texts: Should Increment functions be near-constant time?

texts:
When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" that often occurs. For example:

void IncrementCounterByOne(byte *inout, unsigned int size)
{
    for (int i=int(size-1), carry=1; i>=0 && carry; i--)
        carry = !++inout[i];
}

In the function above, processing terminates when carry is 0.

While not readily apparent, some protocols treat the counter or initialization vector as secret or private data (like TLS). That appears to beg a near-constant time function to avoid leaking information.

I realize there will likely be CPU micro-code variations, and there's probably nothing that can be done about it. (Corrections, please).

A related question is, should the Increment function be near-constant time when it increments the seed to an ANSI X9.17 or X9.31 generator.

And a question I am not asking: should a counter or iv be considered public or secret information. Some projects, like TLS, have already made that decision.


texts: How to test if a number is a primitive root?

texts:
How to test if a number is a primitive root, assuming the $\text{mod}\enspace m$ where $m$ is a prime? And if not?

Is it not enough if the number is relatively prime to the modulus or prime?

I'll write down what I've done and would like to know if I'm right:

I tested if the modulus is prime with the Rabin-miller test. It was prime, so I used python program to factor $m-1$ since $\phi(m) = m - 1$. It printed out $2$ and another prime. So then I calculated $g ^ q \bmod (m-1)$ for all factors where $q$ is the factor and they were $\neq 1$. So $g$ should be a generator, right?


texts:
I am trying to learn about the underlying functionality of the different hash functions (currently SHA) and I'm pretty stuck even after watching a Stanford video about it.
One method of hashing is by using Merkel-Damgård construction with the David Meyers function and SHACAL-2 block ciphers.
As far as I understand MD is the message divided into a chain of 64-bit blocks containing the previous block value or IV (initial vector defined by the hash function or a custom salt key). The block value or IV along with the current block value and some x bit key is after going through the SHACAL-2 function then the new cipher.
Is this correct understood? If it is:
What happens inside the SHACAL function? What is math?
I found this but it doesn't really answer my question:
SHACAL in SHA-256


texts: How does Python's pycrypto library generate primes?

texts:
The pycrypto library in Python can generate random n-bit prime numbers. The syntax I use is as follows:
from Crypto.Util import number
number.getPrime(2048)

The above function has a very impressive performance and returns primes with a very small delay. What is the process used to generate such large primes in such short time periods in this function?


texts:
Having an ElGamal encryption scheme with p=19 which value can not be assigned to
g?

The answers were :  1,7,11,2

I think you can't assign value 1 to g.


texts: Which Cryptographic Standard ensures cryptographic agility and good adapotion

texts:
Which Cryptographic Message Standards are recommended to ensure cryptographic agility in the future and good adapotion trough different programming languages (.NET and Go)?
(PublicKey with authenticated symetric encryption)
I doesn't want handle to cryptographic primitives myself, but rather I want to handle facade which protects more or less from small mistakes.
I found these different Standards, in which my experience varies:

PKCS #7 (Old standard, suitable for the future?)
NaCl crypto_box (Fixed primitives and limited message size)
JSON Web Encryption (JWE) (JWS is very well established, but not JWE)
XML Encryption Syntax and Processing Version 1.1 (Large overhead trough use of XML)

Are some worth mentioning missing? Which would be recommend for a future proof application?
Update
Application: is local installed and sends encrypted data over HTTPS with TLS Auth. to a service in the cloud, but data will be encrypted locally on-prem and not in cloud. One message is around 5kb-2MB and around 100-2.000 messeages per day. Crypt primitives should be fast, around ~50ms.
Constraints: Must be compatible with BSI TR-02102 and should be compatible with BSI recommendations (written in German) for the migration to post-quantum cryptography.


texts: Memory hard password based key derivation functions?

texts:
How are memory hard functions designed for the purpose of password based key derivation? To protect against a brute force attack from a parallel machine.

What design could work well with Skein? The Skein paper (pdf) has a time hard PBKDF (basically hashing the password repeat very many times) but not a memory hard one.


texts: Asymmetric keys (e.g. RSA) must be so much longer than symmetric keys (e.g. AES). Why?

texts: I have been reading that RSA has to do with math (prime numbers), while symmetric key encryption deals with blocks of data and modifying the blocks with replacements and remappings, but I still don't understand why asymmetric encryption has to have longer keys because of that, or whether that's even the reason.


texts: Expanding truly random key into printable password for successive hashing

texts:
The STUN network protocol defines its client authorization in the terms of message-integrity check employing the following scheme [RFC5389, section 10.2]:

$$
  \DeclareMathOperator{\HMAC}{HMAC}
  \DeclareMathOperator*{\SHA}{SHA1}
  \DeclareMathOperator{\MD}{MD5}
  \mathrm{MessageIntegrity} = \HMAC_{\SHA}(\MD(k), m),
$$
where the key $k$ is defined as the following string concatenation:
$$
  k = \mathrm{username} :\mathrm{realm}:\mathrm{password}
$$
In the above expression both username and realm may be treated as constant ASCII strings known to both the server and client (or any traffic eyedropper). The password, however, is a shared secret and never transmitted in plaintext.

I'm not particularly happy about this scheme, but it's that we have now. What I want is to generate a reliable enough password with as large entropy as possible.

Given that the password may contain only printable ASCII text, what password length would be enough to get a reasonable level of security if each password character is chosen at random?
Let's assume there are only $N$ bits of entropy available to generate the password, $N \approx 80...120$. Is it okay to seed these bits into a PRNG and generate a longer password? What would be the required password length in this case? Is it a good idea to generate a really long password in this case?


texts:
Here is arc4random.c from the LibreSSL pseudorandom generator as used in OpenBSD.

It works as follows:

Take 40 "truly random" bytes from OS (PRG seed);
Use the seed as key and IV to generate 1024 bytes of ChaCha keystream;
Use the last 984 bytes of the keystream as a PRG output, and the first 40 bytes as the key and IV to generate the next 1024 of ChaCha keystream;
Repeat until the total number of keystream bytes exceed the limit; after that reseed (go to the step 1).

I don't quite understand the purpose of the step 3 (see the lines 135-138 of the linked code):

/* immediately reinit for backtracking resistance */
_rs_init(rsx->rs_buf, KEYSZ + IVSZ);
memset(rsx->rs_buf, 0, KEYSZ + IVSZ);
rs->rs_have = sizeof(rsx->rs_buf) - KEYSZ - IVSZ;

Why isn’t the whole keystream as a PRG output used? Why does the "rekeying" step make the PRG more secure?


texts: Brute force attack on a block cipher with length n

texts:
Consider a block cipher whose block length is .   = 2 is number of possibilities. Imagine we have  plain text-cipher text pairs { ,  = () } , where the key  selects one of the ! Possible mappings.
Now, imagine you want to brute force this encryption algorithm for the key. In each try, you generate the test key ′ and check whether  = (′,);  i=1,…,t.  If ′ maps  to its proper , we have an evidence that ′ = . However, it could be the case that (.) and ′(.) exactly map the  given plain-texts to the same set of cipher-texts but map the other inputs differently.
a) what’s the probability that (.) and ′(.) are distinct mappings? b) what’s the probability that (.) and ′(.) agree on another ′ plain-text cipher-text pairs where 0 ≤ ′ ≤  − ?
How can I solve this problem?


texts:
There seem to be many OID's that have been put in the ASN.1 tree that have the following ISO identified organization: OIW.

One example is SHA-1 (ElGamal seems to be another):

id-SHA1 OBJECT IDENTIFIER ::=
       {iso(1) identified-organization(3) oiw(14) secsig(3)
        algorithms(2) 26 }

Can anybody explain what this organization entailed? It seems to have been an OSI workshop where NIST participated with other organizations to set up standards. But there is precious little information to find on the internet.

The SHA-1 standard lists it as the "NIST / OSI Implementors' Workshop". But that seems to be little reason for it to specify SHA-1 in itself.


texts: Are there any bi-bidirectionally indistinguishable Asymmetric Encryption Algorithms

texts:
I have been using Asymmetric Encryption for a while, and I have come across an interesting concept, and it would be cool if it could be done.

Are there any Asymmetric Encryption Algorithms where the Encryption Key and the Decryption Key cannot be deciphered from one another?


texts:
Alice and Bob want to agree on a bit $0$ or $1$. Both know it would be fair to pick that at random, but there's no way they could meet to throw a dice and no third party they could trust. Are there known protocols that allow either side to prove that they did not manipulate the outcome?

My idea is: Both randomly (or not - but that would be in their best interest) pick $0$ or $1$, write it down, put it in an envelope and send it to the other person. Then the XOR of both bits could not have been manipulated unfairly by either party.

The problem I see with that: How can Alice prove to Bob that she did not open his envolope before making her choice?

Maybe one could instead choose an initial string $n$ and use the first $k$ with $f^k(n) < a$ as the chosen value. Now if $f$ is a cryptographic hashing function and $a$ is small Alice would have taken a long time if she were to predict $k$ before sending her own choice.


texts:
Decrypting messages can be done by using the following formula:

$$M = C^d \mod n$$

Where $M$ is the decrypted message, $C$ is the encrypted message and $d$ is the private key

Theoretically speaking, Assuming $M$, $C$ and $n$ are known, is it possible for one to calculate $d$ easily? Even for say, large numbers (more than 80 digits etc)?


texts: Which attacks are possible against raw/textbook RSA?

texts:
The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5),  and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5).

Which attacks are possible on signature generation/verification and encryption/decryption if no padding mechanisms are applied, i.e. if raw RSA is used over the plaintext or hash?


texts: How useful is proxy if we use a symmetric key?

texts:
I am trying to understand the proxy re-encryption scheme.
In proxy re-encryption:
(1)Alice use AES key to produce the symmetric ciphertext of her message.
(2)The proxy encrypt symmetric ciphertext using Alice's re-encryption key.
(3)Bob use his private key to get the AES key and decrypt the symmetric ciphertexts.
My question: Why we need the re-encryption? Why not Alice encrypt her AES key using Bob's public key and send it to Bob?
I am new to cryptographic, so I am not sure misunderstand of it.
Thank you!


texts:
SITREP: I am deciding what form of "Random" Number generation would fit best for a Caesar Cipher that encrypts each letter with a different integer as a shift. This encryption is being handled via C# code I have and will write. I have a few options for this as follows.

(Note: The transmission of the key to the receiver is NOT a concern at this time and when it is a problem I will open a new question, this also includes how to hide which method I use to get the key, as that is a question for another time. Also to note, all random numbers not specified to be generated in a specific measure should be assumed to be generated from the C# code Random.Next(); Thank You.)

