texts:
There are a bunch of papers do research on resizable garbled circuits. But I wonder why garbled circuits cannot be reused?

For example, the constructor constructs a garbled circuit of "AND" like this:

$E_{K_{u}^0}(E_{K_{v}^0}(K_{w}^0))$,
$E_{K_{u}^0}(E_{K_{v}^1}(K_{w}^0))$,
$E_{K_{u}^1}(E_{K_{v}^0}(K_{w}^0))$,
$E_{K_{u}^1}(E_{K_{v}^1}(K_{w}^1))$

Then he sends this garbled circuit and $K_{v}^0$, $K_{v}^1$ to the evaluator.

Every time, he wants to evaluate the garbled circuit with an input $b\in\{0,1\}$, he just sends $K_{u}^b$ to the evaluator.

Other than letting the evaluator know that he may have the same input in different evaluations, I cannot think of other revealed information.


texts: How to attack polyalphabetic affine cipher with only ciphertext?

texts:
How to attack polyalphabetic affine cipher with only the ciphertext?

A polyalphabetic affine cipher can be seen as the composition of an affine cipher ($p \mapsto c \equiv a \times p + b \pmod{26})$ and a Vigenère cipher.

Consider we have a key such as $(a_{n\  mod\  3},b_{n\  mod\  3}) \in [(3,1); (7,2); (11,8)]$.
For instance itwas$_{plaintext}$ $\longrightarrow$ zgpbd$_{ciphertext}$.


texts: Qubit / Qutrit - Is there a theoretical limit on how many orthogonal states a quantum bit has?

texts:
Seems like a quantum bit with $3$ orthogonal quantum states is called a qutrit - and they have been demonstrated practically.
In comparison with $n$ qubits that have ~$2^{n}$ states, these have ~$3^{n}$ states.

Is there a theoretical upper-limit on how many orthogonal quantum states a quantum bit has?
How would we call that unit of quantum information?


texts: How does the length of the plaintext affect the cipher strength?

texts:
Let the block length 64-bit, 256-bit key, cipher text accordingly - 64 bits. What is the strength of the block cipher, if any unknown attacks, which could reduce its strength. We can only brute force.

Let $M=\{0,1\}^{64}$ be the plaintext space, $C=\{0,1\}^{64}$ be the  ciphertext space and $K=\{0,1\}^{256}$ be the keyspace. Then:

$\forall m\in M\ \exists\ k_1,\dots,k_n\in K \colon E(m,k_1)=\dots=E(m,k_n)=c$.

That is, for fixed message and some keys.

How can we use this fact to reduce the cost of a brute force attack?


texts: Is there an oblivious decryption scheme?

texts:
Alice has $K$;
Bob has $E(K, m)$;

Is there such a scheme that enables Alice decrypts $E(K, m)$ without knowing $m$, and Bob gets $m$ ?


texts: How are "string-messages" converted to "number-messages"?

texts:
Textbooks most of the time assume that a message, say "secret", is already represented in number format, say "8614" (just as an example!). But how exactly is this conversion achieved?

I imagine it to happen something like that:

"secret" is converted into the binary format, say "1001001" (names like ASCII or UTF-8 come to my mind, though I am not sure)
1001001 is somehow converted into a number, in above example "8614"

Could you please give me more details or some references so I can look it up?


texts: Analytically finding magic constant in reversible hash function

texts:
The below integer "hash" functions form a pair of reversible hash functions:

uint32_t hash ( uint32_t x ) {

    x = ( ( x >> 16 ) ^ x ) * 0x45d9f3b;
    x = ( ( x >> 16 ) ^ x ) * 0x45d9f3b;
    x = ( ( x >> 16 ) ^ x );

    return x;
}

uint32_t unhash ( uint32_t x ) {

    x = ( ( x >> 16 ) ^ x ) * 0x119de1f3;
    x = ( ( x >> 16 ) ^ x ) * 0x119de1f3;
    x = ( ( x >> 16 ) ^ x );

    return x;
}

The reversibility obviously depends on the "magic values". In the case of uint32_t's, given 0x45d9f3b, the value 0x119de1f3 can be easily found by exhaustive search.

I would like to design a 64-bit equivalent. Exhaustive search is in the 64-bit case no longer an option.

The question is: "Can this 'reversing magical constant' be found analytically?"

PS: I do realise that this is not a hash function in a cryptograhical sense.


texts: ASN.1 encoding off RSASSA-PSS default parameters

texts:
I am not totally sure the question belongs to crypto and not stackoverflow but nevertheless...

The problem is the encoding of the RSASSA-PSS default algorithm identifier parameters in an X509 certificate.

During a test case we generate a certificate with the default parameters for PSS and try to import that certificate into an hsm.

The jca wrapper library around the pkcs#11 driver of the hsm rejects the certificate with an exception ala

Wrong parameters for an RSAandMGF1 algorithm identifier

The certificate in question is generated with bouncy castle and can be verified with openssl. The problem is that the algorithm identifier parameters in the certificate is a empty sequence.

RFC3447 A.2.2.3 states the following:

The parameters field associated with this OID in a value of type
AlgorithmIdentifier shall have a value of type RSASSA-PSS-params:

  RSASSA-PSS-params ::= SEQUENCE {
      hashAlgorithm      [0] HashAlgorithm    DEFAULT sha1,
      maskGenAlgorithm   [1] MaskGenAlgorithm DEFAULT mgf1SHA1,
      saltLength         [2] INTEGER          DEFAULT 20,
      trailerField       [3] TrailerField     DEFAULT trailerFieldBC
  }

and a few paragraphs later:

  If the default values of the hashAlgorithm, maskGenAlgorithm, and
  trailerField fields of RSASSA-PSS-params are used, then the
  algorithm identifier will have the following value:

     rSASSA-PSS-Default-Identifier  RSASSA-AlgorithmIdentifier ::= {
         algorithm   id-RSASSA-PSS,
         parameters  RSASSA-PSS-params : {
             hashAlgorithm       sha1,
             maskGenAlgorithm    mgf1SHA1,
             saltLength          20,
             trailerField        trailerFieldBC
         }
     }

     RSASSA-AlgorithmIdentifier ::=
         AlgorithmIdentifier { {PKCS1Algorithms} }

So it seems that bouncy castle is following the ASN.1 definition and returning an empty sequence for the default values. But if I read the last part it seems to me they still require the default values to be set and it seems the library we need to use enforces this.

So before writing a support ticket I just wanted to ask if I did miss something in the rfc or the certificate is really not valid.


texts: Shamir three-pass protocol Elliptic Curve

texts:
I want to know how I can implement this protocol. I know how Shamir three pass protocol operates without elliptic curve, but I don't know how I can perform it with elliptic curve.

I read about this protocol; if Alice want to send to Bob then:

Alice convert the message in a point $M$ of the elliptic curve. Then she picks a random element $k$ that belongs to the finite field of elliptic curve. Then she encrypt with $k \times M$ to generate $kM$, right?
Bob picks a random element $q$ that belongs to the finite field. Then he encrpyt the point received from alice to generate $q(kM)$, for this he computes $q \times (kM)$.
Alice decrypt the message with the inverse of $k$.

It is possible? The function decrypt would be $k^{-1} \times q(kM)$? Then, Alice send $qM$ to Bob.

Bob decrypt wit the inverse of $q$. He decrypts in the same way that Alice does.

I think that this are the steps for this protocol but it does not work in my SAGE implementation. Can somebody indicate if I missed anything?


texts: For this example of my problem I used $2$ and $7$ for $p$ and $q$, and $2$ for my plaintext... but I have tried this with many different numbers and they all have the same problem.  Phi of $n$ was $6$.  My public key was $m^5~mod~14$ and my private key was $m^{11}~mod~14$.  This all worked fine.  If I encrypted my plaintext $2$ with my public key, $2^5~mod~14$, I got $4$.  If I took my ciphertext, $4$, and sent it through the same equation again, $4^5~mod~14$, I get back $2$. How can it be that my RSA public key can decrypt the ciphertext it encrypted?


texts:
Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$.

In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = $E_{k_1}(E_{k_2}(x))$,

can be brute-forced in $O(2^n)$ time and $O((l + n)2^n)$ space using the meet-in-the-middle attack:

create a table with $2^n$ entries mapping
keys of length $l$ to entries of length n by encrypting the known plain text $x$ with all possible keys $k_2$,
then search the table by decrypting the corresponding cipher text $c$ using all possible keys $k_1$.

Suppose you only have $O((l + m)2^m)$ space (where $m < n$),
Give an algorithm to break the double
encryption in time $O(2^{2n-m})$.

I am stuck for days, can't figure out the trick that will allow such an efficient algorithm.

Any ideas? Tips? Hints?

This is homework of course.

ADDED:

Is it sufficient to show that if we choose smaller $n$ the encryption will be broken with non neglect-able probability? Or I must show an algorithm that ALWAYS brake the encryption?


texts: Faster Shuffling for a Simple Application

texts:
Alice, Bob, and Charlie are working on three projects.

Alice is the manager.  At the beginning of each day, she chooses one
project to work on (this choice is based on her preferences and is
not random) and then assigns the other projects to Bob and Charlie.
Bob and Charlie demand that this assignment be 50/50 random and
anonymous (so Alice does not know who got which of the two projects).
Alice accepts this demand, but demands that her original choice be
anonymous too (so Bob and Charlie can not know which project Alice
has, unless they tell each other their projects to deduce the remaining
project).

To accomplish this, at the beginning of each day, Alice writes the
two projects she does not want on two cards and puts them face down on
a table.  Everyone mixes/shuffles the cards until everyone is content
that no one knows which is which.  Bob picks a card, Charlie gets the
other card, and they then work separately on the projects written on
their cards.

The only way I see to accomplish this "at a distance with cryptography"
is Mental Poker, based on
a commuting encryption/decryption method:

Alice shuffles and encrypts both (starting from her two unwanted projects)
-> Bob shuffles and encrypts both
-> Charlie shuffles and encrypts both
-> Alice decrypts both
-> Bob decrypts the first and Charlie decrypts the second
-> In secret, Bob decrypts the second and Charlie decrypts the first

This is a lot of back and forth for every daily assignment - Is there any
simpler solution?

Ignoring Charlie, I was thinking Bob could give some seed (generated from a
private key) to Alice before everything and then Alice would generate random numbers for Bob (readable with his private key, but unreadable to
Alice) which somehow exclude Alice's project...but maybe that is a pipe
dream.


texts:
I'm studying the RC4 algorithm and I have the following questions:

On all questions assume that an expanded (2048-bit) key is used, and that the first 4096 bytes of the KeystreamIm are discarded.

After the above process, is the resulting S-box indistinguishable from a random permutation of the numbers 0 through 255?

Assuming the above process, are the bytes generated indistinguishable from random data?


texts: Equivalence of Secret IV and Secret Prefix MAC

texts:
I read that the secret $IV$ and secret prefix $MAC$ methods are equivalent. Intuitively, this sounds reasonable because the $IV$ and the secret prefix are both the foundation of the inner state at the point of time when the actual message is hashed/compressed.

