinking that I can have two different alphabets for the same ciphertext, as this can be a property of the 2nd cipher. But how can I find the alphabet order for the second message to match deciphering from the ciphertext that resulted from the first message (that can have the normal alphabet)?
I have checked the questions linked below:

Create a ciphertext that decrypt to different plaintexts with different keys in RSA

Ciphertext to different plaintext

Is it possible to get different plaintexts from a single ciphertext using different keys?

From what I understood:

there is such a notion that if I have (text A) and (key A) and the resulting (ciphertext A) and I also have (text B) and (key B) and the resulting (ciphertext B), I can do some operation with [(ciphertext A) and (ciphertext B)] to get (ciphertext C) that, when used with (key A) it'll give me (text A) and when used with (key B) it'll give me (text B)
there is something like a deterministic symmetric encryption that I may use to get a hash for the cipher and then use two different ciphers on the hash, but I may have misunderstood some things here
there might be an option that requires to have a bigger 2x ciphertext that can have its 1st half decoded with the first key and remaining padding, and the 2nd half decoded with the second key and remaining padding

Example:
Key 1 : Adam
Message 1: you are very good you discovered this aaaa
Alphabet 1: ABCDE.....XYZ

Key 2 : Dave
Message 2: this is a secret message harder to find aaa
Alphabet 2: GREPTL......YHX

-> results only 1 ciphertext
Ciphertext: gdeowxiwetzmckdslfproewlqasdcmbrtrw

The "a" at the end of messages is just to have padding up to 35 characters.

For the above example, the other user will only know the resulting ciphertext, the cipher method and the alphabets that were used. So they only have to guess the key to decipher.
Is there such a thing possibile, and relatively trivial to find - for short messages?


texts: Alternatives to FHE for secure function evaluation

texts:
As a followup to a previous question I asked which was more related to Fully Homomorphic Encryption (FHE), what other cryptographic methods are available for computing a private function on public and/or private input? And, what are the benefits/limitations when compared to FHE?

In specific I am interested in Yao's Garbled Circuits construction and a newer publication I recently came across due to Parno et al., which uses functional encryption (aka attribute based encryption). If there are any others, I'd be interested in them too.


texts: Why are RSA key sizes almost always a power of two?

texts: I know that other bit sizes are possible, e.g. this HTTPS server seems to have a 9000 bit key https://www.ssllabs.com/ssltest/analyze.html?d=qqq.gg, but it's very rare that one sees a key not of size 1024, 2048, 4096, etc. bits in common usage - what is the reason for this? Is it just customary, or is there a cryptographic advantage?


texts: How to propagate error in variable-sized message?

texts:
I want to design a scheme to encrypt a variable-length message with a secret key, to provide confidentiality. The message is a short human-readable text string with byte granularity, let's say under 300 bytes. I prefer that the ciphertext is the same length as the plaintext (avoid padding).

Along the way, I also want to support integrity-checking on a best-effort basis. Preferably, I want it so that if any bit of the ciphertext is changed, then the decrypted plaintext will look garbled. (The decrypted output will actually be read by a human, and no automated checking is needed.)

It is not acceptable to append a MAC or any kind of check code due to message size restrictions; valid decryption must be inferred from the garbling of the message itself. CPU time is not a problem as long as it's under 0.1 second. An inefficient but secure scheme is okay, but the scheme should be conceptually simple to describe/audit/implement.

The complicating factor is that the message may be shorter than a block (say 16 bytes, for the AES cipher), which means ciphertext stealing can't be used. (Right?)

I'm aware of these facts already:

Using a stream cipher satisfies the variable-length property but makes the ciphertext very malleable; this is undesirable.
Using a block cipher gives the "decryption garble" property desired.
Using CBC mode instead of ECB will mask repeating patterns in the input.
Ciphertext stealing (for ECB or CBC) makes it possible to not increase the message length - but only if the message is at least one block long.
It's possible to use a keyed hash function / MAC for 3 or 4 rounds to design a custom Feistel network cipher.
It might be possible to use a stream cipher and a bytewise adaptation of the Infinite Garble Extension (IGE) mode to achieve garble propagation.
Designing "home-made" crypto not reviewed by experts is frowned upon and may have subtle and fatal errors.

But I don't know what else I need to know, and how to proceed from here. I can post more details on some of the proposed algorithms (such as IGE and Feistel) if needed.

Addendum:

Feistel network idea: (using Python pseudocode)

Let H(k, m) be a MAC (such as HMAC-SHA-512) with secret key k.
Let M be the message to be encrypted.
Let i = floor(M.length / 2).

Algorithm:
M[0 : i] ^= truncate(H(k, M[i : M.length]))  # left half XOR H(right half)
M[i : M.length] ^= truncate(H(k, M[0 : i]))  # right half XOR H(left half)
M[0 : i] ^= truncate(H(k, M[i : M.length]))  # Round 3 to achieve error propagation
M[i : M.length] ^= truncate(H(k, M[0 : i]))  # Round 4 due to recommendations

(If half the message length is less than the MAC/hash length then truncating is easy. But if it's longer then some kind of stretching, i.e. CSPRNG, is needed.)

Second addendum:

I'm leaning towards this solution:

preprocessed = all-or-nothing-transform(message)
ciphertext = preprocessed XOR (stream cipher keystream)


texts: What's the difference between PBKDF2 and HMAC-SHA256 in security?

texts:
Being a software developer, I haven't dealt with crypto so far. So I know very little, sorry for that already.

I am aware that you should use bcrypt, scrypt, Argon2 or PBKDF2 for generating a hash from a password. However, I have a question about PBKDF2.

DK = PBKDF2(PRF, Password, Salt, c, dkLen)

PBKDF2 uses a pseudorandom function, for example HMAC-SHA256.

What I understand is that PBKDF2 uses HMAC-SHA256 for c iterations. Why not just use HMAC-SHA256 directly?

I know that you should not use SHA256 for passwords because it's basically "too efficient". So, is HMAC-SHA256 way less efficient, and if so why cannot we use it direclty?

Why does PBKDF2 need a PRF?

Perhaps you can explain it so that even I, who has not much to do with crypto stuff, can understand it. ;-)


texts: Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

texts:
I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area.

I'm trying to understand that attack, but every explanation I saw starts with the technical details, without giving some overview, so it's hard to follow...

Can you explain it in a simple words before giving the little details?


texts: How many ring-LWE samples are required for the (Search) Ring Learning With Errors problem to have a unique solution?

texts:
Consider the LWE distribution $\{(\pmb{a}_{i},\left<\pmb{a}_{i} , \pmb{s}\right> + e_{i})\}$ where secret $\pmb{s} \in \mathbb{Z}_{q}^{n}$, randomness is $\pmb{a}_{i} \xleftarrow{\$} \mathbb{Z}_{q}^{n}, e_{i} \xleftarrow{\$} \chi$, $q$ is a prime number and $\chi$ is a discrete Gaussian distribution. Grouping $m$ samples we obtain $(\pmb{A},\pmb{A}\pmb{s}+\pmb{e}) \in \mathbb{Z}_{q}^{m \times n}\times \mathbb{Z}_{q}^{m}$.

We can wonder if the (search) Learning With Errors problem has more than one solution (with bounded error terms). We can compute the probability over the choices of $\pmb{a}_{i}$ of the existance of another $\pmb{s}' \neq \pmb{s}$ such that $\pmb{A}(\pmb{s}-\pmb{s}') = \pmb{e}'-\pmb{e}$ has small norm. If we just want to bound the infinity norm it is easy compute this probability for a particular $\pmb{s}'$ and then do a union bound over all possible $\pmb{s}'$. As a result we get that $m\in\mathcal{O}(n)$ is enough to ensure that the problem has a unique solution except with negligible probability in $n$.

I have also read that Chernoff's bounds could be used to analize these probabilities.

Consider now the ring-LWE distribution, $\{(a_{i},a_{i} \cdot s+e_{i})\}$, where $s \in R_{q} = \mathbb{Z}_{q}[x]/\left<x^n+1\right>$, $a_{i} \xleftarrow{\$} R_{q}$ and $e_{i}\in R_{q}$ is obtained sampling its coefficients from $\chi$.

Since we can think of each ring-LWE sample as $n$ LWE samples I would expect only a constant number of samples to ensure that the problem of recovering $s$ has a unique solution with overwhelming probability. However I do not know how to prove it, since now I cannot use that each $\pmb{a}_i$ was independent, and $R_{q}$ can have divisors of zero.

Is there a general way of obtaining the number of samples required for this condition? Or general applications only require that the problem is hard but never require uniqueness?


texts: Is this transposition cipher information-theoretically secure for 1 message?

texts:
Given:

$m = \{0,1\}^{n}$; a plaintext message of length $n$ encoded in binary

$k = randomshuffle([0, 1, ..., 2n-1])$; A secret key consisting out of unique numbers between 0 and $2n-1$ in a true random order. The key is only used once and preshared between sender and receiver.
We create $t = m||NOT(m)$; a temporary variable with the original message plus the inverse of the original message. (The intention here is to make the number of 1's and 0's equal)
We transpose $t$ using key $k$ as indices to create the ciphertext $c$.