OPTIONS:

User Entered. This can be up to the length of my message or below it in which case I can either use random numbers or simply repeat the sequence provided by the user (Please advise best option if this is the selected method).
Randomly Generated Numbers. I am aware of the use of OTP's but would also like to know how viable shorter keys are.
Computer or User Generated Keys. This method entertains many ideas such as a key linked to file size, time stamps, others. Is there another well documented use of encryption that serves well while being covert as to my use of it at the same time that I may look into?

ANSWERS: Please back up claims if they are not openly supported by the community here. If you would like to link to another question or article that may help please feel free to do so. Thank you for your time.


texts:
I am designing the truncating block of SHA3 algorithm , there its given that first we need to do the inversion per byte of the 1600 bit output and then truncating it to give 512 bits output.

Can any one briefly explain this whole step of SHA3.


texts: Is there a public key encryption for permutations which is homomorphic under permutation composition?

texts:
I'm brainstorming an idea for extending our Latin square autotopism secret sharing scheme (proposed here [open access]) to a repairable scheme.  I seek a cryptographic method, which may or may not exist.

We are encrypting permutations.  (For the application I have in mind, restricting to permutations of $\{1,2,\ldots,14\}$ would be fine.)

It's a public key encryption method.  So I generate a public key $k$ and private key $p$, and I can distribute $k$ for others to encrypt with, but I decrypt with the private key $p$.
So any permutation $\alpha$ is encrypted to $E_k(\alpha)$, say.

It's homomorphic on permutation composition.  I.e., if $\alpha$ and $\beta$ are any two permutations, then $E_k(\alpha \beta)=E_k(\alpha) E_k(\beta)$.

Does such an $E$ exist?
For the application I have in mind, it doesn't need to be efficient computationally.


texts: Is Blake2b vulnerable to length extension attacks?

texts: There are very few resources for Blake2b apart from the official documentation and website. I would like to know if Blake2b is not vulnerable to length extension attacks unlike SHA2. I would like your help as soon as possible.


texts: Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?

texts:
With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key.  When Alice sends something to Bob, Bob can check that it is authentic.  At that point, Bob can deduce that the message must have been sent by someone who knows the key, i.e., it must have been sent by Alice or Bob.

How can Bob verify that the message was sent by Alice?  (not by Alice or Bob)

In particular, standard authenticated encryption only proves that the message come from someone in a trusted group (the group of people who know the symmetric key).  I'd like a scheme where the recipient can verify which individual sent it.

In other words, I'd like to get all the current guarantees of AE, plus ability to authenticate which entity sent the message (only one particular entity must have been able to authenticate the document, unless their key is compromised).  It's OK if it needs to use public-key technology.  Ideally, such a mode would be single pass (like OCB), but hopefully not patent encumbered or GPL tainted (LGPL or weaker is ok).  Getting authenticated associated data would be a bonus.

Or maybe I just need to encrypt (using a plain randomized mode, provides confidentiality only) then sign the ciphertext+associated data (which provides integrity, authentication and knowledge of the sender)?


texts: Understanding Encryption length calculation and rounds

texts:
I am trying to learn about password encryption by creating a simple password hashing algorithm, although many online articles did warn "Do not create your own algorithm".

I discovered that most of the encryption outputs are represented in bits instead of characters. Initially, I misunderstood this, how bits should be used instead of characters--resulting in my creation of an algorithm with a 1024-character output.

Why is encryption always represented in bits instead of characters? If I encrypt a color hexadecimal value (e.g. red with hex value ff0000), and at the end my output still contains value 0-9,a-f with 128 characters in total length, this will be represented as 512 bits since hexadecimal only uses 4 bits, as 512bits/4=128 characters. Have I understood this correctly?

Do the rounds in encryption mean the same thing as the number of iterations of my encryption process (e.g. transposition, mirroring, etc.)? And how should I determine the number of rounds that I should use to make my algorithm strong against attack?


texts: regular expression matching on encrypted data using secure multiparty computation

texts:
Lets consider Secure Multiparty Computation based on Secret Sharing schemes (rather than Garbled Circuits approach). If we have to do regular expression matching on secret shares of words of texts. Trivial solution is to secret share each letter of the word and distribute to different parties and later each party executes the regular expression on the secret shares of each letter.

For example : $SERVER\_01\_LAB$ could be secret shared on each letter "S,E,R,V,E,R,0,1,_,L,A,B" . and for the regular expression $SERVER.*LAB$,  we build secret shares of each letter and send the regex of respective shares to individuals for matching.

But this is too trivial and breaks all the security because if we create secret shares of individual letters then adversary can perform simple frequency analysis on shares and break it .

Can we do this better ?  Any better approaches exist ?


texts: How can I create pre-determined encrypted results?

texts:
I want my encryption results to be the lyrics to Star Spangled Banner.
The original text I'm encrypting would be, for instance, the menu to a local pizza place.
I know what I want my passphrase to be.

How can I determine how to do this if I want to require a particular passphrase for its decryption? Obviously, I don't want something simple like ROT. I want to use cascade ciphers to accomplish this, something like AES, Serpent or Twofish.


texts: Could a very long password theoretically eliminate the need for a slow hash?

texts:
Before I provide details, I want to clarify that I am not looking to implement this practically, but I'm only asking to get a better understanding.

The way I currently understand it, we use slow hashes for passwords because there are too few possibilities in passwords. This means people could calculate all the potential passwords (or a whole lot of them) fairly quickly when using a performance hash, and find what made the digest. E.g. if in an imaginary world where digests are 3 bytes and slow hashes last a decade my password is "abb" and it results in digest "x3x", someone who got this hash could start retrieving my password by hashing "aaa", then "aab", then "abb" and see that the result is "x3x", and so my password must be "abb". With a slow hash, he wouldn't have time to calculate all three results.

This makes sense for short passwords, but I thought the strength in modern block ciphers lied in the key space. For Two-fish for example, it can have a key from any of 2^256 different variations. Trying all those variations would just be insane, and so it can't be done (for now).

Given these two things, wouldn't the strength of a performance hash as a password storage tool increase with each letter? Alphanumeric letters cover 32 to 127 in ASCII, so that's 6 bits entropy per character (I think). If that's true, would a password of 43 characters be secure when hashed with say, SHA 256?


texts: Why do Edwards curves protect against side-channel attacks?

texts:
From Wikipedia:

  One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel attack.

Could you explain with more detail how an explicit doubling can protect against side-channel attacks?


texts: I tried a number of different inputs and keys and checked their respective hamming distances after each round. It seems PRESENT has an ideal or near ideal hamming distance (31 to 33) after only a few rounds. Indeed, some of the later rounds have worse hamming distances, e.g. 38 to 41. So why is it necessary to have so many rounds?


texts: ECDSA signature of a random 32 byte number vs. the hash of the number

texts:
I'm working on an application that involves signing a 32 byte random number generated by the OS. Assuming the RNG works as intended, is it safe to sign the random number itself rather than a hash of the random number?

I'm asking because time is an issue and -if possible- I would like to avoid the few ms it takes to do the hashing.

Thanks!


texts: Whats the probability a random cipher has a high probability differential?

texts:
This is a bit vauge and long winded. Any partial answers or comments/ways to make this more precise would be greatly appreciated.

Fix some general structure for a cipher, for example Sbox then Permutation then add round key iterated n times.

Consider all ciphers obtained by this method where we choose the S-box and permutation randomly from some set. For each such cipher form a tuple consisting of the probabilities of each (n-1)-round differential. Due to compounding randomness going on here, these tuples should have some limiting distribution.

If we can calculate this distribution, we can estimate How likley it is a random cipher of this structure can be broken via differentials.

My two questions:

Should such a limiting distribution exists?
What conditions on the cipher structure make this distribution uniform?


texts:
I managed to implement the proxy re-encryption scheme from http://eprint.iacr.org/2009/189.pdf in Python 2.7, however I am having performance issues. As it is, I can run the algorithm for key sizes up to 5 bits, which is impractical.

I think the problem is the lack of mod operations throughout the algorithm. As the paper does not specify which operations are mod something (or it is trivial they omitted) and I do not have a strong math background, I am having a hard time figuring it out. For example:

  $\operatorname{ReKeyGen}(sk_i, pk_j)$: On input user $i$’s private key $sk_i = (x_{i,1}, x_{i,2} )$ and user $j$’s public key $pk_j = (pk_{j,1}, pk_{j,2})$, this algorithm generates the re-encryption key $rk_{i\to j}$ as below:

  Pick $h\overset{\$}\leftarrow  \{0,1\}^{l_0}$ and $\pi \overset{\$}\leftarrow  \{0,1\}^{l_1}$, compute $v= H_1(h,\pi)$.
  Compute $V=pk_{j,2}^v$ and $W=H_2(g^v) \oplus (h || \pi)$.
  Define $rk_{i\to j}^{(1)} =\dfrac{h}{x_{i,1} H_4(pk_{i,2})+x_{i,2}}$.
  Return $rk_{i\to j} = (rk_{i\to j}^{(1)},V,W)$.

Since there are some huge exponentiations throughout the algorithm, I am sure I am missing some mod operations there.

I have checked others ElGamal and Schnorr signatures implementations, but adding mod as described makes the proxy re-encryption stop functioning. Anyone has a light on this?


texts: What is the correct format for a CRLF in a SSL certificate's pem

texts:
Currently I am working with SSL certificates inside a Ruby on Rails application.

I am storing the certificates in a database along with the corresponding  dhparam, and chain. At some point I want to render these fields into real files and publish them to a server.

Although the published certificates work in the client's browser we got in massive trouble with a couple of other apps (including golang services, amazon cloudfront, ...) telling us that the certificate is not correct (e.g. x509: certificate signed by unknown authority).

So I had a look at the certificates that were rendered. The only difference I was able to find is that Ruby's OpenSSL library returns the certificate with a different carriage return than I was used to:

-----BEGIN CERTIFICATE-----\n
MIIDhDCCBWygAwIBAgIQDyh/z7hUIji7pFcz+75NWTANBgkqhkiG9w0BAQsFADCB\n
kDER ...

but the original, raw string looks like this:

-----BEGIN CERTIFICATE-----\r\n
MIIDhDCCBWygAwIBAgIQDyh/z7hUIji7pFcz+75NWTANBgkqhkiG9w0BAQsFADCB\r\n
kDER ...

And here's how I rendered the certificate:

certificate = OpenSSL::X509::Certificate.new '<raw certificate>'
certificate.to_pem # => This returns the \n formatted certificate

Could the different format of the CRLF be the root of the problem? Are both formats valid?


texts: I am by no means a security expert, but I am curious whether functions that don't produce different outputs when raised to the power of N (without any psuedo-randomness) exist, that are as strong as "bcrypt" or "scrypt"?


texts: Evaluating Algebraic Complexity of a S-box

texts:
While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating the properties of an S-box.

After reading several papers (such as APA), I get to know that Algebraic Complexity is basically the number of terms appearing in the "Algebraic Equation" representing that S-box.

