texts:
Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:
$$
cwMAC_{h,k}(x,n)=H_h(x) \oplus E_k(n),
$$
where $x \in M$, $(h,k) \in K, n \in N, \{H_h\}_{h \in \{0,1\}^n}$ is a AXU family where each $H_h: M \rightarrow T$ and $\{E_k\}_{k \in \{0,1\}^n}$ is a PEP family of block length $n$.
Suppose that when using $cwMAC$, an implementation error causes the system to re-use a nonce more than once. Let us show that the nonce-based Carter-Wegman MAC falls apart if this ever happens.
(a) Consider the nonce-based Carter-Wegman MAC where the AXU function H is instantiated by $xPoly$ defined as:
$$
xPoly_h(x_1||x_2||\dots||x_m)= x_1h \oplus x_2h^2 \oplus \dots \oplus x_mh^m,
$$
where additions and multiplications are in $\mathbb{F_n}$. Show that if the adversary obtains the tag on some one-block message $m_1$ using nonce $n$ and the tag on a different one-block message $m_2$ using the same nonce $n$, then the $MAC$ s becomes insecure: the adversary can forge the $MAC$ on any message of his choice with high probability.
(b) Consider the nonce-based Carter-Wegman $MAC$ with an arbitrary AXU hash function. Suppose that an adversary is free to re-use nonces at will. Show how to create a forgery.
This is what I have tried:
(a) Let $(m_1,n)$ be a message nonce pair and $(m_2,n)$ be another pair.
$cwMAC_{(h,k)}(m_1,n)=xpoly_h(m_1) \oplus E_k(n)$ = $m_1h \oplus E_k(n)=t_1$
$cwMAC_{(h,k)}(m_2,n)=xpoly_h(m_2) \oplus E_k(n)$ = $m_2h \oplus E_k(n)=t_2$
$m_1h \oplus E_k(n) \oplus m_2h \oplus E_k(n) = t_1 \oplus t_2 $
$\implies (m_1 \oplus m_2)h= t_1 \oplus t_2$
Hence we can get the value of $h$ by solving the above equation:
$$
E_k(n)=m_1h \oplus t_1
$$
Now let $m$ be a one-block message and nonce $n$.
$t=mh \oplus E_k(n)$
$(m,t)$ is a valid forgery.
Therefore, the $MAC$ is not secure.
I am unsure about my approach. I have no idea about Part b.


texts: How to derive a hash function from another hash function?

texts:
Problem: Hash functions derived from another hash function (4 marks) Suppose that $H:\{0,1\}^* \rightarrow \{0,1\}^n$ is a collision resistant hash function. Define a new hash function by $G:\{0,1\}^* \rightarrow \{0,1\}^n$ such that $G(x) = H(H(x)).$ Prove tht $G$ is also collision resistant

I'm trying to figure out how to solve this, apparently, it's hashing the hash value itself. So G has two rounds of hashing the original message x. I tried searching for the relationship properties that I could use to achieve this

Collision resistance implies 2nd-preimage resistance
If the output values of  are uniformly distributed, then collision resistance implies preimage resistance
If the output values of  are uniformly distributed, then 2nd-preimage resistance implies preimage resistance
Preimage resistance does not imply 2nd-preimage resistance
2nd-preimage resistance does not imply collision resistance

But I didn't find anything I could use, I'm really having trouble, so I'd appreciate any help.


texts: Which is more secure for hashing: SHA512 or BCrypt with the same salt reused over and over?

texts:
Setting aside questions of if BCrypt should even be used in this way, I was just wondering which one would be more secure hypothetically.

If you want to know why I don't just use random salts as per BCrypts default, it's because there is no way of telling which hash digest is the one that should be checked against in my specific use case. Hence, I have to hash the entered string and check if the result is present in a database table. If the salt is randomized there's no way to determine if the digest is present in the table short of checking each one.

If it makes any difference, the data being hashed is not passwords, they are randomly generated hexadecimal strings of 32 characters.


texts: There is a paper: U. M. Maurer, Secret key agreement by public discussion from common information, IEEE Trans. Inf. Theory, 39(3) 733-742 of 1993, with an IMHO fairly impressive title but having apparently for some unknown reasons been hithertofore ignored in the common textbooks on modern cryptography. The material there is way above my humble knowledge, hence my request: Could some experts kindly give a sketch of the main idea of the paper such that one could get at least a certain rough comprehension of it? Are there good open-source implementations of that key agreement scheme?


texts: RSA algorithm, relationship of the plaintext $m$ with $p$

texts: I am studying the RSA algorithm. If for example the plaintext $m$ has some relationship with prime $p$, let's say $m$ is multiple of $p$ (where $p$ is the $p$ in $n=p \times q$). Can this give an attacker some information given we know ciphertext $y$ and public key?


texts: Why does verifiable secret sharing with an honest majority require a broadcast channel?

texts:
In the information-theoretic model with active adversaries, it seems to be well-known that no protocols with exact reconstruction of the secret exist for the task of verifiable secret sharing (VSS) when $t \geq n/3$. However, one can lift the number of tolerable cheaters by allowing for a small error probability during reconstruction to up to $t < n/2$ cheaters. For such protocols, broadcast channels are assumed to be available (in addition to secure, authenticated communication channels) and it seems to be a well-known result that without this assumption, even this weaker form of VSS is impossible (see e.g. the abstract of the paper linked below).
My question is, why is the assumption of a broadcast channel necessary? To me it seems that a possible reasoning might be that (1) broadcast channel is equivalent to Byzantine agreement, (2) Byzantine agreement is impossible for $n/3 \leq t$ and (3) VSS implies a broadcast channel, hence broadcast needs to be assumed for VSS when $n/3 \leq t < n/2$.
https://web.cs.ucla.edu/~rafail/PUBLIC/145.pdf


texts:
I understand from reading MSDN
that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject directory attributes.

I tried to make a CRL distribution point but the result is garbage:

    $crlExt = New-Object -ComObject X509Enrollment.CX509Extension
        $crlOid = New-Object -ComObject X509Enrollment.CObjectId
    $crlOid.InitializeFromValue('2.5.29.31')
        $crlValue = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('http://www.test.com'))
    $crlExt.Initialize($crlOid, 0x1, $crlValue)
        $crlExt.Critical = $false

Is there any reference on how to encode the values for each of the following? I have searched all over but no luck.

AuthorityInformationAccess
CrlDistributionPoints
FreshestCRL
NameConstraints
PolicyConstraints
PolicyMappings
PrivateKeyUsagePeriod
SubjectDirectoryAttributes

Note that this is about the certenroll com interface in Windows. openssl is not applicable here.


texts: Count the functions that have an entry with a specific structure

texts:
Consider the function $f: \{0,1\}^n\rightarrow \{0,1\}^{2n}$
I want to count all the functions that have one entry where its first n bits are equal with the last n bits.
Assume we target entry number 10 and g is one of those functions that have the aforementioned property: $m=\{0,1\}^n;g(10)=m||m$
The total number of functions assuming $2^n$ rows where each row has $2n$ bits is $2^{{2^n}2n}$
I would say, if we want a specific entry of the function to have that structure we can first count the rest of the rows of the function which have: $(2^{n}-1)*2n$ bits and then since we want the first n bits to be equal with the last to the entry that we didn't take into account, we add another n bits, so total for each function: $(2^{n}-1)*2n+n$.
Total functions: $2^{(2^{n}-1)*2n+n}$
So the probability: $\frac{2^{(2^{n}-1)*2n+n}}{2^{2^n*2n}}=\frac{1}{2^n}$
Do i have it right? Is there an easier way to think about it? The result is to trivial to require that amount of effort.
Edit (added some more details):
One example (for $n=2$):
$F: \{0,1\}^2 \rightarrow \{0,1\}^{4}$
and I want to count all functions that have a specific entry, e.g 00, with a specific structure(first n bits equal with the last n bits). $F(00)=\{0000, 1010, 0101, 1111\}$ in this case

