texts:
With classic diffie-hellman it's possible do it with more than two parties. Is this applicable to elliptic curve diffie hellman?

I'm guessing not.

With ECDH you have a scalar number as the private key and an x, y coordinate (or just x coordinate in the case of Curve25519) as the public key. You multiply the coordinate by the scalar and you get a new coordinate. The x coordinate of that is the shared secret.

If you had two public keys and one private / public ECDH key pair...  if you didn't discard the y coordinate you could multiply one of the public key coordinates by the private key but then it's not clear what you would do with the other public key coordinate. Maybe there's nothing you can really do to facilitate ECDH for more than two parties?


texts: Should HMAC or NMAC or plain Keccak be used for a secure MAC?

texts:
After some digging around in the HMAC spec I found this (paraphrased):

  Step 1: If the length of Key equals the block size of the hash
  function (512 bits/64 Bytes for SHA-256), set the key equal to the
  key. Go straight to step 4.

  Step 2: If the length of key is greater than the block size of hash
  function, hash the key to obtain a string the same length as the hash
  function output, then append 0s up to the length of the Block Size.

  Step 3: If the length of key is less than the block size of the hash
  function, append 0s to the end of the key so that the key length is
  now the same size as the block length.

So if you input a 512 bit key of:

ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a
2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f

Then it will be untouched. If however you add at least one Byte to the end e.g. 'aa', the key now becomes:

3f78f631195be2c7675973fb6c542a7b9b6cda1e6ba59bd1093ebacf70408f53
0000000000000000000000000000000000000000000000000000000000000000

Or if you have less than the block size, perhaps a 256 bit key of:

ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a

Then it now becomes:

ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a
0000000000000000000000000000000000000000000000000000000000000000

It would seem that the more secure way to use HMAC would be to input a key that is exactly equal to the block length of the cipher being used, which for SHA-256 would be 512 bits. This must give full 512 bit diffusion of the key into the HMAC. Otherwise HMAC will turn at least half of the key to zeros.

I did a bit more reading and found that the there is an NMAC spec which is similar to HMAC but requires two independent random keys:

  NMAC = H(k1 || H(k2 || m)).

Questions:

What is the security impact of having at least half the key as null Bytes in HMAC (which would happen in the majority of cases, unless care was taken to specifically choose key sizes the same length as the block size)?
In general, which is the more secure construction, HMAC or NMAC? Given that the spec for HMAC seems to not use two independent random keys, but derives the inner and outer keys from the main key, and also weakens the main key in the first 3 steps.
If I had a key longer than the block length of the hash function, would it be stronger to use the NMAC construction instead of HMAC? Perhaps by splitting the full random key in half to use as k1 and k2. For example, I have a random 768 bit key, I split that into two 384 bit keys then use that with NMAC. Under HMAC that 768 bit key would be reduced to 256 bits psuedo random concatenated with 256 bits of 00000000000000000000... In this case I think NMAC would be more secure, correct?
I know HMAC is designed specifically for the Merkle–Damgård type hashes, but can Keccak (sponge construction) be used with HMAC? Or is it better to use it with the NMAC? Or simply do H(k || m) as the Keccac authors intended? Length extension attacks are no longer an issue for Keccak.


texts: Encrypt a file with AES using a secret key derived with Argon2

texts:
I would like to encrypt some sensitive files on my computer and smartphone so that they remain unreadable even if the computer is stolen.

So far as I'm concerned, AES is the best encryption algorithm, so I would go for it. For the AES, I also need a secret key (or cipher key). Therefore, I need a key derivation function, preferably a password-based one. Obviously, I do not want to store the derived secret key on the computer (or smartphone), otherwise, the encrypted text could be easily decrypted using the secret key.

I have read that Argon2 is considered the best choice for password-based key derivation these days.

Now, in the "argon2 cffi Documentation Release 19.1.0" (January 17, 2019) I have read that "Argon2i uses data-independent memory access, which is preferred for password hashing and password-based key derivation" (page 3). Then, on page 9 I read the very same words about Argon2id: "That makes it [Argon2id] the preferred type for password hashing and password-based key derivation".

Now my first question is: Which of the two types of Argon2 is the best for password-based key derivation?

Further, as per the same document, the argon2.PasswordHasher algorithm "always uses a random salt for hashing". This implies that every time I enter my password to decrypt the file, the hashing algorithm will produce different secret keys, so in no way can I reproduce the secret key to decrypt my file.

Of course, I can store the salt on the computer (or smartphone) but then two other questions arise:

How can I use Argon2 with a predefined salt?

Is there a point in using a salt that is freely accessible (if my data are stolen)?

So, can somebody shed light on how Argon2 can be used as a password-based key derivation function? And what would be the solution to my problem?


texts: Parallelized Pollard's Rho algorithm for ECDLP + Jacobian coordinates

texts:
My implementation of the parallelized Pollard's Rho algorithm is using Jacobian coordinates to avoid the costly inversion operation when performing point addition.

I am wondering if there are any methods to check for distinguished points while in Jacobian form, since switching back to affine coordinates requires an inversion?


texts: Does SHA-1 hash have quasi commutative property?

texts: Although I have tested with a program and found negative answer, I want to be sure.


texts:
Let c = a.b mod p

where p is n bit prime number (e.g. 128 or 160 bit prime number);
a - random number between 1 and (p-1);
b - random number between 1 and (p-1);

Given c, a and p, how hard to compute b?


texts: What is the simplest post-quantum asymmetric cryptographic algorithm for key exchange?

texts:
This question has been burning in the back of my head for the past few days, and a quick Google search doesn't yield any usable results.
As the title suggests: What is the easiest-to-understand post-quantum asymmetric cryptographic algorithm that currently exists (as of 10 May 2021) for key exchange?
To establish common ground, assume that I understand everything from Khan Academy's Math Syllabus. On top of that, assume that I have gone through all of the undergraduate courses for MIT's Electrical Engineering & Computer Science courses.


texts: For encryption with a passphrase, should you re-use the same salt for key generation?

texts:
Let's say I have a simple "vault" application where users can enter data and a passphrase, and it will be encrypted, requiring them to re-enter the passphrase to decrypt it.

This would be implemented as follows:

generate salt for key generation
generate key from (salt, passphrase) with argon2, scrypt, or whatever else libsodium is using
generate nonce or iv
encrypt and sign (plaintext, key, nonce or iv) with chacha / aes-gcm / whatever else libsodium is using
store (ciphertext with signature, salt, iv or nonce) as I need all 3 to decrypt from the passphrase

My question: is there an advantage or disadvantage to re-using the salt everytime for the same user? Most crypto examples re-use keys, which is fine as long as the IV or nonce is different. However if I generate and store the salt everytime I'm effectively using a different key everytime. Is this good / bad / unimportant?


texts: how to compute Bit Independent Criteria on a 4-bit S-box?

texts:
The idea of Bit Independence Criterion (BIC ) was introduced by Webster and Tavares . For a given set of avalanche vectors generated by complementing a single plaintext bit, all avalanche variables should be pairwise independent.
in https://peerj.com/preprints/26452/ Sankhanil Dey1 and Ranjan Ghosh2,introduce the computation on the s-box values instead of the avalanche values and said that it is balanced then BIC achieved. in this way all s boxes will satisfy BIC
table below illustrate the paper computation.
i think we have to find the avalanche first and the compute the all possible or total six xored 4-bit BFs on the avalanche vectors using the formula:
a+d/a+b+c+d
Here, a=(1,1), d=(0,0), b=(1,0), c=(0,1).


texts:
I assume 1 atleast is excluded from the set of possible secret keys, since you can compromise the key just by looking at the equation if it is 1 $g^1 \mod p \equiv g$. In case g is less than $p$ obviously.

What about lower numbers like anything below 100, would it be clever to discard them from the possible keys in case an attacker tries to brute-force the key with $g^{1..p-1} \mod p$?


texts: Which hash function is used for signatures ssh-rsa and ssh-dss?

texts: I'm building a fuse client for ssh/sftp. I write the required ssh and sftp functions myself. Now I read in RFC4253 that before signing the data to sign is default hashed. In RFC4253 8. "Diffie-Hellman Key Exchange" SHA1 is mentioned as the default for ssh-dss. What is it for ssh-rsa?


texts: Check correctness of data using only publicly known variables and a server response

texts:
A smart contract (a publicly known program) needs to check if the data D is correct (belongs to some fixed set). It is by definition correct if our trusted server checks it and decides it's correct.
To check it, the contract receives a hash H from a trusted server. The server knows secret S. It should be impossible to infer S from H.
So we have a publicly known function f(D, H, S) with unknown to the public argument S.
Is it possible for the smart contract to check whether the data is correct without using any unknown to public variables (including S)?
It seems for me that it is impossible: the contract could check it only comparing f(D, H, S) to some fixed value (or set of values), but we can't because we don't know S. Right?
Or is there some cunning way to check it without revealing S?
The smart contract can't ask the server. Smart contract can be called by a hacked with arbitrary D and H. Hacker should be unable to convince the contract that it is called with correct data.
The server cannot write to the blockchain (otherwise it would be trivial: the server would write a pair of D and its correctness boolean value, the contract then would just check it).

It seems that the above question is equivalent to the following formal problem:
Having natural number D and number H dependent on D, is it possible to check correctness of D (it belonging to some set) by checking if g(D, H) = 0 for some publicly known function g? (H is allowed to be forged by a hacker.)


texts: Are SHA-2's $\mathit{Maj}$ and $\mathit{Ch}$ functions non-linear?

texts:
SHA-2 has two functions:

$\mathit{Maj}(x, y, z) = (x \land y) \oplus (y \land z) \oplus (x \land z)$

$\mathit{Ch}(x, y, z) = (x \land y) \lor (\neg x \land z)$

Are these two functions non-linear? Can they be used in place of S-boxes in block ciphers?


texts:
Let $m_1 = \underbrace{ \{0,1\}^n  \times \cdots \times \{0,1\}^n }_{L\text{ times}}$ be a message of space $\mathcal{M}^L$, where  $\mathcal{M} = \{0,1\}^n$.

Let $c_1$ be the encryption of $m_1$ using CBC mode.

Let $x \in \mathcal{K}$ be some binary string.

Finally, let $m_2$ be another message such that:

$m_2[1] = m_1[1] \oplus x$
$m_2[i] = m_1[i]$ for $i = 2, ... ,n$

How can I modify $c_1$ to be a $c_2$ that is the encryption of $m_2$ ?