E.g. in "MDx-MAC and Building Fast MACs from Hash Functions" (link) by Preneel and Oorschot. Section 4.1 The Secret Prefix Method: "If the key consists of a complete block, this corresponds to a hash function with a secret IV."

With secret $IV$ $MAC$ I mean that the key is written into the $IV$ variables / the internal state before the message is hashed.

With secret prefix $MAC$ I consider the function $H(k\ ||\ m)$ where $H$ is a hash function, $k$ is the secret key, $m$ is the message and $||$ denotes concatenation.

I guess the security properties of these two schemes are indeed equivalent but how does this work in practice? For example some attacks against $MD4$ $MAC$s involve the work of offline $MD4$ computations. I can do that on messages with standard $MD4$ in the secret prefix $MAC$ setting (just leaving the unknown key out), but how can one do an offline computation when the secret $IV$ is unknown. How should the hash function be initialized and how (if at all) are the attacks applicable?

Examples of such attacks are:

New Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5 (this targets $HMAC$ instead of secret prefix $MAC$, but I guess the attack is adaptable)

Password Recovery Attack on Authentication Protocol MD4(Password || Challenge) (... must leave out the reference here, due to missing repudiation)


texts: Expand 1-n Oblivious Transfer to retreave only an item I, for which permissions exist

texts:
To my understanding in a 1-n Oblivious Transfer the Sender has some Values $X_1...X_N$ and the receiver wants to retreave some $X_I$, with $1 \le I \le N$.

Can one now somehow guarantee, that the Receiver has the permissions to retreive said $I$? Assuming every receiver has some rights to receive exactly one certain $I$, and no other Receiver has them.
I think keeping the possible $I$ values secret would be insecure and not an option.


texts: How to encrypt a short string and keep the length secret

texts:
I need to encrypt relatively short strings (generally less than 100 characters). If possible, I want to avoid leaking the length of these strings. How can I do that?

The thing that came to my mind is to pad the text to 1 KiB with random data, separating the content from the padding with a 0x00 byte. Is this a good idea?


texts: How do Latin squares relate to quantum cryptography?

texts:
About ten years ago I became interested in Latin squares.  A friend who was at the Clay Institute at the time mentioned that applications for Latin squares were exploding, and that they were being utilized in quantum cryptography.

I've found a paper discussing use of Latin squares in cryptography in general (p.8 in linked doc), but can't find direct info on their uses in quantum cryptography.

This paper also makes reference to a paper entitled: "A message authentication code based on
Latin Squares" from the Australasian Conference on Information Security and Privacy.

However I'm having trouble finding direct references to Latin squares in quantum cryptography.

Basically, I'm trying to get a high-level understanding of this association, if it is indeed accurate.  Any info or insight would be appreciated.


texts: Cycling hashing in PBKDF's and their limitations in strength?

texts:
I hope this question isn't too similar to one that's already been asked. I also want to point out I know part the answer already, AFAIK: I just want some expert input on this.

Let's model a hash that more strictly is a possibly weak PBKDF. It would exist – if it worked – to slow down the cracking of passphrases (relatively short inputs), using well established secure hashes (i.e. SHA-2).

Looped hash on message (UserInput)

I'm well aware that modern ASIC/GPU technology would make cycling-hashing very brute-forceable on weak enough passwords and by cycling hashing I mean

PassHash := Hash(UserInput)
Do Loop 1024 times{
    PassHash := Hash(PassHash)
}
Output := PassHash

In this routine, "Hash" may be SHA-256 (NOT HMAC, but a regular Hash). This pseudo-routine would be just as vulnerable to rainbow tables as SHA-256, AFAIK.

So, let's purpose a small alteration, instead we use this (also bad) "KDF":

Looped hash on salted message (UserInput | Salt)

PassHash := Hash(UserInput | Salt)
Do Loop 1024 times{
    PassHash := Hash(PassHash | Salt)
}
Output := E(Hash(UserInput),Salt) | PassHash

E is performed with any good cipher that will take a 256bit key.

Above "Hash", would still be something like SHA-256. For example: Salt would be a randomly picked ~80 bits. The UserInput variable, (The Password/Passphrase) could be any length but ideally wants to be at least 112 bits.

PBKDF/2

In PBKDF/2, as I understand, we wouldn't use a HASH, but a HMAC (one reason being a lot of hash-functions are vulnerable to length-extension attacks).

Question

As I stated, I recon this code could be much worse than PBKDF2 and bCrypt and I can think of some reasons why. What I'ld like to know is: what are the biggest flaws in this routine, if any and why? And… maybe someone could demonstrate how we’ld go about attacking the design laid out above to show any major weaknesses?


texts: Performing simple arithmetic operations on compressed, and both compressed and encrypted data

texts:
We all know it is possible to perform addition and multiplication operations on encrypted data by means of homomorphic encryption methods. My questions are:

Is there any cryptosystem that is able to perform these operations on

compressed data
first-encrypted then-compressed data
first-compressed then-encrypted data

without any decryption or decompression?


texts: PKCS11: CKA_VALUE_LEN attribute and Unwrap key

texts:
In PKCS11 specification v2.40, we see some confusion with CKA_VALUE_LEN attribute and UnwrapKey behavior.
From PKCS11 spec 2.40 section 2.8.2,

2 -> MUST not be specified when object is created with C_CreateObject.
3 -> MUST be specified when object is generated with C_GenerateKey or C_GenerateKeyPair.
6 -> MUST not be specified when object is unwrapped with C_UnwrapKey.
In the AES-ECB and AES-CBC, spec tells to pass CKA_VALUE_LEN (section 2.8.4),

So what is expected from application? Do the applications need to pass CKA_VALUE_LEN during unwrap?
NOTE: Even PKCS11 spec 3.0 is also saying the same thing.


texts: Is SSL broken? If so, what can I do about it?

texts:
But recently, with the scandals about the (in)filtrations, I read that the NSA (and of course others, but I'm not particularly worried about NSA) is able to break SSL and track your data.

It is true? What can I do about that, given I do not know much about cryptography?


texts: Result of expressions using modular arithmatic for group signatures

texts:
I read the following in a paper about group signatures called "A Practical and Provably Secure
Coalition-Resistant Group Signature Scheme".

In the sign part of paper the following expressions can be found:

$$d_2 = T_2^{r_1}/g^{r_3} \bmod N$$
$$s_1 = r_1-c(e_i-2^{\gamma_1})$$
$$s_3 = r_3-c*e_i*w$$

and in the verify part

$$d_2 = T_2^{s_1-c*2^{\gamma_1}}/g^{s_3} \bmod N$$

this is not producing correct result as $d_2$ doesn't verify.

I am confused about the result of these expressions, can you explain if and why the expressions are correct?


texts: Zero-Knowledge Proof of Subgraph Isomorphism

texts:
I'm trying to find a Zero-Knowledge proof of subgraph isomorphism in the following scenario: Alice and Bob both know about graphs G1 and G2. Alice knows about a subgraph of G1 which is isomorphic to G2. How can Alice convince Bob that she knows of this subgraph existing without giving Bob any help with finding the subgraph.

I'm a bit confused on the entire concept of Zero-Knowledge proofs, so anything that could help me get started on this problem would be great! Thanks!


texts:
I figured that a really secure password would be an AES 128 key. If this key were to be base 64 encoded, I could replace 4 random bytes in it in order to make it unusable unless you know which bytes were replaced and by what.

The process would be like this:

generate a key: [²ú·0ýóQS%ô6
base64 encode it to make it readable: iVuy+rcw/fNRU56AiiX0Ng==
replace 4 random bytes of it iVuy+icw/fNRG5oAiiJ0Ng==

I would remember what the 4 bytes are i.e. the password
the computer would remember which bytes got changed (in this case: 13, 6, 19, 15) and in what order

My question is: how difficult (how many attempts) would it be to guess the correct key if you got hold of the original.

Another way of asking this is: how long has the key to be in order to make it difficult (several decades of guessing with a super computer) with changing just 4 random bytes.

I guess there is a simple mathematical formula to calculate this. But I don't know it.

thank you for your support


texts: How do additional input output pairs help with a Meet in the Middle attack on Double DES

texts:
Double DES is vulnerable to a Meet in the Middle attack where an attacker generates intermediate values and then matches them up to find candidate key pairs. For Double DES using $56$ bit keys and $1$ input/output pair you get $2^{48}$ candidate key pairs. How does this scale when you use multiple input/output pairs?

edit: To be more explicit: How much does each additional input/output pair reduce the number of candidate keys?


texts: Can I use computational diffie hellman problem in the following scheme?

texts:
Suppose $$X=mnrP , Y=\frac{1}{n}Q, R=e(P,Q)^m$$

$X,Y,P,Q$ are randomly chosen from $G_1$.And only $X,Y$ is given in public.
$m,n,r$ are randomly chosen from $Z_q$.
Anybody who knows $(1/r)$ can easily get $R=e(X,Y)^{\frac{1}{r}}$.
Can I use computational diffie hellman problem by assuming
 $$X=g^x, Y=g^y$$, then finding $g^yx$.
Because in authenticated identity-based encryption by Ben Lynn, authenticated key
$$K= e(H(ID_A),H(ID_B))^s$$
is assumed to be secure if the CDH problem is hard.In this case, $H(ID_A),H(ID_B)$ is declared as public.

Which one is better, guessing problem or computational diffie hellman problem?


texts: P-Complete hashes, hashing to a larger set

texts:
Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits).

Also, hash functions that are P-complete have no known parallel algorithm; they must be computed serially which ensures a certain amount of temporal cost in computing them.

Three questions:

What is the technical term for hashes that map to a larger set than the domain?
Are there any good P-complete hashes?
Are there any good P-complete hashes that map to a larger set?


texts: How to recover plaintext, if we know public key(RSA), correctly encrypted text and text encrypted with faulty public key, where one bit is changed?


texts: Is there any way to save Email encrypted in Database and used as normal later?

texts:
I have a senario like
" I want to save a email (like  foo@bar.com) encrypted in Database (For example as 'asdjasjdna')  after that I want to check when User enter this email and compare in database.
Till now findings :

I can't lookup in database using that email directly
I can't convert incoming email to existing encryption as it changes every time depending upon timestamp.

So am I going right ? Is there anyway or workaround ? kindly guide any suggestion would be highly appreciated


texts: Identifying the exact encryption procedure by database hash

texts:
I was asked to develop an external user administration for a legacy system so that it could be integrated into company processes. This system is mostly written in Python, but also uses unmanaged DLLs. There is no sufficient documentation about the system, also no source code.

Now I face the following problem:
In order to successfully create a new user externally, I first have to reproduce the exact encryption process of the user passwords. These are stored in an Oracle 12g database in two columns: "PWDHASH" and "PWDSALT", whereby the columns have the format RAW.

By looking at the responsible Crypto-DLL in a text editor, I could at least find out that the passwords are encrypted by BCrypt with $2^5$ rounds. The output should be accordingly in the format $2y$12$kr.ZczvVffAPjAhqlm9gCeXg52ML0bDHZ7ohELafqbur9VYb6hf5S.