Entry 00| 0000
Entry 01| 0100
Entry 10| 0001
Entry 11| 0100

For example here $F(00)=0000$ and since $00=00$, this function should be counted

Entry 00| 0001
Entry 01| 0000
Entry 10| 0000
Entry 11| 0000

In this function since $F(00)=0001$ and $00\neq 01$, it should not be counted


texts: Why has SSL v3 not yet been upgraded to a higher version with stronger principles, what are the dependencies and issues to do so?

texts: SSLv3 is almost 18 years old; why has it not been updated to a more advanced version with stronger rules and structure. What have been the issues and dependencies in doing so till now???


texts: number of active s-boxes in a block cipher?

texts: How can we find the minimum number of differentially  active s-boxes in a block cipher (actually a Feistel network with several input cells) in a truncated characteristic form? In a recursive algorithm when we get to the situation that there are binary cases, I don't know what to do? For example when I get a xor of two nonzero characteristics, there are two cases nonzero and zero, How can recursive algorithm be applied in this state?


texts: can a key be applied to half the cipher text

texts: id like to ask if we encrypt the word "hello" as "olleh" but then we apply the key to only "oll" will it be converted into its orginal form i.e "llo". this was just for example. another thing id like to as is that how much time would it take to encrypt a 1.6 mb file with an average encryption algorthm. in seconds or miliseconds. like half a second?


texts: Why do one-way accumulators use rigid integers as the modulus?

texts:
In the paper that introduced one-way accumulators, the author's justify their use of rigid integers as the modulus with the following:

  The advantage of using a rigid integer $n = pq$ is that the group of squares (quadratic residues) modulo $n$ that are relatively prime to $n$ has the property that it has size $n' = \frac{p-1}{2}\frac{q-1}{2}$ and the function $e_{n,y}(x) = x^y \mod n$ is a permutation of this group whenever $y$ and $n'$ are relatively prime. Thus, if the factorization of $n$ is hidden, "random" exponentiations of an element of this group are extremely unlikely to produce elements of any proper subgroup. This means that repeated applications of $e_{n,y}(x)$ are extremely unlikely to reduce the size of the domain or produce random collisions.

This section of the paper leaves me with a few questions.

What is the significance of working in the group of quadratic residues?
When $y$ and $n'$ are relatively prime and used in $e_{n,y}$ how is it that "random exponentiations of an element of this group" are unlikely to produce elements of insecure (at least this is what I assume "proper" means here) subgroups?


texts: Do you know of other graphical implementations of the differential cryptanalysis I should know or I may have missed?

texts:
I wrote my master thesis in computer science last year and would like to share it with the community.
When I got to know differential cryptanalysis (DCA), I probably used the same literature and web pages as many others dealing with it. I started to deal with this attack without any prior knowledge.
I quickly found out that the paper by Howard Hays and the book "The Block Cipher Companion" are really good, but they don't always help a beginner in many places. On the other hand, when looking very closely and validating experiments, the specifications do not seem to be fully described.
One of my results with the occupation is an interactive tutorial consisting of three parts, integrated in the open-source and e-learning software CrypTool 2. This is designed to teach the necessary theory with slides and to put it into practice directly. So far there has been no interactive tutorial that combines theory and practice. There are isolated code fragments and for example the website of Amazing King (http://theamazingking.com/crypto-diff.php), but a console application is didactically not as valuable as an application with a graphical interface and the possibility to influence the process.
Various parameters, such as the key to be attacked, can be determined by the user himself. Different types of learners are addressed by different display formats (e.g. for differentials). Learning and understanding is supported by the fact that each step of the DCA can be viewed separately instead of viewing the DCA as a 'black box' with different inputs and a key as output.
Another result are extensive experiments with exact specifications. This creates traceability and the public source code ensures transparency.
If you are interested, you can have a look at the DCA in CrypTool 2. It can be found under the following link and can be downloaded for free:
https://www.cryptool.org/en/ct2-downloads
After finishing my master thesis, I created a series of challenges for the website MysteryTwister
C3 with my supervisor. Currently 2 of 4 challenges of the DCA are published. If you are interested, you can find them at https://www.mysterytwisterc3.org.
I would really appreciate your feedback about how you like the DCA tutorials in CrypTool 2 and wether you know of any other competitive implementations available


texts: Negative correlation in image cryptography

texts: I am working on an algorithm to encrypt images and I am getting a negative correlation between the encrypted image and the original image. Ideally correlation should be zero but what should I infer from a negative value?


texts: Why are 48 bytes appended to Libsodium encrypted messages if nonce is 24 bits?

texts:
When encrypting a string through the Libsodium secret box feature, the ciphertext is 48 bytes longer than the plain text message ...

I am wondering why this is ... since the nonce is only 24 bytes.


texts: Which one is fastest? Karatsuba or Montgomery multiplication?

texts: Is there any complexity analysis between Karatsuba and Montgomery multiplication algorithms? It seems that Karatsuba is more general in the sense that is not modulo tuned while Montgomery it is. Does a also a hybrid model using Karasuba and Montogomery exists?


texts: What is the intuition behind discrete gaussian distribution for error sampling for lattice based crypto?

texts:
I'm still not sure why it has highest entropy (higher than uniform distribution).
What is the intuition of it?


texts: What's the minimum message expansion for Digital Signature?

texts:
Can we prove a minimal message expansion for a Digital Signature scheme (possibly with Message Recovery), for $b$-bit security (that is expected $O(2^b)$ work to break the system)?

Define message expansion as the maximum over all messages (perhaps at least a certain threshold $t$ in size) of the difference in size between the signed message and the original message, with the constraint that from the signed message and the public key, the public verification procedure must reconstruct the original message.

Message expansion of $2b+O(1)$ is claimed by BLS signature with $t=0$ if I understand correctly, and reached by deterministic RSA-MR (ISO/IEC 9796-2 scheme 3) with $t=\log(N)-2b$ bit where $N$ is the public modulus, large enough to prevent factorization attack.


texts: Can the knowledge of the inverse of $p$ modulo $q$ help factor $n=pq$?

texts:
With the RSA algorithm implemented using the Chinese Remainder Theorem (CRT), the private key has to be provided with not only $p$, $q$ and the private exponent $d$, but often also with the pre-computed value $q^{-1} \bmod p$ for a faster recombination using the CRT.

Assuming that $q^{-1} \bmod p$ is leaked to the adversary (but not $d$, $p$ and $q$ themselves), does that help factor $n = pq$? And if so, how?


texts: How to analyze the off-by-one error's impact on the entropy of the result?

texts:
I'm reading Jean-Philippe Aumasson's book Serious Cryptography to learn more about cryptography. On page 37, the author gives an example of Cryptocat's off-by-one error in its PRNG implementation in 2013, as shown below:

Cryptocat.random = function() {
    var x, o = '';
    while (o.length < 16) {
        x = state.getBytes(1);
        if (x[0] <= 250) {
            o += x[0] % 10;
        }
    } return parseFloat('0.' + o)
}

The off-by-one error is found in the IF condition clause which uses <= rather than <. The author states that the values generated had an entropy of 45 instead of approximately 53 bits.

I'm wondering how the entropy of 45 bits is calculated.

In fact, if the code uses <, then everything is all right: the probability of a decimal digit is equally 1/10. Thus the entropy of 16 decimal digits would be 16*10*1/10*log(10, 2) = 53.1508.

However, in the case of the above-flawed code, the probability of decimal 0 is 26/251, and the probability of each other value is 25/251. Thus, the entropy of 16 decimal digits would be 16*(26/251*log(251/26, 2) + 9*25/251*log(251/25, 2)) = 53.149.