I didn't figure out how to modify $c_1$ directly, I could only think about something like $\oplus$ing the Initialization Vector with $x$, so $c_2$ would somehow have both $m[1]$ and $x$ used in its computed first block.


texts: Testing a steganalysis technique on realistic data

texts: I'm developing a new image steganalysis technique, and I'd like to test how effective it is in practice.  How could I do this?  Are there such things as standard "test vectors" for steganalysis?


texts:
I am using OAEP in a project and I want the resulting number of bits (n) to be 288 bits. Most of the implementations online seem to be for 1024 bits and using SHA-256 and I was wondering if truncating the number of bits in the G and H functions and then xoring would result in any security issues such as an increased probability for a collision to occur.

Edit: So in my example, n = 288, k0 = 72. For r, I am using a system random generator from the python library: SystemRandom().getrandbits(k0BitsInt)

Code:

Here is my implementation, a bit messy and uses Sagemath because I want to encrypt using finite fields. But the padding should look the same.

Could you help me with this. Thanks


texts:
I'm having some issues finding keys to a Feistel network. The function is unknown but we can have as many plaintexts and their given ciphertexts as we want.

I'm trying to generalize the cryptanalysis of this Feistel network for 10 rounds but I can only get the keys for the first round. Do you have any answers or tips?


texts:
Function $f$ is a length shortening function. It reduces to log of size of input, i.e $|f(x)|/\log(|x|) \leq$ $a\ positive\ constant$. Is this a one way function?

Edit: $f$ is any function. Unknown definition, only constraint on the ratio being constant for all $x$


texts:
In the following paper (page 5) they have a proof that a triple $\left(g,b_{i-1},b_{i}\right)$ is of the form: $\left(g,g^{x},g^{x^{2}}\right)$ for some x.

The relevant text from the paper is as follows:

They say the protocol is based on a classic proof that a tuple is a DH tuple, however I don't agree because I think they're missing a fundamental issue:

In the ZKP of a DH tuple, the order of g is known, however, here - the order of g is not known because it might leak information about $\phi(N)$.

My goal is to turn the protocol in the paper to a Sigma protocol to make it non-interactive.

I tried to construct a witness extraction (to prove the special soundness property) for the protocol in the paper but I constantly hit a wall where I have to know the order of g:

So assume that we have 2 different transcripts with the same $z_{i},w_{i} $ but different challenges $c_{i},c'_{i}$ that the verifier accepts.

Thus, the following equations hold:

$(1)~\,g^{y_{i}}\cdot b_{i-1}^{-c_{i}}=z_{i}$

$(2)~b_{i-1}^{y_{i}}\cdot b_{i}^{-c_{i}}=w_{i}$

$(3)~ g^{y_{i}'}\cdot b_{i-1}^{-c'_{i}}=z'_{i}$

$(4)~ b_{i-1}^{y'_{i}}\cdot b_{i}^{-c'_{i}}=w'_{i}$

From the first equation and the third equation we get that:

$g^{y_{i}}\cdot b_{i-1}^{-c_{i}}=g^{y_{i}'}\cdot b_{i-1}^{-c'_{i}}$ , thus   $g^{y_{i}-y'_{i}}=b_{i-1}^{c_{i}-c'_{i}}. $

However, now I'm stuck because I cannot find $\left(c_{i}-c'_{i}\right)^{-1}mod\,\phi(N)$ because I don't know $\phi(N)$ in the first place  (as an efficient witness extractor), nor I can do some kind of $gcd(a,b)=1$ trick .

At the same time, this paper hints that it's probably not possible to construct a Sigma protocol while working in groups of unknown order.

However, the protocol in the timed commit paper argues that each ZKP of the $(g, g^x, g^{x^2})$ triples has negligible soundness so it seems to have all the preconditions for a candidate for a Sigma protocol.

What am I missing?

How do you prove the soundness property of the ZKP from the paper without witness extraction (which seems not possible)?

(By the way - I am aware of a paper that proves this in a different way, I merely want to understand what I'm missing here).

Many thanks in advance.


texts: What is the hard problem for this algebraic encryption construct?

texts:
I would like to know what cryptographic hard problem this reduces to.

Select two large prime numbers $p$ and $q$, and let $N=pq$.  Select a random positive integer $r$.  Compute the encryption of plaintext $M$, ($M<p$) as $$
E_I(M)\ =\ (M\ +\ r\times p)\mod N$$

This is the inner encryption of the Algebra Homomorphic Encryption Scheme:  Xiang, Guangli, Benzhi Yu, and Ping Zhu. "A algorithm of fully homomorphic encryption." Fuzzy Systems and Knowledge Discovery (FSKD), 2012 9th International Conference on. IEEE, 2012.

Update: @poncho points out an easy GCD recovery attack against the inner encryption as stated.  In fairness, the inner encryption was never to stand alone in Xiang's paper.  I believe we can fix this by two changes:

Replace $N$ with $q$, and assume $q>p$ and $q$ is large enough to contain the message and factors of $p$, and
Require $r$ such that $r\times p>q$

Giving: $$E_I(M)\ =\ (M\ +\ r\times p)\mod q$$

Regardless, I'm interested in what the hard problem might be on such a thing.

I am relatively new to this.  I looked at a few hard problems; none of the residuosity or discrete logarithmic problems seem to apply, but I'm hesitant to say that it's integer factorization or RSA in case there is some problem with a stronger assumption that fits.  I want to get a good characterization of the construct so that I may describe it accurately.

Xiang et al. claims that the overall method is derived from ElGamal, and so I believe they feel the reduction is that of ElGamal (Discrete Logarithms), despite having introduced the inner encryption construct.

Thanks for your help!


texts: Serious Cryptography by Jean-Philippe Aumasson - Chapter 5 Stream Ciphers - Attacking Salsa20/8 - Page 100 Last Paragraph

texts:
I'm currently reading "Serious Cryptography - A Practical Introduction to Modern Encryption" written by "Jean-Philippe Aumasson" published by NoStarch in 2018.
In "Chapter 5 Stream Ciphers", under the heading "Attacking Salsa20/8" on Page 100, there is one paragraph (see screenshot below) which I do not quite understand.

The author mentions the need for $2^{31}$ pairs of key-stream blocks.
How does index 31 come about or how do we arrive at this index 31?
Any kind folks who can help to explain this clearly greatly appreciated!


texts: Choice of the one-way function (OWF) for Lamport signatures

texts:
I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same size, generally 256.

As the minimal requirement for the OWF is to be pre-image resistant, it seems that 128 bits for the output is "sufficient", this is explained in this discussion: Hash collision resistance requirements for Lamport signatures (basically the theoretical security is 119 bits in that case).

Questions

What about the input? Does a 128-bits input keep the security parameter?
If the answer is positive, what could be the most efficient OWF with 128 bits input -> 128 bits output in terms of implementation? Is there a block cipher (AES-128 ?) that would be more efficient than a cryptographic hash function, for the same level of security requirements?


texts: How WhatsApp users authenticate themselves in end-to-end encryption?

texts:
I read the WhatsApp Security Whitepaper and I want to know how a user A, which uses ECDH (Elliptic Curve Diffie-Hellman) to compute a master_secret, can be sure that the public keys for the recipient B used in the exchange belong to B and they have not been replaced by someone else.
A uses B (public) Identity Key, Signed Pre Key and One-Time Pre Key, all stored on the server at the moment of B's registration: how can A be sure that they are actually his recipient's keys?

(ECDH is an anonymous protocol, therefore authentication must be achieved someway else)


texts: Are the weaknesses of my functions attackable?

texts:
I got specific problem with my functions in $128$-bit block cipher. One round of encryption is like that:
$input$ $\rightarrow$ $F(k_{i},input)$ $\rightarrow$ reverse block $\rightarrow$ $F(k_{i+1},reversed \ block)^{-1}$ $\rightarrow$ $output$
Every function got a specific $128$-bit key, but keys do not change some properties of that function. $F^{-1}$ means that we are looking for such input to function $F(k_{i+1})$ that will give us such a reversed block.
The first problem is with numbers divisible by $2$. Every input block in the function of form 000...0001... also will give us the same first zeros and one. For example:
000001...0111101...
go into:
000001...1111001...
and 0001011... go into 0001111..., but with a different key, it can be 0001000... and so on.
All the rest of the block depends on the key and there is no known way to guess it without the key. It also means that block 000...0001 always gives the same block 000...0001 and a block of only zeros goes into the same block. It also means that every block with $1$ as the first bit will also go into a block with $1$ as the first bit. I think it can be solved, by XORing with some key before every round, let's ignore that problem for now.
The second problem is that every $input + 2^{n}\cdot l$ will give an output block with the same first $n$ bits in such function.
Can you find a way to attack it? The main idea is to avoid problems by reversing blocks and then looking for such input to function, which will give us such a reversed block - it destroys patterns that we have in that function. Let's say we want to encrypt block 000...0001. We know what block will give us the first function (exactly the same, by definition), but without the key of the second function, we can't tell which number is giving 1000...000 block in that next function $F^{-1}$. We can only tell that such block will definitely have the bit 1 at the beginning (because in function $F$ all blocks with 1 at the beginning always gives output with 1 at the beginning).


texts: Ecash - Probability of catching a user using secret splitting who duplicates the coin

texts:
For detecting double spending, secret splitting is used. If a user duplicates the coin, then there will be two different transaction items in transaction list. What is the probability of catching a user who duplicates the coin using this technique?

To clarify:

https://www.cs.bham.ac.uk/~mdr/teaching/modules03/security/students/SS4/DigitalCash.pdf shows on slide 13 of 17 that the probability of catching a user is $1-(\frac{1}{2})^n$ where $n$ is the number of identity pairs used in the transaction item. But how do you calculate it?


texts: Practical Uses for Timing Attacks on Hash Comparisons (e.g. MD5)?

texts:
Consider the following code snippet:

<?php
session_start();
if (md5($_POST['password']) === '550b1f8802ca3d7a987fc46a2af408c3') {
         $_SESSION['loggedIn'] = true;
}
header("Location: /");
exit;

If an attacker doesn't know the hash, they should still be able to leak bits of the hash via timing information (and by knowing the hashing strategy employed).

If you send thousands of requests and study the MD5 hash you transmit (as well as the timing information) of various passwords, you should be able to deduce the first N hexits of the hash. Then, using a client-side brute force search against this known information, optimize your online guessing by discarding a large number of guesses.

Even deducing the first 4 bytes can cut your guess time down by a factor of a billion.

That said, has anyone published any research in this area? Specifically, exploiting a partial leak via timing information and using it to guess passwords against unknown hashes faster.

Would this be worth researching at all?


texts:
I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users will simply use their exchange or their bitcoin client to send money to this address and their accounts will be subsequently credited.

I'm wondering what the best method would be for storage of each wallet's private key. Obviously, the web application needs to know it when the user wants to spend the coins. However, in the event of a database breach, the attacker could obviously steal everyone's private keys, and therefore, their money.