After doing a bit of a research (source) I get to know there are three main methods for finding the polynomial equation to represent S-box which are:

Lagrangian interpolation
Polynomial linearization
Q-ary polynomial deduction

But honestly I am unable to understand any of the above methods to find the algebraic equation of the given S-box. So that ultimately I can evaluate it's Algebraic Complexity.

So, if someone can explain it in detail (or algorithm for the same), it would be really helpful for me to write the code for it. Or if there is some other way (or codes) to find Algebraic Complexity or Algebraic Equation of an AES S-box please share it.

TL;DR: Given an S-box ($n \times n$) , how can we evaluate its Algebraic Equation or Algebraic Complexity?


texts: Practical disadvantages of GCM mode encryption

texts:
It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to recommend it. This question is a call to those experts to clearly define those concerns.

Are there any properties of GCM mode encryption that make it less secure in practical operations than CBC + HMAC using two separate keys?

Answers could focus for instance on properties of the algorithm that make it more vulnerable to side channel attacks than other algorithms.


texts: Can PBKDF2 be used to create an XOR cipher key to encrypt random plaintext?

texts: I want to encrypt a truly random plaintext (a key file) based on a user password. I'll use PBKDF2-HMAC-SHA256 to generate an encryption key from the password, but I'm wondering if I even need to bother with AES or some other cipher: can I expect good security if I just use PBKDF2 to generate a key equal in length to the plaintext, and XOR them together?


texts: Are there any signature schemes for underpowered devices (8-bit microcontroller)?

texts:
I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel.

Recently i've bumped into the natural question of system security. I'm mainly concerned with authentication, that is, I need the slave to be able to tell if a command issued is really trustable. In other words, verify that some command was really sent by the master, and not some impersonator which has connected to the communication bus.

I've started researching and found out about several implementations directed towards low end microcontrollers, including elliptic curve cryptography.

That is all very fine indeed, but I am only worried about signing in a public key scheme. I don't need to do actual data encryption and decryption.

I am aiming for really low cost, so the space available for code is rather small.

I accept all kinds of suggestions, but here comes my real question:

Would it be unsafe to use a scheme like Rabin signature in an awkward way like this:

Use a very small-sized key - 160 bits
Generate a new set of keys and send the public key to the slaves often, so even if it takes a relatively small amount of time to factor the public key, the attack is impractical because it has already changed when the attacker is ready

Mind that this is mostly a theoretical experiment - my aim is only to gain knowledge into cryptography on small devices. Also, this safety would be merely an extra layer on my system and not critical. As I only need signing and verification and not en/decryption I can do without a lot of code dedicated to this. The master is a PC, so the key generation is easy. The slaves do NOT need to authenticate themselves to the master.

Also, note that the signing is to be made on a small block of data which would be sent along with the main command message. This block, when parsed correctly guarantees the identity of the master. As for sending a new key to the slaves, it too would be accompanied by a block which has to be parsed correctly by the old key, or else an attacker could overtake the communication bus.

Update:

Hardware specs

The target platform is for now the S08 family of Freescale's 8bit MCU line. The most likely candidate in this section, considering the low cost would be a MCU with 32K/2K FLASH/RAM. The CPU can reach a maximum operating frequency of 40MHz. Anything under one second for verification is fairly acceptable.

I also have access to a 128K/8K MCU of the same family. However, as a learning exercise I am trying to cut down everything that is possible and be able to get the same code to run on a scaled down version of this MCUs which is cheaper: 8K/768B FLASH/RAM.

In my tests, even the ultra-low spec one is able to run the verification of a 320bit Rabin-signed block. Of course I could throw away the low-spec parts and concentrate on the bigger ones, but this is to be really a learning experiment and I would like to push the boundaries as far as they can go.

Final Update

For those interested, my chosen solution is to abandon authentication for really small sized devices. These will be able to connect to the bus but are insecure, and so must not take part in tasks which are critical. The slaves which must support the authentication process will be built upon MCUs with some more RAM to support the 1536-bit or greater key suggested. Most likely the Rabin cryptosystem will be used for its simpler maths. As before, only authentication is interesting at this moment.


texts:
I'm having a hard time understanding the purpose of having two primes $p,q$ for RSA to work. To illustrate my point, imagine only one prime ($p$) is used.

Alice, the encryptor, can take the public encryption exponent $e$, which Bob, the decryptor, created (along with the private exponent $d$) to satisfy
$$ed\equiv 1\pmod{p-1}$$
Alice then encrypts $M$, sending $C=M^e$ (the full value without a modulus) to Bob.

Bob receives $C$ and retrieves the message: $$C^d\pmod p$$
$$=M^{ed}\pmod p$$
$$=M^{(p-1)k+1}\pmod p$$
$$=M\pmod p$$
$$\text{(by Fermat's Little Theorem)}$$
Assuming an attacker cannot guess $p$ from $e$, this should be secure. Instead, RSA  creates exponents according to $$ed\equiv 1\pmod{(p-1)(q-1)}$$
and decrypts with
$$C^d\pmod p$$
$$=M^{(p-1)(q-1)k+1}\pmod p$$
$$=M\pmod p$$
$$=M\pmod q$$
$$=M\pmod {pq}$$
From this, it seems that the only benefit of using two primes is so that Alice can take a take a modulus before sending the ciphertext. If only one prime is used, Alice could send the ciphertext $\mod p$ and preserve correctness, but then she could use $p$ to derive  $d$, whereas in the two prime version, she can still take a $\mod n$ without knowing $p$ or $q$. I suspect modular exponentiation is much cheaper computationally that regular exponentiation, and that perhaps that is why two primes are used in practice. Is this the only reason? And if so why is the concept of factoring a semi-prime number so central to the idea of RSA?


texts: Does AES encryption work like a padlock or like a safe?

texts:
If I encrypt a plaintext p using AES-256 in GCM mode with the keys $k_1 ... k_n$ and I want to decrypt it later, can I use the keys in any order when decrypting or do I have to use the same order as when encrypting but in reverse?
If not, is there a modern symmetric encryption algorithm that lets me perform the decryption in any order?


texts: what are the uses of tweaks in block ciphers?

texts:
Few block cipher modes has additional parameter , tweaks , especially the ones that are format preserving .

Now the comments section of this blog entry says such tweaks can be used for BIN numbers, expiration dates etc of credit card numbers.

How can tweaks be used to enforce such checks ?

what other ways tweaks can be used ?


texts: Wikipedia's double-and-add point multiplication algorithm for elliptical curves

texts:
Here's the algorithm Wikipedia gives for double-and-add point multiplication:

   N ← P
   Q ← 0
   for i from 0 to m do
      if d[i] = 1 then
          Q ← point_add(Q, N)
      N ← point_double(N)
   return Q

$P$ is an $(x, y)$ coordinate and so it seems reasonable to assume that $0$ is a $(0, 0)$ coordinate but there's no guarantee that $(0, 0)$ will even be on the curve, which would thus skew the whole thing.

Indeed, it seems to me that $Q$ is probably better represented as $\infty$ due to the P + ∞ = P identity?

I suppose one could assume that $0$ and $\infty$ are the same thing, but that wouldn't work if $(0, 0)$ were an actual point on the curve.


texts: Difference and relation between ed25519, x25519 and XEd25519

texts: In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the message since I need to do a Diffie-Hellman key exchange. I wonder whether I could use the same primitive for both DSA and DH, and if not why? Also, some time ago Signal described the XEd25519 signature schema https://signal.org/docs/specifications/xeddsa/ which they say "XEdDSA enables the use of a single key pair format for both elliptic curve Diffie-Hellman and signatures". What is the relation between those primitives, can I for example convert ed25519_dalek and x25519_dalek keys into XEd25519?


texts: Is RSA in a ECB-like-mode safe for bulk encryption?

texts:
Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA.

(Note: I do realize that in practice this is done through an intermediate symmetric key, but this question assumes we only use asymmetric encryption.)

Say I try to do this: I slice up my data into 2n-byte blocks (padding with zeros [edit: padding appropriately] if necessary), append the block index to the block (to prevent the same plaintext from turning into the same ciphertext), then use my friend's public key to encrypt each block separately.

Is this a secure scheme, or does the fact that I'm re-using the key make it susceptible to some kind of attack? If so, is it used in practice in any existing algorithms? If not, is there any way to make it safe, aside from using a symmetric key?


texts: RSA encryption extremely large public exponent

texts:
I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert.

I have an encrypted message $c$, the modulus $n$ and the public exponent $e$ (variable names are by the definition of the wikipedia article). The exponent $e$ is of the same length (308 digits in base10) as the message $c$ and the modulus $n$.

The first thing I thought was that the exponent $e$ so large that no computer would be able to calculate $m^e$ if m is bigger than $1$. So I thought that the message $c$ must be the same as the non-encrypted message $m$. Converting $c$ to base16 and then to ASCII just gave me a bunch of non-sense.

After searching through the internet a lot I found a statement by a user that if the public exponent $e$ is very large it is likely that the private exponent is very small. So assuming the calculation of $m^e$ is possible I tried to decrypt the message with common small exponents $d (3,17)$ but this also did not work.

Since I am really stuck here, I would be very glad for a hint.


texts: Different literature padding for Merkle-Damgard

texts:
I don't think this question addresses what I want to ask. I was taught that the Merkle Damgard scheme worked as in this picture:

Here I assume that we are inserting a pad in filling the last block of the message. Probably, we set a new block if all blocks are full. This is a particular case for SHA1 but I don't think it makes a difference.

However, in the book Introduction to Cryptography by Hans Delf and Helmut Knebl they propose the following scheme:

If one has a function $f:\mathcal{B}^{N+r} \rightarrow \mathcal{B}^N$ and wants $h:\mathcal{B}^{*} \rightarrow \mathcal{B}^N$ then one takes $m \in \mathcal{B}^{*}$ and proceeds as follows:

$m' = m||1000 \cdots \in \mathcal{B}^{kr}$ where you add enough zeros to complete the block. Then one divides $m' = m_1||m_2||\cdots||m_k$ with $m_i \in \mathcal{r}$ and adds a block $m_{k+1}$ which contains the initial size of $m$ with the rest of the block filled with zeros.

What I ask for

I could go probably to Merkle and Damgard's original paper. But I don't know if their padding scheme was ok since I see that there has been some discussions on it. So I ask, are this paddings schemes both correct or has any of them proved insecure?


texts: Can we attack a hash function if we only have the input x such that y = h(x)

texts:
This question deals with a "one-way" function $h$. Then, given the value $y = h(x)$, it is computationally infeasible to find $x$ directly from $y$.

  (a) Suppose that Peter computes $y = h(x)$, where $x$ is Peter's salary, in Ringgits. If John obtains $y$, how can he determine Peter's salary $x$?
  (Hint: Adapt the forward search attack to this problem).