For example, the key 5-4-3-2-1-0 would reverse the order of the bits of $t$.

Full example:

Given: m = 010 and k = 5-4-1-3-0-2
We append the inverse of 010 (which is 101): t = 010101
We tranpose t using k. The resulting ciphertext: c = 101100

To decrypt the ciphertext you would simply reverse the transposition using your key and drop the second half of the message.

Is this scheme unbreakable?


texts: Are RSA and Elgamal partially homomorphic techniques? which one is better if one want to use it for practical purpose? and is there some FHE technique which can be used practically?


texts: Does exponentiation by squaring work on Montgomery curves?

texts: Consider the point multiplication $Q=[d]P$, where $P$ a point on elliptic curve multiplied with an integer $d$ to get another point $Q$ on the same curve. This operation can be computed by a predefined sequence of point additions and point doublings. Is it possible to apply the same technique to Montgomery curves, as group operations in Montgomery form seem simpler than in short Weierstrass form?


texts:
This is in reference to this answer on Stackoverflow. If you read the first paragraph of the answer, you'll find this line:

  It's always a many:1 mapping (meaning there will always be collisions) since every function produces a smaller output than it's capable of inputting (If you feed every possible 1mb file into MD5, you'll get a ton of collisions).

What is this many:1 and what are collisions? Does many:1 mean two different inputs would have the same hash outputs?


texts: The use of Elliptic Curves as part of a blockchain transaction

texts:
As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when assigning a nonce to a hash value with a set number of zeros). Why do we use ECC when validating the initial transaction request, and not when validating the block? Or to flip that around, why not just use Cryptographic hashing in the validating transaction step (and not use ECC at all)? I know hashing is used on the message component during the validating transaction request, so why not use it again for the whole digital signature?

My understanding of blockchain is limited, so upfront apologies for any unclear language!


texts: Which is the best algorithm for large scale file encryption other than AES?

texts:
I've been looking for a fast, powerful and robust algorithm for encrypting large files with authentication .
I would like to implement the algorithm on my own without using third party software. I've used different modes of AES but the software implementation is prone to side channel attacks. Besides the most commonly used AES 256 GCM has an encryption with authentication size limit of 64 GB. I've tried other famous ciphers like Xchacha20/ XSalsa20 with poly1305, but I cant get around their respective size limits (I can only encrypt upto 256 GB with XChaCha20 - Poly1305 - IETF version ) !

Is there a powerful enough cipher other than the above that I can use for large scale encryption with authentication ?
What modifications should I apply to existing algorithms like Xchacha20 / XSalsa20 with Poly1305 for unlimited encryption with authentication?


texts: Is there a downside to encrypting too much data with the same key?

texts:
Is there a downside to encrypting too much data? If so, what?

I'm guessing things like

too much data encrypted with the same key, possibly leaking information due to a collision
encrypting non-essential data, wasting resources

could be a problem, but that's just a hunch, and that's not how we do cryptography.

On the other hand, failing to encrypt some data can leak some very sensitive information, and encrypting everything is an easy way to avoid that.


texts: Homomorphic mapping between elliptic curve point and Zq

texts:
I'm trying to figure out how to do a mapping between elliptic curve points and Zq without breaking homomorphic properties.
Sorry, I'll write the problem in multiplicative notation because it's easier.
I've got $a = g^bh^r \in \mathbb{G}_1$, where $g$ is a generator of $\mathbb{G}_1$, $h = g^s$ and $r, s, b$ are some values from $Z_q$. I need to have a Pedersen commitment to $g^b$, but since $g^b\in \mathbb{G}_1$ I should map it to $Z_q$ with function $F$ first i.e. $c = G^{F(g^b)}H^R$, where $G,H \in \mathbb{G}_1$ is a commitment key and $R$ is randomly selected from $Z_q$.
The point is, I need to relate $a$ and $c$, so I need to find a mapping function F such that
$G^{F(a)} = G^{F(g^b) \cdot F(h^r)}$.
Do you have any idea how to chose $F$ if $\mathbb{G}_1$ is an elliptic curve? Or if it's even possible? In the finite fields, $\bmod q$ would have worked ($q$ is prime). But with points, I'm not sure what to do.  Maybe homomorphic hash functions would work, not sure.


texts: Signature Generation with RSA PKCS#1 v.15

texts:
I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v.15 padding scheme.

Given a message M, the modulus N and the private key D, I need to find the signature S of M. From my understanding, first I need to calculate the hash H of the message N and then create the following sequence of bits:

0x00 | 0x01 | P | 0x00 | S | H

where P is a sequence of OxFF so that this sequence of bits has the same bit length of N, S is the sequence of magic bytes (e.g., for SHA-1 is 0x30 0x21 0x30 0x09 0x06 0x05 0x2b 0x0e 0x03 0x02 0x1a 0x05 0x00 0x04 0x14) and H is the hash of the message M. Then, I can encrypt this sequence with the private key D and the modulus N (power + mod).

Unfortunately, I can't understand how I am supposed to generate the hash H. By using the NIST-generated signature, I can see that the hash code H expected in the message is different from the one I can generate by simply calculating H=sha1(M). Everything else, i.e., the number of bytes in P and the magic code S, is correct. It seems that the message M is manipulated somehow before calculating the corresponding hash code H to be used for the generation of the signature. I checked the documentation but I can't figure out what I am doing wrong.

Thank you so much.


texts: Do there exist cryptographic algorithms where the "core" function is 96-to-32-bit?

texts:
There exists a FOX family of block ciphers (Wikipedia article: IDEA NXT). This cipher uses a function called "f32" which operates on three 32-bit words and outputs one 32-bit word. This function exhibits very high diffusion properties and builds the core of the corresponding variant of the cipher.

Do there exist other cryptographic algorithms that make use of a 96-to-32-bit "core" function (the function is required to be non-linear and exhibit relatively good diffusion)?


texts:
Probability density function of gaussian distribution is
$$ 1/{\sqrt{2 \pi} \sigma}  \times {e^{{(x-c)^2/ 2{\sigma}^2  }}}  $$
in lattices we assume $$ \sigma =s/\sqrt{2 \pi}  $$so the gaussian function becomes
For $$X \in R^n$$ $$\rho_s(X)=1/s^n \times e^{-{\pi}||(x-c||)^2/s^2}$$ but it is given as
$$\rho_s(X)=  e^{-{\pi}||(x-c||)^2/s^2}$$ can you explain why is this difference?


texts:
I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is:

How I will be able to formalize the SHA-1 hash function using keys?
In security proof, which approach could be used - theoretical or practical?


texts: Proving CPA security using a PRG in place of a PRF

texts:
I am stuck on a question involving a security proof. Any Hints on how to approach this is helpful and greatly appreciated.

Question is:

  State whether the following scheme has indistinguishable
  encryptions in the presence of an eavesdropper and whether it is CPA-secure: In this case, the key is random $k\in \{0,1\}^n$.

  To encrypt $m\in \{0,1\}^{n+1}$, pick a random $r\in \{0,1\}^n$, and send $\langle r, G(r)\oplus m\rangle$, where $G$ is a PRG with expansion factor $n+1$.

I think it is CPA- secure, but am having a hard time proving it. My rough idea is, given a PPT adversary A, construct an algorithm D, takes input $w\in \{0,1\}^{n+1}$, with no oracles. But how would D answer queries? Its not like the case where a PRF is used in place of $G$, when D can use its oracle to distinguish a random function from a pseudorandom function.


texts: In CBC, can I use a zero IV and prepend my actual IV to the plaintext?

texts:
I understand that in CBC mode, the IV must be chosen randomly for every use of the same key.

But for practical purposes I would like to easily store the IV alongside the cyphertext.

So I thought of calling the encryption function with a zero IV and prepend my actual IV to the plaintext:

         IV         P1         P2
          │          │          │
          ▼          ▼          ▼
Zero ──▶ XOR   ┌──▶ XOR   ┌──▶ XOR   ┌──▶ ...
          │    │     │    │     │    │
          ▼    │     ▼    │     ▼    │
         AES   │    AES   │    AES   │
          │    │     │    │     │    │
          ├────┘     ├────┘     ├────┘
          ▼          ▼          ▼
         C1         C2         C3

The decryption function can be called with the same constant (zero) IV and then I can just discard the first block_len bytes to recover the plaintext.

Are there any security risks with this approach?


texts:
There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With weak keys I refer to the definition given by Handschuh and Preneel:

  In symmetric cryptology, a class of keys [D] is called a weak key class
  if for the members of that class the algorithm behaves in an unexpected way and if it is easy to detect whether a particular unknown key belongs to this class. For a MAC algorithm, the unexpected behavior  can  be  that the  forgery  probability  for  this  key  is  substantially  larger  than average.

All these papers give suggestions how to avoid weak keys or how to minimize the class of weak keys. However, none of these suggestions have been accepted in the NIST standard. The standard is obviously older than the papers about weak keys, yet AES-GCM is still one of the most accepted algorithms.