Here is my idea and I would like some feedback whether or not it is secure:

I am already using phpass which utilizes bcrypt to salt and hash their password on signup. When a signup occurs, generate a bitcoin key pair, and (MCRYPT_RIJNDAEL_256) encode the private key using the user's password as the encryption key.

Now when users are willing to spend their coins, I simply re-ask them for their password to uncover their private key to the web application. This is a small price to pay for the added security.

If the database is ever breached, the attacker would only see bcrypted passwords and MCRYPT_RIJNDAEL_256 encoded private keys to which he does not know the decryption key.

Update 1: I suppose the public key should also follow the same algos as the private key because a database attacker could replace the public key with one of his own unbeknownst to the user.

By the way, I've already asked this question on Bitcoin Beta SE but with much less emphasis on the specifics and more of just a general best practice question.


texts: Why are cyclic keys in Feistel Networks insecure?

texts:
So everyone seems to agree that recurring round keys in a Feistel network (eg. using the same key for every round) are a massive security leak. When researching this, the only thing I found is the Slide Attack (https://en.wikipedia.org/wiki/Slide_attack), in which a slid pair is found, which can be used as a plaintext-ciphertext pair of the PRF used in the network (which is the same / repeated in the network).

My problem with using this attack to prove that key reuse is insecure, is that this only works if the PRF is vulnerable to known-plaintext attacks, ie. the key / part of the key can be recovered if a plaintext-ciphertext pair is known. Now, my understanding is that if one was to just use a keyed PRF which does not leak parts of the key from a cipher-/plaintext pair, the whole network would be secure, which I am relatively sure is not the case.

In addition, what I do not get is why a Slide attack completely breaks the algorithm; according to all sources I have found, one still has to find $2^{n/4}$ cipher-/plaintext pairs, which of course is significantly less than the original $2^n$, but still not polynomial, ie. I can just quadruple the block size to get the same amount of security.

What information am I missing that invalidates my claims, so that cyclic keys really make a Feistel network insecure?


texts: How much pre-hashing a password increase security against brute force attack?

texts:
I am wondering how much hashing a password used as key for a symmetric key algorithm helps preventing brute force attack on crypted text.

Let's assume I want to crypt text A using key B using AES-256. I expect user to input not secure keys, such as: ['apple', '22march', 'newyork'].
So I hash these keys with PBKDF2 using many iterations, and I got the key B. That is long and fixed length key I will use for crypting the text with AES.

AES(TEXT, PBKDF2(KEY))

Would this help preventing brute force attacks?

The attackers should also hash each input (for example from a dictionary, where they'll match 'apple') to get the key B for trying decrypting the text A using AES? Or alternatively, they should trying brute forcing directly the AES crypted text, but the keys are always output from PBKDF2 and so they are really difficult to be cracked.


texts: In end-to-end encryption, doesn't the server need to be trusted?

texts: Applications like WhatsApp use end to end encryption. WhatsApp says that only the users share a specific key and no third party can view the messages. But I do not understand how the two users agree on the shared key. It must have been transferred via WhatsApp servers. In that way, WhatsApp would know the shared key right? Please help me understand how keys are shared in end to end encryption.


texts: Can a Message Authenticaty Code recover original data from corrupted data?

texts:
I am new to cryptography and have been studying for Dan Boneh's Stanford Course on Coursera, after going through encrytpion and decryption I've started the integrity portion of the Course.

Sir brought up MACs and how they use a key to ensure that data is not tampered. If my understanding is correct, data that is known to a hacker/eavesdropper(say the bootstrap in a windows 10 device) is kept secure since the system has a private key that can verify the data with it's own private key. That under ideal circumstances, the correct message would yield the correct tag and corrupted data would not, therefore any tampered with data would not fool the system(lack of better words).

Is my understanding correct so far?

Coming to the crux of my question, let's say that someone has used an XOR gate with one of the inputs as some random noise, the original data would get altered to some other data set. Is such a case possible if the authentication system is poorly designed? And if it is possible, how would the system get back the original data?


texts: Affine cipher and plaintext attacks, how to find the base modulo?

texts:
Last year, a question concerning plaintext attacks was posted at Mathematics.SE: “Plaintext attacks: affine cipher”.
I have no problem to see how to solve it when we are given two ciphertexts and $(c_1,c_2)$ and their corresponding plaintexts $(m_1,m_2)$. But, when I am to deal with the situation where $p$ is unknown it gets complicated. In this instance, I have three pairs of ciphertexts and plaintexts - $c_i \not =c_j$ for $i,j \in \{1,2,3\}$ and $m_i \not = m_j$ for $i,j \in \{1,2,3\}$. This differs then from the previous question in the sense that I cannot use the method that fkraiem provided given two of the ciphertexts are equal.

To find $p$:
You have $k_1m_1+k_2 \equiv k_1m_2+k_2 \equiv c_2 \pmod p$ so $k_1(m_1-m_2) \equiv 0 \pmod p$. This means that either $k_1$ or $m_1-m_2$ is a multiple of $p$ (this is where the fact that $p$ is prime comes in). $k_1$ can't be a multiple of $p$, because otherwise the encryption function is constant, which is absurd, so $m_1-m_2$ is a multiple of $p$.

Thus my question is this: How would one go about determine $p$ if the ciphertexts are all different?
I am not applying it to any exciting problem other than textbook style number problems.


texts: RSA - Finding all possible encryption exponents

texts:
Consider the standard RSA-algorithm: We have chosen two primes $p$ and $q $ such that $n:=p \cdot q$ and computed $\varphi(n)$. We now need to choose the public key $e$ such that

$$1<e<\varphi(n) \text{ and } gcd(e,\varphi(n)) = 1$$

If I am not mistaken there should be $\varphi(\varphi(n))-1$ many possible $e$'s ; we have to add $-1$ since we want to exclude $e \ne 1$.

Is there a "clever" algorithm to find all possible $e$'s other than to apply Euclid's algorithm on all numbers below $\varphi(n)$ and checks whether they are coprime to it?


texts: Why not the one-time pad with pseudo-number generator

texts:
I am very new to cryptography (so be kind), but I have a question that may seem silly.

If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one of the strongest:

To encrypt:

generate a random bit array using a pseudo number generator with the key as the seed
The generated bit array is the size of the data
use a simple XOR to encrypt using the generated bit array

To decrypt:

pseudo-random number generator will generate the same bit array with the same seed (the key)
generate bit array the same size of the encrypted data
run XOR on encrypted data using bit array that's generated

This is very simplified, but you can imagine how for larger encryption you could break down the data into blocks, and in order to ensure that the block bit arrays are random a new seed for each can be derived from the key. So, if $f(k)$ is the pseudo random number generator, and b is the block number, you can encrypt each block with $f(k+b)$. ($k$ is key)

Instead of using a pseudo-random number generator, you could use some hash algorithm to generate the pad.

Ceteris paribus (assuming you can use equivalently strong keys) would this not be a very strong cipher method? Perhaps it may be strong and heavy on memory since the pad needs to be the size of the data. So during encryption and decryption you need to generate a pad that's equivalent to the size of the data.

Is there a flaw in this algorithm, or would something like this not be practical and much slower than current standards?


texts:
I'm trying to implement RSA without using any java libraries using the algorithm from wikipedia HERE

So, anyone can clearly see that it is a raw RSA, and can directly be attacked.

The question is how can i include padding to the algorithm because i'm not using Java libraries, so what is the simple algorithm to implement the RSA padding to make it secure against some attacks?

Also, would Padding alone be enough? or there is something else i need to know?

Any help is appreciated.
Thank you.


texts: How do I calculate key rotation schedules?

texts:
tl;dr: How do I formulaically determine key rotation schedules for different kinds of keys and use cases?

The organization I'm a part of for utilizes both symmetric and public/private key encryption for both external and internal communication. In the past we have essentially done key rotation on an as needed basis, or when operations resources free up. We're trying to get more serious about security in general and this isn't going to fly anymore. We'd also like to automate key rotation.

How can I calculate how often to rotate keys given key size and amount of data encrypted? Applied Cryptography gives some guidelines, but they're rather out of date and don't quite fit our use case. Most other public domain info is catered more towards PGP and file encryption key rotation.

I fully understand there isn't some magic formula that pings out the exact amount of minutes to keep a key, i'm just trying to find a way I can justify my policies to other engineers and potentially a way I can empower people not security minded to make rotation decisions.

Just a point in the direction of some literature or prior art would be fantastic as well, google has not been very useful.


texts: Is it a good idea to use Lagrange/Newtonian interpolation for encryption?

texts:
I see that Lagrange interpolation is commonly used for secret sharing, but could it be used for encryption?

The goal is to reduce database I/O and compute new values on the fly. Suppose the use case involves that a client C sends to a server S a message m and a number n that C wants to be appended to m with some encoding. S returns to C the updated message m'. So, over time m becomes a list of numbers. Suppose C must not see the values of those numbers. Would it be a good idea to adopt this approach:

Given a working list of numbers $[e_0,e_1,e_2,\ldots,e_p]$ on S, formulate the equation $y = e_0 + e_1 \times x + e_2 \times x^2 + \ldots + e_p \times x^p$ and compute $p$ points using that equation.
Pick one point and store it in S's database. Encode the remaining $p-1$ points in the message $m'$ and send it to the client C.
When C sends the message back, S decrypts the message by decoding the message and reading the missing point from its database. S applies Lagrange/Newtoian interpolation to retrieve $e_n$.
repeat.

Indeed, the message could just be encrypted, but AFAIK, Lagrange/Newtonian interpolation is $O(n^2)$ (so the proposed decryption is $n^2$) and the encryption part here is only $O(n)$ given that it involves only simple substitutions. In comparison, AFAIK, both encryption and decryption with RSA are $O(n^2)$.

The database will still need to be read each time a message is received (to retrieve the missing number), but I think it's relatively lightweight given that each row only needs to contain two attributes (id and missing_point). In contrast, if every number is to be stored in the database, it'd seem to be rather heavy. Is this approach an overkill? If not, is it sound?

Hopefully my description is clear enough.


texts: How to compute projective coordinate Z in elliptic curve cryptography?

texts:
I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided

Can somebody tell me how to compute 'z'?...I read at some places that z can be assumed as (1,1). If so then can it be used for implementing NistP256 curves?


texts: Why does UMAC encrypt the output of universal hash function?

texts:
UMAC uses a key to choose a random hash function from a family of universal hash functions. The value of the hash function is always encrypted using yet another key, and the resulting ciphertext becomes the MAC code.