How do I explain the attack just by using cryptanalysis and forward search attack?

  (b) Why does your attack not violate the one-way property of $h$?

Assuming he used forward search attack does not violate the one way property of $h$?

  (c) How could Peter prevent this attack? We assume that John has access to the output of the function $h$, John knows that the input includes Peter's salary, and John knows the format of the input. Also, no keys are available, so Peter cannot encrypt the output value.

Second pre-image resistant to prevent this attack?


texts:
I want to implement a PRG (Pseudorandom Generator). As AES is implemented in hardware, I am planning to use AES for efficiency. I am planning to use:

$(AES_k(seed) \| AES_k(seed+1) \| AES_k(seed+2) \|....)$

as a PRG ($k$ represents the key of AES). The receiver of this sequence does not know the random seed, but knows the AES key $k$. So, is this sequence a provably secure PRG, when the AES key is known (at least in ideal cipher model)?


texts: I'm trying to understand Matsui's linear attack on DES and I don't understand something in the paper. I can't understand how the algorithms 1 & 2 work.


texts:
I currently use Argon2 to derive a key (I will use a salt which I will save in a file as plaintext for when I later need to derive a key again) from a given password which I will use to encrypt a file (Algorithm: AES CBC PKCS7Padding).

When a user enters the password I need to verify it is the correct password, storing the key or the password will of course break the encryption (since if it's the key they can just decrypt, if it's the password they can derive the key again)

So from what I can see I have 2 options

Use Argon2 as a hash function instead of a KDF function and store the result (I will change the salt between the 2 Argon2 invocations), you can probably guess this will be very slow.
Hash the key with SHA-256

To verify I will just re-hash with either option 1 or option 2 and check if it matches.

Questions

Would option 2 achieve the same security as would option 1?
If I use option 2, for the salt, should I use a new generated salt specifically for that (which I will store in a file as plaintext for later verifications) or use the salt I used with the initial Argon2 KDF or use no salt?


texts: Non-Interactive Zero-Knowledge-Proof for discret Logarithm?

texts:
In a Non-Interactive $Zero-Knowledge-Proof$, the challenge is chosen
by the Prover.

I am trying to find a Non-Interactive Zero-Knowledge-Proof based on the following problem:

DISCRETE LOGARITHM

Input: Prime number $p$, generator $g$ of $Z^{*}_{p}$ , and $y\in Z^{∗}_{p}$ .

Question: find $x \in \lbrace1, . . . , p − 1\rbrace$ with $y ≡ g^{x}\;mod\;p$?


texts: Simple digital signature example that one could compute without a computer?

texts:
I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms.

There is a great question (Is there a simple hash function that one can compute without a computer?) with a great answer, which helps to understand hashing in cryptography better. I am looking for a similar answer like the question above received, but related to Bitcoin… more specifically, the digital signatures (public key & private key) used by the Bitcoin protocol.

I'm trying to understand how a verification works in the image below:

The goal is to simplify the signature generation and verification algorithm in a way that I can make it understandable for students that are not familiar with digital signatures or elliptic curve cryptography at all. So, what I am looking for is a pseudo/toy-algorithm (something like the Caesar cipher) that the students can use to understand how public and private keys work in an extremely simplified way.

Does any such digital signature example exist that one could compute without a computer? Or could you give me a helping hand coming up with an example that I could provide to my students?


texts: Is there any relationship between Paillier Cryptosystem's random r and other factors

texts:
I want to try run an example of  Paillier cryptosystem(Algorithm), So i just started with some basic examples, but cannot obtain correct result/decryption.
I just change random factor r from 97 to 101 in Reliable Implementation of Paillier Cryptosystem, and return with wrong result. is there any relation between the random r and other Paillier factors i,e; g, λ, n etc
The other example is:

Key Gen:

p = 5, q = 7 ,n =3 5 ,n² = 1225;
g = n+1 = 36;
λ = LCM(p-1,q-1) = 12;
μ = L(g^λ mod n²)^(-1) mod n
μ = L(36^12 mod 1225)^(-1) mod 35
μ = L(421)^(-1) mod 35
μ = 3    ; where L(421) = 12

Encryption:

Let m = 32; random r = 17;
c = ((g^m) * (r^n)) (mod n^2)
c = ((36^32) * (17^35)) mod 1225
c = 278

Decryption:

m = L(C^λ mod n^2) * μ (mod n);
m = L((278^12) mod 1225) *3;
m = 1191*3 mod 35;
m = 3;

But the original message is 32. what is wrong?
I went through some other example, but unable to decrypt correctly.


texts: How do I generate a number from a Z* order q set

texts:
I would like to generate a random number based on this set, firstly how do I generate the numbers that belong to the Z* order q set. I have the q value and the prime p value.

Also if there's a library in python that does that already that'd be nice


texts: What are some of the current relevant fully homomorphic schemes?

texts:
As of February 2017, I have the feeling that all information on FHE is currently a bit scattered and finding a good summary/ timeline on the topic is really hard.

I'm currently looking into FHE over standard/ ring-LWE which seems to have one of the better security assumptions. Are there any other relevant schemes/ methods that are very refined or even practically in use?


texts:
I am aware of the vulnerabilities of simple xor ciphers and recently I came across a block cipher that claims to solve those vulnerabilities.

The cipher goes as follows with both the block and key sizes at 256-bits: the key is separated into chunks of length 1 bit.  Every bit in the plaintext is xored with every key chunk.

For example assume that the first bit of the plaintext is 1. Say that the key is 10100101010010101…
The operation that takes place is:

1 xor 1 = 0
0 xor 0 = 0
0 xor 1 = 1
1 xor 0 = 1
1 xor 0 = 1

This continues until the end of the key and the result becomes the first bit of the ciphertext.

Is this really as secure as advertised?
If not why?


texts:
I need to construct an AES key from an array of bytes (in Java), but I first I have to check if the key created from these bytes would be weak.

Java can check for weakness for DES, but not for AES. What are the criteria for an AES key to be considered weak?


texts:
No SHA-1 collisions are actually known, though there are a number of cryptographic attacks to weaken it.

But, how likely is it that, of all the SHA-1 hashes computed since the invention of the algorithm, there has been a collision?

Not sure how to approach this, but it probably involves the Birthday Problem?

(if there's a better SE to ask this in, let me know)


texts: How do I detect a failed AES-256 decryption programmatically?

texts:
I have implemented a simple encryption/decryption program based on AES-256 in CBC mode1.

Actually, it is more precise to describe it as a compression+encryption / decryption+decompression program.

If one provides the wrong key to the decryption+decompression function, the decompression stage will explicitly fail, as expected, since the decrypted content (being based on the wrong key) will be just noise.

I would like to modify the decryption phase of the scheme so that it detects on its own that the wrong key has been used, before it proceeds to the decompression phase. I am looking for a scheme to support this functionality that does not weaken the overall cryptographic strength of the framework.

A naive approach would be to generate the encrypted content as2

AES256_CBC(key, iv, SENTINEL_STRING + plaintext)

where SENTINEL_STRING is a string that the decryption phase can know in advance. While I am being naive about it, I could make the SENTINEL_STRING be equal to the key, for example.

I imagine there are pretty standard ways to solve this problem. In fact, for all I know, the design of AES-256-CBC already has built into it a way to check that decryption succeeded.

I hope someone can enlighten me on these matters.

Also, if this problem is common enough to have a generally accepted name (suitable as search engine fodder) please let me know.

1 For what it's worth, my current implementation of this uses Python's pycrypto module, but an earlier implementation used Perl's Crypto::CBC package. Both versions can reciprocally decrypt+decompress files compressed+encrypted by the other. I bother mentioning all this to stress the fact that this question is primarily about AES-256-CBC in general, and not about any specific implementation of it.

2 I hope my ad-hoc notation here is not too stupid. I mean it as a shorthand for "encrypt the string SENTINEL_STRING + plaintext with AES-256 in CBC mode, using the key key and initialization vector iv".


texts: Is it possible to use crib drag on base64 cipher text?

texts:
I am pretty new to the cryptography scene but I wanted to know if it is possible to use crib dragging on cipher text which doesn't contain words? This data would be encrypted using the same key with a one time pad and the data is encoded using base64 before it is encrypted.

For example,

key = [1, 2, 3, 4]
message1 = [C, B, D, K]
message2 = [H, K, L, U]
encryptedMessage1 = [D, D, G, O]
encryptedMessage2 = [I, M, O, Y]

(yes I know this isn't exactly base64)

So if we XOR these two encrypted messages together we may or may not get CBDK or HKLU based on the word used for cribbing and even if we do get one how can you verify that it is the correct message?

Again total noob and trying to teach myself. ;)


texts:
Noting D-Wave's press release on a 1000 qubits quantum computer had me wondering...

Does the number of qubits nonlinearly change the speed/rate at breaking a SHA256 hash?

If someone makes a say 10,000 qubit processor, does this speed up cracking the hash more than 10 times (linearly) faster?


texts: Solve System of Equations including XOR and Modular Addition

texts:
A Dummy cipher is shown in figure below. Plaintext is 16 bits ($X_1$ and $X_2$ are 8 bit each). Ciphertext is computed after two rounds using two round keys $K_1$ and $K_2$. Can the round keys $K_1$ and $K_2$ be found by solving the system of equations, which involves XOR and Modular Addition?

$\boxplus $ = addition modulo $2^8$

$\oplus$ = XOR

$X_1$, $X_2$, $Y_1$, $Y_2$ are 8-bit. $i=1,2$.

I am confused on how to solve such system of equation which involves XOR and modular addition. How many PT-CT pairs are required to solve such system of equations? How many linear, non-linear/quadratic terms will there be in the system of equations?


texts: openssl_get_cipher_methods: which one to choose?

texts:
When calling openssl_get_cipher_methods we get several cipher methods.

I noticed that some of these method have same prefix like AES-256-(CBC|CFB|CFB1) or IDEA-(CBC|CFB).

My question is which one to choose: which is the most safe and secure for encrypting a string or large file? What process should I follow to encrypt data correctly?


texts: Analyzing/Breaking a strange One-Time-Pad

texts:
In my assignment there is a bonus question:

It asks me to decrypt a file which has been encrypted using an One-Time-Pad.
But the ciphertext seems to contain english word fragments and other parts which in my opinion should not be in the file if an otp had been used.

The ciphertext seems to be some part of a boot log.

Now this all may have been done on purpose to confuse the students.

My question is:

Does this information help me in anyway to find the plaintext?
Would there be another way to find the plaintext, assuming that they did not use a completely random key?