Now the highlight - in the database there is only a hexadecimal string for the password hash (48 characters), also for the salt (32 characters).
These are built like this:

[PWDHASH: 71CB599837172944B13CB650E3E60468619AF5BECC80C867;
PWDSALT: F6DDABC4B7BBD433F5FF6B9BD634AFC0]

Now the question: How can I find out what happened between the encryption with BCrypt and the final values found in the database? Is Oracle's own encryption possibly still used here (RAW column format)? Is there a way to get this information without source code?


texts: What is "Blinding" used for in cryptography?

texts: What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?


texts: PBKDF2-SHA256+SHA256 for password storage

texts:
I recently came across an interesting paper detailing the use of hardened session cookies. Each cookie includes a preimage of the password hash, and the preimage is hashed once more and compared to the stored password hash as part of the cookie authentication process.

In order for this to work, we must be able to quickly compute the password hash from the preimage on each web request. This is not easily possible using plain PBKDF2-SHA256 to store the passwords. However, if we store the passwords as:

$SHA256(PBKDF2(password, salt, iterations=10000))$

we can quickly move from the preimage, $PBKDF2(password,salt,iterations=10000)$, to the stored hash by computing $SHA256(preimage)$.

What are the relative weaknesses here, compared with just storing the PBKDF2-SHA256 digest?


texts: Proof of using a literal from known set, inside a computed formula

texts:
Suppose I have publicly revealed the value of  $\phi(u) = A+Bu$,
where A, B, u are private values from a large group, that I want to keep in secret.

Furthermore, I want to add proof that the value $u$ is from a publicly known set of values, without revealing its real value.

How can I do that?
Same question with proof about $A$

I thought about:

A zero-knowledge scheme, but it seems to be inadequate to that purpose because the value $u$ is publicly known.
Private set intersection - But since $u$ is from a publicly known set I might reveal its value.


texts: What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

texts:
Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistel scheme as a round function for a four-round Feistel scheme.

I wanted to know if doing so would provide better security than existing schemes, like Blowfish. And what if I use Blowfish Cipher itself as the round function (like in Turtle), will it, or, is it known to enhance security? If so, by how much?

I understood the idea of using cipher structures that are already known to be secure (as mentioned in the paper on Turtle that I linked above), but once the sub-Feistel Cipher is broken, the whole cipher should be broken, isn't it?

It's also the matter of the amount of processing required. It isn't heavy for general use, but it's a matter of concern when you expect your algorithm to be super fast.

I am currently working on an array of crypto algorithms for an inter-high-school science contest, which includes a Turtle like Feistel Cipher (Feistel Cipher using a sub-Feistel Cipher) and a fast PRNG that uses a Sponge Hash function that uses a Feistel Cipher as a function, and I thought I'd use the above-mentioned proposal of this cipher in the PRNG. However, I am a little skeptical about using it for the PRNG, as it might slow it down, and I am only trying to achieve an avalanche effect for the Hash function, which could also be accomplished by simpler Feistel construction. So, I also wanted to know if Turtle like algorithms is exceptionally good enough to be used in PRNGs, i.e., do they improve the unpredictability of the pseudo-random numbers generated.

P.S. I am insisting on using simpler constructions for the PRNG as I want it to be as fast as possible. I did a humiliatingly bad mistake in my last years' presentation for the same contest, where the then proposed PRNG took many seconds to generate a few numbers. This time I want it to be as fast as possible. So I will use the Turtle like proposal only if it increases the cryptographic security of the generator, or else I will resort to something simpler.


texts: Correct integer input value for keccak 256

texts:
Assuming that we use k = sha3.keccak_256()(pysha3 package).

How should one convert integer input for a function k.update(myinteger) so that the output will be correct?

example:

import sha3

myinteger = 1064880000

k = sha3.keccak_256()
k.update(myinteger)
k.hexdigest()


texts: is H1 (H2(x)) hash function collision-resistant

texts:
If H1 is collision-resistant then is H1 (H2(x)) collision-resistant?
I think yes but I don't know how to prove it


texts: Finding a base of an exponent in mod field


texts: Is it possible to find a preimage for a reduced size hash?

texts:
Given a message $M$ and a 256 bit key $K$, perform HMAC($K$, $M$) with a 256 bit hash function resulting in:

$a$ = 9a58e0eef2effc968d27cd61c47394867ceae43c7a877d59938f8400fe1a0204

Now take every second hexadecimal symbol resulting in a 128 bit hash:

$b$ = a80e2fc6d7d14346ca4ca7d93f40ea24

Assume the attacker knows the HMAC hash function.

Knowing only $b$, is it possible to find a preimage for $M$ or $K$?
Knowing only $b$, to find the original $K$ or $M$,
does an attacker need to repeat the same process (HMAC($K$, $M$) + taking every
second symbol) and perform a brute force search with 2256 different keys to match the hash back to $b$? Or is there a faster way?


texts:
I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/01/Damn-Cool-Algorithms-Fountain-Codes).

Here's what I have understood from those links.

Suppose the message to be sent and verified is a text Hello or ['H','e','l','l','o'] (ASCII values [72, 101, 108, 108, 111]).

An LT code scheme will create unlimited number of encoded chunks, one of which could be $c_1 = \mathrm{'H'} \oplus \mathrm{'e'}$.

Now transforming it to a homomorphic scheme, it becomes $c_1 = (\mathrm{'H'} + \mathrm{'e'}) \bmod q = (72 + 101) \mod 257 = 173$.
173 is sent and received by the receiver which verifies the block on-the-fly using homomorphic hashing.
$$h(c_1) = (h(\mathrm{'H'}) \cdot h(\mathrm{'e'})) \bmod p$$

If it matches, it stores the encoded block otherwise it discards it. (Assuming it already stores the hashes of the individual blocks, in this case block size is assumed to be 1)

Suppose some other encoded block is $c_2 = \mathrm{'H'} = 72$. It is verified at the receiver and LT decoder decodes it to 'H' and 'e' as follows:

$c_1 = 173 = \mathrm{'H'} \oplus \mathrm{'e'}$ and $c_2 = 72 = \mathrm{'H'}$ so $c_1 - c_2 = 102 = \mathrm{'e'}$, and so on and so forth.

Is this the right way to go about it? Am I missing something in the implementation? Can we use $\oplus$ (xor) instead of addition while sending the encoded blocks?

As per above link, Nick discussed verifying file in batches of blocks. So continuing the same example, assume we'd use homomorphic hashing after receiving the first 3 bytes ('H', 'e', 'l'). After we receive first 3 bytes, we'd apply a homomorphic hash the same way as applied to string Hello as in Nick's blog. If the hash matches , we're good but if hash doesn't match (say because we had received 'I', 'e', 'l'), how do we figure out that it's the first byte that is corrupted?


texts: Can a nonce be used to steganographically hide a message?

texts:
If a standard encryption scheme involves a nonce, as most do, can the nonce be used to hide another small message?
That is, the nonce (rather than being randomly generated) is a hidden message XORed with another secret key.  As long as this other secret key is hashed/random and unique for each message, this is equivalent to random, right?
In an extended nonce setup (such as Xsalsa) 192 bits could be sent as a hidden/deniable message.  I realise this is still tiny, but it seems truly deniable since you are using a standard encryption scheme, therefore overcoming the issue detailed in the answer here.
Aside from the obvious problem/hassle of exchanging a 2nd secret key and sending small messages as a series of larger ones, is this a viable idea?


texts: Signal Sender Keys: Why it works and which is the common key at the end?

texts:
As I has read upon "WhatsUp Encryption Overview" when a client receives a sender message then it performs the following actions:

Decomposes Sender Message to Chain Key and Signature Key.
Generates a Message Key from a Chain Key and update the Chain Key.
The sender encrypts the message using AES256 in CBC mode and signs it with Signature key.
The sender transmits the single ciphertext message to the server,
which does server-side fan-out to all group participants.

So I wonder at the end which is the final group key each participant, as far as I understand has a single key so how others on a group chat are able to decrypt the message?

Also I cannot understand at step 2 which key is used in order to encrypt the message in AES CBC Mode?

Also how Chain Key is updated? As some sort of a DKF function is used to concat all single keys into one master key?


texts: Pollard's Lambda algorithm ecdlp with Pohlig Hellman

texts:
I'm trying to solve the ECDLP problem given an elliptic curve defined over a prime field. This prime is large (about 256 bits).

I managed to factor the order of the curve, and most of the prime factors were smooth, but two of the factors weren't, they were about 80 bits each. I'm given two points $P$ and $Q$, and $Q = nP$, so the goal is to find $n$.

So the order has some smooth factors and some not so smooth factors, so I tried to apply pollard rho to the semi-large primes but that's still a $O(\sqrt{2^{80}})$ complexity, which I think will take too long.

I started looking at Pollard's lambda algorithm. I'm not given a bound on $n$, but I was given an upper bound on $n$, so I know that $n < U$, $U$ was about $b$ bits, could I use with pollard's lambda algorithm (or pollard's rho algorithm) so it's more efficient than $O(\sqrt{2^{80}})$

So is it possible pollard's lambda with the pohlig-hellman algorithm, or is the a better attack to use if I know a number $U$ so that $n < U$ and $Q = nP$.


texts:
This site suggests that Secure Remote Password protocol is secure when "Attackers can intercept, modify, and forge arbitrary messages between client and server."

However, from a quick reading of the Wikipedia page on SRP [1], it seems that an obvious shortcoming of the method is that the server cannot, in general, be trusted.  Since organization-hacking and stealing of credentials is the problem that is being addressed by not storing passwords in plain-text, the client's password verifier and salt ($v$ and $s$ in the notation of [1]) cannot be assumed to be known only to the server.  Therefore an attacker with knowledge of $v$ and $s$ (stolen from the server) could perform a man-in-the-middle on an SRP authentication, obtaining the symmetric key using the same procedure as the server.  Using the known symmetric key, it seems that the attacker can now issue arbitrary requests to the server masquerading as the client.

I'm not a security expert, so I'm almost certainly missing something here.  What's the catch?


texts:
In a recent press interview, a former terrorist of the 1970s described the cipher his group used to communicate. He claimed that method was unbreakable and I wonder if cryptographers today would agree. Here is how it functionned:

Take two identical books (same edition): one for the sender, one for the recipient.
Each sign - one could include spaces between words as signs - is encoded as follows:

  (page number) (line number) (number of character on the line) (random
  number)

additions, subtractions, multiplications or divisions of certain agreed value in a certain order are then applied. For example, 357 could mean:

  (page number*3) (line number -5) (character number +7)

This means that negative values can be created, especially if the
substraction value is in the double digits

A software script for such a cipher would be I think relatively easy to design. Also, the agreed values of the operations in step 2 can be changed anytime so the same base text can be reused.