I don't any clues on how to get the 45 bits entropy. Can anyone help me, please?

References:

https://tobtu.com/decryptocat.php
https://nakedsecurity.sophos.com/2013/07/09/anatomy-of-a-pseudorandom-number-generator-visualising-cryptocats-buggy-prng/


texts:
Does the SHA-512 value of an input leak any information about the SHA-256 value of that same input?

Specifically, if I'm using SHA-512 to derive encryption and HMAC keys from a 256 bit ECDH shared secret (by splitting it into two 256 bit chunks), does publishing a SHA-256 fingerprint of that shared secret reveal any useful info about the derived keys?


texts:
I have given seven cipher text encryted by the many-time pad. All are encrypted uwith the same random chosen secret key but I have no idea how to decrypt them.
There are 7 ciphertexts:
758c7313325a32e070d50a8fc9993a7822f54e88c7433f3ef29da27405eb1a
688a705c265e21f17fd51c8fd6933e6270f549d1860a3e7bffd0a27a19fb1af947
7196795426522de87fd4158fd69e32626ef81dc6c9176d39f39db67c0de912f446fe31
758c73133c5a33f179c81bcecb857d6476e959d1860b2428e2d2a06c
718c6f403d5033a57fc952d8cd97293772f444dbcf002428e2cef2661ffa1fee
758c7313245b39f67fd91bcecb857d6770fd5edccf00287bfbd8b67c08e615f2
758c7f40744332ea74d617c2859f2e376cf34988d20b2c2fb6d9bb730de618e25fe6


texts: Why is Ring-LWE more efficient compared to LWE?

texts:
Can someone please tell me why is the Ring-LWE more efficient?
By introducing polynomials in place of matrices, what kind of optimizations do we introduce that make Ring-LWE more efficient?


texts: Encrypting structured data (text) with RSA

texts:
In "Cryptography Engineering" Bruce Schneier wrote:

  ... All of them come down to a single thing: it is very bad  to have
  any kind of structure in the numbers that RSA operates on. The
  solution is to use a function that destroys any available structure.

Few lines lower he mentions PKCS #1 v2.1. As I understood pkcs is about padding. Does it mean that if together with random symmetric key I have some non-random data (file name) I have to xor it with some pseudo-random byte stream before encryption?

p.s. The question is crossposted from https://stackoverflow.com/questions/40194332/encrypting-strucutered-data-text-with-rsa ,  where it was voted out as off-topic since related to cryptography.


texts: Can ECDSA signature signing and verification process replaces password hashed based login system?

texts:
ECDSA or DSA in general was to sign a message or data using private key and verify it using public key, if the attacker/imposter doesn't have the private key then they couldn't sign the message properly.
If ECDSA private key was kept private, can the signature verification of ECDSA be used for user to login into a system ? Rather than a password hashed based login approach ?


texts: Homomorphic decryption circuit in integer-based scheme

texts:
I'm reading this excellent paper by Gentry as a smooth introduction to Fully Homomorphic Encryption. Most things are clear to me except from the way the homomorphic evaluation of the decryption circuit is described (which is after all the whole point).

If I understand correctly, we assume (for simplicity) 1 message $m$ encrypted as a ciphertext $c_1$ under the first public key $pk_1$ via $c_1=ENC(pk_1,m)$. Let's say this is a big $Q$-bit number.

Then Gentry suggests, that we double-encrypt this ciphertext, by encrypting each one of the $Q$-bits with a new public key $pk_2$, to obtain obviously a vector of $Q$ new ciphertexts, each one being $Q$-bits. Let's call this new ciphertext $\bar{c}$.

We also need an encryption of the $P$-bit secret key $sk_1$ in a similar fashion (i.e. encrypting each bit of it with $pk_2$ to generate $P$ vectors of $Q$-bit ciphertexts. Let's call this encrypted secret key $\bar{sk_1}$).

He now suggests, that we use the values $\bar{c},\bar{sk_1}$ (remember vectors of ciphertexts) as inputs to an evaluation circuit for the homomorphic evaluation of the decryption (this cleverly removes the inner encryption with $pk_1$ but still keeps the message wrapped under encryption with $pk_2$).

The scheme originally performs encryption of the form $c=pq+m$, where $m$ encodes 1-bit of the initial message as its least significant bit, so decryption is $(c \bmod p) \bmod 2$ ($\bmod 2$ obviously to retrieve the last bit). As such, the "default decryption" circuit accepts a $Q$-bit ciphertext and a $P$-bit secret key $p$ and outputs just one bit as the $\bmod 2$ operation dictates.

However, in the homomorphic case, the inputs are actually vectors and the output should be a fresh $Q$-bit ciphertext, that will be doubly-encrypted with a new key and so on. How then does this circuit look like? If it handles the vectors $\bar{c},\bar{sk}$ as huge integers it would still output 1 bit via the final $\bmod 2$ operation but this is not consistent with the concept of double encryptions.

Any idea?


texts:
I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination.

I have been trying to generate a 512-bits key and crack it. As far as I can understand, $p$ and $q$ are $65537^a \bmod L$ where $a$ is random and $L = 2\cdot3\cdot5\cdot7\cdot\dots$. If at one point, I find out what $p$ or $q$ is, than I can find the other one easily and then compute the private key.

Is this correct? I am sorry if I do not make any sense and any hint to the right solution is greatly appreciated.


texts:
Let $p$ be a large public prime. Alice holds a private key $(e_1,d_1) \in Z_{p-1}^*$ such that $e_1 d_1 = 1 \mod {p-1}$. Bob also holds a different private key $(e_2,d_2)$ with the same property.

Let's say Alice wants to send a message $\large m \in Z_p^*$ to Bob:

$1.$ Alice computes and sends $\large m^{e_1} \mod p$ to Bob.
$2.$ Bob computes and sends $\large m^{e_1e_2} \mod p$ to Alice.
$3.$ Alice computes and sends $\large m^{e_1e_2d_1} = m^{e_2} \mod p $ to Bob.
$4.$ Bob decrypts by computing $\large m^{e_2d_2} = m \mod p$

Assuming Eve can read (but not modify) the messages exchanged between Alice and Bob, can she obtain any meaningful information about $\large m$ ? What happens if Alice and Bob use the same protocol to exchange multiple messages $\large m_1,m_2,...,m_t$ using the same private keys ?


texts: Bubble sort in Fully Homomorphic Encryption

texts:
I've read in a pdf written by Ayantika Chatterjee and Khin Mi Mi Aung whose title is "Fully Homomorphic Encryption in Real World Applications" that it is possible to implement a bubble sort algorithm using certain Fully homomorphic libraries to be able to compare and sort messages while they are encrypted, here is a snippet of the pdf:

The FHS circuit depends on two main operations: subtraction operation and decision
making based on the subtraction result. Fully Homomorphic subtraction, which
is implemented by performing homomorphic addition of one ciphertext with 2’s
complement of another ciphertext. For two plaintext numbers a and b, subtraction
can be computed as:
a − b = a + 2’s complement of b

Now a homomorphic subtraction of a' and b' which are the encryptions of a and b
respectively is computed using the homomorphic addition as follows:
a' − b' = a' + Encrypt(2’s complement of b)
The 2’s complement of b in the encrypted domain is obtained as follows:
Encrypt((2's complement of b), pk) = b' ⊕ Encrypt(11 . . . 1, pk) ⊕ Encrypt(1, pk)

They also say that:

The MSB (most significant bit) of the substraction output is further fed to the decision making module as a selection line.
The following equations represent how the swap operation takes place between two elements A[i] and A[i + 1] depending on MSB (represented here as bt):
temp = bt ∗ A[i] + (1 − bt) ∗ A[i + 1]
A[i + 1] = (1 − bt) ∗ A[i] + bt ∗ A[i + 1]
A[i] = temp

So they make very clear that its the MSB of the substraction that determines which encrypted message is the biggest/smallest.