I've uploaded the ciphertext here.


texts: Precise meaning of various terms related to universal hash functions

texts:
I've been reading about universal hashing, but I'm confused by all these different terms and notations.  Could someone help me understand the precise meaning or relation between the following terms:

universal hash family
pairwise independent hash functions
2-universal hash family
strongly universal hash family
delta-universal hash family


texts: Why does WPA-PSK not use Diffie-Hellman key exchange?

texts: Is there a reason, why in pre-shared key mode, Wi-Fi session key is not secured with something like Diffie-Hellman but instead is derived from PSK key and some information exchanged in clear during sign-on?


texts: How does knowing the factorization of N help to obtain the secret?

texts: Assuming $x=a^2 \pmod n$ and knowing $x$, $p$, $q$ how is it possible to obtain $a$?


texts: I have come up with an encryption algorithm and I am looking for a place to possibly publish it.  Any ideas?


texts: Using e-ID Number for Encryption and Digital Signing

texts:
I want to use e-ID number for performing Encryption/Decryption and Digital Signing - and in order to do so, I've opted a PGP-oriented approach which goes a bit like this.

Generating PGP key-pair using e-ID Number (pass-phrase protected)
Digital Signing using e-ID Number (private-key) - and verifying the signature legitimacy by matching the sender's e-ID public-key fingerprint/key-id which has been pre-shared (via telephone/meeting) with the recipient.
Encrypting using e-ID Number (pre-shared) public-key of the recipient - and will then be Decrypted by using his/her private-key.

There will be a use of 'Random Session Key' for each session - as per the PGP concept and the implementation of classical (RSA, Elgamal) for Encryption/Decryption and (RSA or DSA) for Digital Signatures will be realized.

This is still a quite rogue approach - and therefore I would like you to share your view-point concerning the feasibility and the possible weaknesses of such a mechanism.

I will also appreciate other possible (effective) ways to use the e-ID card features for performing the Encryption/Decryption and Digital Signing - excluding the fact that card's electronic chip itself is equipped with a key-pair (by the reason of not being supported/compatible/encouraged for encryption and just for digital signing).


texts:
I have just learned about the OTP, how it uses XOR, and how it's secure if the keys are random.

But what will happen when the same plaintext is used again with a new key?

$c_1 = k_1 ⊕ p$

$c_2 = k_2 ⊕ p$

$c_3 = k_3 ⊕ p$

$c_n = k_n ⊕ p$

Is this secure?


texts: Proof of membership and non-membership in Merkle tree (Hash-tree)

texts:
If we just know the Merkle root and the data block and we want to know this block is a member of this merkle tree. We need to know all the blocks from the leaf to the root that are associated with data block and we ignore the rest.
But how and whats the point of this?.
If the system is doing so much work finding the blocks associated with this data block we have.It might as well directly do a simple search and find out whether the given data block exists in the first place.
This is becomes even confusing when we use a sorted merkle tree for proof of non-membership. Please explain me what's the concept and what's going on in these two proofs


texts: Is there any reason not to use EdDSA with Weierstrass curves?

texts:
I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run.

Our library is highly modular, so the question needs to be asked:
Is there any (good) reason to limit the use of EdDSA solely to twisted Edwards curves?

According to the paper "EdDSA for more curves" by Bernstein, Lange et al. one can use any odd-prime field, however EdDSA is usually only being talked about in the context of Ed448 and Ed25519.


texts:
I am reading a paper which defines an algorithm as following: Suppose for the BLS algorithm I have parameters (p,g , G, GT ,e) where , G and GT are multiplicative cyclic groups of prime order p , g is a generator of G and e: G X G --> GT.

Now the client choses a random x from Zp as secret key and from here the public key is derived as g^x.

Now this paper states that Let a <--R--G (which means that a is randomly chosen from the cyclic group G) be another generator of G.

But how is this possible? How can a cyclic group have two genertors. Is it possible ?


texts: Complexity lower bound in Uber-Assumption family

texts:
I try to wrap my head around calculating of complexity lower bound using Corollary 1 from The Uber-Assumption Family by X.Boyen
 (http://www.academia.edu/download/30698012/Steven_Galbraith_PairingBased_Cryptography_Pair.pdf#page=48), but I have some questions:

Do I understand correctly that bound is the same when we add more elements to problem instance as long as we don't increase maximal degree of polynomial? I mean

  given $g^{ab}, g^b, g^c$ calculate $z$

and

  given $g^{ab}, g^b, g^c, g^{bc}, g^{ac}$ calculate $z$

have the same bound in uber-assuption framework as they have the same maximal degree of $2$?
How do you calculate degrees when there are rational exponents? Let's say I try to calculate bound of problem:

  Given $g^\alpha, v \in G_1$ check if $v=g^{1/\alpha^2}$

We have $R=<1, \alpha>, S=<1>, T=<1>$ and $f=1/\alpha^2$. $d_R=1, d_S=0, d_T=0$ but what is $d_f$? Should we use $\pi_i=1$ here for degree calculation or $\pi_i\Delta=\alpha^2$? In first case we have $d_f=0$, in second $d_f=2$
Can this calculated lower bound be used to draw any security conclusions about real world usage? It's defined asymptotically when $\kappa \rightarrow\infty$ so I think it tells you nothing about security of concrete implementation at any fixed $\kappa$. Am I correct?
Can uber-assumption framework be used as only support when defining new assumptions? I mean is it valid to claim that assumption holds based only on proof based on Theorem 1 or Corollary 1 from the paper?


texts: What are possible caveats when generating a group for use as parameters for Diffie-Hellman key exchange?

texts:
As reusing a widely used group for Diffie-Hellman key exchanges might lead to far easier third-party key discovery through precomputation for that specific group, I would like to know what can possibly go wrong when generating custom groups for use as Diffie-Hellman parameters.

Here is what I currently believe to be true about the requirements. Please correct me or explain further if this is wrong or not detailed enough:

A field is needed for the Diffie-Hellman key exchange to work.
Rings without zero divisors are also integral domains. Integral domains that are finite are also fields. For some reason, a group with a prime modulus is also a finite ring without zero divisors and therefore a finite integral domain and therefore also a field.
To be hard to attack, the modulus needs to be large enough and one needs to be sure that the modulus is actually prime and not just pseudo prime.


texts: Is it possible to use an S-box similar to the one used in DES in AES? How would this work?

texts: I'm reviewing some questions given to me by a professor and am stumped on this one. My initial guess is that yes, this is possible, but I do not know how to explain it, specifically for a function $\{0,1\}^8\to \{0,1\}^6$. Any help would be appreciated!


texts: How to compromise the privacy of NaCl encrypted messages, when nonce is reused?

texts:
I want to know to how break NaCl encryption when a nonce is used more than once for a given key private key. According to PyNaCl docs:

  It is VITALLY important that the nonce is a nonce, i.e. it is a number used only once for any given key. If you fail to do this, you compromise the privacy of the messages encrypted.


texts: SSL Pinning security: can MitM generate the same public key?

texts:
This is a very newbie question.
SSL Pinning is "safe" in assumption that only the real server can decrypt the public key.
By design, it should be almost impossible to find the private key from the public key.
However, is it relatively easy to create a new certificate (private key) that generates the "same" public key which the SSL Pinning trusts?
In order words, how hard is to create a new private key that generates the public key "I want".
For example, if I want to create a new certificate which the public key is:
sha256/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=
Can I easily do that?


texts: What info should be signed with a digital signature to provide entity authenticaton for DH?

texts:
$i \to r\colon\; g^x\bmod p$
$r \to i\colon\; g^y, \langle g^y,g^x\rangle_r$
$i \to r\colon\; \langle g^x,g^y\rangle_i$

Looking at run 2, I am trying to work out why it is necessary to include $g^x$ in the digital signature. Since $r$ is providing the digital signature to provide entity authentication for its public key, $i$'s public key should not need to be included in the digital signature.

Am I right in thinking the message that is being signed must be the same as the message that is being sent? Therefore run 2 should also send $i$'s public key if the digital signature is computed over both of them?

This must surely be adding redundancy and therefore inefficiency to the message.

Thoughts?


texts:
Is  this $e(g^x,g^yH^z) = e(g^x,g^y)e(g^x,H^z)$ expression is true?

where $ g$ is the generator and $ H \in G  $


texts: Is AES easier to crack when the input is small?

texts:
Say you just want to encrypt a number. For example, say the number could be any  double. A double in C# and Java is 8 bytes.

If you were to encrypt a double using AES (MS-Doc, defaults to CBC as the mode):

var cypherText = AES.Encrypt(123d); // 8 bytes

would that be trivial to crack? If not would it at least be significantly easier to crack than the cyphertext from a larger input:

var largeText = GetDeclarationOfIndependence(); // 6760 ascii characters, so 6760 bytes
var cypherText = AES.Encrypt(largeText);


texts:
Von Neumann extractor works as follows:

  Suppose $C$ is a biased coin, with $p = P[C = 1] > P[C = 0]$ and let $b_1b_2\ldots$ be sequence of results by independent coin tosses. For $i \ge 0$ one observes $b_{2i}b_{2i+1}$. If the two bits differ then one takes $b_i'$ to be the first bit. Otherwise,one takes $b_i' = \epsilon$ the empty word.

I would like to prove that in the sequence $b_1'b_2'\ldots$, bits are uniformly distributed. This would show that this mechanism is a real randomness extractor.

My approach

I applied the total law of probability in this way (please let me know how can I properly write this equation in latex):

$P[b_i' = 1] = P[b_{2i}b_{2i+1} = 01] P[b_i'= 1 : b_{2i}b_{2i+1} = 01] +$

$P[b_{2i}b_{2i+1} = 10] P[b_i'= 1 : b_{2i}b_{2i+1} = 10] +$

$P[b_{2i}b_{2i+1} \neq 01,10] P[b_i'= 1 : b_{2i}b_{2i+1} \neq 01,10] = p (1-p)$

The result is the same for $P[b_i' = 0]$.

However, then $p$ cannot be arbitrary right? Because I would need $2p(1-p) = 1$. Otherwise I have to compute the probability of $b_i' = \epsilon$, but this does not make sense because the $\epsilon$ won't appear in the final string.

How can I formally finish this situation?


texts: Transforming a key into a seed with the most entropy

texts:
I'm making a very simple encrypter in C# which is basically a Stream cipher.
The user enters a key(password), converted to a seed for a pseudo-random generator, and the pseudo-random generator generates the numbers used to shift the characters. The decrypt process goes the same, but then in inverse.

Here's the pseudo-code I use:

1. Get the characters
2. Initialize a seed with the value 0
3. Loop through each character, adding the characters' value to the seed
4. Return the seed

But that has a problem. What if I have a (poor) password, like Hello.
The encrypted output would be the same if I used eHlol or loeHl.
You can write this password in 5! = 120 ways. That's not good!

So I came up with a solution:

1. Get the characters
2. Initialize a seed with the value 0
3. Loop through each character, adding the characters' value times it's position to the seed
4. Return the seed

But that's not good either. With a large password, you would get huge skips in numbers if you modify the last number. That's bad, because you want the most permutations possible for a random number generator.