What would go wrong if I skipped the encryption step?
In case I have to skip the encryption step (but I can choose different universal hash function than UHASH), what properties would be required from the universal hash function to make the scheme secure?


texts: Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

texts:
I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2?

I could not confirm this as the paper does not provide a reference. Can any expert confirm this information?


texts: Workaround to implementing Forward Secrecy

texts:
In the case where I am self-signing my digital certificates, if I just change my certificate (generate a new one) every week or month, will this have (sort of similar to) the same effect as implementing Forward Secrecy, since I should have a new private key every time?

Please correct me if I'm mistaken.

Thanks.


texts: Would using a hash of the site name salted with a master password be a secure password for all sites?

texts: I am considering creating an application that is able to work out a unique password for a site by hashing the url while using a secure master password as a salt (or technically pepper since it will always be the same?). I am incredibly inexperienced in the world of cryptology so if this is a stupid question then sorry for wasting your time (:


texts: Universal forgery based on mathematical problem

texts: It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-trivial mathematical problem?


texts: How long would it take to crack a double hash if salt and final hash are public?

texts:
I have a hash of a file $H_1$ and then I add salt and rehash it: $H_2$. I make my $H_2$ and salt public and I use my $H_1$ as a password. How long would it take for this to be cracked with someone trying to figure out all the combinations of the 128 characters and adding the salt to get $H_2$?

So they are trying to figure out $H_1$ and adding salt to confirm that it matches $H_2$. As $Hash(H_1 \| salt) = H_2$, how long would it take to crack the 128 characters to find the $H_1$ that corresponds with this combination?

Please assume SHA3-512 as hash function.


texts: Proving a function is one way hash function

texts:
I am working on a project which computes the hash of the given input, I have to prove that the function is pre-image resistant that is given an output we cannot get back to the input.

While proving the function to be pre-image resistant. The function that I am using has a property that for every output there are more than one possible input. In other words, I have proved my function is many to one function. Is it sufficient to show that we cannot calculate the inverse of the function because it is a many to one function and not a one-one function.


texts: IPsec authentication and encryption lgorithms

texts:
I am looking for the implementation of IPsec security algorithms for both
authentication and Encryption.
Is there any open source implementation available for the same ?

And if someone supposed to implement these algorithms, then what background knowledge is required for someone new in the cryptography world?

Please recommend some links and documents that can help in understanding these
algorithms for the implementation.

Also suggest some open source implementations of following algorithms:

 HMAC-MD5,
 HMAC-SHA1,
 DES-CBC,
 Triple-DES-CBC and
 AES

and the open source projects that have used it.

Apart of the one I have listed above which are others algorithms that can be used for IPsec ?

What are the differences between authentication algorithms (HMAC-MD5 and HMAC-SHA1) and similarly
what are differences between encryption algorithms (DES, 3DES, AES) ?


texts:
Would this encryption and signing scenario be considered tamper-proof?
plaintext = "hello world"
password = "secret key"
hash = sha3_512(plaintext)
ciphertext = encrypt(plaintext,password)
output = ciphertext+hash

I'm computing the hash of the plaintext and then adding it to the end of the ciphertext output. I know this isn't exactly MAC or HMAC, but does this scenario work? Is it secure? From my perspective, the only way to forge the plaintext is if you know the key. Otherwise, any change will be reflected in the hash. Is this secure? Assume that the cipher is non-malleable. I believe this is the scheme used by Mcrypt for file encryption. Thanks.
This is not a duplicate because it would be infeasible to brute-force the plaintext from the hash as described in the possible duplicate question, scenario 3.


texts: Calculation expansion factor of $x ^ n - x - 1$

texts:
I'm trying to calculate the expansion factor for a polynomial of the form $x ^ n - x - 1$.

Any help would be appreciated.


texts: How do I explain zero knowledge proof to my 7 year old cousin?


texts: How much information of the length of a plaintext can an adversary get from its ciphertext?

texts:
Let $\Pi$ be a public-key encryption scheme. For every palintext $x \in \{0,1\}^{*}$, is there a PPT adversary $A$ such that
$$\Pr \left[ 1^{|x|} \leftarrow A\left( pk, \mathrm{Enc}_{pk} (x) \right) \right] \geq 1 / poly \left( \lambda \right)$$
or even
$$\Pr \left[ 1^{|x|} \leftarrow A\left( pk, \mathrm{Enc}_{pk} (x) \right) \right] \geq 1 - \varepsilon\left( \lambda \right)$$

Of course, if the plaintext space is finite (e.g. $\mathcal{P} = \{0,1\}^{m}$), it is not true.
Here we assume that $\mathcal{P} = \{0,1\}^{*}$.

The definitions of many kinds of security (e.g. IND-CPA) have a condition that the test plaintexts must have the same length.
Maybe, it implies that the ciphertext must preserve some information about the length of the plaintext. Is there a formal form about it?


texts: Is that proved that breaking ECDSA as hard as solving ECDLP?

texts: Is that proved that breaking ECDSA (Elliptic Curve Digital Signature Algorithm) as hard as solving ECDLP(Elliptic Curve Discrete Logarithm Problem)?


texts: Encryption that purposefully take hours to decrypt

texts:
My problem:

I want to block sites on my router.
I want to generate new password for my router after blocking sites.
This new password I want to encrypt.
But to decrypt it, I want it to take 2 to 8 hour to decrypt.

Is there any solution that could solve my problem?

The reason to do that is I want to lock myself out. By generating a random password that I can't memorize and doing the encryption, I can be sure that it's impossible for me to login. As Joseph Sible-Reinstate Monica commented:

  I think the actual goal here is that the OP is trying to focus on something important for a while, and so block access to distracting sites, and needs to lock themselves out so they don't just unblock them when they want to look at them.

Related: How to hide a code from myself until a specified time?
on Super User.


texts: Is there a point using GCM block chiper with Authenticated DH?

texts:
I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher is enough?

Also, I'm not sure what's the point authenticating the encrypted data, since if it gets modified, it will produce garbage at decryption, or if adversary gains the key somehow they will be able to fake the authentication tag too.


texts: How do we know one-way functions can be iterated?

texts:
Suppose we have some one-way function $h$. Without further specification of $h$, how can we be sure that we can define another function $g(n) = h(h(n))$?

That is, how do we know the range of $h$ is a subset of the domain of $h$?

Relevance to Cryptography: One-way functions are minimal assumptions for the constructing pseudorandom generators. Thus, one-way functions are fundamental to theoretical cryptography (perhaps not for applied cryptography)....but cryptography all the same.


texts:
Recently reading about CPA, CCA safety security proof.
After reading a few papers, the author is in the process of proof. The challenger maintains some lists. I really don’t understand why the challenger wants to maintain some lists, and some of the following steps need to check the list, and some do not need to check?
For example, the security proof of this paper (Thm. phase1)
https://ieeexplore.ieee.org/document/8662560


texts: Is there benefit to signing unencrypted emails?

texts: I came to this article from another comment on Crypto StackExchange. After reading it, I am wondering if there is any benefit to using a digital signature on unencrypted S/MIME emails?


texts: Discrete Logarithm problem with selected order

texts: If the order of group ($p$)selected by attacker then discrete logarithm is still hard?


texts: For Diffie-Hellman key exchange method, what are examples of very poor a and b values?

texts:
For Diffie-Hellman key exchange method, what are examples of very poor $a$ and $b$ values? Given that $g$ and $p$ values are both large prime number and the formula is

$$g^{a . b} \bmod p$$


texts: How is it possible to detect "unknown SHA-1 cryptanalytic collision attacks given just a single file from a colliding file pair"?

texts:
The following description from http://shattered.it caught my eye:

  How do I detect this attack?

  You can use the online tool above to submit files and have them checked for a cryptanalytic collision attack on SHA-1. The code behind this was developed by Marc Stevens (CWI) and Dan Shumow (Microsoft) and is publicly available on GitHub.

  It is based on the concept of counter-cryptanalysis and it is able to detect known and unknown SHA-1 cryptanalytic collision attacks given just a single file from a colliding file pair.

I know basically nothing about cryptography, so I don't really know the full meaning of the phrase SHA-1 cryptanalytic collision attacks. The way I read the description, it states that I can analyze an arbitrary file on my hard drive and be told whether that file has been the target of a collision attack. If that is the case and if the tool's only knowledge of the world is the contents of my file, I can't see how such a thing could be possible.

I'm hoping someone can explain, in (relatively) simple terms, why my understanding is wrong or how this is actually possible.


texts: How to select a 'tweak' used in FE1 mode format preserving encryption?

texts:
I'm experimenting with this library Botan
which includes a module for format preserving encryption based on FE1 mode.

The parameters for the Encrypt method are as follows

        /// <summary>
    /// Generic Z_n FPE encryption, FE1 scheme
    /// </summary>
    /// <param name="modulus">Use to determine the range of the numbers. Example, if the
    /// numbers range from 0 to 999, use "1000" here.</param>
    /// <param name="plaintext">The number to encrypt.</param>
    /// <param name="key">Secret key</param>
    /// <param name="tweak">Non-secret parameter, think of it as an IV</param>
    /// <returns>The encrypted number.</returns>
    public static BigInteger Encrypt(BigInteger modulus, BigInteger plaintext,
                       byte[] key,
                       byte[] tweak)

Modulus, plaintext and key I understand, but not clear on the tweak.
How do you decide what it is and can you use the same value for all plaintext input.  Can it be any number?


texts:
I am trying to figure out the best parameters for Argon2 for password hashing.

I have read the RFC and the recommendations they put into it. So I follow up on the recommendation on the paper depending on my target machine.

The thing is that one single call fits perfectly into the desired time. However, they never mention several calls at the same time.

For example. I have a server with 8 CPU cores and 32GB RAM.
Then I configure an Argon2id with: 16 lanes, 1 iteration, and 128MiB memory.

I call it once. Perfect! I got an execution time of ˜50ms.
Now I simulate several calls at the same time. Execution time increases a lot. For 20 parallel calls, execution time goes up to ˜500ms.

I can tune the algorithm to fit with the average traffic on the server to fit the desired time, but every time I will have a peak, performances will be deteriorated. And this also means lowering the values which means cheaper to attack.

Which is the best way to proceed?


texts: Implementing AES algorithm using Arduino

texts:
I am using an Arduino board to implement the AES Algorithm:

I am having a large data of length approximately 500 bytes. I did all the basic stuff in implementing this AES Algorithm. I am getting partial Results.