Thus, I would like to know if famous applications like TLS or IPSec have implemented a weak keys detection or how do they avoid weak keys? Or is the probability to get a weak key (assumed that one is using secure random number generators) still so so small that the existence of weak keys is negligible?


texts: How to find the encoding of an RSA public key?


texts: Cracking a hash which descends to a single value after repeated hashes

texts:
Assume I have a hash function (such as the one below) and a cipher, and I know that if I repeatedly hash any string over and over again, it will eventually descend to one unique value.

Is there any known way to crack a hash function following this pattern? Does this property lend itself to any exploitable vulnerabilities?

Hash function (in python):

def compute_hash(uinput):
    if len(uinput) > 32: return
    blen = 32
    n = blen - len(uinput) % blen
    if n == 0:
        n = blen
    pad = chr(n)
    ninput = uinput + pad * n
    r = ""
    for i in range(0, blen, 4):
        s = ninput[i:i+4]
        h = 0
        for j in range(len(s)):
            h = (h << 4) + ord(s[j])
            g = h & 4026531840
            if not(g == 0):
                h ^= g >> 24
            h &= ~g
        r += chr(h % 256)
    h = ""
    for c in r:
        h += c.encode("hex")
    return h


texts: How do I produce a stream of secure random numbers from AES-Counter mode?

texts:
I have just made my own program to encipher, using AES in counter mode, and have validated it using NIST data. So I know I have done it properly.

I have read that AES-CTR can produce a stream of random numbers. To achieve this, what do I feed in as the plaintext? Will any text do? Does it matter if the plaintext has repetitions?


texts: algebraic attacks for mixed operations (mod 2 and mod 256)

texts: If a cipher has mixed operations, e.g $\oplus$ (addition mod $2$), and addition modulo $2^8$. How we we going to express them mathematically? Thanks in advance!


texts: Is it hypocritical to use AES-256 and RSA 2048 in the same application?

texts:
I see a common claim that AES-256 is the gold standard and is good future proofing, often in the same wind as "just use 2048-bit keys for RSA". Security documents seem to recommend both AES-256 and 2048-bit RSA keys, and 2048-bit RSA keys are often used in the key exchange for a 256-bit AES key.

I believe:

Using AES-256 is "future-proofing" your system
Using 2048-bit keys in RSA is being practical and not worrying about future-proofing

Is it hypocritical to increase AES to 256-bit keys without increasing the RSA key length?


texts: How can recovered 5-letters plain text help me to recover reused OTP key

texts:
I have 10 cipher texts ciphered with One Time Pad (OTP) using the same key.

I need to recover the key (or in other words, to recover the 11th cipher text which I assumed would require me to recover the key first).

I followed a technique called "Crib Drag" described in: Taking advantage of one-time pad key reuse?
Simply, by XORing the word " the " (including spaces) with the result of (C1 XOR C2), I could recover 5-letters that make sense to me that it is a plain text.

However, I do not know whether this plain text belongs to P1 or P2.

Can you help me how to know if the plain text belongs to P1 or P2 ?
How can I recover the key bytes if I could recover letters from P1 or P2 ?
How can I check whether they belong to P1 or P2 ?

I tried several attempts but no hope. Please, help me to continue and recover the key using this method.


texts: Does seemingly random output imply irreversibility in hash function?

texts:
My question mainly stems from the following observation of properties of cryptographic hash function:

Preimage resistance: Given $H(x)$, it's hard to find $x$
Second preimage resistance: Given $m1$, it's hard to find another $m2$ such that $H(m1)=H(m2)$
Collision resistance: It's hard to find any two distinct messages $m1$, $m2$ such that $H(m1)=H(m2)$.

It is said that property 3 implies property 2 which implies property 1. I can understand if it is hard to find any two distinct messages $m1$ and $m2$ for $H(m1)=H(m2)$ then it will be hard to find a distinct $m2$ for given $m1$ for $H(m1)=H(m2)$ (property 3 implies property 2). And if I have $m1$ and $H(m1)$ then from property 2 I can say it is hard to get $m2$ from $H(m2)$ if $H(m1)=H(m2)$, and as $H(m2)=H(m1)$ it is hard to get $m1$ from $H(m1)$ as well (property 2 implies property 1).

Now my question is if a hash function has this property: for small changes in inputs it outputs such numbers that will seem random so that from output it will be hard to determine changes in input, does it imply any of the above property specially property 1, i.e. irreversibility of cryptographic hash function?

I am asking this because for $m1$ & $m2$ I will get $H(m1)$ & $H(m2)$ respectively and if $H(m1)$ & $H(m2)$ are correlated (not random) and I know $m1$ and $H(m1)$ (prior information) then from changes in output can I know easily changes in input thus know which input produces output? Putting slight differently is it possible to train a hash function from input and output if outputs are not seemingly random so that for given output I will know input?


texts: RSA example-calculation: Public Key = Private Key (e = d)

texts:
I am a bit confused. I just calculated manually the single steps of RSA for an implementation with small numbers and suddenly $d$ was equal $e$. Please help me understand what I am doing wrong.

Here’s my example:

I chose: $q = 7$ and $p = 11$
$N = 77$
$phi(N) = 60$
I chose: $e = 29$
$e \times d + k \times phi(N) = 1 \rightarrow$ Extended Euclidean algorithm
$$k = -14\\
   d = 29$$

Test: $29 \times 29 + (-14) \times 60 = 1$

Where is the mistake?


texts: Why do we need asymmetric algorithms for key exchange?

texts: In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in key exchange?


texts: Does using modulo (%) affect quality of randomness?

texts:
I'm writing a small script that generates random non-signed decimal integers within a certain range of values. I'm using GNU od, with the following command:

od /dev/hwrng --address-radix=n --read-bytes=4 --format=u4

/dev/hwrng is linked to a SoC thermal noise sensor (bcm2708 on Raspberry Pi), so it would return pure random bits.
Once obtained a pure random integer from od, I would use the modulo operator (eg: % in C/C++) to restrict the range of values (eg: 96-127). I have some doubts:

Does modulo affect the quality of randomness, faking in some way the distribution of values?
I'm not sure whether bits gathered from /dev/hwrng can be considered truly random, but I guess so, since its entropy is based on a physical phenomenon
Can I use 2 bytes instead of 4 bytes as int size, assuming that the needed range of generated values is low (eg: maximum value = 200)? I mean, probably 2 bytes are enough for small numbers. I ask this, because of the question (1): probably using bigger ranges in od results in higher quality of randomness when using modulo
Is using /dev/hwrng only for the seed value still true randomness? I would use the default PHP rand() as PRNG.


texts: Is it generally possible to employ brute force methods when the encryption scheme is not known? Why or why not?

texts: Lets say you are presented with an encrypted string of bits or text, and no other information. What would be necessary before you could apply brute force methods to decrypting the string? How would a cryptanalyst approach such a case? (lets assume the conditions are such that the encryption can be brute forced in a reasonable time frame).


texts: collision resistant summarizer for long hash values

texts: how we can summarize SHA-256 into shorter values when we for example can't handle more than 128 bits on system? its better just use first 128bit and ignore the rest of bits or split full value and XOR them? or use another hash function that produce required bit long hashes to generate a hash from SHA-256's value (e.g SHA-1)? which way is more robust and unpredictable?


texts: Constructions of PRF (Pseudo Random Function)

texts: I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.


texts: Whcih one is computationally more expensive: Zero knowledge proof or cut-and-choose

texts:
As we know, in order to have multi-party protocol secure against the malicious parties, researchers usually utilise the standard techniques such as zero-knowledge proofs or cut-and-choose technique.

Question: Which one of the two is computationally more expensive?


texts: What are the advantages of MICKEY over Trivium and Grain?

texts:
These three stream ciphers were chosen for the final hardware profile of the eSTREAM portfolio. As far as I understand it, their merits are:

Trivium: elegant design, very high throughput per area, small area, parallelizable.
Grain: simple design, small area, high throughput, comes in a 128 bits flavor and in an authenticated version, easy area-throughput tradeoff.
MICKEY: small area.

(source: http://asic.ethz.ch/estream)

As I see it, Trivium and Grain have many more strengths than MICKEY. So my question is:

Are there qualitative (e.g. a property like Trivium's parallelazibility) or quantitative reasons that would make MICKEY a better choice than the two other ones in some situations?


texts: Where shall we use an authenticated encryption mode?

texts: I learned from Wikipedia that authenticated encryption modes include OCB, CCM, EAX, GCM, and so on. Does this mean that when we want to use authenticated encryption we shall use these modes? But these modes don't use public-key encryption or a hash-based MAC, which may be more advanced. So when shall we use an authenticated encryption mode, and when shall we use other MACs such as HMAC-SHA-256?


texts: I actually do want to know how to generate the multiplication inverse (M.I) table, I mean the calculation how the M.I been generated.. such as the M.I of 22 is 5A regarding to the table.. Do you know how to calculate M.I how the 22 will become 5A


texts: Secure method of encrypting data within a database

texts:
I'm designing a program which makes queries to a database stored locally which could potentially contain a lot of sensitive information. As such the information must be kept secure as possible from any possible attack. I plan on doing this by encrypting the data by AES-256 in CBC mode. The encryption / decryption key will be kept secure.

My question is, using this scheme, how should the database be encrypted to ensure the data is kept secure against attacks? Originally I planned on encrypting the database cell by cell (with each row having 10 or so columns) and storing a unique, randomly generated IV for each row.