Bottom line, it means for example a single 7-letter word would produce a string of 28 numbers, of various lenghts and some negative values or decimals or fractions perhaps - depending on what values are used for the operations.

what is your opinion on this method?


texts: XOR cipher for encrypting compiled C code

texts:
I'm exploring ways of encrypting Intel hex files we send to customers for flashing onto an embedded device. The embedded processor itself has a built-in mechanism that prevents anyone from reading the contents of the flash memory unless you unlock it using a 128-bit password.

A trivial method I thought of to encrypt the contents of the hex file is to XOR its data fields with this 128-bit password. The embedded bootloader (which knows the password) would then XOR the incoming cipher text to recover the plain text before flashing it.

The hex files are several hundred kilobytes in size. Typically such a scheme is susceptible to a frequency analysis attack, but (according to Wikipedia) the success of such an attack is dependent on the ability to make assumptions about patterns in the plain text. I have two conflicting arguments with regard to this, and I can't decide which one is more accurate.

Since the underlying plain text is processor instructions one cannot make assumptions about repetition patterns.
Because the plain text consists of opcodes interspersed with operands for those opcodes, you're working with a finite set (the opcodes supported by this processor), this fact can be exploited to identify patterns.

Pertaining to the second argument, it is a CISC processor that supports several hundred instructions; some of these opcodes (parts of the opcode) vary depending on the operand. It is certainly not a small set we're talking about.

Is this approach flawed or does it make for reasonable encryption under these circumstances? (I realize the question is subjective, but I don't know how to make it more quantitative).

The password certainly does not have to be limited to 128 bits, but due to size concerns it'll always be several orders of magnitude smaller than the code being encrypted.

What if I were to introduce some heuristic where, depending on the data content, the password was first rotated before XORing with a given block of plain text?

Lastly, I'm open to other ideas of dealing with this situation as well.


texts: Is ECDH(E) Key Exchange FIPS 140-2 compliant?

texts: We have read dozens of documents now - some that contradict each other - and cannot find a solid source of truth. Does FIPS 140-2 compliance allow for the use of elliptic curve cryptography as a key exchange for TLS communication? ECDH and ECDHE - if so, which P-xxx key sizes?


texts: Is there a way to encrypt multiple sets of data into one result, with separate keys decrypting each set of data

texts:
What I am picturing is something like this:

Block A: "Hello, how are you today?"

Block B: "The weather reminds me of summer."

I encode this, giving me two keys and a resulting encrypted block e.g.

AP: 2da93742a7340ad12372aff
BP: 023cd97d40293d7c4027947
DATA: ksdjhfksdjhf0wddfg74059r7sdhdkfh

Whereas decrypting with AP would give me "Hello, how are you today?" and with BP would correspond to "The weather reminds me of summer.".


texts: In ROLLO -Rank-Ouroboros, LAKE & LOCKER  p.20, it says that "Notice that for 128 security bits parameters, the practical security is rather higher than 128 at about 170 bits." How Can I calculate this size?


texts: Is there a variant of Merkle tree with no traceability from root to leaves?

texts:
I'd like to store a large amount of objects, all authenticated using something like a Merkle tree. The root will be published, and I'd like to make sure there is no way to enumerate these objects from the root of the tree, or even prove a document is in the tree, unless this information has been published by me.

Is there an existing variant of Merkle tree to do so, or should I invent something myself? I came up with the following scheme, but it is most probably utterly broken:

A root is a hash(first-level nodes + salt).
Every node is a hash(next-level nodes/documents + salt).
A separate salt is stored for every document and for every node
In order to reveal a document I publish the path in the tree with all the salts along the way.


texts: Strategy to crack a presumed substitution cipher

texts:
The ciphertext given is:

ejitp spawa qleji taiul rtwll rflrl laoat wsqqj atgac kthls iraoa twlpl qjatw jufrh lhuts qataq itats aittk stqfj cae

I've done frequency analysis on the text. That yielded the following results:

A(15), B(0), C(2), D(0), E(3), F(3),  G(1), H(3), I(6), J(6), K(2), L(11), M(0),
N(0),  O(2), P(3), Q(7), R(5), S(6), T(15), U(3), V(0), W(5), X(0), Y(0),  Z(0)

There are 120 characters total. The format of the ciphertext does not match the format of the quote from which it was created.

The most common digrams (in order of most frequent to least, max 6, min 2):

at, it, tw, lr ,ta, ej, ai, ao, aq, ll, ts, wl, ji, hl, ja, sq, oa, qj

The most common trigrams in the same order (max 3, min 2):

atw, ita, jat, jit ,eji, twl, oat, aoa, qja

I've tried substituting character a few at a time to see if I could start to make out some words, but every time I have ended up with letters next to each other that don't make any sense.

I don't need the exact answer, but if someone could help point me in the right direction I would appreciate it. The answer would be great too, but I'd really like to understand the process here.


texts:
Assume:

Alice and Bob both generate separate EC keypairs
Alice obtains Bob's public key, and together with her private key creates a shared secret key
Alice encrypts a message using the shared key and some mode of authenticated encryption (AES-GCM, for example)
Bob generates the same shared secret key using his private key and Alice's public key
Bob decrypts the message, paying attention to whether or not the auth-tag is valid

My question is; if Bob is confident that Alice's public key really belongs to Alice, then can he be confident that it was Alice who encrypted the message? Or to put it another way, in this scenario does the auth-tag effectively serve as a signature created with a public-key? Intuitively I want to say yes, but I just want to make sure I'm not overlooking anything.


texts: Currently I am working on a public key certificate. I got a question: Why is a public key certificate needed for TLS/SSL? Wouldn't TLS/SSL itself is enough? What is the role of the certificate?


texts: Can elliptic curve (25519) be used to encrypt file?

texts:
This is probably a simple question, but I haven't been able to see it stated anywhere. Is it possible to directly encrypt a file (of any length) with some form of EC using the 25519 curve.

I know it's common to exchange a key with EC and then use symmetric encryption (AES) to encrypt a file, however I was curious if it was possible directly ?

I've seen the salsa20 and chacha stream ciphers but I am unsure if they are suitable. If so is there a pre-existing tool that can be used or is something like libsodium the way to go.

As you probably have guessed, I'm still in research mode and I'm fairly keen to use as many pre-existing tools as possible.


texts: Is this method of speeding up a symmetrical algorithm secure? (AES output joining)

texts:
I was trying to find out a way of speeding up a given symmetrical algorithm the reason and programing launguage in this case are unimportant. I have came up with the following thing:

Divide data into n parts
Run n threads
Each thread encrypts its part of the data
Take the output of all of the threads and concatenate (join) all of them together

And for the decryption:

Divide the cipher text into the same parts that where joined
If feasible Run the same amount of threads as parts If not decrypt one after another
Join the outputs

Things that i can not do with my enviorment:

Change the algorithm code (I can only use encrypt and decrypt)

I am aware that i can use Electronic Code Book (ecb) for this goal but i would like it work for all modes.

My question is does the above method compromise security in any way?
If it does. To what extend?

Sorry for making any mistakes this is my first question


texts: What is the Bilinear-map accumulator disadvantage

texts: Bilinear-map accumulator [1] is more efficient than the RSA accumulator [2] but do you know any disadvantage for the bilinear-map accumulator when compared to RSA accumulator?


texts: Scalar product of vectors over polynomial rings

texts:
I have been studying about homomorphic encryption (HE) lately, and I am trying to perform simple computations over encrypted data. Specifically, I am interested in the scalar product between two vectors.
I came across this presentation about HElib (an implementation of HE) and on slide 32 there's this particular way of encoding vectors that gives use the scalar product after we multiply the polynomials that represent them:

Given $v=[1, 2, 3]$, $u=[4,5,6]$
If we make two polynomials such as $V(x) = 1 + 2x + 3x^2$, $U(x)=4 + 5x + 6x^2$
But $V(x)U(x) = 4 + 13x + 28x^2 + 27x^3 + 18x^4$
Change a little bit $Û(x) = 6 + 5x + 4x^2$
$V(x)Û(x) = 6 + 17x + 32x^2 + 23x^3 + 12x^4$
$32 = \langle v, u \rangle$

So my question is: How to choose the polynomial encoding of the vectors in order to obtain the scalar product value from a particular coefficient after multiplication? In other words, why inverting the representation of $U(x)$ to $Û(x)$ gave us the scalar product in the third coefficient?


texts:
I can't find any usable resources about it online (at least ones that make sense to me right now), so any links to articles or if you could explain it to me would be greatly appreciated.

What I don't understand is what is PSS? I understand that RSA is an encryption type with two keys (usually public and private), but is PSS a signature (like the name suggests) and if so, how is it different from a hash?


texts: How to backup a secret encrypted by multi parties without revealing the secret?

texts:
I'm searching for a way to backup a secret that only the end user knows the information with 2 trusted hosts.

But trusted hosts shouldn't have access to secret at any time.

First basic version :
Alice encrypt secret using Server A public key
Alice encrypt encrypted secret using Server B public key.
Alice store this double encrypted secret somewhere safe

To restore :
Alice ask server B to decrypt double encrypted secret
Alice ask server A to decrypt result
Alice get secret ... but server A also !

It could work if :
to restore :
Alice ask server B to decrypt double encrypted secret
Alice encrypt result using a magical encryption mechanism (?)
Alice ask server A to decrypt this information (homomorphic ??)
Alice receive result and decrypt using a magical decryption mechanism (?)
Alice get secret ... and server A got just an encrypted information !

Is an encryption mechanism like this exists ?

Is there an alternative approach to my goal ?

Thanks


texts: Brute Force on 3DES with Reduced Keyspace and Unknown IV

texts:
I'm trying to brute force a 3DES problem given a reduced keyspace (ie I know the first half of the key) but with an unknown IV. The code decrypts to plaintext. My first thought was that I could set the IV to the first 8 bytes of the CT, decode the rest and then substitute back to find the IV. This doesn't seem to work though - my brute forcer cannot find plaintext. I thought maybe it was getting confused with padding bytes at the end of the block being non-printable, so I removed the last 16 bytes as well, but that doesn't produce any results either.

Is there a flaw with my logic or is it more likely to be in my code?

Additional information from the comments

The ciphertext was generated using 3DES CBC and a 128 bit 3DES ABA key.

The key is 16 bytes, I know the first 10 (a ten letter word) and the next six are numbers (as in the ascii val of the digits 0-9). I'm basically brute forcing from WORDWORDWO000000 to WORDWORDWO999999.


texts: Would using a one-time pad multiple times with some conditions be safe?

texts:
I understand why |one-time pad|=|message| using a normal one-time pad, but I don't understand why for perfect secrecy it must alway be that |key|>|all messages exchanged|.

What if, for example, I had |one-time pad|=n*|message| with n>1 and then used it for (for example) 2n messages with a random starting point (itself encoded at some point in the message with a 'normal' one-time pad which given it's a single number could be simply be the first part of the original OTP)?