Please help me implement this.


texts: Cryptographically secure linear congruential generator - is it possible?

texts:
Let's consider generator:
$x_{n+1} = (a \cdot x_{n} + c) \mod m$
And let's assume we will meet three requirements known as Hull–Dobell Theorem. Also consider only $m=2^{i}$ (then $c$ has to be odd).
Now let's consider $a$, $c$ and $x_{0}$ are 256-bit keys ($c \neq 0$). Could this generate secure pseudorandom numbers? Wikipedia says: if $m$ is a power of $2$, then $a−1$ should be divisible by $4$ but not divisible by $8$. Let's say we will meet also this requirement. By the way what will happen if we will not?
Are there any other problems which can make such a generator insecure? Is there also requirement that $a−1$ can't be divisible by $16$, $32$ and so on? Anywany it is not a big problem to choose $a$ this way.


texts:
Post Structure:

Sources Cited
Question & Details
Before You Answer
Useful Info From Comments

Sources Cited:

https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-encryption/  (see first comment on the blog)
https://competitions.cr.yp.to/round1/ocbv1.pdf
https://csrc.nist.gov/CSRC/media/Projects/Block-Cipher-Techniques/documents/BCM/proposed-modes/gcm/gcm-nist-ipr.pdf
(shared by @fgrieu in the first comment)
https://eprint.iacr.org/2004/193.pdf

Question:

Are the AE modes -- specifically AES-GCM -- safe ( i.e. won't cause legal issues ) for commercial use presently (October 2018)?

The aforementioned sources point to the fact that various AE schemes are patented by VDG and IBM.

Specifically, the 'Intellectual Property' section of the second source states:

"Gligor and Donescu (VDG) and Jutla (IBM) are inventors (owners) on US patents 6,963,976,
6,973,187, 7,093,126, and 8,107,620, all which concern AE but which may or may not apply to OCB."

Before You Answer:

I understand these sources are 6-12 years old.
The obvious argument that the details of the patents are not specified, and probably do permit the usage, given the widespread use of these AE schemes, is understood.
Despite point (2) above, the question is posed not out of laziness, but to check if the current ( official? ) status is already known, and verify the point (2).
My search term "Authenticated Encryption Usage Patents" does not return any existing answers to this question.
The second source says "If any of this information changes, the submitters will promptly (and within at most one month)
announce these changes on the crypto-competitions mailing list."; this is probably where the current status should be.

Useful Info From Comments:

Based on the first comment citing the third source above, the GCM authors do not claim any rights on the mode, nor are aware of any.
Additionally, the fourth source states the same.

  "The  authors  are  unaware  of  any  intellectual  property  rights
  that  pertain  to  the  Galois/Counter Mode  of  operation  (GCM)
  [1],  nor  do  they  claim  any  such  rights.  The  avoidance  of
  such  encumbrances  was  a  specific  design  goal  of  the  mode.
  It  is  based  on  methods  that  appeared  in  the literature  over
  two  decades  ago:  counter  mode and universal  hashing."

  "The Galois/Counter Mode (GCM) of operation for block ciphers was
  designed to meet the need for an authenticated encryption mode that
  can efficiently achieve speeds of 10 gigabits per second and higher in
  hardware, can perform well in software, and is free of intellectual
  property restrictions"


texts: Looking for encryption algorithm not subject to known-plaintext attack with IV reuse

texts:
I've encountered an interesting problem where we can basically say the following:

We need to encrypt messages, but we have no room to store IVs. We can synthesize IVs; however an attacker would be able to observe different blocks encrypted with the same IV.
We can detect message tampering directly. That is, we don't have to care about somebody injecting blocks to change plaintext. They will be caught.
Large amounts of plaintext are known to any would-be attacker.

Are there any known block cipher secure against data-reading attacks with these constraints?

The problem comes in disk atomicity. 4096 bytes can be written atomically, 4096 + N bytes cannot be. Using simple sequential IVs was my plan, but someone seeing the disk twice would be able to exploit that.


texts: Name for a Ceasar Cipher that uses random offsets?

texts:
In a traditional Ceasar Cipher, you pick a specific offset such as "plus three" so that to encrypt each character of a message you count three letters up from the input and to decrypt you count three letters down from the input. For example, "APPLE" would become "DSSOH" where D is A+3, S is P+3, and so on.

I saw a variant of this where the key is used as the seed of a random number generator instead of a constant offset, and those random offsets are then used to encode the message. This has the advantage that the same input characters are not mapped to the same output characters. For example, my RNG might generate a sequence of 3 7 5 0 2, so then "APPLE" would become "DWULG" where D is A+3, W is P+7, U is P+5, etc.

Since the random number generator is deterministic, you can re-seed the RNG with the original key and generate the same random sequence to decode.

Is there a specific name for this type of cipher?


texts: Two formulas work for this three-pass exchange problem, but I can't figure out why one of them works

texts:
Problem statement:
"Suppose that users Alice and Bob carry out the 3-pass Diffie-Hellman protocol with p = 101. Suppose that Alice chooses a 1 = 19 and Bob chooses b 1 = 13. If Alice wants to send the secret message m=5 to Bob, show all the messages exchanged between Alice and Bob."
Official solution:
$a_2 = {a_1}^{-1}\bmod(p-1)=79$
$b_2=77$
Alice → Bob: $m^{a_1}\bmod p=37$
Bob → Alice: $80$
Alice → Bob: $56$
Bob obtains $m$ by evaluating $56^{b_2}\bmod p=5$
Solution I made using someone's help (since I can't find very specific information about this three-pass protocol online):
Alice:
$\begin{align}
a_2&={a_1}^{p-2}\bmod(p-1)\\
&=19^{99}\bmod100\\
&=79\end{align}$
Bob:
$\begin{align}
b_2&={b_1}^{p-2}\bmod(p-1)\\
&=13^{99}\bmod100\\
&=77\end{align}$
Alice to Bob #1:
$\begin{align}
m_\text{AliceToBob1}&=m^{a_1}\bmod p\\
&=5^{19}\bmod101\\
&=37\end{align}$
Bob to Alice (#1 - there is no #2):
$\begin{align}
m_\text{BobToAlice}&={m_\text{AliceToBob1}}^{b_1}\bmod p\\
&=37^{13}\bmod101\\
&=80\end{align}$
Alice to Bob #2:
$\begin{align}
m_\text{AliceToBob2}&={m_\text{BobToAlice}}^{a_2}\bmod p\\
&=80^7\bmod101\\
&=56\end{align}$
Bob obtains the message as follows:
$\begin{align}
m'&={m_\text{AliceToBob2}}^{b_2}\bmod p\\
&=56^{77}\bmod101\\
&=5\end{align}$
My question:
Why does the official solution use $a_2={a_1}^{-1}\bmod(p-1)=79$ instead of $a_2={a_1}^{p-2}\bmod(p-1)=79$, and how can that equivalence in the context of this type of problem be justified? (I say "in the context of this type of problem" because, to my understanding, the two expressions are not always equivalent).
Any input that could help me clarify my confusion would be GREATLY appreciated!
P.S.

$a_1$ is Alice's encryption key
$a_2$ is Alice's decryption key
$b_1$ is Bob's encryption key
$b_2$ is Bob's decryption key


texts:
3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length key components or key shares, in accordance with an industry accepted method

I got some knowledges on NIST SP800-57 about the split-knowledge:"When split-knowledge procedures are used, the key shall exist outside of a [FIPS140]
cryptographic module as multiple key components. The keying material may be created within
a cryptographic module and then split into components for export from the module, or may be
created as separate components. Each key component shall provide no knowledge of the key
value (e.g., each key component must appear to be generated randomly). If knowledge of k
components is required to construct the original key, then knowledge of any k-1 key
components shall provide no information about the original key other than, possibly, its length."

I just got job as QSA for PCI field, I'm wondering AS a QSA how to Verify if the audited party meet the condition？ Thanks a lot~


texts:
I would like to send small separate packets of data.

I am thinking of using AES-128 or AES-256, and to add a counter as part of the plain text message.

Some clarifications:
Each message will be one block length.
The transmitter and the received are "counter synched". i.e. the transmitter sends the packet at constant time intervals (once a second), and the receiver expects the known counter on each packet.

Is it a reasonable solution?
Are there any possible security risks?
Since the plain text will not repeat itself, should I still use an IV? or can I omit it?
Should I use a MAC, or is the counter is a sufficient authentication?


texts: Does weak hardcore bit(s) implies strong hardcore bit(s)?

texts:
It is well known that weak OWF implies strong OWF
by concatenating several evaluations of weak OWF (see e.g. here),
where weak OWF is defined as

$ \exists $ poly $Q$, $\forall$ PPT $\mathcal A$ such that:
$$Pr[x←\{0,1\}^n; \mathcal A(1^n,f(x))=x′ s.t. f(x′)=f(x)]≤1−1/Q(n).$$

I want to establish a similar argument for a hardcore bit:

Let $f : \{0,1\}^n \rightarrow \{0,1\}^m$
be an (injective) function and $B : \{0,1\}^n \rightarrow \{0,1\}$ be a weak hardcore predicate of $f.$
Define a concatenate function $F: \{0,1\}^{t\cdot n} \rightarrow \{0,1\}^{t\cdot m}$ defined by
$$ F(x_1, \cdots,x_t) = (f( x_1) || \cdots || f(x_t)). $$
Then for sufficiently large $t,$ for any PPT $\mathcal B,$
$$ \Pr[x_i \leftarrow \{0,1\}^n; \mathcal B(1^{t\cdot n}, (F(x_1, \cdots, x_t)) = (B(x_1), \cdots, B( x_t))] = negl(n).$$

So far, I defined weak hardcore predicate in a similar way to OWF,
and trying to adapt the proof for OWF to this case,
but it gives many obstacles so far.
Is there anyone who know some results for this?
I've failed to find those kind of argument,
so any help, even some counterexamples, will be appreciated.
(*) In my goal, the vector $(B(\vec x_1), \cdots, B(\vec x_t))$
does not need to be indistinguishable from uniform,
whose concept seems to be called by simultaneous hardcore bits.


texts:
It is obvious that there are different hashes.  I am looking for a reference on hash complexity as it relates to strength because I am considering making a "bad hash".  I have read a few things on the impossibility of making an efficient hash based on a block cipher, and then I thought that there are cases for bad hashes.  Here is an example of why I am considering this.

In hardware, you have a branch instruction.  The branch instructions that branch on memory address are a concern  If you can augment this memory address, you can leave the memory segment.  As a simple example, consider a BRANCH of 6, and this looks like

 BRANCH    OFFSET MEMORY
 1000      0110

It would be interesting to have a hash that results in some valid construct for a valid memory range.  The point of the hash is to not reveal the valid memory range.

BRANCH   HASH   OFFSET
1000     XXXX   XXXX

An interrupt would occur if the memory offset is outside the allowed hash.  The time available to calculate this hash would be small, so it could not be a good hash.