However, to my understanding of the generated stream this could cause problems as I would be using the same key + IV combination to encrypt / decrypt all the cells of this row. This would allow an attacker to potentially compute the XOR of two cells and reveal enough information where they could decrypt the entire row (two-time pad). I know this is more of a problem in CTR mode but I have read that it could also be a problem in CBC if two of the cells began with the same sequence of bytes. Please correct me if I misunderstand the concept of this type of attack as I am still a little unsure of its exact mechanism.

Encrypting the entire database itself is not very pretty and obviously will cause performance issues if the database is large enough. Therefore, the only other method I could think of is having EACH CELL have a unique, random IV which on the surface seems like a lot of extra data to have to store but I will go this route if need be.

Just as a side note; this program isn't being implemented anywhere in which security will be an issue. It is more of a side project for myself to learn the intricacies of cryptography and ways of defending against attacks. Thank you for all your help in advance!


texts:
I have cause to use the PRNG half of RC4, but am seriously confused as to the randomness of its output.  (Only the PRNG half.)

On the one hand, there is a large body of literature finding ever greater biases in RC4's keystream.  It appears that both weak and strong distinguishers can identify RC4 from a truly random sequence.  These analyses are performed by clever people.

On the other hand, an RC4 keystream passes most accepted randomness testing suites.  I've personally run the Dieharder tests against a 100 GB file of output and it passed.  These test suites are designed to identify biases in allegedly random bit sequences and are written by clever people.

Can anyone square this circle?

EDIT:

Having reviewed the answers/comments, I'm minded to believe that the PRNG portion of the RC4 algorithm is better than it appears initially from cursory inspection.  In saying this, I'm excluding the so called key scheduling algorithm which clearly is quite broken.  I would make the following observations:

The fact remains that a singular keystream passes the best statistical tests for randomness.  This cannot be ignored.  If there was significant deviation from randomness, of any type, standard testing would discover it.  The only hypothesis that matches the evidence is that long term bias is within typically acceptable levels.
The below referenced paper accepts that major statistical biases occur only within the first 512 bytes of the keystream, and are fully attributable to the key scheduling algorithm/key length.
Long term biases are 500 times lower than the initial ones, and the authors highlight the uncertainty with which long term biases were determined, with $2^{-16}$ biases difficult to fully assess or categorise.
The decimal expansion of pi shows similar magnitude biases (10e-6) even out to 2 trillion digits — that's the nature of randomness.
If the same degree of extensive scrutiny were applied to other PRNGs, would they too show similar biases?

In summary, it appears to me that with a fully randomised and manually injected state array (thus bypassing the inherent key scheduling component), RC4 is a good PRNG.


texts: Are more complex algorithms easier to break with timing attacks?

texts:
Is there a point where increasing the complexity of an encryption algorithm will make it easier to break using a timing attack?

Or is there no connection here at all?


texts: Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

texts:
RSA-PSS private keys

The following command will generate an RSA-PSS private key:

openssl genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537 -out CA.priKey

Here's a sample one I just generated:

https://pastebin.com/AQk0gkkT

Here's the asn1parse output:

    0:d=0  hl=4 l=1213 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :00
    7:d=1  hl=2 l=  11 cons:  SEQUENCE
    9:d=2  hl=2 l=   9 prim:   OBJECT            :rsassaPss
   20:d=1  hl=4 l=1193 prim:  OCTET STRING

Regular RSA private keys

This command, in contrast, will generate a regular RSA private key:

Here's a sample one I just generated:

https://pastebin.com/s6gES7hr

Here's the asn1parse output:

    0:d=0  hl=4 l=1213 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :00
    7:d=1  hl=2 l=  13 cons:  SEQUENCE
    9:d=2  hl=2 l=   9 prim:   OBJECT            :rsaEncryption
   20:d=2  hl=2 l=   0 prim:   NULL
   22:d=1  hl=4 l=1191 prim:  OCTET STRING

My question

Why do RSA-PSS private keys have their own format? The probabilistic signature scheme (PSS) affects how the signatures are made. At least according to PKCS#1 v2.2. The keys are the same. They both make use of the same CRT parameters and what not. So why two different OIDs in this context? Is there a difference or is this just OpenSSL being dumb? And are there any other OIDs OpenSSL might be using to represent RSA private keys?


texts: Às the title already indicates, I would like to know: Are MACs vulnerable to birthday attacks?


texts: How to calculate the redundancy of a language

texts:
I originally asked this question on the information security stack exchange but I think it's better suited here.

I'm trying to calculating the unicity distance for a cipher applied to a language I wrote and I'm having trouble understanding the concept of redundancy in a language.

From this book

  The redundancy of a language severely reduces the amount of information conveyed with each character and the rate of a language is defined as the average number of bits of information contained in each character of a message, i.e. $\frac{H(X)}{N}$ where $N$ is the number of characters in the message.

You need to generate a frequency table for a language to calculate $H(X)$ but an accurate frequency table requires a long message. Won't this cause all redundancies to tend towards 0 since $N$ can be arbitrarily long? How exactly is the redundancy for English, 1 to 1.5 given by this book, calculated? What value of $N$ do they use?


texts: How do i manage encryption keys with a cloud provider?

texts:
I would like to provision services from a Software as a Service (SaaS) provider. This is multitenant environment (multiple companies will be using a single instance of the application, with a single database, running on the same hardware and same OS).

Our company has a requirement to encrypt our data at rest (e.g. file stores, databases, backups).

Most of the guidance I have read states that the key should be kept with the customer or a third party and not with the cloud provider.

If I have the key; then every user in my company will need the key to access the file store once logged in? How would this work practically? Will the key be binded with my a users Username and Password?

Other option is to store the key in a configuration file on the cloud platform and managed by the cloud provider. But this creates another problem of securing the config file and the risk of having our key on a shared platform.

Where can the cloud provider store the key securely so that only I and my employees can use it?

What is best practice in terms of key management when having encrypted data on the cloud?

Best practice from my research states the following:

• Store the key with the customer or 3rd party

• Only authorised persons to access the key.

• Do not store the key on the same platform as the data.


texts: PRFs / hash functions with a parameter amount of 'hot' bits?

texts:
Does there exist a cryptographically secure hash function (or keyed PRF) that can take, as a parameter, the number of 'hot bits' in the output? And if so, what is the name? The goal here is to produce a cryptographically-secure pseudorandom bitmask with a fixed number of bits in the mask.
E.g. $\text{some_magic_hash}(x; 12)$ should produce a bitstring with exactly 12 positive bits.


texts: (AES in mind) How can we show two irreducible polynomials have a bit-wise linear isomorphism

texts:
This refers to answer 2 on a similar question:Design properties of the Rijndael finite field

I am unsure what many of the terms mean in this answer. I think a bit-wise linear isomorphism of irreducible polynomial A refers to: $$A(x) = x^8+x^4+x^3+x+1=100011011$$ or $11B$ in hex. And I assume B refers to another irreducible polynomial over $GF(2^8)$ (btw Is there a list of these? I cannot find them). If I am right, I still cannot fully understand what is meant by:$$L(X+_AY)=L(X)+_BL(Y)$$ or $$L(X \times_AY)=L(X)\times _BL(Y)$$Specifically, I am not sure what $X$ and $Y$ are (but I think they are other polynomials) or what $+_A$, $+_B$, $\times_A$, $\times_B$ mean. A full numerical example would be very helpful, even if only one of the two equations above.


texts: Segmenting encryption to get the same results with the same key

texts:
The given examples below are dummy and in English. They are mainly for place holding as this is a concept question rather specific example based

Given AES has a block size of 128 bit (16 letters of English) and assume I am using the 128 bit key version without an IV.

Assume I have the plaintext hellohowareyoutodayihopeyouareok and the key 1234567890123456

If i take the first section of the plaintext hellohowareyouto and run the encryption on it with the above key and get the ciphertext 111erqsdgdisa222 and later we run the plaintext dayihopeyouareok with the same key we get the ciphertext 333isdisiodfi444.

My question is, given the cipher works on blocks of size 128 bit, if we take the entire plaintext hellohowareyoutodayihopeyouareok and encrypt it with the same key, would we get 111erqsdgdisa222333isdisiodfi444 ?

If no, why not? (Given the IV is constant, or no IV exists, given not all encryption algorithms require and IV. The story of having a fixed IV for all encryption being a bad idea is a different topic and not the aim of this question)


texts:
I want to assure integrity and authenticity in data sent trough a TLS channel.
What are the best techniques? For integrity a hash (sha, bcrypt,...) should do the job right?
And for authenticity? Should i use MAC?
Or is it the best way to use HMAC and achieve both integrity and authenticity?
Thanks for your time!


texts: Does a stream cipher require a KDF when it's key is variable length?

texts:
RC4 has a variable length key. Is it still necessary to use a key derivation function, such as PBKDF2, to initialize it?

Would using a single character password weaken it's output when compared to a block cipher using, for example, the SHA-256 hash of that same single character password as the key?


texts:
In SEAL homomorphic encryption library, there is an internal procedure to decompose a polynomial with large coefficients into a vector of polynomials with smaller coefficients. The procedure is described in pages 3-4 here. I wonder if someone can paraphrase the procedure and provide a simple example to show how polynomial multiplication can be done via that procedure and why it is better than school-book polynomial multiplication followed by modular reduction.