I'm pretty sure there must be something that doesn't work, because if this was still perfectly secret then a one-time pad could be used to generate infinite one-time pads which would be useful but impossible (wouldn't everybody be using it?). So, where does the perfect encryption of the one-time pad end?


texts: Lehmer random number generator - cipher?

texts:
Let's consider linear congruential generator:
$X_{k+1} = a \cdot X_{k} \mod 2^{128}$
Such that $a$ is some number which for every 128-bit input $X_{k}$ from $0$ to $2^{128}-1$ will give us different output $X_{k+1}$ from $0$ to $2^{128}-1$. So we got bijection here (we can find many such $a$).
Now let's say we will choose such 128-bit $a_{1},a_{2}, ..., a_{10}$ as a keys, randomly. We make $10$ rounds of encryption and every round compute:

$a_{i} \cdot INPUT \mod 2^{128}$
Reverse 128-bit block.

So the next round input is an inverted block of previous round output. And it looks like it make a big difference. If we wouldn't reverse block - we got just keyed Lehmer random number generator with a modulus which is a power of two - and it is definitely not secure (because the low $k$ bits form a modulo-$2^{k}$ generator all by themselves).
But with "reversing" we get completely different results! It looks chaotic. I have no idea is 10 rounds enough - just guessing. Is this type of encryption secure? Do you see any obvious weaknesses? To analyze it we can choose smaller keys and smaller operating mode - for example 5-bit or 10-bit. A detailed analysis of this cipher can be difficult, my question is rather about some obvious weaknesses. The cipher appears to be unexpectedly good, despite being only a minor modification of the linear congruential generator. So either I don't notice something or it is quite a non-trivial proposition.
Comment 1: let's skip the encryption problems with zero-block - it can be solve easily, for example if we will use xoring before every round.


texts: Recently, I have been reading some dual system encryption papers. In these systems, is the adversary able to generate “semi-functional ciphertexts”?


texts: Are there any existing open source implementations of "id-tied" public/private key encryption?

texts:
I don't quite know how to even ask the question for what I have in mind; but succinctly, I'm looking for some publicly implemented cryptosystem where messages for a user with id U can be sent to U using nothing but a single system-wide public key and knowledge of U.
I have an unusual situation where I've been asked to code support for a massive peer-to-peer computing project with no central server.  There is a central trusted authority that can email people secrets, very slowly, but isn't available at scale or in realtime to resolve issues of identity and authorization during a time when they will all be heavily active talking to each other.
Each entity in the system has a unique identifier U, which we can imagine as a positive integer.  As an abuse of notation, I'll use U to both refer to the entity, and their id.
Rather than try to publish and/or promulgate a very large number of authority-issued certificates tying U to its own public key, which I think is the normal way of doing this, I'm hoping to use a cryptographic communication scheme such that given a shared (ie, known to all entities) public key E, any party can send a private message M to U via some f[U, E](M).
For instance, based on my limited understanding of RSA, the idea is for some master to generate N = p*q, for p and q prime, and then calculate some E and D, E*D == 1 mod phi(N).  Then E may serve as a public key, and D as a private key, via (M**E)**D mod N.  If instead we use E*D*U == 1 mod phi(N), then D*U may be used to encrypt M, and E can be U's private key.  As a bonus, this remains symmetric; U can sign something using D, and anyone else can verify using U*E.
The idea is then that the central authority could pick N, not reveal p or q, promulgate N and E publicly, and email each entity U its private secret D value, by which they would later identify themselves.  From that point forward, any doubter could authenticate an entity claiming to be U, by sending challenges encrypted as E*U, and confirming the entity claiming to be U can decrypt.  (I do not worry about private keys having been compromised.)
So good in theory, but all I've ever heard is that you don't want to ever implement your own crypto library.  Is there anything like the above that already pre-exists as an open-source and battle-tested solution?


texts: Is triple-CRC-32 a bad (or not) idea for generating a uniform distribution hash?

texts:
I have an input of 288 bits (comprising 4 × 32-bit and 10 × 16-bit integers). I need to hash this to 96 bits with as few collisions as possible.

I'm aware that CRC is a bijective hash, thus ensuring 100% even distribution (as I understand it). In my view, I should be able to run 3 parallel CRC paths through the input, resulting in a 96-bit hash of optimum distribution.

However, I'm also aware that CRC is not used for such applications. An algorithm such as MetroHash would typically be used.

Could someone explain to me why CRC is a bad (or not) idea for this application?

Note: This is not intended for anything secure.


texts: Can I replace SHA-1 with SHA-512/160 to address Shambles?

texts: The destination is software (within a remote trust boundary) that expects SHA-1 results. Would it be safer for the source (that's within my own trust boundary) to replace my SHA-1 computation at my source with a SHA-512/160 instead?


texts: Are the hash functions collosion resistant or not?

texts:
If H is collision resistant then the following are collision resistant or not?

H'(x) = H(x) || H(x)
H'(x) = 1 || H(x)

My thoughts:
I am confused in question 1. In case of different hash function(H'(x) = H1(x) || H2(x)) we can safely conclude that H'(x) is safe through proof by contradiction if any one of them is safe. But how to approach when same hash function is used.
In question 2, I am thinking that it is collision resistant with 1 appended in front of the generated hash value.
Need inputs on my analogy for question 2 and some hints for approaching question 1.


texts:
I am doing a research about secure communication protocols.

I would be interested to know whether a protocol exists such that it grants that the two end-points taking part to the communication cannot be traced (i.e. They can deny the communication ever took part).

Can anyone point out any relevant publication?


texts: Cryptanalysis affine cipher and substitution cipher

texts:
1) Consider the chosen-plaintext attack on the simple substitution
  cipher. How many chosen plaintext characters suffice to uniquely
  determine the key?

My answer was: 26!

  2) Consider the chosen-ciphertext attack on the simple substitution
  cipher. How many chosen ciphertext characters suffice to uniquely
  determine the key?

My answer was: 2 over 26.

  3) Using a brute force approach, roughly how many keys would need to
  be searched on average before guessing the key of the simple
  substitution cipher? How would one detect that the correct key has
  been guessed?

My answer was: more than 177 years at 2 over 56 keys/seconds.

  4) Consider the chosen-plaintext attack on the simple affine cipher.
  How many chosen plaintext characters  suffice to uniquely determine
  the key?

My answer was: 26

  5) Consider the chosen-ciphertext attack on the simple affine cipher. How
  many chosen ciphertext characters suffice to uniquely determine the
  key?

My answer was: 2 over 26.

  6) Using a brute force approach, roughly how many keys would need to
  be searched on average before guessing the key of the simple
  substitution cipher? How would one detect that the correct key has
  been guessed?

These questions asked me in the exam, but after the exam I could not find the correct answer and did not understand how to find the results? I really want to learn the reason behind it and correct answers. Thank you.


texts: An unusual use-case for HMAC as compression function in web browsers

texts:
It's an unfortunate fact that, right now (2019), browsers don't expose standardized streaming hashing interfaces in SubtleCrypto. The only way to hash a file, is to load it into an ArrayBuffer in its entirety, which for large files, this could be prohibitvely costly memory-wise.

To get around it, I'm thinking of building a custom hash function using HMAC as its compression function, in a usual Merkal-Damgaard construct.

$
\text{compress}(IV, M) = \text{HMAC-SHA256}_{IV}(M)\\
IV_i = \text{compress}(IV_{i-1},M_i) \\
IV_0 = \text{00h}^\text{hashlen} \\
H(M_1|M_2|...|M_n) = IV_n
$

The specific questions I have are:

Q1: Do I still need to include file length in the final block? I'm guessing no because the HMAC compression function already length-pad my message during processing.

Q2: What are the characteristics of such construct with regard to length-extension attack? I'm using SHA256 because it's standardized in Web Crypto, and it's length-extendable, so I wouldn't be bothering to defend against it in my HMAC-Hash construct.


texts: Need for secure hash function for a bloom filter

texts:
I'm creating a bloom filter.

The purpose of bloom filters is to tell the enquirer whether a value is either definitely not in the set, or is possibly in the set.

The only attack vector I can think of is:

  An attacker has two versions of the bloom filter, the first version containing a set of values and the second version containing that set plus one additional value.

  Could the attacker get any information about the newly added value from the (up to 20) hash-derived bits that are set in the second version and clear in the first version?

Are there other attack vectors?

Is there any benefit to using a cryptographically secure hash function when calculating (20) hashes of the value, which are used to set bits in the bloom filter?

In particular, with a non-cryptographic hash function, does prefixing the value with the byte values 0-19, before hashing, to create the 20 hashes, create any form of weakness?


texts: Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?

texts: where $g$ is a group element in bilinear group $\mathbb{G}$. I understand it is very similar to the conventional DBDH problem, but $g^{1/b}$ is also known, possibly making it easier? Does anyone know the answer or suggest some material for reference? Thanks.


texts: Can you really trust WhatsApp's end-to-end encryption?

texts:
I've seen many articles that actually trust WhatsApp's encryption and they may be right, but here is the thing that really makes me suspicious; all end-to-end encrypted apps I know, such as Telegram and Signal are blocked in China, but WhatsApp that is far more popular is not.

If China is not blocking this app in particular (and after seeing all those chummy visits by Zuckerberg) I am a little wary that your data is really end-to-end encrypted without the possibility of Facebook to intervene.

Is there any way for anyone to assess without shadow of a doubt that WhatsApp encryption is really end-to-end encrypted like there is with Signal?


texts: RSA KeyPair generation with Bouncy Castle provider: $e*d(φ(n))$ not equal to one

texts:
I am using the Java Bouncy Castle provider to generate RSA key pairs. I want to test if the generated keys are valid.

According to Wikipedia the RSA key pair is generated as follows:

Choose two distinct prime numbers $p$ and $q$
Compute $n = pq$
Compute $φ(n) = φ(p)φ(q) = (p − 1)(q − 1) = n − (p + q − 1)$
Choose an integer $e$ such that $1 < e < φ(n)$ and $\operatorname{gcd}(e, φ(n)) = 1$;
i.e., $e$ and $φ(n)$ are co-prime
Determine $d$ as $d ≡ e−1 \mod φ(n)$;This is more clearly stated as:
solve for $d$ given $d⋅e ≡ 1 \mod φ(n)$.

When trying to generate 1000 key pairs, I found that $d⋅e ≡ 1 \mod φ(n)$ is only valid for 30% of key pairs.

Test code in Java below:

public void testRSAKey() throws NoSuchAlgorithmException {
        KeyPairGenerator rsa = KeyPairGenerator.getInstance("RSA", new BouncyCastleProvider());
        rsa.initialize(1024,new SecureRandom());
        int total=0;
        int isOne=0,notOne=0;
        BigInteger one=  new BigInteger("1");
        while (total<1000) {
            KeyPair keyPair = rsa.generateKeyPair();
            PrivateKey privateKey = keyPair.getPrivate();
            BCRSAPrivateCrtKey privateCrtKey = (BCRSAPrivateCrtKey) privateKey;
            BigInteger primeP = privateCrtKey.getPrimeP();
            BigInteger primeQ = privateCrtKey.getPrimeQ();
            BigInteger p1 = primeP.add(new BigInteger("-1"));
            BigInteger q1 = primeQ.add(new BigInteger("-1"));
            BigInteger fn = p1.multiply(q1);
            BigInteger publicExponent = privateCrtKey.getPublicExponent();
            BigInteger privateExponent = privateCrtKey.getPrivateExponent();
            BigInteger mod = publicExponent.multiply(privateExponent).mod(fn);//mod  ought to be one
            if(mod.equals(one)) {
                System.out.println("e*d(mod fn)=" + mod);
                isOne++;
            }else {
                System.out.println("e*d(mod fn) not equal to one");
                notOne++;
            }
            total++;
        }
        System.out.println("total=" + total);
        System.out.println("isOne=" + isOne);
        System.out.println("notOne=" + notOne);
    }


texts: Contrasting Key Rotation Requirements : Asymmetric vs. Symmetric Ciphers

texts:
I'm trying to contrast key rotation requirements for asymmetric and symmetric ciphers.