Is there a reference on complexity and strength so I might consider this further?


texts: inverse element in Paillier cryptosystem

texts:
As I know, in Paillier cryptosystem, the encryption $c$ of a message $m$ is calculated as $c=g^m r^n \bmod n^2$.

Now, I am wondering if I can derive $g^m  \bmod n^2$ given that I know $c$, $r$, and $n$?

It seems that the "$\bmod\ n^2$" operation does not constitute a finite field. Not every element has the corresponding multiplicative inverse in $\mathbb Z^*_{n^2}$. So, it seems not always impossible for to find a proper $(r^n)^{-1}$ to get $g^m=g^m r^n (r^n)^{-1} \bmod n^2$

If so, can we find or limit the use of $r$ so that $(r^n)^{-1}$ can always be found?


texts: How to prove Security of Onion Layers of encryption?

texts:
CryptDB has Onion layers of Encryption to provide wider functionality from weaker forms of encryption. How do we prove such things are indeed secure ? Intuitively It seems ok. Are there any parallels in theory that is related say, security of multiple encryption schemes etc? or Universal Composability etc?

Is this same as Cascade ciphers ? Product Ciphers ?


texts: Zero Knowledge Proof: Prove correct ElGamal encryption without leaking message

texts:
I know it is possible to prove zero knowledge that a given ElGamal ciphertext $(c,d)$ encrypts a plaintext belonging to some set ($\{0,1\}$ is frequently used for electronic voting applications).
Next I was thinking if it is also possible to prove encryption of a specific plaintext (i.e. the verifier knows the exact plaintext). A use case could be that someone sends a plaintext to some trusted service and obtains a ciphertext, along with a proof that the ciphertext really encrypts the plaintext. (The difference to the user encrypting the plaintext himself would be that the user does not learn the random parameter $r$ used in the encryption).
The basic approach that works fine for disjunctive proofs about set membership of the plaintext is: given $(c,d)=(g^r, mY^r)$ be the ElGamal ciphertext, where $r$ is drawn randomly and $Y=g^x$ is the public key.

The prover decides on a random $s$
The prover shares $(a,b)=(g^s, Y^s)$ with the verifier
The verifier sends a random challenge $C$ to the prover
The prover sends $z=s+Cr$ to the verifier
The verifier verifies that $g^z=g^sg^{Cr}=ac^C$ and $Y^z=Y^sY^{Cr}=b\left(\frac{d}{m}\right)^C$

But as poncho pointed out, $m$ can directly be recovered from the equation of $Y^z$
Is there a similar proof that DOES prove proper encryption of a given plaintext?


texts: Is equal length of primes in Paillier cryptosystem is mandate for security reasons?

texts:
In continuation to this question about length of primes , I am in doubt about the restriction on length of primes itself .

In Paillier  cryptosystem , equal length of primes are used .

My doubt is whether this restriction is to ensure the following condition only

$$\gcd(pq,(p-1)(q-1))=1$$

or , there are another security reasons that makes the equal length condition mandate .

I mean, in cryptosystems like RSA, approximately equal length primes are generally preferred for security reasons , If the length is more than specified value, then cryptosystem is not secure.

Is it the same case in paillier cryptosysyem too or not ?


texts:
Within RFC 2104 section 3 there is discussion around keys (below). How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute keys?

  "Keys need to be chosen at random (or using a cryptographically strong
  pseudo-random generator seeded with a random seed), and periodically
  refreshed.  (Current attacks do not indicate a specific recommended
  frequency for key changes as these attacks are practically infeasible.
  However, periodic key refreshment is a fundamental security practice
  that helps against potential weaknesses of the function and keys, and
  limits the damage of an exposed key.)"


texts:
I am developer of an application that uses XTS with ciphers which use 128-bit blocks (AES, Serpent and Twofish).

I now want to use XTS with a cipher which uses 256-bit blocks (Shacal-2).
AFAIK, I just have to extend the tweak to a 256-bit value. But what to do with the multiplication of the tweak? Should I keep the 0x87 constant, and use it depending on the carry of the 256-bit value (bit 255)? But in this case, should I do something about the bit 127?


texts: Are collisions possible on the output of Blowfish?

texts:
I'm using the Blowfish block cipher to encrypt messages of 64 bit without using any block cipher mode of operation. Can I still have a collision?

I'm asking this to understand if Blowfish is susceptible to the birthday attack when used on plaintexts of 64 bit.


texts: Why Rejewski advanced three position for the right rotor in the second set of rotors in the Cyclometer he devised?

texts:
In this article about decryption of Enigma(p.259), author says that

  the second set of rotors was stepped three positions beyond the groundsetting

in the Cyclometer Rejewski devised. I would like to know why did he advanced 3 positions for the right rotor in the second set of rotors instead of 1 or 2 positions for the same.


texts:
I'm thinking about the scenario of using a set of (potentially untrusted) hosts to store (potentially private) files. Think something like distributed backup where you contribute some disk space and in exchange you get to store N copies of your data in other nodes. The issue is how to combine key management + deduplication and I saw the following approach somewhere which looked really promising:

split up the data in fixed-size chunks (not really a necessity, just makes the balancing of the storage simple)
hash the chunk using SHA-512 for example
using the hash as key, encrypt the chunk and store it

The idea is that if two people have the same data (like "kernel32.dll" for a particular version / patch level of Windows for example), they will independently come up with the same chunks and the data will be deduplicated without them having to coordinate. At the same time if you don't have access to the data, you can't compute the key (hash) and thus this is usable for private data also.

Do people see any problem with the security of this scheme?


texts: What happens if you increment MAX counter in AES-CTR?

texts: Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? Will it result in an overflow error of sorts?


texts:
I've got an homework to implement an encryption algorithm (I can choose what),

now we didn't learn about encryptions yet, I guess you can call it pre-class homework or

something, I know what is encryption in idea and read on how some encryptions algorithms

works, and I don't know which one will be good for me to implement,

at first I thought maybe trying to implement AES but I don't want to implement something

that I'll not fully understand what I'm doing, because as I said the encryption class

didn't even started yet and I don't know what for example is the RCON table or the S-BOX

Table, I know for what they're used but if I were to implement the algorithm it would

look to me like I'm just doing some byte actions with those tables without understanding

the true meaning of the values that lie in each and every index in those tables. (they're like magic numbers for me)

So I want a suggestions for something that will be a good for first implementation and easy to understand the concept of how it works, remember that I yet to learn about encryptions in class but we know the concept.


texts: Comparison of values in Paillier homomorphic encryption

texts:
For a project, I am using homomorphic encryption with the Paillier cryptosystem, and I have to compare two values...

Can this be done using homomorphic encryption?
And I know subtraction can be done using homomorphic encryption, but can anyone simplify the steps?

Any advice will be helpful.


texts: Signing a document: which algorithm to use?

texts:
What I want to do is to digitally sign a document. I am new to cryptography and was wondering what issues to take into account.
The only criteria is that a textual document signed should produce a code that is different if lines in the same document are shifted. I heard that MD5 is broken and that one should avoid SHA1 (because of NSA etc).

As I said, I am new to crypto. Any suggestions would be welcome!


texts:
I have very short messages which I want to keep to 32-bits encrypted (ie one block). The keys can (and should) be as large as possible to maximize security.

However, I don't know many ciphers with 32-bit modes. Are there any that offer 90+ bit security? Which has the most cryptanalysis?


texts: What is the relation between x y and r s in an ECDSA signature?

texts:
I'm writing functions in C using OpenSSL and the EVP interface to interact with Intel SGX. One of those functions calculates an ECDSA (with SHA256) signature over some data.

The output of the ECDSA signature in OpenSSL is an ASN.1 structure with two integers, which I am assuming to be r and s. However, the data structure in Intel SGX that represents the signature has two values, x and y, each of fixed length 32 bytes.

#define SGX_SHA256_HASH_SIZE            32
#define SGX_ECP256_KEY_SIZE             32
#define SGX_NISTP_ECP256_KEY_SIZE       (SGX_ECP256_KEY_SIZE/sizeof(uint32_t))

typedef struct _sgx_ec256_private_t
{
    uint8_t r[SGX_ECP256_KEY_SIZE];
} sgx_ec256_private_t;

typedef struct _sgx_ec256_public_t
{
    uint8_t gx[SGX_ECP256_KEY_SIZE];
    uint8_t gy[SGX_ECP256_KEY_SIZE];
} sgx_ec256_public_t;

typedef struct _sgx_ec256_signature_t           <----- this structure
{
    uint32_t x[SGX_NISTP_ECP256_KEY_SIZE];
    uint32_t y[SGX_NISTP_ECP256_KEY_SIZE];
} sgx_ec256_signature_t;

I need to somehow convert the r and the s returned by OpenSSL's libcrypto to the x and the y used in Intel SGX. What is the relation between these parameters in the context of an ECDSA signature?


texts: Convert numeric message from RSA ciphertext to alphabetic

texts:
I have a set of numeric values that are supposed to represent a message encoded via textbook RSA. For example:

60889
37946
13359
61629
35960
13747

I've decrypted these values to find the corresponding messages:

1535
3109
2789
1191
2700
1829

Now I need to convert these values the alphabetic using the rule that each value represents a triplet of alphabetic characters as follows:

DOG -> 3*(262) + 14*26 + 6 = 2398
CAT -> 2*(262) + 0*26 + 19 = 1371
ZZZ -> 25*(262) + 25*26 + 25 = 17575

I'm not sure how to find the alphabetic characters once I have the original numeric message. The only way I could think to do it would be to calculate every possible triplet combination of letters then find the numeric match for each element. But this method seems way overly complicated.

Anyone have a better way to figure this out? I'm writing this all in Java, so a code example would be even better!


texts: Do I have to recompute all hashes if I change the work factor in bcrypt?

texts:
The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number of computations. This as the article says allows for keeping up with Moore Law - when we have faster processors in the future we just increase the work factor and continue using bcrypt.

One question arises - if I use bcrypt and want to increase the work factor the do I have to recompute all hashes? If so - how do I do that if I'm not supposed to store plaintexts? If I don't need to recompute them - how will the function with greater work factor deal with passwords hashed with smaller work factor?


texts: Hiding and Binding key in Groth-Sahai NIZK proof system

texts:
In context of Groth-Sahai NIZK proof system, I have a couple of doubts on Hiding and Binding keys.

In case of hiding keys (highlighted in red), how is it ensured that $\tau(A) \subseteq \langle u_1,...u_m \rangle$?
In case of binding keys (highlighted in green), how come $\tau \circ p$ be an identity map on $A$? Shouldn't it be an identity map on $B$?


texts: How does DSA provide non-repudiation in proving a document was properly displayed (not altered or displayed incorrectly)?

texts:
I am building an iOS app that allows the user to sign a document served to them by a web server. So that page of the app simply has a document in the top pane, and at the bottom pane, a place to sign with your finger.