Let $n = 4$, $q = 199$, $w = 16$. This means that $\ell_{w,q}=2$, $\mathbb{Z}_q = \{-99,...,99\}$, and $\mathbb{Z}_w = \{-8,...,7\}$.

Let $a = 70X^2 + 56X+45$ and $b = 61X+31$.

Please show $Dec_{w,q}(a)$ and $Pow_{w,q}(b)$ and how the dot product is equivalent to polynomial multiplication as follows: $\langle Dec_{w,q}(a),Pow_{w,q}(b) \rangle = a.b \pmod q$.


texts: Best way to attack a small e and small m RSA problem?

texts:
I am working through a series of crypto exercises to learn a bit more about RSA and crypto in general. In the case where one has a small $e$ AND a small m, would it be correct to say that if $m<N^{1/e}$ then we can attack by calculating the $e$-th square of $m^{e}$?

If that is a correct statement, then what would be the best way to approach such an attack practically? Is there a tool that exists? Or would it be better to code a brute force solution in Python?

Apologize for the basic questions - just beginning to dip into crypto. Any advice is much appreciated. Thank you!


texts: Are CFB and OFB really meant for streaming?

texts: CFB, OFB and other modes are meant for streaming and don't require padding. Are there still limitations such as the text needs to be greater than key length?


texts:
I've a doubt about the Encrypt-then-MAC approach when using HMAC-SHA-256 with AES-128 in CBC mode, as seen in https://en.wikipedia.org/wiki/Authenticated_encryption.
I need to encode the resulting ciphertext in base 64 in order to send along with the HMAC. Should I generate the HMAC before or after encoding the ciphertext in base 64? Does it even matters?
For example:
1 - Encrypt-then-encode-then-MAC, or
2 - Encrypt-then-MAC-then-encode.
Thanks in advance.

EDIT: I'm using JSON to separate the message and the HMAC, like:
{
  "payload":"base64-encoded-ciphertext-goes-here",
  "hmac":"base64-encoded-HMAC-goes-here"
}


texts: How is QKD (Quantum Key Distribution) advantageous over McEliece/AES?

texts:
I don't understand the popularity of the idea of QKD (often coupled with OTP). From what I can tell, a quantum-safe key exchange algorithm like McEliece has just as much security while operating over current networks, through repeaters, and not requiring single-photon emitters. Combining this with AES seems convenient and practical.

Why would one ever choose QKD over McEliece?

The only reason I can discern is that there is some possibility that a yet-to-be-discovered algorithm may weaken McEliece or AES.


texts: Quantum bit level security of Supersingular Isogeny based Diffie Hellman scheme

texts:
I'm a newbie in studying and learning how SIDH works.
I have a simple doubt.
So my question is in the SIKE submission  present in this link (https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Round-1-Submissions), once you download and unzip the SIKE folder, you get supporting documentation, a .pdf file. In that .pdf file, Section 5.1, 5.2  (Chapter 5), in Table 5.1, they mention that SIKE503 has a quantum security level of 64 bits and SIKE 751 has a quantum security level of 96, right?
The doubt that I have is SIDH or SIKE is not a block cipher, isn't it? Can we still use Grover's algorithm to get it quantum security level ? or am I missing something here. Any explanation will be highly appreciated. Thank you so much for your patience! Looking forward to some help


texts: Are different elliptic curves compatible?

texts:
Regarding SubtleCrypto and curves P-256, P-384 and P-521.
Can I mix two different curves for key derivation?
For example performing key derivation between P-256 and P-521.
EDIT:
Can I mix two different curves to derive data?
(So not to derive keys, it is not what I meant)


texts:
I am trying to check the part where messages are both encrypted and signed. But what is the difference between a message which looks like this

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2

hQEMA40Tbs69jxZxAQf/QfWUH8waN2CFAbn4bWlORERoaL7Zpm95WeDPcwJDObMt
E7hW+ERITJ0gakacppZuVlbHTPT4DuMpDsT1tZzk1ZfO638Jias5WyVeF9g8E3tG
m6cvuyeSp4mD8WuKao2v52HvOecXctMGETaSg58upf6co1DG0XJ0oDGyuEXmc2MN
t+uRtHHxht53sLwLEpVZlrS2L/910DU7PzDwFDuEY4aKlWUz1Q2mdg6XIyJHOoW2
ySNF3AuoOc6VmZ4T3EY2ewjrZoIbX1aLfVFKuoM27RpOohnnIOYP4mtr8JPfq3Ej
M1IWL28hCXzZX3wgqvYEjh8wiXlDEij4Xm5riT2J5NLA1QGbVFkOxVwK7qvqMT3o
USAecl1GdJ6Bx31csQ7eOpv+gJ6/9BgnnXR6TyWjgA4fXnQNJzl5LguVy/4W+IoE
ezXmCDo0VbhgeX5RlytqX9c5+kTXp5dvfAocMqFb0GzYphvno2yqe4CiU7GTKib3
a2E6VHENKgTd3GHoqDs8N57hxsejzURhlcmBneSNvMIqdFJuynNos50Ri61PU+O4
QmX6xSCy4VnT8y4C3CLbts9JWSkFZVSTmeI/hkzWqmk08HguQTRTTOyTNtVX36yk
9c77Gd9MHi3YMOEqcQw4ze+EqnNIP+h+CKrV8gW4SUQK9amVKyX7vM+ValJ2LQBh
Z9ebwL89Vt6S26EQ6uv9E8Xo+lZQANBCVN9pI4r8ZcCg3EFnx0kJ6p+BQ88ePaJ0
jXn97ogMqxxaJlQZo91R/i47x14UlWdgOYE87MoqRcCYi//DI3pY8os35e1lj9Eg
V+cooRU46Bqwtff7jVyXxMUhRuQq8ZE//vL3LPj+GochhINFvvE9yAlQS9nOZ18V
TbVwRSqeiA==
=/i6B
-----END PGP MESSAGE-----

And the other type which looks like this

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ba2c254d75426db8e8ac6cb59020a82633731ad9
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJduy+HAAoJEEo3afbgQ4/jZ38H/1K1wOnHz6za0NdkzwfKCPV+
XXT0Nr4/qsD1FH7r8Pb1WBxWacq34YG2Y73x+c9kA62FWggLxm2J2EwLxE/UITxJ
DOxwLUXPNKN9/iSJcbH450x6SkMEia//yoZRAgC3iVfXyLFmJw/odkmEgdZRTAEG
4wqFENkb2D1QHGh9Eq/iBRdwpUlXIvc+6rKX81RSvGEmgCMd4HpWFGOIdP0yfJRe
rbolxhxpdVzY5eUj/DwGoivJKZliXWC/cEWFQdc0J6QhwouaoDe/WCbpI7RqjsJb
sYcmFrYYyn1X7s6llgX7mBeTqemsBV1CJsFt1pIxrxQscJbm3KfwugzLIclNj/c=
=vpbL
-----END PGP SIGNATURE-----

Should we decrypt and check both the above types in the same way? It looks like both are decrypted same way and both the above can be signed and encrypted. What is the difference?


texts: How does the Signature Scheme in Picnic Works

texts:
I am trying to understand how  signature scheme proposed to NIST, Picnic, works.

The propossal uses ZKboo and ZKboo++ as their basis. I can see how the ZKPoK works, where the witness x is some key for any block-cipher. A prover and a verifier can run a game based on MPC in the head such that they can re-encrypt some pre-define bitstring using x.

However, this is not quite intuitable translatable to Digital Signatures. For instance, the propossal suggests that I should use H(r||m) as the protocols challenge. It is not clear however, what the response (z) actually is?

In the presentations they cite easy examples such as the Fiat-Shamir transform to signal that a Signature Scheme can be easily (and naively) obtained. They even use the same terminology as when the transform is applied to the Schnorr protocol, signaling that it is enough to use the message as the challenge (e). However it is not clear to me how this can be, because I do not how to plug the challenge in. I think I am struggling to see the role of the challenge as a hash of the message during both Signing (Prove) and Verification (Verify).

How is this challenge being incorporated into z (say, as an encryption using thewitness as key?) What is actually z? And what is the equation being verified to check the validity of the signature?

Finally Kudos to the designers, I love the basic idea, I hope I manage to understand it better with your help!


texts:
I'm implementing a public key cryptosystem in a proprietary System On Chip that only allows modular reductions by $n$.

However, that cryptosystem requires ($n^2$) modular reductions. Perhaps someone knows a strategy for performing those reductions relying on a modular reducer by $n$? The Montgomery reduction requires a value $R > n$ that makes ill-suited my approach.

I can perform any modular arithmetic operation mod $n$ but nothing $n^2$.


texts: Chosen plain text and chosen ciphertext definitions clarification

texts:
I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition.

If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that will mean he will get a valid encryption for this message. Now according to the definition of the CCA attack the adversary should send another ciphertext not equal to the just obtained one.