So my question is how were they able to determine that is only the MSB which determines the answer because i know that if we have the number 2 which is smaller than the number 3 after encryption we don't have a guarantee that Enc(2) is smaller than Enc(3)


texts: How do you implement a cipher as one lookup table?

texts:
I am reading up on whitebox cryptography and have trouble understanding how are ciphers implemented as one lookup table?

Assuming my plaintext is just 4 bits so the size of my lookup table should be $2^4$, what does such a lookup table look like?

Specifically, this is the slide I am looking at, I found it on Google.


texts: Misuse-resistant authenticated encryption based on SHA-3/Blake2b and AES-CTR/ChaCha20

texts:
I am wondering if the following is a useful misuse-resistant authenticated encryption scheme:

Parameters (shared by many users):

Choose a hash function $H$, such as Blake2 or Keccak.  SHA2 could also be used.
Choose a stream cipher $E$, such as ChaCha20 and AES in CTR mode.

Inputs

Up to a large amount of associated data $A$.
Up to $2^{64}$ bytes of plaintext $m$.
Secret key $K$, which must have at least $k$ bits of entropy but can be much longer.

Outputs

Ciphertext $C$, of the same length as the plaintext.
An auth tag $t$, of 256 or 512 bits depending on the choice of $H$.

Decryption takes $A$, $C$, $t$, and $K$ as inputs and returns either $m$ or the symbol $\text{FAIL}$ if the message was forged.

All lengths are 64 bit, little-endian encoded.

Encryption algorithm:

Calculate the auth tag $t$ as $H(len(K)||K||len(A)||A||len(P)||P)$.
Calculate the shared secret $S$ as $H(len(K)||K||t)$.
Use $S$ as the key for stream cipher encryption. Any extra bits can be use for the nonce.  Bits beyond that are discarded.

Decryption algorithm:

Calculate shared secret (same as step 2 of encryption).
Perform stream cipher decryption (same as encryption step, since encryption = decryption for a stream cipher).
Recompute auth tag $t'$ from plaintext, AAD and key (same as encryption step 1).
The message is rejected unless $t=t'$.

Claim

256-bit confidentiality.
256-bit integrity when used with a 256-bit hash.
512-bit integrity when used with a 512-bit hash and $K$ has at least 512 bits of entropy.
IND-CCA2 security provided that the AAD is never repeated with the same key.
If the AAD repeats the only leak is whether a message repeated.

I would definitely like to know if this cryptosystem lives up to my claims.  I doubt it, since I am not a cryptographer -- but I would be glad if I was proven wrong.


texts: Use AES in Web Crypto with public/private key pair

texts:
this is a very top-level question - as I'm just starting to delve into crypto.

The main objective is to be able to communicate between 2 mobile devices through a BAAS server such as Firebase so that one app can notify another one and send data.

The data to be exchanged are encrypted image documents. Security is paramount since the images may contain sensitive data.

I will be using Ionic 3 to develop the apps.

So far I have tested the following technologies:

Using WebCryptoApi in Ionic 3. I tested a few examples from WebCrypto Examples, and they
tested ok on android.
App to App communication (using Notification) using Firebase.

I plan to decode an image into Base64 (which is just a string) and use AES encryption/decryption.I plan to use the following simple workflow:

Case Scenario: User A requests file from user B:

User A creates key-pair and sends the public key to user B
User A keeps app open so that the private key is not stored anywhere.
User B encrypts the file with the public key
User B sends encrypted file to user A
User A decrypts user B's file

But Web Crypto does not seem to generate a simple AES Private/Public Key pair that enables me to encrypt/decrypt, as is the case with RSA-OAEP for example, where I can generate a public/private key pair.

AES-CTR, for example, only generates one key and uses a counter instead of a private key. But this counter is needed to encrypt as well, which makes my scenario not possible.

Is it possible to achieve my scenario with AES? If so, how should this be done? If not, what approach should I take?

I Appreciate any comments on this.


texts: 1:1 algorithmic shuffle of massive numerical space

texts:
For a personal project I'm currently tinkering on, I'm looking for a function which has the following properties:

For any number X in the range 0..MAX, there is a 1:1 random mapping with another number Y in that range.
As long as the key/algorithm remains the same, that mapping should
not change. For every X, there is one and only one Y, and for every
Y there is one and only one X.
Small changes in X should generate massive changes in Y.
Calculating X -> Y should be computationally simple, even for extraordinarily large values of MAX.
Calculating Y -> X should be (effectively) impossible, as should guessing the key.

In non-numerical terms: I'll be encrypting chunks of data (think 4096 bits, maybe more), and expecting an equally-sized unique output chunk for every possible input chunk. Every chunk will always be the same size.
Arbitrary values of X will be converted to Y quite often. End users will be able to choose their value of X at will and see its corresponding Y, across a vast numerical range. Cryptography is not my strong suit, but from my reading this translates as "the algorithm would need to be resistant to chosen-plaintext attacks". The users should never be able to calculate Y -> X, as that would spoil all the fun (to say the least).
A simple visual, for MAX=8:

X
Y

0
7

1
6

2
5

3
4

4
1

5
0

6
3

7
2

So it should be criminally easy to start with X=2 and calculate Y=5, but it should be essentially impossible to guess X=6 from Y=3 without brute forcing.
There were several promising answers here, but it was unclear how secure any of them actually would be given the conditions: https://stackoverflow.com/questions/16398843/unique-int-to-int-hash
My strong preference would be to use an existing and battle-tested encryption algorithm for this, and preferably one which exists in OpenSSL or some other library I can just plug into from Rust, but I've had trouble knowing the right vocabulary to search for what I want (I'm far from new to programming, but very very green in cryptography). It seems from my reading that block ciphers are what I'm looking for, but I have been thrown off by all the talk of IVs and counters and am unsure if CBC/CTR/etc actually work for what I'm trying to do (or if what I'm trying to do is even possible).
Any pointers in the right direction would be greatly appreciated!


texts: Real life collision when only using truncated hash

texts:
For MD5 two different inputs are known that produce the same 128 bit hash value. However, these inputs are artificially created for this specific purpose.

For normal, real life inputs I believe no such collision is known?

When you only consider the first n bits of the hash however certainly such collisions are known for small n.

My question: what is the largest n bits truncation for which an accidental collision is known?

(of course answers need not be limited to MD5 but can also be about others hashes)


texts:
I'm aware that it's advisable to rotate cryptographic keys periodically.  HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length.  It also accepts a salt, the RFC states that "the use of salt adds significantly to the strength of HKDF".   Naturally, changing the salt results in distinct Output Key Material.

What I would like to clarify, is whether updating the salt (in the context of HKDF) constitutes 'key rotation', or whether the IKM itself needs to be changed periodically.  I suspect the latter, but I'd like to hear what other people have to say.  I assume that this also applies to other KDFs like Scrypt.


texts: Is it possible to implement the Signal Protocol without a server?

texts:
My question is regarding the Signal Protocol[1]. Is it possible to implement the protocol securely, without a server?

(I have no particular motivation for the question other than to understand better how the Signal Protocol works, what kind of trust I give to the server, and what attacks are possible if the server can be hacked or if server <> client communication can be monitored).

Imagine a room with a big whiteboard (or a chalkboard). This is our "server", but anyone can enter the room at any time and make any modification they want. The goal is for Alice to initiate an encrypted, asynchronous conversation with Bob by writing messages on the board.

My understanding is that neither XEdDSA/VXEdDSA nor the Double Ratchet component of the protocol are affected by the board being public. Is that correct?

That leaves the other two components of the protocol.

X3DH

As stated in X3DH Section 4.7, "Server Trust"[2], the following properties are true when using a server, and would still be true using a whiteboard:

The server can cause communication to fail by refusing to deliver messages (someone can erase the board).
The server can refuse to provide pre-keys, or somebody can drain pre-keys (erase them from the board), reducing forward secrecy.