Example:

Last character(12) has a value of 10
10 * 12 = 120
Then you change it to 11
11 * 12 = 132
          ^ gap of 12

Then I changed step 4 into this:

4. Return the seed divided by the length of the key

That's not a good option either, because with large passwords it wouldn't really matter what the value was of the first character in order to make a difference.

Example:

Password size: 10
1/10 = 0
8/10 = 0

So what's a good method for user-based passwords?


texts: Initialization vector based on data which can be changed by an attacker

texts:
We need to exchange some data encrypted between a device and our software where the device does not have access to a source of randomness. Both the software and the device know the key (although they cannot access it, they can only use it for encryption using AES). We are planning to use AES in CCM or CBC (depending on authentication requirements and capabilities of our crypto library) mode for encryption.

Is it wrong to send a randomly generated value from the software to the device, hash it using SHA-256, and use that for the initialization vector?

Or is it better to send the randomly generated value encrypted as well (we can generate a proper IV on the software side)? I guess it would then matter more whether we use CCM or CBC.

The communication between the device and the software can be intercepted and changed by the attacker.


texts: 1-1 trapdoor function mapping the set of $n$-bit numbers to themselves

texts:
I am looking for a trapdoor one-to-one function $f : \{0,1\}^n \rightarrow \{0,1\}^n$ (that is, mapping the set of $n$ bit numbers 1-1 onto itself [any $n$ is OK]).

I was considering the use of something like AES-256 but unfortunately AES is symmetric.

I don't think plain RSA will work since I want powers of two.

Basically, I want something like RSA except instead of working with a mod a semi-prime $N$, I want to work mod $2^n$.


texts:
Is there any security risk in encrypting parts of blocks twice? I'd like to get around block sizes and make encrypted messages just as long as the unencrypted ones:

Block 1: Byte 0 - 7
Block 2: Byte 8 - 15
Block 3: Byte 16 - 23
Block 4: Byte 21 - 29

In this example blocks 3 and 4 overlap by 2 bytes. I plan on using CAST-128.

Thank you very much for helping!

Florian


texts:
Is it valid to XOR shift bytes to produce a hash/checksum?  I can't find any evidence that it collides more than say CRC32.

This code seems to run about 40x faster than Java's util.zip.CRC32 class.

public static long hash64( byte[] bytes )
    {
    long x = 1;

    for ( int i = 0; i < bytes.length; i++ )
        {
        x ^= bytes[ i ];
        x ^= ( x << 21 );
        x ^= ( x >>> 35 );
        x ^= ( x << 4 );
        }

    return x;
    }

public static int hash32( byte[] bytes )
    {
    int x = 1;

    for ( int i = 0; i < bytes.length; i++ )
        {
        x ^= bytes[ i ];
        x ^= ( x << 13 );
        x ^= ( x >>> 17 );
        x ^= ( x << 5 );
        }

    return x;
    }


texts: What is meant by the probability distribution of a verifier?

texts:
I'm having trouble understanding the role of probability distributions in the definitions of computational/statistical indistinguishability, especially in the definition of zero-knowledge.
From A Perfect Zero-Knowledge Proof for a Problem Equivalent to Discrete Logarithm:

An interactive proof is called perfect zero-knowledge if the probability distribution generated by any probabilistic polynomial-time verifier interacting with the prover on input a
theorem $\phi$, can be generated by another probabilistic polynomial time machine which only gets $\phi$ as input (and interacts with nobody!).

This I would understand if "probability distribution" were replaced by "computable function", such that zero-knowledge means that we cannot compute anything beyond what we can compute anyway after the proof because we did not gain new knowledge besides the truth of the theorem. But why "probability distribution"? And what is the subject of distribution here, the random coin tosses of prover and verifier? Because that would not make sense to me.
From The Knowledge Complexity of Interactive Proof Systems:

Consider a pair x, y in QNR and say that A follows the protocol. Can B obtain any additional knowledge? For the moment, assume that B follows the protocol. B "sees" [$\{b_i\}$, $\alpha$, $\{ w_i\}$, $\{c_i\}$] distributed according to a particular distribution. Without any help from a prover, we can quickly generate a random string according to this distribution: just choose $\{b_i\}$ and $\alpha$ randomly, and then compute $\{w_i\}$ from them; then compute $c_i = b_i$ for each $i$.

Here we have a very concrete example of the "subject of distribution" I mentioned above, namely [$\{b_i\}$, $\alpha$, $\{w_i\}$, $\{c_i\}$]. However, I don't quite get the usefulness of that.
Is it just that the verifier, does not know anything for certain, so he looks sort of through a "probability-distribution lens" to make sense of the world?


texts: Padding always the same, problem or not?

texts:
I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm.

My problem is that I split the message into 64-byte blocks and then apply a pkcs7 padding. The result is that the padded message always ends with a full block of 16s before encryption. Does this pose a security problem since an attacker will know the last plaintext block ?

One possible solution I might use is splitting into blocks of size 64+x instaed with x random between 0 and 15 so the padding will not be predictable. Is this a good/better idea ?

PS: I use AES-CBC with 128 bit keys


texts: Can “PrivateKey+MagicValue” decode pre-encoded data without intermediate key?

texts:
Let's say I want to build a public repository of encrypted files.

EncA(FileA)
EncB(FileB)
EncC(FileC)

And I have users with Public/Private key pairs.

PubX/PrivX
PubY/PrivY
PubZ/PrivZ

Now I want to give individual users permanent access to individual files by handing them some special MagicKey that is only for them.
However, I don't want them to be able to share FilaA with third parties except by sharing FileA directly (or by also sharing their private key).

i.e.: decrypt(PubX, MagicKey(PubX, EncAPars), EncA(FileA)) yields FileA, but with no intermediate result that can directly decrypt EncA(FileA).

A close solution I was thinking about is:

EncA is AES
PubX/PrivX is RSA

with

 EncA(FileA) = aesEncrypt(aesKeyA, FileA)
 MagicKey(PubX, aesKeyA) = rsaEncrypt(PubX, aesKeyA)
 decrypt(PrivX, MagicKey(PubX, aesKeyA), Enc(FileA)) = aesDecrypt(rsaDecrypt(PrivX, MagicKey(PubX, aesKeyA)), EncA(FileA))

but this does not do what I want, because UserX could just share the AES key with third parties who download EncA(FileA) from my repository and then decrypt directly.


texts: How to find collisions in a secret-prefix Merkle–Damgård given an adversary that can choose the IV?

texts:
I am given the following Merkle–Damgård construction:

Let $f \colon (\{0,1\}^n \times \{0,1\}^b) \to \{0,1\}^n$ be a compression function. Fix a string $\mathrm{IV}\in\{0,1\}^n$, and for $M \in (\{0,1\}^b)^+$ define $H(\mathrm{IV},M)$ as follows. Parse $M=M_1 || \cdots || M_\ell$, let
$h_0 = \mathrm{IV}$, and let $h_i = f(h_{i-1},M_i)$ for $i=1,2,\cdots,\ell$.
Then $H(\mathrm{IV},M) = h_\ell$. (Note that this does not mean that all imputs to $H$ have to be the same length.)

I'm also given an algorithm C that takes in a value for any IV, and outputs some messages $X,X’$ such that $H(IV,X)=H(IV,X’)$.

Lastly, I'm given access to a secret-key function $F_K(\cdot)=H(K,\cdot)$.

Using C, how can I find a pair of messages $M,M’$ such that $F_K(M)=F_K(M’)$?

I've looked at the proof for Merkle–Damgård constructions and understand that since $H$ is broken, the underlying compressing function f must be broken. What I don't understand is how we could possibly come up with such an M and M' with no knowledge of the IV?

I know that it is not important to know the IV to create a forgery for this construction, but I'm being asked to produce a collision; not a forgery.

I've been struggling with this problem for quite a while, and would love some help on where to start.


texts: Is there a zero knowledge proof for divisibility by 7?

texts:
For a demonstration, I would like to present a zero knowledge proof that one party has a secret number that is divisible by 7. The goal is to prove that they have such a number without releasing the number.

Is this a reasonable thing to prove with a zero knowledge system? If so, how would I go about doing it?

For bonus points, I'd like to demonstrate it with a non-interactive zero knowledge proof.


texts: I need to send 16 bytes using ECC keys on a resource-constrained device

texts:
I have a system where a resource-constrained device has to send 16 bytes. It has its ECC key pair, and a peer's Public ECC Key. We're using the p256 curve. The device also has an AES-128 hardware implementation, so we want to take advantage of that when possible. I only need confidentiality for the payload. Integrity and proof of origin are handled by other components of the system.

I've come up with my own scheme for this, bit it seems much more simple than the example implementations that I've looked at.

The device generates the Shared Secret using the peer Public Key and its own Private Key.
The device generates 16 random bytes.
The 32-byte Shared Secret is run through AES128-CMAC using the 16 random bytes as a key.
The output of the CMAC is used as the key for AES, with the 16-byte payload used as plaintext input.
The device sends its own Public Key, the 16 random bytes, and the 16 ciphertext bytes.

The two irregularities in this scheme I can think of are that:

The 16 random bytes kept public. This should be okay, since the CMAC output cannot be determined without the Shared Secret.
The payload is used as the "raw" input to AES. This should be okay, since the key is unique, and the input is small, so patterns can never emerge in the output as in typical ECB mode.

Are there vulnerabilities to this scheme? My concern comes from the fact that other protocols like that used for Bluetooth's "LE Secure Connections" are much more complicated, such as using many more inputs to the CMAC portion. I suspect that this has to do with the goal of establishing keys to use for more plaintext than 16 bytes.


texts: How can a learnable function be obfuscable?

texts:
I overheard in a lecture on cryptographic obfuscation that the learnable functions are obfuscable. But to me this seems so counter-intuitive.
Let's take a linear function (as an example of learnable function), then say I am given any obfuscated version of the function, I can always find the original function by querying an oracle having access to the original function- then how did I manage to obfuscate the original learnable function to begin with?


texts:
I have an application that would benefit from very small (e.g., 16-20 byte) EdDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" security, so having the signature be attackable by someone with a lot of resources is not a huge problem. (Full Ed25519 or similar are used for the real security parts of the system.)
How would one go about generating such a curve? Or is this an extremely nontrivial thing to do? I can find some sample code for general EdDSA but no curves other than 25519 and 448. This makes sense since small curves wouldn't have many use cases, but I have one.
Right now, I have sample code using traditional ECDSA with the Brainpool P-160t curve. It works, but I'm wondering if an Edwards curve would be faster and would offer better security with an even smaller key and signature size.


texts: How often does RSA-OAEP have a leading zero?

texts:
We are working with a third party vendor who is very tight lipped about their security protocols, and one of our customers who used this vendor's products is claiming that approximately one in every 250 times they initialize the system, it generates a key file that is 127 bits instead of 128, and gets rejected. They believe that when the key has a leading zero, that zero is dropped, resulting in a key that is too short and is rejected by the system. My understanding is that in the final step of RSA-OAEP encryption, the key is left-padded with zeroes. I'm not even sure they're using OAEP. (Personally, I think if they were really concerned about security they'd be less worried about hiding their implementation details and more worried about only using a 128 bit key, but the attack surface for this system is very, very small.)