What prevents an attacker from just sending the received ciphertext to the recipient who will think that this is the legitimate message? Or in other words why in the definition is the attacker only allowed to send other messages.


texts: Is there an encryption algorithm, which is a magnitude faster than AES (with weaker guarantees)?

texts:
There are current state-of-the-art encryption algorithms, which considered absolutely safe currently, like AES. Their speed is around the 100MB/sec ballpark on current PCs (note: this is the speed when AES instruction set is not used - I'm interested in the general case, not when HW acceleration is available).

And there are fast, non-safe, obfuscation-only algorithms, like for example, xoring with some fast general-purpose, non-cryptographic random. Their speed can be very-very fast, possibly in the 10GB/sec range. But they can be broken easily (if a little part of the clear-text is known, they can be broken immediately).

Are there any algorithms, which are between these? Like, it has speed of ~1GB/sec, and it can be broken, with some computational effort (like the key can be found in a week/month/year of bruteforce searching on a current PC)?

It can be used in a scenario, when speed matters, but the data is not that sensitive, so it would not worth to break the encryption.


texts: Trade-offs for more parties in PICNIC multi-computation

texts:
In the PICNIC post-quantum signature scheme, a zero-knowledge proof of the secret key for a symmetric encryption is produced by implementing the encryption as a Yao garbled circuit of a three-party computation. The proof is to divide the key into three shares notionally split between three parties and produce transcripts of each party's actions in the computation and provided commitments to several such transcripts. A challenge is to pick two of the parties for each commitment and a response is to provide their transcripts so that the verifier can check that the computation is consistent. As the multi-party computation should not reveal anything about other parties' shares, the proof is zero knowledge.
There's no reason to limit to three parties and the framework would still hold with $m$ parties and revealing $m-1$ transcripts. What are the tradeoffs? Presumably fewer transcripts are required, but the transcripts are correspondingly more complex. Is this analysed somewhere?


texts:
I'm doing some exercises before my exam, and I am stuck with task number 4 in this file: http://www.cs.umd.edu/~jkatz/crypto/f10/hw1.pdf

Could you help me with this task?

  When using the one-time pad encryption scheme, it can occur that $k=0^l$ and then the ciphertext is equal to the plaintext! It has been suggested to improve the one-time pad by only choosing non-zero keys. What do you think of this improvement? In particular, is it still perfectly secret? If yes, prove it. If no, reconcile this with the fact that encryption with the all-0 key completely reveals the plaintext.


texts: Symmetric algorithm effective key length

texts:
If we have a symmetric algorithm with key length $m$ bit, and we do a 5 time encryption with it.
How much will it be its effective key length.


texts: Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

texts:
I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is used to encrypt the stored data.

The padding isn't verified manually. Does that make the process vulnerable to Padding Oracle attacks?

Would the process benefit from using AES/GCM?


texts: Does Java SunJCE Provider use AES for encrypting nonce in Poly1305?

texts:
RFC 8439 states:

  AES is used there for encrypting the nonce, so as to get a unique (and secret) 128-bit string, but as the paper states, "There is nothing special about AES here.  One can replace AES with an arbitrary keyed function from an arbitrary set of nonces to 16-byte strings."

If an implementation like SunJCE uses AES, ChaCha20-Poly1305 may not have any performance advantage over AES in non-Intel architecture


texts: Prevent/minimize replay attacks in public message board

texts:
Assume we have a public message board where anyone can send a message to. If plain messages are used, anyone can impersonate anyone. The goal is to disallow impersonations. We can use public key cryptography and users have access to secure means of distributing their public key (e.g. their personal website). There is a central server but it can't be trusted. The server is just as likely to perform a man in the middle attack as any other entity. The server's only job is to broadcast each message received to all recipients.

Users can enter and leave the room at any time. Also, apart from public keys of other trusted users, they won't be able to remember anything else from last visit when they enter the room again. However, they can track everything that happens while they're in the room.

The only way that I can think to stop users from replaying past messages in order to impersonate the target user, is to include a strictly increasing number in each message and sign the entire message using the private key. Receiving users can keep track of the last number and ensure the next message has a number larger. The problem is, what number do we pick for the first message? I thought a UTC timestamp would do it, but there is no reliable way to ensure everyone's clock is synced.

Another idea I had was for users currently in the room to challenge new users with random strings, but this doesn't scale well. Say there are 100 users currently in the room and another user comes in. The new user has to answer 100 challenges before being able to send a message others can trust.

Any ideas?


texts: Difficulty of collision vs preimage vs second-preimage attacks

texts:
It seems at first glance that brute-forcing a collision would be exactly as difficult for all of them. They all (I would expect) work like this: select a hash value, and then try messages to get an equal hash.

The difference between them is just how that first hash is selected:

Collision: random message.
Preimage: the supplied hash.
Second-preimage: the hash of the supplied message.

So why are they different in difficulty? (~$2^{n}$ vs ~$2^{n/2}$) Yes. Obviously I'm wrong about some point (probably that collision resistance has some shortcut). I'm asking what is my error.

EDIT

It seems that the simple answer to my question is that collision resistance is weaker because every hash one is testing can be paired with every hash tested up to that point, and not only with one specific hash.

If this is not correct - please correct me. If it is, however:

In practice, somewhere around $2^{40}$ (-Terabyte) - the IO time for storing and testing would probably be greater than hashing a message (which can be in excess of $10^{8}$ hashes/s). and over $2^{60}$ would probably be practically impossible. So the difficulty levels are more theoretical than practical for high values such as in the case of SHA-256. Is this correct?


texts: calculate ESS IV initialization vector for aes- bc essiv encryption

texts:
I want to do block level encrypton on my ext4 image file system with aes-cbc-essiv

How can I find/calculate the the ESSIV needed for encryption?


texts: How much data do I leak if I use the first bytes of a file as AES-CBC IV?

texts: I found a piece of code that uses the first 16 bytes of the input file as IV. This immediately set off some flags in my head, but I have no idea how bad it really is. So, how bad is it? Obviously we're storing the first block in plaintext as the IV, but can we get any other information out?


texts:
I am making an arduino project to open my garage door.  I want to make it so users with the passphrase can open the door.  Due to computational restrictions it is unlikely encryption is possible.  Under the assumption that only hashing algorithms are available, what is a secure way of protecting the door?  My thoughts:

Client sends request to open door.  Server increments counter.
Server responds with current counter value, timestamp and date, with hmac of the above.
Client responds with H(passphrase + counter) + above server response.
Server verifies hmac of server response, timestamp is within valid window, and sent hash matches known secret appended with counter.

Have I thought this one through properly or am I missing something?


texts: How to get the keyword from a keyword cipher?

texts:
I was given a ciphertext and now I am trying to break it via looking for the keyword.
This is a keyword cipher. So:

PlainEnglish: ABCDEFGHIJKLMNOPQRSTUVWXYZ

If keyword is HELLO,

CipherLetters: HELOABCDFGIJKMNPQRSTUVWXYZ

So, I had done a little frequency analysis where I've managed to get the percentage of most frequent letters used and I've made a table of letters that I've arranged in a descending manner and compared it to the normal expected English letter frequencies.

Well I could carry on and try and match the text one by one, but I read that there is a possibility that a keyword can be found as well. I'm looking for a little idea on how I can start off with this task.

English on the left and cipher letters on the right:

e   12.702      o   10.772
t   9.056       k   10.611
a   8.167       t   9.003
o   7.507       d   8.521
i   6.966       n   8.039
n   6.749       j   6.913
s   6.327       q   6.431
h   6.094       r   4.984
r   5.987       c   4.823
d   4.253       h   3.939
l   4.025       l   3.617
c   2.782       s   3.617
u   2.758       u   3.296
m   2.406       i   2.894
w   2.36        w   2.492
f   2.228       a   2.412
g   2.015       b   1.849
y   1.974       m   1.688
p   1.929       y   1.367
b   1.492       v   1.125
v   0.978       e   0.884
k   0.772       g   0.241
j   0.153       p   0.161
x   0.15        z   0.161
q   0.095       f   0.08
z   0.074       x   0.08

So I arranged it back according to normal ABCDEFs. Just trying to make sense out of it more. I sort of have a clue. I thought the keyword might be TVSHOW, but it can't be, as I tried deciphering using it already, and W is like way down in the chain. Any ideas on how I can solve the keyword?

abcdefghijklmnopqrstuvwxyz
tvshoabrnpglijdyfcqkuewzmx


texts: Is the Representation Problem hard on elliptic curves?

texts:
The RP in ECC would be to find $a_1,\ldots,a_n$ (integers) given $P$ and $Q_1,\ldots,Q_n$ (points in the EC) such that  $P = a_1 \cdot Q_1 + \ldots + a_n \cdot Q_n$.