What are the other attacks which would be made possible by giving anyone access to the board?

Sesame

As stated in Sesame Section 6.3, "Protecting Server Communications"[3]:

  If an attacker is able to impersonate a victim device when authenticating to the server, the attacker could fetch messages being sent to this device. The attacker would not be able to decrypt these messages, but would learn sender UserIDs and DeviceIDs.

This would obviously be impossible to prevent on the whiteboard, so everyone would be able to see who is communicating with whom.

Sesame also relies on server <> client communication being encrypted and authenticated. From the same section:

  Communication between devices and servers should be encrypted and authenticated. This limits the amount of metadata that is exposed to eavesdroppers, and makes it harder for third-party attackers to perform active or passive attacks on device-to-device communications.

What attacks would be made possible by giving anyone access to the board?

Conclusion

As best I can tell, the only reduction in security comes from the fact that anyone would be able to monitor who is talking to whom.

Forward secrecy could also be reduced by eliminating pre-keys. Would that completely eliminate forward secrecy?

How could cryptographic deniability be affected?

Have any similar protocols ever been developed which would give the same properties as the Signal Protocol without trusting a server at all (e.g. you could literally do it on our whiteboard)?

Thanks, and I hope you have fun thinking about it!

[1] https://www.signal.org/docs/

[2] https://www.signal.org/docs/specifications/x3dh/#server-trust

[3] https://www.signal.org/docs/specifications/sesame/#protecting-server-communications


texts: In sha-256, when the words go through the compression function, they get added to the previous hash. In case of the first 64 rounds, they get added to the initial words ($\bmod 2^{32}$ of course). However, would xor'ing instead of adding be more secure, or not?


texts: Small signature for packets using asymetric encryption?

texts:
The smallest signature sizes that I can find are for elliptic curve public key systems where the signature is 4 times the security level (2 x the key size). In my case I can change the key every day, after which it is OK if the key is revealed.

So my questions are:

is there a more efficient signature than 2 x key size?
what would be the minimal acceptable key size for implementations over the next 10 years or so. Looking at a table of key size vs. operations to crack I get a 108 bit ECC key requires 1.8 x 10^8 MIPS, but I'm not sure how to interpret MIPS these days when graphics processors are so powerful. Is 1.8 x 10^8 MIPS a lot of compute power?


texts: Recognizing and decrypting custom cipher with known plaintext and ciphertext

texts:
I've been trying to reconstruct an encryption algorithm that produces a known ciphertext from a know plaintext. I have done some analysis:

the algorithm operates on single bytes
a plain text can be of any length and len(ptext) == len(ctext)
for a same letter plaintext the ciphertext repeats after 20B

Example (bytes are hex; ASCII(A) == 0x41):

P: 4141414141414141414141414141414141414141 414141...
C: cbcd7f01128216acb2495fa2625aa245d9d30366 cbcd7f...

a minor change in input reflects in minor change of output

Example (ASCII(B) = 0x42; the diffrence is probably +-3 max):

P1: 414141414141...
P2: 424242424242...
C1: cd7f01128216...
C2: ce7c02118115...

xor of ciphertexts from single letter plaintexts is obviosly corelated

Example (Cx = ciphertext of same letter 'x' plaintext)

Ca: cd7f01128216...
Cb: ce7c02118115...
Cc: cf7d03108014...
Cd: c87a04178713...

Ca ^ Cb: 3 3 3 3 3...
Ca ^ Cc: 2 2 2 2 2...
Ca ^ Cd: 5 5 5 5 5...
Cb ^ Cc: 1 1 1 1 1...
Cb ^ Cd: 6 6 6 6 6...
Cc ^ Cd: 7 7 7 7 7...

Do you recognize this cipher? How could I proceed with my analysis/reconstruct the algorithm?

Another complication is that ciphertexts seems to be sort of "rotated" with every new message, see what I mean.

Example (P1 and P2 are sent separately; '!' is used only to visualize it better):

P1: P2
P2: 4141414141414141414141414141414141414141 414141...
C1: !!!cbcd7f01128216acb2495fa2625aa245d9d30366 cbcd7f...
C2: 0366!!!cbcd7f01128216acb2495fa2625aa245d9d3 0366cb...

I am a beginner, any help is appreciated.


texts: What are the practical implications of ciphertext distinguishability?

texts:
Commonly there are four ways to "break" a secrecy-focused cryptosystem:

Recover the secret key
Recover the message
Distinguish an encryption from random noise
Distinguish the encryption of two different messages

The practical implications of the first two breaks are obious: They allow arbitrary message recovery (more or less) fast.

However I'm unclear about the practical implications of the the last two breaks.

So let's assume an encryption algorithm or a public key cryptosystem which fails to provide indistinguishability but also doesn't allow key or message recovery. As an example assume the scheme from the "Present an attack for the combination of OTP and textbook RSA" question under a chosen plaintext attack.

So:
What are the practical implications if a distinguishable cryptosystem would be used in practice?


texts: Using AES-CBC and providing the IV in file header -> security hole?

texts:
currently I audit some code I've written in the past to use KeePass 1.x databases. I stumbled over the following question:

The database itself is decrypted with AES-CBC and inside the file header the IV is stored in plain text. Is this a security hole? Following this article it's not really one as the IV is only needed for the first block but following this it is as a watermark attack is possible. Could someone explain this please in more detail?

Thanks a lot.


texts: Is there an Elgamal implementation in javascript?

texts:
Does anyone know a good, well known implementation of ElGamal encryption and decryption in JavaScript?
I was told that Stanford Javascript Crypto Library https://github.com/bitwiseshiftleft/sjcl/ uses ElGamal but I am not sure about it. Does anyone know if they use it?  Thank you all in advance for your help.


texts: SHA's finite character set and collision

texts:
From what I've researched, SHA's hex encoded string contains the characters [a-fA-F0-9]. If we represent it in Base64, it can contain [a-zA-Z0-9+/].

So the number of possible hash permutations are 22^64 and 59^64 respectively.

My question is, while we have infinite permutations for the input text, if the output hash is finite, then aren't all SHA algorithms meant to collide at some point?

I'm self taught. So please bear if this is a basic thing in cryptography.


texts: How to prove a cipher resistant to differential cryptanalysis?

texts: How do you prove that a cipher is resistant to differential cryptanalysis? It's said that Rijndael has been proven resistance to differential cryptanalysis. How do cryptographers do that?


texts: Can I use a key-derivation-function as the hash function H in SRP?

texts:
In the Secure Remote Password Protocol, the verifier must be stored on the server.  In the case of a server compromise, an attacker could obtain these verifiers.  If nobody reused passwords, this wouldn't be a big deal (as the users' data is probably also compromised).  However since people do reuse passwords it seems a good idea to make offline attacks against the password file difficult.

SRP is based off of a cryptographic hash H; part of the cost of an offline attack would be calculating H, so using an expensive hash for this step seems good.  However, I am unsure of the suitability of tunably expensive hashing mechanisms (e.g. PBKDF2, bcrypt, scrypt) for this.


texts: Is it possible to validate a Public Key in RSA?

texts:
If I have a 1024-bit number, and someone is telling me that it is in fact a valid RSA public key, is there any way I can quickly validate that it is indeed so (without cracking RSA)?

(I suppose I am asking if it's possible to quickly tell if a number only has 2 prime factors)


texts:
I would like to refer you to page 430 of the Handbook of Applied Crypto, where the authors said "... reordering of multiple signed blocks presents a security risk..."

This statement was made in reference to not breaking messages into fixed lengths which can then be signed individually using signature schemes with message recovery.

My question is

  How does the security risk arise?
  If I do not want to include a hash function for signature schemes with appendix, can I break the message up into blocks of fixed lengths and sign each block?