So, I want to use DSA to allow this app to sign that doc and have the non-repudiation property. But a colleague brought up what seems to be a critical flaw.

If I send the iOS app a document, the user can still cryptographically sign it (with the signature bitmap and timestamp) using their private key, but we might actually be displaying some other document. In a sense, the crypto doesn't actually provide any assurance that the signer was looking at the document in question when he signed -- he could have been looking at a picture of Mickey Mouse. It just proves that we had that document in RAM, and that the user signed something.

So clearly it's easy to tell using DSA if someone mistakenly sent you a digitally signed picture of Mickey Mouse instead of a contract. But what if the problem was at the view/display layer, and in point of fact, the correct document was in RAM, and just displayed incorrectly? (For example, say I had some horrid bug that would randomly replace pixels on the screen with pictures of Mickey Mouse at the OS layer?) Then, we would send a seemingly valid signature of the seemingly appropriate contract, while the user in reality had been looking at Mickey.

I'm trying to get my head around how the crypto solves this problem. I'm sure it's something trivial but I'm having so much trouble figuring it out. Any thoughts would be very much appreciated. If this is one of those "nature of the beast" type trust questions, how does Adobe's implementation in PDF provide non-repudiation?


texts:
Hi everyone I was wondering would it be possible to mine a cryptocurrency like bitcoin in parallel. I have read a little about mining pools https://en.wikipedia.org/wiki/Mining_pool , But that's not quite what I'm looking for . the idea i had was to create a customized mining software that would Comprise of a master node with multiple Slave nodes like this .

The master node would join the most profitable bitcoin mining pool
so let's say i had the slave software running on 20,000 computer.
The mining pool would see is one miner from me is this practical.


texts:
Show that digital signatures under plain RSA are insecure (Plain RSA means that signing is done by calculating $m^d\bmod n$, with $0\le m<n$, and no padding or hashing of $m$).

Write an algorithm that, given someone’s public signature verification key ($e$, $n$), can easily generate a (message, signature) pair for some message that the private key holder never intended to sign. For full credit your algorithm should not require a signing oracle and your algorithm should generate “signed” messages where your message is different than its signature (Hints: The message need not have any meaning to count as a forgery. Think backwards).


texts:
I have doubts about this question

  Consider the following textbook RSA example. Let be p = 7, q = 11 and
  e = 3. Give a general algorithm for calculating d and run such
  algorithm with the above inputs.  What is the max integer that can be
  encrypted? Is there any changes in the answers, if we swap the values
  of p and q?

I tried to apply RSA in this way:

$p=7$ and $q = 11$ so $n=(pq)$ and $n=77$, therefore $$\phi(pq) = (p-1)(q-1) = (7-1)(11-1)= 60$$

Pick $e$ that is $<60$ and isn't coprime (which means I can't use $2,3$ and $5$)

So after that, I'm blocked, and my solution is to choose another coprime, for example $e=7$ in order to have  public-key: $(n,e)= (77,7)$

But I'm wrong somewhere, because if I use $7$ (or another coprime like $11$) I can't compute $d$.
In fact, for all numbers that I used, for example with $e=7$, if I pick $d=9$ I have $63$ that if I divided for $60$ I have $1$ with rest $3$.

So my questions are these :

Am I wronging? (where?)
As a request , can I pick 3, even if it isn't coprime? (because as I saw
on theory, I need at least a coprime).
pick $e= p$ or $q$ seams wrong.right?


texts: Scrypt KDF cipher (scrypt CLI) - known vulnerabilities and cryptanalysis?

texts:
There is a scrypt cipher that is used for example by some cryptos like LItecoin for their mining algorithm.

I never heard of scrypt. I know eg SHA-256 which is well analyzed and considered as secure until now.

Any known cryptanalysis for scrypt / vulnerabilities?
is scrypt considered in the community as a secure (comparable to sha256) cipher?
How collision-resistant is it?
Is it easily breakable by quantum computing attacks?


texts:
What is the difference between chosen plaintext and chosen ciphertext attack?
In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?


texts: Quantum vs. regular computing time to break ECC?

texts:
How long exactly would it take for a regular computer to crack an elliptic curve public/private key via bruteforce, vs. a quantum computer using Shor's algorithm with a couple thousand qubits?  Can anyone reference me a source?

I'm assuming the digital computer will take thousands of years, but how long exactly is the polynomial time achieved by theoretical quantum computers?


texts: Is there anyone intrested in quantum fully homomorphic encryption?

texts: Recently, I have read a paper named "Classical Homomorphic Encryption for Quantum Circuits". The author claims a quantum scheme that can apply an encrypted (like GSW encryption) bit to control CNOT gate. However, in my opinion, doesn't such a scheme imply a quantum decryption algorithm for paricular GSW encrption? The author's scheme is not really security in the quantum case, since the encrypted Puail key can be efficiently decrypted by a quantum method, which is similar to that the author has used to perform encrypted CNOT gate.


texts: Why can't I reverse a hash to a possible input?

texts:
I'm going to provide “proof” why a hash function can be reversed, and I hope you can tell my why I'm wrong

So, a hash function can be implemented as a series of logic gates. All logic gates can be implemented using only NOT and OR gates. (I'm fairly sure about both of these, but please correct me if I'm wrong.)

Therefore, a hash function can be implemented as a series of NOT and OR gates.

A NOT gate can be easily reversed by going through another NOT gate.

An OR gate cannot be reversed, since it fundamentally losses information. However, a possible input can be derived from any given output.

Therefore, I should be able to construct a possible input given an output from a set of logic gates, including from a hash function.

What have I gotten wrong here?


texts:
I'm not quite sure the benefits of working over a prime modulus in Shamir's secret share- but doesn't limiting the numbers you pull from make the secret easier to guess? Instead of being over the real numbers, with infinite elements, limiting yourself to some prime limits the possibilities-albeit that number can get very large.
Isn't this bad? What benefits are there to working over a prime that justify this choice?


texts: El Gamal Signature: Attack to recover private key if $k$ is generated as $k_{i+1}=k_{i}+a$ where $a$ is a large unknown constant

texts:
$k_0$ is randomly generated and subsequently $k_{i+1} = k_{i}+a$, where $a$ is a large unknown constant

I've tried formulating an attack as such:

Given 3 Messages $M_0$, $M_1$ $M_2$and  with $(r_0,s_0)$, $(r_1,s_1)$ and $(r_2,s_2)$ respectively. We can write $r_0$, $r_1$ and $r_2$ as such:

$$r_0 = g^{k_0} {\ }mod{\ } p $$
$$r_i = g^{k_i} {\ }mod{\ } p = g^{k_0}g^{a*i} {\ }mod{\ } p = r_0g^{a*i} {\ }mod{\ } p$$

$s_0$, $s_1$ and $s_2$ can then be rewritten as the following:

$$s_0k_0 = M_0-xr_0{\ } mod{\ } p-1$$
$$s_1(k_0+a) = M_1-xr_0g^{a}{\ }mod{\ } p-1$$
$$s_2(k_0+2a) = M_2-xr_0g^{2a}{\ }mod{\ } p-1$$

and making $xr_0$ the subject we get the following:
$$xr_0 = M_0 - s_0k_0$$
$$xr_0 = g^{-a}(M_1 - s_1(k_0+a))$$
$$xr_0 = g^{-2a}(M_2 - s_2(k_0+2a))$$

But I do not think we can solve this using linear equations because we do not know what is $g^{-a}$ and $g^{-2a}$.


texts:
I'm facing an RSA CTF problem to solve.
All I have is:

The public key $(n,e)$, with $e=3$, and $n$ of 1024 bits
$C'$, the encryption of a long number $K$, where $C' = K^3 \bmod n$
The Ciphertext which is the encryption of the Plaintext plus long number $C = (P+K)^3 \bmod n$

I know $K$ is a 64-byte random value $k$ left-shifted by 24 bits.

Is there a way to break this and get the plaintext?


texts: does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448?

texts:
Quoting The Transport Layer Security (TLS) Protocol Version 1.3:

  ECDSA algorithms  Indicates a signature algorithm using ECDSA
        [ECDSA], the corresponding curve as defined in ANSI X9.62 [X962]
        and FIPS 186-4 [DSS], and the corresponding hash algorithm as
        defined in [SHS].  The signature is represented as a DER-encoded
        [X690] ECDSA-Sig-Value structure.

  ...

  EdDSA algorithms  Indicates a signature algorithm using EdDSA as
        defined in [RFC8032] or its successors.  Note that these
        correspond to the "PureEdDSA" algorithms and not the "prehash"
        variants.

ECDSA-Sig-Value is defined thusly:

ECDSA-Sig-Value ::= SEQUENCE {
  r  INTEGER,
  s  INTEGER
}

RFC8032: Edwards-Curve Digital Signature Algorithm (EdDSA) says the following about the signature format:

  Form the signature of the concatenation of R (32 octets) and the
     little-endian encoding of S (32 octets; the three most
     significant bits of the final octet are always zero).

I don't see why ECDSA-Sig-Value couldn't be used with EdDSA in TLS 1.3 but that doesn't mean that it is. Indeed, I'm guessing that it isn't and that you're supposed to use the RFC8032 construction?


texts: What's the definition of the width of a circuit

texts: We consider the size and depth of a circuit under most situations, but recently I read some papers which consider the “width” of a circuit, so I wonder what's the definition of the width of a circuit? I have searched some definitions but they doesn't seem to be well-defined, can you provide a link or a formal definition of the width for a circuit (you can take Yao's garbled circuits as an example)?


texts:
Are there any realties tests or criterias that prove the security of the PRNG?
What kind of tests or criteria?


texts: Can a list of hashes with property $X_{n+1} = \operatorname{SHA-256}(X_n)$ loop?

texts:
This is the situation:
I have a list of hashes where each hash is always the SHA-256 of the one above it.

If I keep going down the list it must at some point loop since there can only be $16^{64}$ possible SHA-256 hashes.
So at some point the hash I get has already been in the list before.

The problem is that the algorithms behind SHA-256 is above what I can currently comprehend (I'm only 17 and a part free programmer for 3 years).
But on here there seem to be a lot of geniuses so my question is:

Is SHA-256 designed to loop after exactly $16^{64}$ hashed hashes, or is there a chance it will do so before that point?

Also: If so, it would probably do multiple times.