Is it hard when DH-like assumption holds in the EC?
Is is hard in secp256k1 or Curve25519?


texts: Good layperson analogy for password and encryption keys

texts:
NOTE: QUESTION UPDATED. SEE BOTTOM OF THIS POST.
I'm writing something where I need to make someone come across as though they know cryptography. I don't know enough, but as cryptography plays only a very minor role in what I'm writing, there's very little I need to know.
As I understand it, a password is a (preferably) mnemonic string that is fed into a function that generates a much longer and complex string that nobody knows, the user included. The encryption key is what is actually used to encrypt and decrypt a file.
Again, as I understand it, if you want to break an encrypted file, you can either try to brute-force the password, or the encryption key (there may well be other ways I'm not aware of). I learned this many years ago when I had forgotten my password to a document and the recovery tool I used claimed that it wouldn't try to crack the password, but rather the encryption key (it did work, in case you're wondering). I don't know where I picked this up from, but for years I was convinced that brute-forcing the encryption key is a better option to crack an encrypted file than going after its password. Possibly, the very software I used claimed it.
Years later, I realised I'm actually not sure if it's true. Is it actually generally faster/more efficient to brute-force the encryption key rather than the password itself? Considering the definition of the password and encryption key I gave above, you'd think the opposite is true.
Also, would you say that, if brute-forcing a password is like trying a bagillion keys to see which one opens a door, finding the encryption key of a file is like removing the lock from the door? I'm looking for a good analogy but I'm not sure this one works at all—especially because doors are rarely scrambled when they're locked...
UPDATE
After reading Gilles 'SO- stop being evil' answer below, I realised I didn't ask the right question. The right question is here. Probably more about information security than cryptography per se.


texts: Expectation Value of the Index of Coincidence

texts:
Can Anybody tell me why the expectation value of the Index of Coincidence is the following?

For a cipher text string of length $L$, where $n$ is the number of
alphabet characters, $k_r = 1/n$, and $k_p = \sum_{i=1}^n p_i^2$

$$ E(IC) =  \frac{1}{t}*\frac{L - t}{L - 1}*k_p + \frac{t - 1}{t}*\frac{L}{L - 1}*k_r$$

I forgot to state that $t$ is the period of the poly alphabetic cipher used to encipher the message.


texts:
I need to choose an HMAC function for PBKDF2.

I'm using .net so I don't have the option to use SHA3. At first glance, and according to this answer by Thomas Pornin  it seems like SHA512 would be best.

However, I've heard that there are some possible downsides to SHA2 compared to SHA1. One of them possibly having something to do with quantum computers. (Yes, I know they're not practical yet, but why not choose better over worse?)

So the bottom line is - should I use HMACSHA1 or HMACSHA2 (512)? Or in other words, is the abovementioned answer a recommendation to always use SHA2 or is it dependant on some factors?

[Also, I would like to verify that I understand correctly that in any case, I should only ask it for the native output (160 bits for HMACSHA1 and 512 for HMACSHA2-512 - right?). Right?]

More (possibly relevant) info

I have a requirement to use only Microsoft libraries. And I need to implement a password stretching function with feedback - how far is the function done. So I can't use Rfc2898DeriveBytes (which doesn't provide feedback), nor SHA3 (unless I write it myself. But I've already written the PBKDF2 myself, and would rather use a built in HMAC rather than write that too.).


texts:
My secret message is encrypted in a byte buffer with AES-128 in CBC mode.  The first 16 bytes are the IV and the message follows contiguously.  If I want to securely delete this message is it enough to delete (overwrite with random) the IV, the first block, or both?

In an answer to similar post (crypto shredding by erasing the IV instead of the key) it was suggested that if the key and one plain-text block is known then the entire message can be recovered.  So it may be better to overwrite the entire secret message...

However, if the secret key has been forgotten decryption is impossible and so the length of the encrypted message is unknown.  There may be circumstances where overwriting the entire is undesirable.


texts: Parameters and key dimension for DH and RSA

texts:
I studied RSA and Diffie-Hellman key exchange from a quite old book (Discrete Mathematics by Berardi, Beutelspacher) and so I wonder if the recommended dimensions for the prime p and the secret numbers a and b of the DH key exchange and for the RSA's public key are still valid or not. The dimensions are 1024 for the prime in RSA and the same for the group of DH.

I tried to find an answer online but I found several different opinions.
Can anyone share his knowledge and/or experience about it? I would appreciate also references to data from valid online resources.


texts: What information to include when calculating the HMAC of ciphertext

texts:
I'm aware that it's crucial to include the IV when calculating the HMAC of a ciphertext (assuming an IV is used).  Can anyone explain, in simple terms, why this is?

Furthermore, assume that there is other metadata associated with the cipher, which needs to be known to correctly decrypt the ciphertext (for example, the type of algorithm used, the mode, options such as configurable block size, etc).  Is there any sense in including this information when calculating the HMAC?  Or on the contrary, is the any reason not to?


texts: Store symmetrical (AES) key in Indexeddb?

texts:
Using web crypto API and it won't let me store an AES key in the indexeddb (it requires a public/private key).

Does anyone have suggestions on how to do this? Should I/could I create a public/private key, store it in the indexeddb and use it to secure the AES key?

The idea is to have shared workspaces for messages and documents, all encrypted with AES. The AES key is generated client side by the person creating the workspace and then distributed to each member. The server should never be able to access the key (needs to be zero knowledge).


texts: RSA engine with inaccessible private keys - susceptible to any attacks?

texts:
We are going to integrate some hardware accelerator for RSA into our next system on chip. This chip can accelerate the core RSA operation, i.e. modular exponentiation $y=A^x \mod(N)$. The private key ($x$) to use can either be provided from the outside or will be stored inside the hardware core, unaccessible to any other hardware /software component. Side-channel attacks are not an issue in this question.

We assume that the software can query the accelerator to do the modular exponentiation using the on-chip key ($x$) and just gets the result ($y$) for any arbitrary $A$ he provides. Would this setup be susceptible to any oracle-kind attack which would allow extraction of the on-chip key $x$? If so is there any countermeasure against this (using padding according to PKCS #v1.5 or RSASSA-PSS)?


texts: Which one is better using DSA, or MAC and encryption?

texts:
I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA.

by using MAC, I required a shared key between client and server which can be conducted by distributing public key to the client, and the client can generate share key, encrypts it by using public key and send to the server. So I require encryption and MAC algorithms.
by using a Digital signature, I required only distributed public key to clients.

So which one is better using DSA, or MAC and encryption?


texts: Information leakage from the ecryptfs filesystem

texts:
I'm wondering what information might be leaked from the ecryptfs filesystem. This is what Ubuntu uses if you check the box for "encrypted home directory" when using the desktop installer, so is probably quite widely used. Key characteristics of it:

each file is encrypted individually and stored in the underlying filesystem
each file is padded in size to be a multiple of 4096 bytes, with a minimum of 12288 (except for directories and soft links)
file and directory names are encrypted
the directory structure is maintained

(Note I haven't found a spec about the above, this is worked out from observing my own filesystem - it's stored in /home/.ecryptfs/USERNAME/.Private if you want to examine your own).

So assuming you can't break the encryption keys then you can't examine the contents of the files. However there is still some information left to examine, and just as traffic analysis can deduce useful information from encrypted communications data, I'm wondering how much someone might be able to work out from the directory structure and approximate file sizes.

Certainly you could work out which directories and files contained music, video and photographs from file size. You might even be able to work out what music and videos existed. You could probably work out some of the applications in use due to their pattern of config/cache directories - firefox vs chrome etc.

Is there anything else? Is there a standard analysis of what could be deduced? Does anything else spring to mind?

(I must admit I assumed there was no padding of file sizes when I started writing this question - I'm reassured that there is).


texts: What is the difference between PBE and symmetric key encryption?

texts:
What is the difference between PBE (password based encryption) and symmetric-key algorithms?

My understanding is that symmetric-key algorithms like AES and Twofish are used in PBE. Hence PBE is just a technique which employs symmetric-key algorithms to do the work. So there is no point in comparing the two. Is that correct, or am I missing something?


texts:
I asked this question already at the Information Security SO site, but my research on how to overcome this problem ended always on the crypto site. That's why I will try to find some help here :)

I am currently working on a software challenge where you have to unlock several functions of a piece of software. The software is written in Java. One of them is the update mechanism of the firmware. What it does is to download a file from a webserver and make a few checks, before the update is performed. I need to find a way to overcome these checks in such a way, that I am able to update the firmware using my own created firmware update.

Here is how the update mechanism works:

The software downloads a file from the webserver. It is a zip file which should have the following structure:

|Zip file content| SecurityTag: | Tag|

Zip file content: This is where I have to add a file, called version.txt which needs to contain a number x > 1.0. (The software reads that part as ZipInputStream.)
SecurityTag: This is a string, which has to be within this file! I cannot modify that one.
Tag: The Tag which is used during the check.

It takes the Zip file content, checks if the version.txt file is included and extracts the number from it.
It hashes the Zip file content using hash = MD5(Zip file content)
Takes the tag and decrypts it using RSA: t = (tag)^e mod N. I know e=65537 and N.
It verifies if hash == t and len(t) == len(hash).

Somehow, I have to pass this check but I am not sure how.

I had a look if I could make use of RSA's homomorphic property but I don't see how to do it efficiently :( I don't have any signature or any other information, besides the file structure and that it has to contain the SecurityTag: string and the public parameters e = 65537 and N.

Is there any attack scenario which I am missing here? Can anyone point me in the right direction?


texts: Protocol for Sharing Blinding Factor with RSA

texts:
What is the protocol for choosing blinding factor when RSA is applied with key blinding?