Thanks for your help!


texts: Using two or more encryption algorithms together, how do we compute the strength of the final encryption?

texts:
If two or more encryption algorithms are used together, how do we compute the strength of the final encryption?
And how would the application perform against quantum computers?
The first two tables are accurate, correct?
In the third table where we combine two encryptions together, can we calculate the key length? And bits of encryption? Is it correct?
In the 3rd table, the bits are just added, correct?
Let's say:
encryption | Key length | bits of encryption
AES-128    | 128        | 128

Now, if we do add two of them together (combine using cascade encryption)
AES-128 + AES-128 = 256 key length ? | 256 bits of encryption ?
Is that correct?
Or what is the correct answer for:
AES-128 + AES-128 = ___ key length ?  ___ bits of encryption ?


texts: Indistinguishable encryptions in the presence of an eavesdropper equivalence

texts:
I'm trying to prove that definition 5 and definition 6 in this document are equivalent. This is what I've done at the moment: Asume that the scheme has Indistinguishable encryptions in the presence of an eavesdropper (definition 5), then:

$$\mbox{Prob}[\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n)=1]=\mbox{Prob}[\texttt{output}(\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n,0))=0]+\mbox{Prob}[\texttt{output}(\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n,1))=1]=(1/2-\mbox{Prob}[\texttt{output}(\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n,0))=1])+\mbox{Prob}[\texttt{output}(\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n,1))=1]\leq 1/2+negl(n)$$

And we get that:

$$\mbox{Prob}[\texttt{output}(\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n,1))=1]-\mbox{Prob}[\texttt{output}(\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n,0))=1]\leq negl(n)$$

Now I'm trying to prove that:

$$\mbox{Prob}[\texttt{output}(\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n,0))=1]-\mbox{Prob}[\texttt{output}(\mbox{Priv}_{\mathcal{A},\Pi}^{\mbox{eav}}(n,1))=1]\leq negl(n)$$

For finishing the inequality with the absolute value. Is there someone who can help me with this? Thanks!

PS: I can understand the last line in the definition 6 in the document I've given: where the probability is taken over...

Can someone explain me that?


texts: Cryptodefense ransom use RSA-2048. Any chance with known plaintext attack?

texts:
The "new" kind of ransomware invade your computer and crypt all your files using the RSA-2048.

Personally, I have been victim of cryptodefense: 40000 files encrypted...
I'm not going to pay anything to this &? but this is a big loss. I have a lot of files in both form: crypted and uncrypted (backup from 2011...)

Is there any chance to apply a known plain text attack on RSA-2048. I read another topic and it seems that if you have two files you miss a variable (e) but is there any way to find it with more than a thousand of files?

Does that means that this is a question of calculation capacity (in that case I'm gonna wait a couple of years to have my pictures back ;-)


texts:
This is the question.

Suppose $G$ is a secure PRG with expansion factor $\ell(n) = 2n$ such that $n$ is a security parameter.
Is it always the case that,
$G'\colon \lbrace 0,1 \rbrace^n \to \lbrace 0,1 \rbrace^{3n}$,
defined by, $G'(s) := G(s) || \bar{s}$ is also a PRG ?
Here, $||$ represents concatenation of bit strings, and $\bar{s}$ represents the bitwise complement of s (e.g., if $s$ is $100010$, then $\bar{s}$ is $011101$).

My unsure attempt of solving this says it is a broken PRG (i.e. not secure) because, I always check on following points for a construction to be a secure PRG:
.. $\ell(n) > n$,
.. efficient,
.. deterministic, &,
.. pseudorandom, i.e., $| Pr[D(G(s) = 1] - Pr[D(r) = 1] | \leq \operatorname{negl}(n)$.

And the construction in question failed in passing the pseudorandomness.

My attempt was, let's say $w$ is final output (of $3n$ size, which is given to the distinguisher) and I leaked the first bit of my construction (i.e., only $n-1$ bits i.e., $s[2:n]$, are passed into G and are expanded to $2n-1$ bits) such that first bit of $w$, i.e., $w[1]$ is complement of $w[2n+1]$ (because last $n$ bits are simply concatenated and $2n+1$ refers to the first bit among the last $n$ bits).

XORing $w[1]$ with $w[2n+1]$ gives us $1$ which clearly depicts inefficient randomness and failure of computational adversarial indistinguishability (i.e., ability to guess bits better than a probability of $1/2$ exist).

I'm unsure whether this is the right approach though.
When we are talking about PRGs, my knowledge says we cannot modify/control the seed (nor we can see it, though we control its size), and then we know that $G$ will output $2n$ bits (i.e., an expansion factor of $2|s|$).
Is it possible to explicitly only send $s[2:n]$ bits to a PRG to get the expanded $2n-1$ bits back and then attach that first bit in the starting of the pseudorandom string ?.

What's your verdict towards my approach ?. Thank you, for your time &, I really liked you read it.

I have another explanation that proves $G'$ is secure, however, I'm sure with a probability of 50% that, that is not right and rather this is right (i.e. $G'$ is not secure).


texts:
So for a Diffie-Hellman problem, I am given the prime $p$ for the Diffie-Hellman exchange.
I am also given $g$, secret number for machine as $A$, secret number for station as $B$, a Diffie-Hellman shielded Login Name $V$, and Diffie-Hellman shielded password $W$.

For this problem, I am given three users and see which one accessed files to which they had no clearance to. So I computed  $x=g^A\pmod p$ and $y=g^B\pmod p$, then $x^A\pmod p$ and $y^B\pmod p$ which gave me my secret common key. Where I am confused is as to how to now unshield the DHS key and how I can use $V$ and $W$ to do so.

What do I do next?

According to a textbook I am reading, it says that the equation $DHS*u = 1\pmod p$ has a solution in $\mathbb N_p$ and this is the solution for $UDHS$, or the unshielding of DHS. But I am confused by what this means. Help is appreciated.


texts: Creating colliding x509 certificates: Crafting RSA moduli step

texts:
I am trying to generate 2 x509 certificates with the same signature but different values in the common name field, based on md5 collisions, as it was specified in this paper (page 7).

Now I have successfully created 2 files with the same md5 value, that are valid certificates, but the public key field doesn't contain valid RSA moduli yet. According to the paper, they can be generated using the method described in this paper (page 2, step 4), with sizes for p and q of 1976 and 6216 bits in one hour on a regular laptop. It doesn't say how to adjust the values in the second paper exactly (which was for 2048 bit moduli). Moreover, hashclash produced 9 md5 blocks instead of 8 in the paper, so it might not work with these sizes.

Here's the algorithm from the second paper for a quick reference: www.imgur.com/Z35J8Af

The difference is that $b_1$ and $b_2$ are 4704 bits each (9 * 512 + 96), so $b$ should be 3488 bits.

I simply tried different values that might make sense (1024, 1976, 1740, 1730, ...), for several hours, but the script never finished. It worked for 1024 bit moduli though.

Now, what I need to know is:

What size to pick for p, if it's not one of the values that I tried
Or is there another parameter I might have to change in the script below ?