I saw the post on $\operatorname{Hash}(x)=x$ with $p=1-\frac1e$ answered by User fgrieu, saying that we don't yet know. But if this is determined by probability is my question also answered by probability? Please let me know if I'm thinking the wrong way or give me an answer if you have one.


texts: What is the code when looking at the LPN problem?

texts:
We are given the problem in this question.
We know that we have to use the algorithm $A_D$ in order to get $e_i$.
Our idea is that we construct a vector $l$ of $l_i$'s by getting $n$ samples from the $LPN$ oracle and construct a suitable parity check matrix $P \in \mathbb{F}_2^{(n-k)\times n}$ with which we can then input the syndrome $P\times l^t$ and the $P$ and get returned the value of $e$.
We wonder right now how the code is defined for which we will construct the parity check matrix as well as how to construct it.
Additionally we got the tip that we have to think about when exactly the parity cehck matrix exists and if so, if it is efficently computable.


texts: Multi-Authority (KGC) Certificateless Cryptography

texts:
I'm thinking to a particular scenario where I'm adopting the certificateless cryptography (the generic schema) where I have 2 trusted nodes, that we can identify as: $KGC_1$, $KGC_2$. Furthermore, I define two users, $A$ and $B$.

The first user $A$ owns (after the interaction with $KGC_1$) the $\langle SK_A^1, SK_A^2\rangle$ and the $\langle PK_A^1, PK_A^2\rangle$ which are secret and public key respectively. The second one $B$ owns (after the interaction with $KGC_2$) the $\langle SK_B^1, SK_B^2\rangle$ and the $\langle PK_B^1, PK_B^2\rangle$ which are secret and public key respectively.

In detail, each $KGC$ has its master key pair, so $KGC_1$ and $KGC_2$ own the following key pairs ($s_n$ is the Master Private Key, and $s_nG$ is the Master Public Key):

$KGC_1: \langle s_1, s_1G \rangle$

$KGC_2: \langle s_2, s_2G \rangle$

After that each node receives the partial key from the respective $KGC$, we suppose that them want to start a key-agreement procedure. Now, I have the following problem: the session key generated between the actors is different due the fact that the Master Private Key of each Authority is different ($s_1$ and $s_2$).

Are there any suggestions? My concern is avoid to share the Master Private Key among the authorities (the two $KGC$) and avoid the fact that if a $KGC$ is compromised, there isn't the risk to compromise the entire infrastructure.


texts: Is a die implemented in a physics engine truly random?

texts: So, a fair die throw is really random, not pseudo. So, would a RNG implemented as the result of a die throw in a physics engine (say, Newton, Havok, Nvidia's PhysX) be regarded as both cryptographically secure and really random (Not a PRNG, but a real RNG)?


texts:
The pre-print, Unstructured Inversions of NewHope was posted yesterday and uses a backdoor method against NTRU to claim that Grover's algorithm and an inversion oracle could be applied to NewHope.

My question is whether the backdoor from the Unstructured Inversions article could actually be used against NTRU?  I'm not interested about the impact it may or may not have against NewHope, just forms of NTRU.


texts: Why Camellia paper declares that it is faster than Rijndael while it is actually much slower?

texts:
I'm writing an assignment on Camellia cipher, reading the [NTT paper][1] they declare a speed at least comparable with Rijndael, but, searching around, I found that it is actually much slower [2]. I thought this may be caused by AES using specific cpu subsets, but even without them it is faster than Camellia with them [3].

[1] : https://www.cosic.esat.kuleuven.be/nessie/updatedPhase2Specs/camellia/camellia-v2.pdf

[2] : https://www.jmest.org/wp-content/uploads/JMESTN42351298.pdf

[3] :
What is the fastest block cipher in the (Intel) world?


texts: Showing a CBC-MAC is not preimage resistant with a proof

texts:
So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$.
I want to be able to that this won't be preimage resistant using a proof for an arbitrary single-block message $P$ that hashes to a given digest $T$. So far I've gotten as far as $$T = E(P \oplus IV, K)$$ $$D(T, K) = P \oplus IV$$ $$P = D(T, K) \oplus IV$$
I can't for the life of me figure out how to move from this to something that will show that the operation is not preimage resistant. As far as I understand if $K$ and $IV$ are fixed it should be computationally infeasible to find another $T_x$ such that $$D(T,K) \oplus IV = D(T_x, K) \oplus IV$$
Ideally I'd want to be able to extend this to show that for $P$ of any length I could find a $T_x$.


texts: Is encrypting data with AES-CTR-128 and keys with RSA-2048 secure?

texts:
Here's a question. I have a file that have to be encrypted with strong cipher (I've choosen AES-CTR-128). I'm using MVC 2019 to compile C++ program. Firstly, I create RSA-2048 key pair (public and private), then I read all data from file to buffer (filesize ±300kb), encrypt with AES-CTR-128 buffer with data from file, encrypt key and nonce used for AES-CTR-128 (I'm using WinAPI function CryptGenKey() to create random key and nonce) with public key of RSA-2048 generated previously, write encrypted key and nonce to the end of file.

  Is there any possibility to get original data if attacker don't know
  key+nonce and RSA-2048 private key?

I know that original text can be changed even if it was encrypted, but it doesn't matter. Also, I know that I can skip encryption of nonce, but... better it will be safe.


texts: Does a break in a collision resistance property of a hash function by definition implies an attack at the first pre-image attack?

texts: Is there a formal security proof in the shape of reduction that states that if an attacker manages to break the collision resistance property of a cryptographic hash function (a random oracle) he will break the pre-image attack as well? To rephrase it: is first pre-image resistance as hard as collision resistance s.t if you break collision resistance you break first pre-image attack?


texts: Why do we need Rekey (Use case of rekey cryptography)

texts:
I'm new to cryptography, and I'm trying to understand the concept of rekeying. What is the motivation (necessity) behind rekeying? What is the detailed mechanism for generating new session keys for an encrypted established connection?

Clear explanations of basic concepts would be very helpful, as would links to good videos or blogs.  (I have been unable to find such materials online.)


texts: Are longer passwords really safer against brute force attacks?

texts:
If we take two password strings of different length and attempt to bruteforce match them, it is obvious that the longer one will take longer to crack on average. However if we assume that when selecting a password our maximum password length is given ,does it really matter how long the actually selected password is, if it is then padded to the maximum length?

Example:

Max Length: 10 characters

Password A: "abc" -> padded to "abc0000000"

Password B: "abcdefgh" -> padded to "abcdefgh00"

Now we have two strings of equal length, which theoretically should both be equally hard to crack, despite the actual password entered being shorter. This assumes that the padding technique is of course kept secret.

Is there anything wrong with this reasoning? Is this actually done in practice? If not, why not?


texts: What is the length field in SHA-512 padding?

texts:
If I am using SHA-512 on a message and need to determine the padding field and length field, how do I determine the length field?  I think I understand the padding, but not the length field.

For instance, if I have a 1919-bit message the padding field would be one 1 and zero 0's.  But what would the length field be?  1919?


texts:
I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of books "Serious Cryptography" and "Understanding Cryptography" but found the AEAD explanations to be too terse. My goal is to understand docs when using crypto libraries and they mention AEAD and the pros and cons of various modes for AES. Below are the questions I have about AEAD.

What is an example problem/scenario that AEAD solves? (looking to understand the problem not the solution)
How does AEAD solve this problem? (not the algorithm details but higher level big picture)
What are typical examples of associated data?
If AEAD is not used what are attackers able to do? (a lot of online references talk about a padding  oracle attack I tried to  understand the attack but it seems to require deep  understanding of how AES works)
As a  developer  should  I always use AEAD for everything?
What are typical mistakes developers  make when applying  AEAD?
Is AEAD only required for block ciphers but not required for stream ciphers?
Is AEAD required when  using a public key crypto such as  RSA?


texts: Are picture files "random enough" to be usable as a one-time pad?

texts:
Say you have a picture with 1 megapixels taken at random and with $2^{24}$ possible colours per pixel (RGB-24). That image would be unique and the possible combinations $(2^{24})^{10^6}$ immense.

However when taking a picture in the real world, say of a clear sky, there will be a lot of repetition.

The question is: would such repetition present a security risk when used as a one-time pad, where the requirements of randomness is so high?

My hunch is that it is, as true randomness would require the possibility of all pixels being #FF0020 or whatever, but I would like to be proven right or wrong.

If I've been unclear at some point, please let me know and I will edit my post.


texts:
In the CRIME attack slides at the Ekoparty presentation (where it was first introduced), I didn't get something.
In slides 32-35 ( https://www.ekoparty.org/archive/2012/CRIME_ekoparty2012.pdf )
When we attack TLS compression - as is, why do we need to use the "Chosen Boundary Attack" concept?
Why do we need to fill 16k of data, split it to 2 records and leave the last byte (time after time) to get each byte?
We can put out guessed secret to the url when the whole secret is in the first record without filling the 16k record, why wouldn't this work?
Thanks!


texts: What does it mean to say a function is length regular and Length preserving? Does any one of them implies the other? Example if any could be useful


texts: AES sbox security issue - power analysis attack?

texts:
I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES.

I am new to power analysis attacks, so it is hard to understand for me why / why not the sbox which is used in AES could be a possibility for attackers to find out the key.

If yes, what would be an alternative? I could compute the sbox values on the flight but would that be an advantage?

Note: I don't care about performance, just about security.


texts: Hash collisions in sha512 hash of secp256k1 public keys

texts: For a sha512 hash of a secp256k1 public key, how many other public keys could generate that hash? I would assume zero since the key size is equal to the hash length (secp256k1 public keys are 64 bytes, 512-bit), and there are only $2^{256}$ public keys as the private keys are 256-bit.


texts: What is the main difference between a key, an IV and a nonce?

texts: What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their purposes? Is it only that, in literature and in practice, an IV is being used as "initiator" of a block cipher encryption mode which should be unique? And the same property should hold for a nonce as well, but since it doesn't instantiate something we call it a nonce? I.e: in AES-CTR mode the IV is a nonce+counter. And both are put in plaintext format in the beginning of the ciphertext.


texts: Disadvantage of the using a counter within plain text for encrypting with AES256 and authentication?

texts:
What if we use a counter within the plain text and then encrypt the plain text with aes 256 to encrypt & authenticate?

For example:

encryptAES(32bit_counter+plain_text_of_96bit);
or
encryptAES(16bit_counter+plain_text_of_112bit);

This way we do not need to depend on other authentication algorithms and can send about 2^32*96 ~= 48 GB of data using single key.

User can also adjust their counter length & massage length and they can start using a new key by securely exchanging a new key before reaching maximum data transfer limit.

So is there any disadvantages of using this method except reduced data transfer rate?

Is this authentication method better than available cryptographic hash functions?  (How much future proof this method is, considering weakness of cryptographic hash functions to collision attacks & length extension attacks? Ref: Comparison of SHA functions).