In the case of symmetric ciphers, we have the results such as the so called "CBC Theorem" (stated on pg. 24 of https://crypto.stanford.edu/~dabo/cs255/lectures/PRP-PRF.pdf)
The CBC Theorem states that for a "q - query" CPA attacker attempting to break semantic security of AES-128-CBC, the attacker's advantage is less than $1/2^{32}$ only if $q^{2}L^{2} / \left\lVert X \right\rVert$, the "error" term in the CBC theorem, is less than $1/2^{32}$, i.e. given that $\left\lVert X \right\rVert = 2^{128}$ for AES-128, we can encrypt $2^{48}$ AES-128 blocks after which we need to switch the key in order to keep the attacker’s advantage below $1/2^{32}$

I have not seen a proof of theorem, but I'm guessing such results arise from basing the security of block cipher modes purely on their behavior as pseudo random functions.

Probabilistic asymmetric encryption schemes such as RSAES-OAEP, ECIES etc., on the other hand, employ the assumption of pseudo randomness in addition to an assumption around (computational) hardness of some number theoretic or algebraic problem, such as hardness of EC/DLP, factoring or short vector problems etc.

Does the fact that asymmetric schemes are based on such dual assumptions (pseudo randomness + factoring etc.) mitigate or extend the horizon for key rotation in such schemes after a certain number of encryptions under the same key, beyond what is implied by relying purely on pseudorandomness as is the case for AES-128-CBC under the CBC theorem? Is there an asymmetric analog for the CBC theorem that quantifies the advantage conferred to an adversary  after some number of encryptions under the same key?


texts: What are the advantages of using Leveled Homomorphic Encryption over Somewhat Homomorphic Encryption?

texts:
Is there a point in using LHE over SHE?

From what I understand, SHE is like an extended version of LHE, the only difference is that you limit the depth of circuits that can be evaluated. Therefore, I wonder which is better to use since they seem to be the same.

What is the effect of limiting the depth of the circuits? That does not make much sense to me.


texts: How are data science and cryptography related?

texts:
Are there any interesting connections between the fields of data science and cryptography?

Data science involves the use of statistical analysis to analyze data while cryptography also involves statistics in crypt-analysis in order to protect data. And of course both fields require a lot of math.

So I wonder if there are any interesting links between these two fields.


texts: What is the difference between zk-SNARK and NIZK?

texts:
I am not exactly sure what is the difference between zk-SNARK and NIZK? Are NIZK not succinct? If so, why Pinocchio protocol considered itself a NIZK although they have succinct proof?
I tried Google but couldn't find the exact difference.


texts:
Assume it's proven: "Security of protocol $\Pi$ can be deduced from hardness of problem $P$".

Is it correct to state: "Security of protocol $\Pi$ can be reduced to (hardness of) problem $P$" ?

My question is about accepted VOCABULARY in the field of cryptography with provable security.

This is a simplified version of this question, where the first of the above assertions is (I assume, rigorously) established by exhibiting an algorithm that would solve problem $P$ from an algorithm that would break protocol $\Pi$. I read two interesting answers (which I thus upvoted) concluding for one that that reduced "cannot (technically)" be used in this way but remains understandable in the context, for the other that it's "appropriate".

For a non-native speaker like me, that's far from trivial.


texts: Is AES in CBC mode secure if a known and/or fixed IV is used?

texts:
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of the credentials for the internal app.

I picked AES as the encryption algorithm, but the problem is that the password-based scheme doesn't produce a "secret" IV. So, the IV must at least be known to an attacker (stored alongside the encrypted data). A hash value used for password verification could work, or I could just generate a pseudorandom byte array and drop it in the DB as a new column. I was further considering, for simplicity, to use a constant IV.

What adverse effect will either of these choices have on the security of the encryption? Does AES depend, as many block ciphers do, on an unpredictable IV? Does it matter if the IV is stored as unencrypted plaintext?


texts: Randomness test question from FIPS 140-1 and comparison with 140-2

texts:
In FIPS 140-1 there are 4 statistical random number generator tests (The Monobit Test, The Poker Test, The Runs Test and The Long Runs Test. Then FIPS 140-2 came along and supposedly tightened the criteria for these tests. I'll provide a short summary of the changes here:

The Monobit Test

Count the number of ones in the 20,000 bit stream. Denote this quantity by X.

FIPS 140-1: The test is passed if 9,654 < X < 10,346.
FIPS 140-2: The test is passed if 9,725 < X < 10,275.

The poker test

Divide the 20,000 bit stream into 5,000 consecutive 4 bit segments. Count and store the number of occurrences of the 16 possible 4 bit values. Denote f(i)as the number of each 4 bit value i, where 0 ≤ i ≤ 15.

Evaluate the following:
X = (16/5000) * (SUM i=0 -> i=15 [f(i)]^2) - 5000

FIPS 140-1: The test is passed if 1.03 < X < 57.4.
FIPS 140-2: The test is passed if 2.16 < X < 46.17.

The Runs Test

A run is defined as a maximal sequence of consecutive bits of either all ones or all zeros, which is part of the 20,000 bit sample stream. The incidences of runs (for both consecutive zeros and consecutive ones) of all lengths ( >= 1 ) in the sample stream should be counted and stored.

The test is passed if the number of runs that occur (of lengths 1 through 6) is each within the corresponding interval specified below. This must hold for both the zeros and ones; that is, all 12 counts must lie in the specified interval.
The test is passed if the number of runs that occur (of lengths 1 through 6) is each within the corresponding interval specified below. This must hold for both the zeros and ones; that is, all 12 counts must lie in the specified interval. For the purpose of this test, runs of greater than 6 are considered to be of length 6.

FIPS 140-1:

Length of Run   Required Interval
1  2267-2733
2  1079-1421
3  502-748
4  223-402
5  90-223
6+ 90-223

FIPS 140-2:

Length of Run   Required Interval
1  2343–2657
2  1135–1365
3  542-708
4  251-373
5  111-201
6+ 111-201

The long runs test

On the sample of 20,000 bits, the test is passed if there are no long runs.

FIPS 140-1: A long run is defined to be a run of length 34 or more (of either zeros or ones).
FIPS 140-2: A long run is defined to be a run of length 26 or more (of either zeros or ones).

So in general there are appears to be a narrowing of the criteria to pass the tests. I have a few questions however:

In FIPS 140-2 these tests are listed on page 57 but are striked out. I.e. there's a line through all the text. Why is this? In the draft 140-3 the tests do not appear at all..?
Does this narrowing down of the test criteria from 140-1 to 140-2 make for a better and stronger RNG if it passes the narrower/stricter criteria? Or does that make it weaker because there's less allowed variance?
For The Runs Test, when implementing this and checking if the run is within the required interval e.g. 2343–2657 is this inclusive or exclusive? So if the run was 2343 or 2657 is that a pass or fail?


texts:
Assume that $S(x): \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ is a good S-box. Is there anyway we can construct a keyed S-box $T(k, x): \{0, 1\}^{n} \times  \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ from it with it retaining its good properties?

Update: A preferable property for the keyed S-box $T$ would be that for any fixed $k$ the relation $T(k, x) = S(x)$ does hold true for every $x$. In formal notation, $\forall{k}(\neg\forall{x}(T(k, x)=S(x)))$.


texts: How can Alice prove that a message has not been tampered with?

texts:
In terms of the usual suspects.

The problem I have is that Alice wants to send Bob a message M, which gives Bob permission to perform some actions.  However Alice wants to verify, from time to time, that the Bob has not changed the message in anyway, allowing himself more privileges than Alice originally intended, without having Bob send the message M back to Alice.

Obviously Alice cannot keep asking the same question as Bob could successfully answer once, change the message, and repeat the first answer every time.

Other contributing facts, Alice obviously knows the message M that was sent, and knows that she was talking to Bob, and can trust that the messages and responses are not modified in transit


texts: AES encryption takes more time to decrypt than encrypt

texts:
I am trying to find how much time an AES encryption and decryption takes for a given amount of data and key. In all the cases encryption takes way lesser processing time than decryption. I tried to get this answer somewhere else but can't find. May I know why does decryption takes a lot more time than encryption for AES 128/256 bit?

I am trying to implement a simple AES encryption in Arduino UNO. I use micros() to measure the time it takes to encrypt or decrypt.

Here is what I did for encryption:

Serial.print("Encrypted: ");
unsigned long start1 = micros();
String enc = aes_encrypt("this is data source","this is key");
Serial.println(enc);
unsigned long start2 = micros();
unsigned long diff1 = start2 - start1;
Serial.print("Time to encrypt the data: ");
Serial.print(diff1);
Serial.println(" microseconds");


texts: What does the "x" operator stands for in cryptography?

texts:
I am studying commitment scheme and in of the notes from the class this statement comes up.

I'd like to know exactly what the X = M x R mean, since I don't seem to understand how the "x" operator should be interpreted in here


texts: What is the difference between these AES encryption methods

texts:
I am using AES encryption (Rijindael) with Base-64 encoding in Obj-C and VB. I am currently using the following two projects to achieve this:

Obj-C: https://github.com/dev5tec/FBEncryptor/tree/3c739f18c94ea257aba5cb7b6a97f49af2589977

Visual Basic:
http://www.codeproject.com/Articles/15280/Cryptography-101-for-the-NET-Framework#_articleTop

When I encrypt with what I believe is AES 256-bit on each platform, I get completely different results. Here is an example:

-Keyword: Hello

-Text To Encrypt (plain text): test

-Obj-C Result: 3V5u+L76l5sOOnlxzW7huA==

-VB Result: HR1TCsoEvFMDkdCjZui9Og==

Why are they so different if both claim to be the same type of encryption?
Does this have to do with the IV?

Could someone point me in the right direction, or at least confirm that both are in fact using AES 256?