Here is the script:

from mymath import *
import random
import sys

e = 65537

def read_file_as_number(name, skip):

    f = open(name)
    n = 0
    byte = f.read(1)

    while byte != "":
        if skip == 0:
            n = n << 8 | ord(byte)
        else:
            skip -= 1
        byte = f.read(1)

    f.close()

    return n

b1 = read_file_as_number("file1_9.bin", 244)
b2 = read_file_as_number("file2_9.bin", 244)

print hex(b1)
print hex(b2)

b_size = 3488

print "b length in bits:", b_size

b1 <<= b_size
b2 <<= b_size

def random_prime(bitsize):
    x = random.randint(0, 1 << (bitsize - 1))

    return next_prime(x)

# random prime x, where x - 1 is coprime to n
def random_prime_coprime(bitsize, n):

    x = random_prime(bitsize)

    if gcd(x - 1, n) == 1:
        return x
    else:
        return random_prime_coprime(bitsize, n)

# chinese remainder theorem
def crt(a1, a2, n1, n2):
    N = n1 * n2

    inv1 = mod_inv(n2, n1)
    inv2 = mod_inv(n1, n2)

    return -(a1 * inv1 * n2 + a2 * inv2 * n1) % N

p_size = 1740

print "p size:", p_size

maxb = 1 << b_size

while True:
    b = 0
    k = 0
    p1 = random_prime_coprime(p_size, e)
    p2 = random_prime_coprime(p_size, e)

    b0 = crt(b1, b2, p1, p2)

    assert gcd(p1, b1 + b0) == p1
    assert gcd(p2, b2 + b0) == p2
    assert b0 < p1 * p2

    while b < maxb:

        b = b0 + k * p1 * p2

        q1 = (b1 + b) / p1
        q2 = (b2 + b) / p2

        if gcd(q1 - 1, e) == 1 and gcd(q2 - 1, e) == 1 and is_prime(q1) and is_prime(q2):

            print b0

            print "DONE"
            print "p1 =", p1
            print "p2 =", p2
            print "q1 =", q1
            print "q2 =", q2

            print "n1 =", b1 + b
            print "n2 =", b2 + b

            exit()

        k += 1
        sys.stdout.write('-')
        sys.stdout.flush()

    sys.stdout.write('.')
    sys.stdout.flush()


texts: Termonology help: What is using AEAD without encrypting data called?

texts:
I'm using ChaCha20-Poly1305 in a "full AEAD" mode, where a payload of data is encrypted and a block of unencrypted "additional data" is secured as well.

However, I'd like to also occasionally use the same algorithm without encrypting, just appending the payload of data that would normally get encrypted to the additional data, using an encrypt length of zero.

The tag is to best I can tell, a tag. It's not really a signature, it's not a hash, it's pretty close to a mac. Is tag in this case colloquially synonymous with anything else?
Is it right to say ChaCha20 in AEAD-mode? I know GCM has GHASH and GMAC, but I think those are the Galois part. Would be it be fair-enough to say I'm using ChaCha20 in HMAC mode? What would be the right way to phrase this?


texts: What kind of ciphers does not depend on order of operation?

texts:
What kind of cipher does not depend on order of operation ?

For Instance if we have two operations encryption Enc(m,k), decryption Dec(m,k) and some message m.

For which ciphers the following is true:

Dec ( Enc (m, k), k ) = Enc ( Dec (m,k),k )

I suppose ciphers in counters mode where Enc() and Dec() are identical operations provide such property.

What about AES_CBC ? ChaCha20 ? Camellia ?


texts: How is SPHINCS Hash-based signature "stateless"?

texts:
I really hope someone can help me with these questions related to SPHINCS.

I am trying to understand the concept of “stateless” vs. “stateful” signature scheme which is the basis of SPHINCS. I went to read Chapter 6.4 of Goldreich’s Foundations of Cryptography, Volume 2. In page 546, image attached with this question, he gives a small example of one parent node x authenticating two children nodes, x_0 and x_1.

Here are my questions:

Q1: node x generates (S_x, V_x) pair where S_x is the Secret Key and V_x is the Public Key. Then node x generates two additional pairs (S_x0,V_x0 )  and (S_x1,V_x1) for nodes x_0  and x_1, respectively. Is there is any relationship between S_x  and S_x0,S_x1 other than the fact that they use the same G(1^n) ?

Q2: the public key is only V_x?

Q3: signing only occurs with children nodes. Say I sign α with S_x0, thus the signature is going to be σ=f_Sx0(α),V_x0,auth_x0  where auth_x0= f_Sx(V_x0) ?

Q4: In SPHINCS, can we assume that all private keys are also generated with the same G(1^n) ? and thus we are always going to generate the same private keys given the same seed? Thus the “stateless” came from?

Thank you very much


texts: Why is PuTTYgen-created RSA public exponent(e) not in {3,17,65537}?

texts:
As far as I know, RSA public exponent(e) should be one of {3,17,65537}.
However, I found PuTTYgen-created RSA public exponent(e) is 0x25(37) by default,as follows, (PuTTYgen version: 0.66)

I am curious why PuTTY uses 0x25(37) instead of 0x10001(65537), and does 0x25(37) offer adequate security?


texts: What's up with unnamed elliptic curves in e-passports?

texts:
At my work I deal with the cryptographic aspects of the international E-Passport specification (the crypto chips embedded in your passports, the kiosks at airports that talk to them, and the certificate authorities that issue their certs).

The relevant standards document is BSI TR-03110-3.

Section A.2.1.1. Standardized Domain Parameters provides a list of NIST and Brainpool curves that are allowed. Cool. Section A.2.1.2. Explicit Domain Parameters provides a mechanism for you to use any domain parameters you want.

My question is: Are they on drugs? Coming up with safe domain parameters is non-trivial. I suppose some countries' passport offices have cryptographers on staff who know what to look for in parameter generation, but not all. That seems like an awful lot of rope to hang yourself with for no real gain. Can anyone shed more light on why they would allow this?


texts: Security implication of concatenating two hashes using different algorithms

texts:
Background
Hashing files is an expensive thing for CPU. I am tasked to write a secure digital signature scheme. For that, I decided to check the integrity of files using Hash/Digest.
To be more secure, my plan is to use two or three hashes instead of one. Rough diagram looks like following.
Generating Hash which will be signed by a private key
[plain.txt] ---- algoX ----> [sha512(plain.txt) + sha256(plain.txt)]
Verifying Hash
Calculate sha512, sha256 of plain.txt and verify it by matching with the output of algoX. Verify is OK if and only if all hashes match.
Postscript
I know that it is as hard as most difficult hash, but will it yield significant security improvement keeping in view the expense of hash calculations.
What are possible attacks which can be carried out against this type of scheme?


texts:
Is it possible to deduce the original function that used to generate those prepaid cards number that are used for charging your mobile phone credits?

For example: If I've collected about 1000 of those cards, how can I analyze those numbers so that I can re-generate the generated numbers again using my own software?


texts: In DGHV FHE, why noise $r$ can be in $(-2^{\rho'}, 0)$?

texts:
"Fully Homomorphic Encryption over the Integer" described a simple FHE scheme based on the GACD assumption. Its encryption function (on page 6) has the form $c \leftarrow (m + 2r + 2*\sum_{i \in S} x_i) \mod x_0$, where $\sum_{i \in S} x_i$ can be viewed as some ciphertexts of plaintext 0 (which can be divided by the secret key $p \in 2\mathbb{Z}+1$), and $r$, as the paper informed us, is randomly chosen from $(-2^{\rho'}, 2^{\rho'})$.

Decryption is taken by $m' = (c \mod p) \mod 2$.

It seems that "mod p" is used to drop $2*\sum_{i \in S} x_i$ and "mod 2" is used to drop $2r$.

If $r > 0$, the item $2r \mod p$ is even. It will not change the parity of $c \mod p$.

However, since $p$ is odd, for any $r < 0$, the item $2r \mod p$ in fact equals $p + 2r \mod p$, which is odd and will change the parity of $(c \mod p)$. I have programed for this algorithm and the result matchs the observation above.

What's the mistake of my reasoning and/or my understanding?


texts: Ways to protect flash player against MITM diffie hellman

texts:
We have a server, which sends content encrypted with AES128 or RC4 to a flash client over an insecure HTTP channel. The encryption key is negotiated using Diffie Hellman.