I don't follow all of the math leading up to that step, but how often is the result of the modular exponentiation step exactly the desired number of bits? My expectation is that if it were an issue with dropping leading zeroes, that the error would occur much more often than 1 in ~250 (which I assume is 1 in 256, since most of the process is handled in octet strings).

Edit: I did find clarification that there is an issue in the documentation we received and it is 128 bytes.


texts: Security problems if ECDH and ECDSA use the same key

texts:
Hy!
I want to use an EC key for ECDH and ECDSA too. Using the same key does compromise the security of the key in a cryptographic / mathematical sense?
I read a lot in this theme, but I found nothing exact. I know that the usage of the same key for encryption and for signing is not recommended (because of encryption keys must be escrowed, and signing keys must not be escrowed), but is there any mathematical/cryptographic reason to use different keys? (Only in Elliptic curve cryptography of course). Is there an RFC or something formal paper about this? (A haven't found any)
I want to generate an EC key on a HSM, but I can't enable SIGN, and DERIVE at the same time. (I think that's because the HSM generates an ECDSA key in the precending case, and an ECDH key in the latter case, and don't know what to do if they are enabled in the same time). But I can generate an EC key with openssl without so much as to know if I want to use it for ECDH, or ECDSA purposes. Is there any workaround for that? Can I generate a general EC key on the HSM?


texts: The security proof for Key Policy Attribute Based Encryption

texts:
My question relates to the original KP-ABE paper:

http://research.microsoft.com/en-us/um/people/vipul/abe.pdf

I'm having trouble understanding the proof (pages 10–13) that the scheme is secure in the Selective Set Model:

  Proof: Suppose there exists a polynomial-time adversary A, that can attack our scheme
  in the Selective-Set model with advantage $\epsilon$. We build a simulator B that can play the Decisional BDH game with advantage $\epsilon/2$. The simulation proceeds as follows:

  We first let the challenger set the groups G1 and G2 with an efficient bilinear map, e
  and generator g. The challenger fips a fair binary coin $\mu$, outside of B's view. If $\mu = 0$, the challenger sets $(A, B, C, Z) = (g^a,g^b,g^c,e(g,g)^{abc})$, otherwise it sets $(A, B, C, Z) =(g^a, g^b, g^c, e(g,g)^z)$ for random $a, b, c, z$. We assume the universe, U is defined.

  ...

  Phase 1 A adaptively makes requests for the keys corresponding to any access structures T such that the challenge set $\gamma$ does not satisfy T . Suppose A makes a request for the secret key for an access structure T where $T(\gamma) = 0$. To generate the secret key, B needs to assign a polynomial $Q_x$ of degree $d_x$ for every node in the access tree T .

  We first define the following two procedures: PolySat and PolyUnsat.

  PolySat$(T_x,\gamma,{\lambda_x})$ : ....

  PolyUnsat$(T_x,\gamma, g^{\lambda_x})$: This procedure sets up the polynomials for the nodes of an access tree with unsatisfied root node, that is, $T_x(\gamma) = 0$. The procedure takes an access tree $T_x$ (with root node x) as input along with a set of attributes $\gamma$ and an element $g^{\lambda_x} \in G1$ (where $\lambda_x \in Z_p$).
  It first defines a polynomial $q_x$ of degree $d_x$ for the root node $x$ such that $q_x(0) = \lambda_x$. Because $T_x(\gamma) = 0$, no more than $d_x$ children of $x$ are satisfied. Let $h_x \leq d_x$ be the number of satisfied children of $x$. For each satisfied child $x'$ of $x$, the procedure chooses a random point $\lambda_{x'} \in Z_p$ and sets $q_x(index(x')) = \lambda_{x'}$. It then fixes the remaining $d_x - h_x$ points of $q_x$ randomly to completely define $q_x$.

  ...

  To give keys for access structure $T$, simulator first run PolyUnsat$(T,\gamma,A)$ to define a polynomial $q_x$ for each node $x$ of $T$.

  ...

My question is relating to the last (bold) paragraph: How is it possible to define such $q_x$, since the simulator cannot learn $\lambda_{x}$ from $g^{\lambda_x}$ unless he can compute discrete log?


texts:
Suppose you have the following set up for RLWE: $K$ is a cyclotomic field of degree $n$ over $\mathbb{Q}$, and $p\in\mathbb{Z}$ is a prime integer that splits as follows in $R = \mathcal{O}_K$: $p\mathcal{O}_K = \prod_{i=0}^{n-1}\mathfrak{p}^{e}_i$. Let $R_p = R/pR$ and $R^\vee$ denote the dual lattice. Let an RLWE sample be $(a,b)=(a,(a\cdot s)/p+e)\in R_p\times \mathbb{T}$, where $s\in R_p^\vee$.
My question is: given access to samples $(a,b)$ and $s \bmod \mathfrak{p}_iR^\vee$, can you solve $\mathfrak{p}^e_i$-RLWE? i.e. can you find $s\bmod\mathfrak{p}^e_iR^\vee$? If not in generality, then what conditions need you impose to find a solution?


texts:
Consider the stream cipher that consists of 3 LFSRs, with the output of one coming being used to determine which of the other 2 is used that clock cycle.

Both the IV and the polynomials are secret.

Is this broken?  I know that the related shrinking generator is not, but needs buffering to avoid timing attacks.


texts:
I am really not much of a crypto guy so I don't really get how a differential power analysis on AES works.

Can somebody explain it to me how it basically works?


texts:
We recently had the question whether it's possible to have multiple private keys with one public key for the cramer-shoup cryptosystem.

There it was stated that finding such "secondary" private keys is possible if $log_{g_1}(g_2) \bmod q$ is known. However computing this discrete logarithm is infeasible as both $g$s need to be random.

But the description also mentions that shared group parameters are allowed, meaning a party A could generate the $g$s so other partys could use them.

Now let's assume this party A to be some standardization body, like NIST, getting the $g$s by somebody (for example the NSA). Now let's further assume that there exists some $a$ for which $g^a_1\equiv g_2 \pmod q$ holds and that the supplying party knows $a$.

Can the supplying party (knowing $a$) anyhow break the security of Cramer-Shoup (=IND-CCA2) if honest parties use the backdoored parameters?

Note: "honest parties" use the standardized group and choose their private keys following the specification and assume security of the parameters.


texts: I am encrypting a text file using AES 256 encryption. Does it add much to the security of the file’s contents to also add a salted password to the file? (I don’t believe it would add much) Can a salted password be added as part of the encryption process to make the encryption itself more secure? ( I don’t believe so - my understanding is that salting only makes the password more difficult to determine, not the encryption )


texts: I am a final-year student in the Department of Computer Science. I do my bachelor thesis in cryptography and the subject is multilinear maps. There exists a good book describing the concepts? Or maybe other theses..


texts: Can I publish the accumulator trapdoor and still keep it secure?

texts:
I'm implementing the Camenish-Lysyanskaya dynamic accumulator. It seems to me that the accumulator is provably secure because the trapdoor is unknown to the attacker.

The risks should be the fact that, given the Euler theorem, I can forge an element that is was not accumulated but still passes the test, namely:

$v^x\equiv v^{x\mod\phi}\mod n$

where $v$ is the accumulator without $x$, $\phi$ is the Euler function, and

$x\mod\phi\equiv x_f$

so we have a forged $x$ that passes the test.

What if I don't care about the factorization of n and I even publish $\phi$, but I just require that an acceptable integer $x_{acc}$ must be $A<x_{acc}<A+\phi$ with $A<\phi$.

This means that if, for example my input is the string "user1" this string will be hashed into an integer in the accepted interval.

If $\phi$ is large enough, I still can defy collisions and stop caring about keeping $\phi$ secret. All the possibly forged inputs fall automatically out of the specified interval so they will be discarded immediately. In other words there is no valid integer congruent to integer that maps the input "user1"

What do you think? Is this feasible? Or am I missing something obvious?
I understand I may have skipped something important, I am not in the field, please ask for clarifications.


texts: Deriving Keys for Symmetric Encryption and Authentication

texts:
So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it OK to derive the cipher key, authentication key and IV from a master key? It wouldn't stop the need for key rotation policy (changing the key every 30 days), but it would greatly simplify it. So here's the concept:

MasterKey = 256 - 512 bits of CS random entropy

Then, on encrypt:

Salt = 256 bits of random entropy
Derivation = PBKDF2(SHA-512, MasterKey, Salt, 10000, 640bit)

CipherKey = Derivation[0:256bit]
AuthKey = Derivation[256bit:512bit]
IV = Derivation[512bit:640bit]

Then, the Salt is all that's shared in the ciphertext package: Salt || CipherText || AuthText...

The few points here:

That MasterKey should be high entropy (at least the number of bits of Cryptographically Secure random as the longest required key).
The salt should be as strong as practical as well (CS as well), since salt collisions will automatically become cipherkey, authkey and IV collisions.
The maximum length of a single derived key should be less than the blocksize of the PRF used in PBKDF2 (to reduce exposure of the master key if a derived key is found).

For example, if you used MD5 (bs of 128 bit) to generate a 256 bit key, if that 256 bit key was found (brute force, or other weakness), the entire 128 bit output of a PBKDF2 round would be found. Therefore, the entire PBKDF2 output would not need to be brute forced, but only a single round of it (still hard, but much easier). But if the BS is larger (sha512 vs 256bit key), then finding a derived key would only give you 1/2 the output of a round, making the search much harder (since there are a LOT of inputs that would generate the same 1/2 output)...

The iteration count feed into PBKDF2 should be high enough to provide a proof of work on the derivation, but is obviously application dependent.

Based on my understanding, it demonstrates good forward security (not perfect, but good) in that if you are able to find the CipherKey or AuthKey of a particular message, they would not be applicable to future or past messages. You would need to use that information to brute force the derivation, which would be non-trivial in the least. So therefore, as long as the master key is not compromised, the individual derived keys should be safe and practically independent of each other.

Am I on track here? Or is there something that I'm missing?


texts: Solving a discrete logarithm using GDlog

texts:
I am trying to calculate an $x$, such that $t = g^x \pmod p$ in order to crack a weak ElGamal encryption for university.

I found GDlog, but I cant figure out how I can use the input to calculate my $x$.