EDIT: I've re-written the VB code with Microsoft's Rijndael Managed frameworks and it looks a little something like this: http://codeupload.com/6319

However, the Obj-C version still doesn't want to decrypt the text. I believe that it is due to a difference in IVs because as you can see, I haven't figured out how to randomly generate an IV. Also note that the salt is NOT static even though a static variable still exists. The Salt is generated through the GenerateSalt method.


texts:
Paillier Cryptosystem depends on both the factorization where $n = p.q$ and the complex residuosity problem which is defined in the original paper as:

The problem of deciding n-th residuosity, i.e. distinguishing n-th residues
from the non n-th residues will be denoted by CR[n]. Observe that like the problems of deciding quadratic or higher degree residuosity, CR[n] is a random-self- reducible problem that is, all of its instances are polynomially equivalent. Each case is thus an average case, and the problem is either uniformly intractable or uniformly polynomial. As for prime residuosity, deciding n-th residuosity is believed to be computationally hard. Accordingly, we will assume that :

Conjecture 2. There exists no polynomial-time distinguisher for n-th residues modulo n2, i.e. CR[n]is intractable.

So, based on what this note states given a number in $\mathbb{Z}_{n^2}^*$ I cannot determine whether this number is on the residues set or not.

My Questions are:

What is so difficult about this if $z=y^n\ mod\ n^2$
The more important thing what is so dangerous in knowing that a number in the residues set. How It can help me break the encryption?


texts: Determining the secret using the Blakley's scheme?

texts:
I am solving a example with Blakley's scheme problem. The issue that I am having is using the row operation to determine the secret $x_{0}$. So what I have so far is:

Given three planes: $z = 7x + 84y + 41$, $z = 17x + 5y + 3$, and $z = 37x + 46y + 66$. Then I set up the matrix:
$$
\begin{equation}
\begin{pmatrix}
    7       & 84 & -1  \\
    17       & 5 & -1  \\
    37   & 46 & -1
\end{pmatrix}
\begin{pmatrix} x_{0} \\ y_{0} \\ z_{0} \end{pmatrix}
\equiv
\begin{pmatrix} -41 \\ -3 \\ -66 \end{pmatrix}
(mod \ 87)
\end{equation}
$$
I used the row operations calculator to get the matrix, however it seems way off and incorrect. Am I suppose to do a row operations first and once I do that what do I need to do after to get $x_{0}$,$y_{0}$, and $z_{0}?$
Any help is appreciated.


texts: Pipelined architecture for secret key block ciphers

texts:
I want to implement a pipelined architecture of AES128; and I couldn't figure out the number of the pipline stages. As I undestand, it is possible to make the piepline stages inside the round, or outside it or both. What I don't understand is if the I chose to make them inside a round, why the number of stages must be a divisor of number of rounds? I understand that it must be a divisor if the pipelined stages are between the rounds. Correct me if my understanding is wrong.
I think that since there is 4 operations inside every round then it is possible to make 4 stages? but what about the last round?
Here what I have read:
A traditional methodology for design of high-performance implementations of secret-key block ciphers, operating in non-feedback cipher modes is shown in Fig. 21. The basic iterative architecture, shown in Fig. 21a is implemented first, and its speed and area determined. Based on these estimations, the number of rounds K that can be unrolled without exceeding the available circuit area is found. The number of unrolled rounds, K, must be a divisor of the total number of cipher rounds, #rounds. If the available circuit area is not large enough to fit all cipher rounds, architecture with partial outer-round pipelining, shown in Fig. 21b, is applied.


texts: Use of nonces in Kerberos and Needham–Schroeder protocols

texts:
Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport.

In particular :

Can you explain me the use of $N_A$?

And also, I suppose $N_B$ is used for the scope of letting $B$ know that $A$ shares the same key $K_{AB}$ and was able to decipher the value of $N_B$, alter it and encrypt it back by using $K_{AB}$.

Is this assumption correct?

And finally:

How does the use of the nonces provide more security to the protocol?

Here you can find more details about the two protocols.


texts: Extracting Private Keys in Diffie Hellman

texts:
I know that the security of Diffie Hellman Key Exchange depends upon the discrete logarithm problem, but is it possible to extract the private keys if we know more? Say that in addition to modulus ($q$), primitive root ($g$) and public keys of Alice and Bob ($g^a$ and $g^b$ respectively), if we knew the calculated key ($g^{ab}$) as well, will it be possible to extract individual keys of Alice and Bob ($a$ and $b$) without using a brute force method? I know it sounds silly and serves no practical purpose at all, but the question was bugging me.

Thanks,

Edit: Added $g$ and other variables for clarity.


texts:
The question is as follows: Is there an algorithm to calculate a $(x,y)$ pair which is consecutive to an existing $x$-Coordinate on an elliptic curve?
Background Information for the curve:
Known Values: Prime Curve ($p$), Prime Multiplier ($N$), Trace ($P-N$), Curve is Half. Multipliers $(M_1 + M_2) = N$, $y$ Coordinates + Inverse $Y$ Coordinate = $P$.
Any help is greatly appreciated.
Update: An algorithm to calculate a $(x,y)$ pair and integer multiplier which is consecutive to an existing $x$-coordinate on the curve.


texts: Facebook app-scoped identifiers and similar - implementing stateless ID obfuscation

texts:
After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is never shared through facebook APIs, but each app sees a unique never-changing value.

To formalize this through two functions:

mask(user_id, app_id)
unmask(masked_id, app_id)

These functions should satisfy some properties:

reversible: user_id == unmask(mask(user_id, app_id), app_id)
secret: given y = mask(user_id, app_id) it should be 'hard' to obtain the original user_id.
deterministic: mask(user_id, app_id) == mask(user_id, app_id), where user_id == user_id and app_id == app_id
collision resistant: for all user ids, given the same app_id, it should not be the case that mask(user_id1, app_id) == mask(user_id2, app_id)

After a lot of reading, I have come up with two possible implementations:

Stateful: store a triple (user_id, app_id, hash(user_id, app_id)).
Stateless: for each app_id generate & store a secret, and encrypt(user_id, secret) on the fly. the encryption should be a deterministic cypher, such as AES-SIV.

From the get go, I'd like to avoid a stateful implementation. I am not sure however as to the validity of the stateless approach as I'm not very familiar with deterministic symmetric cyphers, and their security implications.

Is there some other approach I might be missing here? I think this is a deceptively easy problem, looking forward to get some insight.


texts: Why is Paillier Cryptosystem called probabilistic?

texts: The definition of Paillier Cryptosystem says that it is a probabilistic asymmetric key algorithm for public key cryptography. Can some body explain why it is called "probabilistic"?


texts: In elliptic curve cryptography, how is "A dot A" computed?

texts:
I was just reading Ars Technica's primer on ECC. Somewhere near the middle of the second page, the author introduces the "dot" operation that takes an elliptic curve and two other known points, giving a third unique point.

However, the author then claims that A dot A equals B. That is, if the two first points are the same, it's possible to come up with a unique third intersecting point. How is this possible? Intuition tells me that there is an infinite number of possible intersections if the two first points are the same.


texts:
Somewhat of a crypto noob here. I've been doing a lot of reading and think I have something but would appreciate any feedback, including "you are full of it".
I'm looking for a way to replace a sensitive token with another string. I can go with a lookup table but trying to avoid that and use encryption instead (stateless, faster and simpler).
My inputs are 128bit values (a type 4 UUID actually, so they are random).
The output token can be from 128 to 128+16=144 bits long.
Desired properties:

easy to decrypt original value with a key but without any other information (such as an additional IV)
probability of collisions small enough to ignore
same value always produces the same token
impossible to recover original value from the token without key (short of bruit force)
once issued, token is valid forever
same key should be safe to use for at least 10^6 tokens
authenticated encryption is a strong plus - i.e. reject tokens that had been tempered with
ideally, easy to implement with golang standard library crypto

Challenges:

I've looked at GCM and other authenticated modes but the challenge is that I would need to transmit IV and 12-16 bytes overhead, which I have no room for
I could use ECB (I don't think lack of diffusion is a problem because (a) I only have 1 block and (b) I need same value to produce same token in the first place). But, will using the same key on so many tokens without an IV make it easier to recover?

My idea so far:

128 bits maps onto single AES block - so far so good
use AES-CBC for 1 block (this gives me an IV that I can vary)
output is encrypted(input) appended with first 16 bits of hash(input)
IV is also first 16 bits of hash(input) "extended" to 128 bits
the same 16 bits of hash can be used as an authentication check after decryption
for hash, I am thinking of using SHA256 truncated to 128 bits
for "extending" 16 bits to 128 bit IV I'm also thinking of SHA256(16bits) truncated to 128bits

Questions:

16 bits of sha256 is a pretty weak authentication check. But given that it is also used for IV, I think that should make it pretty impossible to temper with the token undetected. Is this sound?
IV is computed from input. I think this is ok because I need same input to produce same output. But it should still make it harder to extract the key from many tokens. Is this sound?
Is there a better way to compute a 16 bit hash?
Is there a better way to extend 16 bits to 128 bit IV to cover the full block?
Is there a better way to do this whole thing and I'm just reinventing the wheel?


texts:
On the following site:

https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence

when talking about the dangers of using bcrypt it states:

  There is a nontrivial chance that one of the raw bytes in the hash
  will be 0x00. The sooner this byte appears in the string, the cost of
  finding a collision becomes exponentially cheaper.

I am not fully understanding what this means and how 0x00 would result in finding a collision sooner than any other hex digit. Can someone explain this more clearly to me. I also do not understand why sending it through base64_encode would make a difference as the password will still be the same and can be decoded with base64_decode.

Also, on this page it states that using base64_encode will get around the 72 character limit of bcrypt. However, if the bcrypt algorithm limits any input to 72 characters why wouldn't it also limit the base64_encoded string to 72 characters?


texts: Generation of N bit prime numbers -> what is the actual range?

texts:
Short version: When generating a prime number of N bits, should I draw random numbers from the range $[0 , 2^n]$, or $[2^{(n-1)} , 2^n]$?

Context: I'm trying to implement a toy-version of RSA as a hobby, with a Miller-Rabin test to generate primes. Initially, my function to generate the keys had the following signature:

$$generateKeys :: (Range, Seed) \rightarrow (PublicKey, PrivateKey)$$

where Range is the range of numbers in which to generate random numbers to search for primes, which initially I had set to $[2^{16}, 2^n]$ to avoid the $[0-2^{16}]$ range, given that RSA implementation guides recommend avoiding using small primes.

But I started wondering if instead I should specify the number of bits of the

$$generateKeys :: (BitsToUse, Seed)\rightarrow (PublicKey, PrivateKey)$$

And this in turn got me wondering exactly what does a "N bit prime" mean, ie, exactly which range from which to pick the prime is generally desired, specially since the range $[2^{(n-1)}, 2^n]$ is "only" half the size of $[0 , 2^n]$, although I guess primes are a bit less dense in that range.


texts: GSW and homomorphic addition on integers

texts:
Is it possible to use the GSW scheme (Gentry, Sahai, Waters) also on integer values and not just single bits? If not, are there any schemes that support integer arithmetic with the same nice property of not having to use an evaluation key?
Thank you


texts: Derive anonymous dsa key-pair from two certificate authorities

texts:
Is it possible to derive a dsa key-pair based on two private keys from different/independent "Certificate Authorities" (ca1 and ca2) to sign s.th. which then verifies only that the signature is a child of ca1 and ca2 but not which of the keys, that have been originally issued by the ca's has been used? Thus anonymized signature?

ca1 = certificate authority 1
ca2 = certificate authority 2
cert1 = public certificate of ca1
cert2 = public certificate of c2
privkey1 = private key issued by ca1
privkey2 = private key issued by ca2
privkey = getprivkey(privkey1, privkey2) = private key derived from ca1 & ca2
datasig = signature of data package - signed with privkey
dsaproof = digital signature algorithm proof function

Is the following possible?