(Related question: How would you find the Blinding factor R in RSA blind signature algorithm?)

Since blinding factor R should be randomly chosen, who has control
over how R is chosen - the client (public key user), or the server
(private key user)? If the client has control over the choice, the
client can defult to the same value of R every time & thus defeat
the purpose of choosing a random R.
Given that R must be a shared value for every encrypt/decrypt
operation (sort of an IV like parameter for symmetric ciphers),
which protocols supported the     transmission of a blinding factor?


texts:
I read that paper Efficient Protocols for Set Membership and Range Proofs of Camenisch et. al that describes the zero knowledge range proof. The paper applications looks interesting like if you want to proof your age between a range without stating exactly what is the exact age?

But I read that a commitment (C) provided by the prover to the verifier should be first verified by a trusted party before it can be used in the zero-knowledge protocol? Is it just a signature on the C value?

I need a simple explanation of how such a commitment can be done. Since as far as I know about a commitment (C) that is only known for only one party.


texts: Is SHA256 resistant to second preimage attack?

texts: I am looking into building a merkle tree algorithm and I need to know if SHA256 is resistant to second preimage attack.


texts:
TFHE (Fully Homomorphic Encryption over Torus) seems to be a state-of-the-art form of homomorphic encryption.

But, I got a bit confused.

I have recently read the paper Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP from CRYPTO 2012.

The author states in section 1.1 that

  For technical reasons, we don't implement the scheme over fractions,
  but rather mimic the invariant perspective over $\mathbb{Z}_q$ (see
  Section 1.2 for more details).

However, TFHE seems to be defined over fractions.
Does this imply that TFHE overcomes such a technical difficulty?
If so, doesn't any security side-effect come?


texts: How do we guarantee plaintext is coprime in RSA?

texts: The specifications for RSA state: $P^{\phi(N)} \equiv 1 ~mod~N$ if and only if $P$ and $N$ are coprime. Here $P$ is the plaintext and $N$ is the product of two suitable primes $x_1, x_2$. My question is how do we guarantee that $P$, the plaintext will be coprime to $N$? Thank you in advance!


texts: paradox on fully homomorphic equality checking

texts:
Imagine, a client encrypts a corpus of data (say documents of text) with the public key of a Fully Homomorphic Encryption scheme (FHE) and outsources the data to an untrusted server.Now the client wants search for a particular word in the corpus of encrypted documents and retrieve the matching documents that contain the word as a result. So the client could encrypt the search word with public key of FHE scheme and send to the server. The server would evaluate a "equality circuit" for blind folded matching using Evaluate method of FHE scheme. Remember the result (in this case it is MATCH or NO MATCH) also is encrypted in FHE schemes and hidden from the untrusted server.

Now my paradox begins,
Does this mean server does not know whether the string matches the document ?

If the server does not know how will it retrieve and send those matching documents alone ?
If the server knows whether the string matches or not in this particular case  will such FHE scheme considered secure at all ?
Is this situation any better if the FHE scheme is probabilistic or deterministic ?

On a side note, the above need not be for a word (as in words of a text) equality checking, the same argument could be given for numerical equality checking (arithmetic circuits) as well. Any comments on this paradox ?


texts: risk of attacker decrypting RSA ciphertext without public or private key

texts:
As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a simple symmetric encryption like AES-256. The answer to that question pointed out that using RSA to encrypt the symmetric encryption keys cannot make the solution any more secure. But since there are practical advantages I wanted to ask a further question:

When we say "RSA is broken" do we mean that a practical attack is discovered to retrieve the private key from the public, or do we mean that given a ciphertext and no knowledge of either the private or the public key the attacker can decrypt the data? I'm thinking that perhaps in my case the risk of the public key leaking from a trusted system that is doing the key-wrapped symmetric encryption is pretty small. And if by "broken" we mean the first alternative, and if we assume for a moment that the risk or the RSA public key leaks is zero (i.e. it's not public anymore) I am wondering if the more practical RSA+AES solution is for some reason actually less secure, rather than just equally secure, than the plain symmetric method.

Thank you!


texts: What is fixed randomness and unfixed randomness?

texts:
I have found these notions recently in an article. What is fixed randomness ? What is unfixed randomness ?
Link of the article : http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.431.9034&rep=rep1&type=pdf
Page 8, part 4.1, Encrypt() algorithm.
Thank you!


texts: Order of OTs and commitments in Yao's Protocol for malicious adversaries

texts:
I was reading the book Efficient Secure Two-Party Protocols by Y. Lindell and C. Hazay. Page 92 of the book says

  This check is crucial and thus the order of first running the oblivious transfer and then sending the circuits and commitments is not at all arbitrary

I don't understand what difference would it make in the security if OTs are done after the commitments.


texts: Using crypto_sign then crypto_box_seal for anonymous messages

texts:
If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do?
crypto_box_seal(crypto_sign(M, alice), bob)

(Alice signs message, then box seals to bob.)
This answer suggests crypto_box_seal then crypto_sign, am wondering if the opposite ordering is ok.
Thanks!


texts: Complexity of Gaussian Elimination over a Finite Field

texts:
I read somewhere that the complexity of solving a Linear $n\times n$ system over a Finite Field $\Bbb F_q$ using Gaussian Elimination is $\mathcal{O}(n^3)$ operations in $\Bbb F_q$.
What's the role of $\Bbb F_q$ here in the complexity?
Also, what's the cost of this algorithm in terms of $q$ and $n$?


texts: Symmetry between a public and a private key

texts: I know that the private and public key in assymetric cryptography are different and the public is used for encryption while the private for decryption. My question is if they are symmetrical to each other in a mathematical way? They must be because the one is inverting what is done by the other.


texts: Length of encryption password aes-256-cbc

texts:
I'm encrypting a file with sensitive information with

cat secret | openssl aes-256-cbc -a -salt > secret.enc

I am choosing a random encryption password with openssl rand -base64 32 | head -c [password-length]

Is there any standard, how long it should be? Given the password length, how long would it take to crack and view the contents of the file?

I have read this article, but it seems it supposes that you use a password size of 256 bits.

Edit: I found this picture, which pretty much answers my question. Is it reliable?

https://www.inetsolution.com/blog/june-2012/complex-passwords-harder-to-crack,-but-it-may-not


texts: RSA How to find the private key to a given public key when n doesn't consist of two primes?

texts:
I have the homework to find to the public key (120, 3) the private key. I guess 120 is n and 3 will be e.
So that $\lfloor\sqrt{120}\rfloor=10$ I can't find a matching prime number. So it gets more complicated. I also know $\phi(n)=(p-1)(q-1)$ and $3\cdot d\equiv 1\mod (p-1)(q-1)$
But here I stuck, could somebody help me from this point on?


texts: Can key-wrapping help to securely change passphrase used to generate encryption key?

texts:
I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my users some easy-to-store value (10-15 bytes long) that he stores in a safe and use it as "recovery key" when he forgot his password.

I am studying how key-wrapping works and how it can be used to change (forgotten) password in application where password / passphrase is used as input for encryption key generation (KDF). This article Encryption background: What is key wrapping? discuss how key wrapping works and how can be easy to change user password without need to re-encrypt user's data.

I understand there is no problem when I'm changing password that I know - I know my password, original encrypt key is unwrapped and re-wrapped with new key derived from new password; so far so good.

Question1: How can be key-wrapping mechanism used when I forgot my password? (password is used to create wrapping key). I think that in this situation it cannot done and user's data are lost because I cannot unwrap original encrypt key so I cannot re-wrap original encrypt key. Am I right or wrong?

Question2: Is there some way / mechanism / technique how can I decrypt encrypted symmetric cipher key (AES) with two secret values? One value is derived from password / passphrase and second is from something as Apple's recovery key. I am studying paper Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption but I'm not done yet.


texts: Is computing roots moduli a composite $N$ a hard problem without knowing the factorization of $N$?

texts: Suppose that we are given $\mathbb{Z}_{N}$ and an element $x^u \in \mathbb{Z}_{N}$ with $u \in (0,l]$ where $l$ is the bit-size of $N$. Is it difficult to recover $x$ by knowing $u$ without knowing the factorization of $N$?


texts: Calculation of time needed to crack DES with my CPU

texts:
I have a laptop that has the CPU and the RAMs shown below in the images.

My question is that, using this CPU and the RAMs, how much time would it take for me to crack an old school DES algorithm with 56 bit key.

I have read on the web that it was cracked in 56 hours using a 220,000$ machine in 1998. But I believe we are much more advanced in computing speed after 15 years and counting.

I would also highly appreciate if someone can explain the steps of how such a calculation takes place.!


texts: Secure MultiParty Computation with secret inputs for secret outputs

texts:
I want to know if it’s possible to use a SMPC (Secure Multi-Party Computation) to have $N$ entities compute the outcome of a known mathematical operation with two or more secret inputs, where each secret input is only known by one entity in the $N$-sized group.

I’m asking, because I want to define a protocol where two network nodes take part in a virtual money transfer – with $k$ witness nodes – where the balance of each node taking part in the transaction is kept secret to itself. After the transaction is calculated, each part can verify with the outputs whether the operation was successful or not.