Here is what we got (from gdlogs example code):

p:1000000000000000000000000000057 //prime number, modulus
q:290240017                       //(p-1)/2
g:5                               //generator
t:519335238006017621936447751736  //member of the group

GDlogs result: Logarithm of the 519335238006017621936447751736 to the 5 is 142363323.
My question is: What is the number that GDlog outputs (142363323)?

This is what is written in the README:

  Find $0 \le x < q - 1$ such that $g^{x (p-1)/q} \pmod p = b^{(p-1)/q} \pmod p$ (assuming that such $x$ exists).

But I still can't figure out how to do it.


texts: Finding Linear Redundancy by counting the number of distinct frequency distributions of absolute walsh transform


texts: Can I use a HMAC for Replay Attack protection?

texts: I am considering a system where a small device accepts messages/commands from another device over a wireless channel.  I am worried about replay attacks.  The messages will be encrypted.  What are well-vetted schemes for protection against these attacks?  I am not too keen on timestamps (as described in this Q&A) as I don't really want to have to keep clocks synchronised.  I am currently thinking of using HMAC but want to be sure that I'm doing the right thing.


texts: Is this RSA / SRA cipher modification secure?

texts:
I have modified SRA algorithm to suit my problem and I'm wondering if it is still safe to use.

Main question is if RSA Encryption key that contains even number is a safe one way function?

In RSA algorithm: encrypted message is (message)^e1 % N

As far as I understand when I select e1 as even number, multiplicative inverse of e1 mod N won't exists.

If e1 is selected even, the algorithm strength remain unchanged?
If not, what is a different way to public encryption key and ensure everybody that I do not posses decryption key?


texts: Where can I find NIST SP800-38E's Test vectors?

texts:
I am implementing XTS-AES mode in NIST SP800-38E, But I didn't find test vectors about it.

Who can help me?


texts: Can Stream Cipher be Used to Encrypt & Decrypt a File (Eg: .txt .docx .exe .zip)?

texts:
I was new to cryptography. And I know that in the world of cryptography there are two types of Symmetric Algorithms:

Stream Cipher (RC4, Salsa & Chacha)
Block Cipher (DES, AES)

And when doing some research on their implementation, I only looked at file encryption & decryption software products that use the AES algorithm (Block Cipher in general). (i know that AES is secure)
Can anyone help me answer the question whether Stream Cipher can be used to encrypt files like: .txt .docx .exe .zip?
I know this is a stupid question. Please forgive me.


texts:
I have read a lot about the concept of adding a salt to a password and understand that it protects against various attacks, especially the use of rainbow tables. But this kind of attack is based on getting access to the server side stored-password database.
What if the passwords are never stored? Because the salt is, per definition, not secret, it doesn't help to make a weak password stronger (to my mind, only key stretching will help in this case, right?). Hence an application that encrypts only on the client-side (user enters password > KDF > key > encryption) doesn't seem to have any benefit when feeding a salt into the KDF algorithm.
Is it OK to set the mandatory salt parameter of KDF functions (e.g., PBKDF2) to a hardcoded value? Or have I completely overlooked another salt feature?


texts:
One of the weaknesses of Ceasar is that an attacker knows the order of my alphabet, IE ABC...Z

If I scramble this, then are there enough permutations to ensure my resultant ciphertext cannot be brute forced.
Does this then only leave me vulnerable to frequency analysis.


texts: Decrypting ciphertext that is missing a block

texts:
In the AES encryption, suppose that the key is known. The ciphertext is also known except for a block of the same size as the key. For example, the adversary knows $k, c_0, c_1, \dots, c_{n - 1}$; They do not know the final ciphertext $c_n$.

In the worst case scenario for the attacker, how hard is it for them to successfully decrypt the ciphertext, compared with the case when the key is unknown and the ciphertext is fully known?


texts: Has there ever been more then a theoretical difference between preimage resistance and second preimage resistance?

texts: In other words, has there ever been a point in time in which having the content of a message has actually helped break a hash function?


texts: What are the implications of the new alleged key recovery attack preprint on SIMON?

texts:
Just recently, a new attack was published against SIMON-32/64 which claims to also be applicable to other versions of the cipher. The paper is titled A Note on SIMON-32/64 Security (archived 2019-05-11) and describes a new practical, low-cost key recovery attack which is significantly faster than exhaustive search. Unfortunately, the authors spend more time describing a zero-knowledge proof that allows them to refuse to publish their analysis methods than in actually describing their analysis.

Abstract: This paper presents the results of a new approach to the cryptanalysis of SIMON-32/64, a cipher published by NSA in 2013. Our cryptanalysis essentially considers combinatorial properties. These properties allow us to recover a secret key from two plaintext/ciphertext pairs, in a time ranging from a few hours to a few days, with rather limited computing resources.
The efficiency of our cryptanalysis technique compared to all known cryptanalyses (including key exhaustive search) is a justification for not revealing the cryptanalysis techniques used. We have adopted a zero-knowledge-inspired method of proof which was initiated in [11].

Given only what is known so far, what are the implications of this attack? Does it apply to any SIMON-like block cipher, or is it a general technique that works on a large number of different ciphers?


texts: How to accurately calculate Unicity Distance for English?

texts:
The Unicity Distance for the DES cipher is around $8.6$ characters, and can be calculated using the $U=H(k)/D$ formula, where $D = R - r$, and where $R = 8$ is the number of bits in a byte (ASCII is 7 but we are rounding up), $r \approx 1.5$ bits is the average entropy of a single letter in written English, and $H(k) = 56$ bits is the DES key length.

If the above is correct then, for a 16 bit cipher, your UD would be around 2.46. Surely you need more than 2 characters to tell whether what you are getting is valid English. Can anyone explain?

This is a follow up question from here: https://crypto.stackexchange.com/a/22929
The code to run the experiment can be found here: https://github.com/coolfeature/sac

Here are some calculations:

Unicity Distance is The Entropy of the key space / the redundancy
D = R - r
Assuming R is 8.0 bits (ASCII) and r is 1.5.
H(K) / D == 16 / 6.5 == 2.461538

We need 2.461538 letters to get a meaningful message.

65536 candidate keys - block size 1 (2 chars) possible meaningful : 8 - chance of getting a meaningful msg: 0.000122

2809 candidate keys - block size 2 (4 chars) possible meaningful : 64 - chance of getting a meaningful msg: 0.000000

1600 candidate keys - block size 3 (6 chars) possible meaningful : 512 - chance of getting a meaningful msg: 0.000000

896 candidate keys - block size 4 (8 chars) possible meaningful : 4096 - chance of getting a meaningful msg: 0.000000

20 candidate keys - block size 5 (10 chars) possible meaningful : 32768 - chance of getting a meaningful msg: 0.000000

20 candidate keys - block size 6 (12 chars) possible meaningful : 262144 - chance of getting a meaningful msg: 0.000000

1 candidate keys - block size 7 (14 chars) possible meaningful : 2097152 - chance of getting a meaningful msg: 0.000000

The key 0x431a(17178) found after 7 attempts
7 blocks (14 characters/bytes needed) - DECRYPTING...
Message Entropy = 3.854248670673993


texts: Why is a certificate needed at client side

texts: I was wondering why you need a certificate of the server at client side. Can't you just fetch it from the CA itself? I am using mbedtls to program some small client, and in all the client examples they use a certificate of the server. However, if you need to specify the server certificate to be able to make a connection to it, then how are browsers able to verify all secure websites? I don't think they have all certificates of all servers hard coded (which is off course not possible as new secure websites arise every day)


texts: How to use HMAC for authenticating multiple messages

texts:
The standard HMAC function, $H(K, m)$, authenticates a single message $m$.

Instead, I'd like to authenticate 2 messages, like this: $$H'(K, m_1, m_2)$$

The simplest solution, $H(K, m_1||m_2)$, confuses e.g. "ab"+"cd" or "abc"+"d" as messages.

Would this be secure instead: $H(H(K, m_1), m_2)$?


texts: Is it safe to use GZIP to avoid padding related attacks

texts:
I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different padding schemes but I want to retain interoperability even when mixing CommonCrypto implementation and OpenSSL ones. (My library should work under Linux which have only OpenSSL, iOS which have only CommonCrypto and OS X which have both.)

Given that my library already have gzip and gzip archives can still be unarchived with any byte string concatenated after it, I am considering this padding scheme:

Gzip the incoming data.
Concatenate this archive with random bytes to bring the length up to AES block boundary.

When decrypting, the gzip algorithm will automatically discard the appended random bytes.


texts: Are there any known security issues when doing the following chaining of BCrypt Hashes: 'bcryt(bcrypt(user-pw, work-factor1), work-factor2)'

texts:
I am currently developing a protocol which would be able to "upgrade" the strength of a bcrypt password hashes without the knowledge of the user-password so a system may upgrade it without user interaction.

Bcrypt requires the password as input to calculate the hash, if you already have a hash, there is no way to "calculate some more rounds" to increase the work-factor (see here).

Example

So the idea is to just chain the bcrypt hash with a stronger work-factor und using the old bcrypt hash as input like:

bcryptHashOld = bcrypt(pw, 4);
bcryptStronger = bcrypt(bcryptHashOld, 10);

Which would be the theoretical strength of 2^4 = 16 and additionally 2^10= 1024 => 1040 iterations.

Is there any issue with this protocol, ie. hashing the hash WITHOUT the user password? Does the work-factor increase as I have shown in the example above?

Theoretical Problem Statement

As SEJPM added in the comment a better problem statement would be: "whether chaining two PRFs yields another PRF and whether this chain can be evaluated using less work than two successive PRF calls. In formulas: Whether $F_{k1}(F′_{k2}(m))$ is a PRF that requires evaluations of $F$ and $F′$ to be evaluated"

(Note: I'm not asking how to increase the work factor, but if this approach is cryptographically sound)


texts: The equivalence of exponentiation and multiplication over elliptic curves

texts:
I am trying to convert $(g^a)^{i^2}\mod p$ to an equivalent Elliptic Curve expression.
Let's assume a base point $G$ over an appropriate ECC.
Will $(g^a)^{i^2}\mod p$ be equivalent to $G\cdot a\cdot i^2$ (where the dot operation is multiplication over the elliptic curve)?


texts:
I'm aware of these posts:

What is a "rewinding argument"?

Random oracle model proofs and programmability

But I think, some concrete examples are missing.

I need to know how exactly rewinding technique is used with some examples.

Moreover, I'd like to know how many time we need to rewind a party and in the case where we consider a semi-honest adversary, the adversary's random value is fixed no matter how many times we rewind it.


texts: Does the following equation hold in bilinear pairings?

texts:
$e:G_1 \times G_1 \rightarrow G_2$,
where $g$ is a generator of $G_1$.
$\text{H}: \lbrace 0,1\rbrace ^* \rightarrow G_1$.
Is $e(\text{H}(D)g^a,g) == e(\text{H}(D)g,g)^a$ ? where $D$ is a string