True = dsaproof(datasig, cert1)
True = dsaproof(datasig, cert2)


texts: What are the standard properties of an S-Box

texts:
Apart form the following, what are the other properties of a good cryptographic Substitution box or the S-Box:

Changing one input bit should change about half of the output bits.
Each output bit should depend on every input bit.


texts: (Re-)Using deterministic IV in CTR mode / How to: deterministic AES

texts:
I am aware of the requirement of an IV to be unique in CTR mode (Why must IV/key-pairs not be reused in CTR mode?). However I wonder if I can use an IV depending on the plaintext deterministically. This means, of course, that the whole encryption is deterministic, which is what I want.

In the following scenario:

$C_1 = ENC_{AES-CTR}(K, P_1, IV(P_1))$

$C_2 = ENC_{AES-CTR}(K, P_2, IV(P_2))$

If $P_1 = P_2$

then $C_1 = C_2$

then $C_1 \oplus C_2 = C_1 \oplus C_1 = 0$, which essentially doesn't mean anything other than $P_1 = P_2$, which we already knew, as we're talking about deterministic encryption.

The question is: Is, by definition, the use of an IV for the same plaintext a re-use? If not, will a strong hash function be suitable to derive an IV from the plaintext? (Similar question: Security of this deterministic encryption scheme)

I'd like to use SIV mode, but it's not available in neither of the different platforms involved.

Edit:
Some more information about my plaintext: I want to encrypt filenames. This means the plaintext is short, might consist of known words, has little entropy and sometimes fits into a single block. As already said before, I want equal plaintext filenames to result in equal ciphertexts.

Edit 2:
All information needed for decryption must be contained in the resulting ciphered filename, e.g. as a prefix. Due to length constraints on certain file systems this prefix should be as short as possible.


texts: Ephemeral key is held constant in ElGamal

texts:
Is there a known algorithm to recover the sender's messages in ElGamal $\mathbb{F}_p^*$ if the ephemeral key is held constant in two or more transmissions, assuming the messages are always distinct?

Say Alice picks a prime $p$ between $2^{1000}$ and $2^{1001}$ and chooses a $g \in \mathbb{F}_p^*$ with large prime order. $L$ is her public key. Doug the doofus sends Alice two or more transmissions $(c_1, c_i), c_1 = g^k (mod\,p), c_i = m_{i}L^k (mod\,p) i = 1,2,...,n$ with $k$ held constant. Can Eve the eavesdropper recover Doug's messages?

IOW, why does the ephemeral key need to be ephemeral?


texts: Does varying ChaCha rounds add any security?

texts:
This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key is likely to take longer time to halt.

It works on the following principle: a sender encrypts a block of message using a random number of round (R), which is never shared with the receiver. However, the sender along with the ciphertext shares the hash of the cipher
state (or partial cipher-state) after executing R rounds. The hash is sent in cleartext; and the receiver can compute R using the correct key, and the received hash. This expected hash acts as a halting condition for the decryption process.

I don't really understand what the hash halting process adds here. The attacker doesn't need to search incorrect keys forever, just for the maximum possible number of rounds.  The small benefit of not having a second key is that the ciphertext is 50% or so larger due to all the hashes provided.
The proposed cipher also amends the first constant of the ChaCha block.  This seems bizarre given Bernstein's comments on the constants being carefully chosen.
It seems there are more simple ways to implement a variable round ChaCha than the linked paper.  We could use added secret bits to create a stream (using SHA3) of 512 bits that could be read as a series of n bits to add to the rounds.  Every iteration of SHA3 would be good to seed the added rounds for about 1024-2048 iterations of ChaCha (assuming additional rounds of 16 or 8).
Does varying the rounds (based on something unrelated to the 256bit ChaCha key) add any security?  Or is the main benefit of the proposed cipher in the linked paper the hash halting concept or something else I'm missing?


texts: What does the $e$ operation mean in cryptography research papers?

texts:
I read a cryptography scheme that it include the following operation:
$$c= H(e(g_1,g_n)^t)$$
where H is a hash function.
I need to know what the operation $e$ means.


texts: How to get the original list back given a shuffled list and seed?

texts:
Say I have a shuffled list that was shuffled in Python using random.shuffle(). The shuffling was performed using a seeded random number generator. Is there a way I can get the original list back, i.e. un-shuffle the list?
eg list1=[1,4,2,5] after seeding random and shuffling list2=[5,2,1,4] is there a way to get back list1 if we only have knowledge of list2 and seed value


texts: How sensitive to change are elliptic curve formulae In layman's terms?

texts:
Take for example a curve from a recent question such as #25519:-

$$y^2 = x^3 + 486662x^2 + x$$

It's considered "safe".  What are are the implications of amending it very slightly to:-

$$y^2 = x^3 + 486664x^2 + x$$

I'm trying to get a layman's feel for what this would mean.  For example, is it now entirely invalid and can't be used at all, very easy to break or just a little easier to break? Or does this tiny change suddenly allow specific attacks to come into play?


texts: security of multiplicative secret sharing

texts:
I was having a read of this question: "Is multiplicative secret sharing secure?"
posted in 2013 which asks if the simple multiplicative scheme is secure.
Everyone agreed that it was information theoretic secure, however I am not so sure that this is the case. In particular, if the secret is 0 then does that not mean that a participant's share is 0? If this is the case than a participant with a share of 0 instantly knows the secret is 0.

Am i missing something here?

And is this the correct way to post this or would I be better off leaving a comment on the post in question?


texts: How can complexity be increased or decreased in AES?

texts:
I have been studying data compression for a while. For educational purposes, after a lot of reading, I managed to create a software that performs encryption and authentication using AES256-GCM. However, I have now reached a point after which I cannot find a possible answer and this is confusing me.

My software allows the user to choose the "hardness" of the encryption, a value ranging from 0% to 100% (a scale). Nonetheless, I have not managed exactly how I could mingle the logic of "hardness" with the logic of AES. Yes, I have a lot of ideas about playing with the key, the IV, the resulting data and so on, but a point I have learned on this area is that you should never reinventing the well when there is already studies on the same aspects and whose results had been checked and rechecked over and over and over again.

Therefore, what would be the best way to perform such work? I seek for theory, not necessarily coding.


texts: For WinRar, how long should a password be to make up for a lack of complexity?

texts:
Assuming that the best alternative to complexity is length, how long do you recommend a password or phrase to be when using WinRar?

Note that I'm aware that it's not always that simple, but I would like to get this right.


texts: What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?

texts:
Given a binary shift register of $n$ bits, a primitive binary nonlinear feedback shift register will generate a sequence with a period of $2^n - 1$.

While I am unable to find a paper which directly describes the methods, the paper A List of Maximum Period NLFSRs has just came up on eprint, which lists all NLFRSs with a period of $2^n - 1$, for $n < 25$.

Does anyone have links to papers describing the construction methods for such primitive binary nonlinear feedback shift registers?


texts: How to measure Cycles per Byte of an Algorithm?

texts:
I am trying to measure the cycles per byte for $\mathop{SHA-3}$ reference implementation. I am using recommendations from Microsoft querying the performance counter. As you can see in the first snippet, cycles are measured before converting into microseconds. My code looks like the following:

QueryPerformanceCounter(&StartingTime);
SHA3_256(K_OUT, K_IN, length);
QueryPerformanceCounter(&EndingTime);

ElapsedMicroseconds.QuadPart = EndingTime.QuadPart - StartingTime.QuadPart;
printf("Elapsed ticks: %.20f \n", ElapsedMicroseconds.QuadPart / (float)(length));

But the results are definitively wrong. It is mostly something smaller than $0.9$. I would guess a value around $30$ Cycles per Byte. What am I doing wrong?


texts: Which hardware-accelerated AES-GCM implementations support encryption in-place?

texts:
By encrypt in place I mean the following.  Suppose I have an input plaintext of length L and I have also allocated an extra E bytes at the start and/or end of the buffer, with E << L.  So the length of the input buffer is L+E and I'd like to use the same buffer for output (the encrypted data).  I understand some fixed expansion may be necessary but supposing the buffer is megabytes to begin with; then that extra amount is negligible.

I'm wondering which AES-GCM implementations (preferably those that are hardware-accelerated (e.g.: AESNI, VPAES, QuickAssist)) will allow for the encryption to take place all within the original buffer without allocation of considerable additional memory (beyond the L+E total).  Similarly, I'd like an encrypted buffer to be given (with additional bytes allocated, as before) and I'd like the plaintext to be decoded in-place.

Do any implementations support this?  Can they be adapted to do so very easily?  Specifically, what about crypto++ or OpenSSL?


texts: How does a rectilinear filter used for QKD-BB84 detect both horizontal and vertical polarizations?

texts:
When using the BB84 algorithm for QKD, you arbitrarily choose which of two filters (bases) to use when detecting a photon:  rectilinear or diagonal.  If you choose rectilinear, you can detect polarization with certainty if the photon is rectilinear, i.e., either vertically- or horizontally-polarized.

But how?  A polarization filter that allows transmission of
vertically-polarized photons will block horizontally-polarized
photons and vice-versa, no?
Perhaps you use a
vertically-polarized filter as the rectilinear filter and then the
complete lack of a photon indicates horizontal polarization, but how
would you distinguish that from, say, absorption of the photon into
the fiber?


texts: hash collision chance using a 5 chars hash made of a-z A-Z and 0-9 (62 chars total)

texts:
What is the chance for collision or resistance of a hash made out of 5 chars randomly picked from this sets a-z A-Z and 0-9 (62 chars total).

Also, what is total amount of combinations without collision that I can get, AFAIK :

$62^5 = 916.132.832$

Thank you.


texts: CCA attack on RSA padded with random oracle

texts:
I'm trying to do the ex 11.15 of the Katz-Lindell book.

Consider the RSA-based encryption scheme
in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by computing $m' := H(m)||m$ and outputting the ciphertext $c' := m'^e modN $. $(H : $ {$0, 1$}$^l → ${$0, 1$}$^n$ and assume $l + n < ||N||$, $||N||$ is the bit-length of N). The receiver
recovers $m'$ in the usual way and verifies that it has the correct form before outputting
the $l$ least-significant bits as $m$. Prove or disprove that this scheme is CCA-secure if $H$ is modeled as a random oracle.

I know that this scheme isn't CCA-secure because it's deterministic.

But I tried to transform the cyphertext without success, because if I modify the second part of $m'$ let's say computing $m''$, using another cyphertext and multiplying it to $c'$, then I need $H(m'')$ to compose a correct cyphertext but since I don't know $m'$ I'm not able to query $H(m'')$.