The problem:

Diffie Hellman can be MITM-ed.
flash client can be easily reversed (can be obfuscated though), so if I use a hardcoded key, it can be easily retrieved

Is there any way to strengthen the weakest links, in this case, the key exchange and the flash client?


texts: How to evaluate the security of a certain encryption method?

texts:
I've been slinging code for a while now, but relatively new to encryption/security. What should I look for when evaluating an encryption method in the wild?

For example, the Standard File protocol supports E2E encryption. It's implemented here: https://github.com/standardnotes/web/blob/6fd5719/app/assets/javascripts/app/services/encryption/crypto.js

To my untrained eyes, that looks reasonably secure. How could I spot red flags? For example, is splitting a key in thirds a good idea?

I'm not asking about evaluating this specific library, rather, patterns or resources I can use to determine security. One idea that comes to mind is placing a public bounty as a challenge to break the encryption. Telegram did this with a $300k bounty.


texts: Can we do modulus switching for number theoretic encryption?

texts: Can we do modulus switching for number theoretic encryption such as Paillier or ElGamal?


texts: Why are some group representations much easier to compute discrete logarithm for?

texts:
The multiplicative group mod $p$ is isometric to the additive group mod $p-1$, yet computing discrete logarithms in the additive group is easy and completing discrete logarithms in the multiplicative group is usually hard.

What is it about group representation that makes group representation matter so much for the complexity of computing discrete logarithms?


texts: RSA public key same across all clients or different?

texts:
I understand that public key is a pair of $(e, N)$ where $N$ is product of two primes and $e$ is encryption key.

I understand that $N$ is usually unique for an entity. For example, Facebook, Google, etc. have $1028$ or $2048$ bit $N$ that they publish.

What about $e$? Is it also unique or do these entity give different $e$ to different clients/customers? Does it changes from one session to other for same client?


texts: How to prove membership of a list without disclosing the list members?

texts:
I'm designing a messaging system where the sender A sends a message m with a signature s to n Receivers.

A Receiver Ri should then be able to prove to a Verifier V that he is one of the receivers of the message without disclosing m and the identity of the other receivers. He will however disclose A and Ri.

Question: how could this be done ? What must A store along with m and sign with s for this to be possible ?

The solution I have now is that A would computes hash(m) and hash(A || Ri || hash(m)) for each receiver Ri. The signature s uses a hash computed over all hash values and nothing else. All these hash values are then send along with m and the signature s to all receivers.

To prove that a receiver Ri is member of the list the receiver sends to the verifier A, all the hash values, s and Ri. The verifier can then verify the signature s and that hash(A || Ri || hash(m)) is in the list of hashes of the receivers.

This solution uses hashes to obfuscate the identity of the receivers and the message.

Is there another solution which would not need to generate and send the list of hashes ?

Is there a risk that something could be deduced about R2 knowing A, R1, hash(m), hash(A || R1 || hash(m)) and hash(A || R2 || hash(m)) ?  I guess no if the hash is secure.

Edit : As signaled by poncho this proposed solution is not optimal because the Verifier could easily test if R2 is member of the list. Prior knowledge of potential members of the list would then expose their presence.

Another solution I found that solves this problem, but is unfortunately very inefficient, is for A to generate random numbers and encrypt them with the public key of each receiver Ri. A would then sign the list of encrypted random numbers and sent both with the message to each receiver.

With its secret key, a receiver can decrypt the random number and pass it to the verifier. The verifier can then encrypt the random number and check that the encryption matches the one found in the list and signed by A.

This algorithm is very bad in term of computation complexity for A and in size for the message m. But this proves at least that one solution exist.

Apparently the principle of accumulators would be the way to go. Here is a reference article on this subject: http://www.cs.stevens.edu/~nicolosi/tech-reports/FaNi00.pdf which could be of interest.

Edit 2: Following David Cary's which is technically valid, I must make clear that A (Alice) can't interact with the verifier V. The reason is because the verification process is very infrequent compared to the sending process. Also the verifier's role is strictly limited to verification. It doesn't relay the message. Thus Ri must be able to prove that it is one of the receivers as stated by A by only using information sent along with m.

The only viable solution I found so far is for A to send a list of random numbers, each one encrypted by the public key of one of the Ri. A would sign the list of encrypted random numbers. Each Ri can decrypt its random number and can use this knowledge to prove its identity. Because the numbers are random and encrypted with public key, the identity of the other receivers is perfectly sealed.

Unfortunately it requires one public key encryption for each receiver of each message. This is expensive in processing time and in amount of data to transmit along with the message m.


texts: Is an equality test possible when using paillier crypto?

texts:
Given two ciphertexts $c_1=Ek_1(p_1)$ and $c_2=Ek_2(p_2)$ encrpted by two different users with two different keys, i.e. $Ek_1$ and $Ek_2$ using a homomorphic crypto such as Paillier. Can a third party perform an equality test on $c_1$ and $c_2$ without knowing the keys?

As for my research efforts…

I read few papers on equality tests, and homomorphic encryption. However, in those papers almost all the scenarios are like when a client upload its encrypted data on the cloud and then search an encrypted keyword on it. In my case, I have a shared table of cipher texts and i have to find common attributes among the cipher texts encrypted by different clients stored in shared database. whereas normally comparison is made on cipher texts encrypted by a single client and done by the owner of the data.


texts: Self-synchronizing cipher recovery from dropped bits

texts:
This cryptography book says:

  There are also asynchronous or self-synchronizing stream ciphers,
  where the previously produced ciphertext bits are used to produce the
  current keystream bit. This has the interesting consequence that a
  receiver can eventually recover if some ciphertext bits are dropped.

CFB is an example of a self-synchronizing cipher. What does this mean that it can "eventually recover if some ciphertext bits are dropped"?

This is the equation for CFB:

$$
C_i = E_K (C_{i-1}) \oplus P_i
$$

There are 4 variables. I don't see how you eliminate more than two such that the receiver knows all but one and deduce the only unknown variable.

The receiver knows $k$. The receiver knows $C_i$ or $C_{i-1}$, but not both since the situation we're considering is "some ciphertext bits are dropped". The receiver does not know $P_i$ since it's the receiver and it's trying to decipher.

What am I misunderstanding?


texts: Showing a generator based to pseudorandom function is also pseudorandom

texts:
First of all sorry for the bad title, this is an exercise I'm struggling with:
Let $F_k$ be a pseudorandom keyed function (abbreviated to PRF) with key, input and output of length $n$.
Define the following generator $G$ with expansion factor $n^2$:
1) Let $s \in (0,1)^n$ be random seed.
2) Set $x_0 = 0^n$
3) For $i=1$ to $n$, set $x_i = F_s(x_{i-1})$
4) Output $x_1 \cdot x_2 \cdot ...\cdot x_n$
I need to show that $G$ is pseudorandom generator (PRG).
The reduction is pretty obvious, I build a distinguisher $D_F$ for $F$ by using a distinguisher $D_G$ for $G$ in the following way:
Given oracle access $O(.)$ to some function, $D_F$ queries the oracle to compute $X=x_1 \cdot x_2 \cdot ...\cdot x_n$ as defined above, gives it to $D_G$, and returns whatever $D_G$ returns.
A hint is given, and says that in the analysis one should take into account the possibilty that $f(x_i)=f(x_j), i \neq j$ where $f$ is a truly random function.  Why is that matters? If the aforementioned event occurs, does it causes $X$ not to be a truly random string for $D_G$?


texts: Is there any way to check hash of homomorphic encrypted data?

texts:
I need some algorithm that satisfies:

H - hash function
Enc - encryption function (using public key)
M - secret data
$Enc(H(M)) = H(Enc(M))$

Let this system exist: the First person has a secret data $M$, he publishes hash H(M) so everyone knows it. He encrypts data with public key of the second person and publishes it, so second can get and decrypt it. But the third person needs to check if the published hash is a hash of data that was encrypted and sent without knowing the data.


texts: Strange modular expression in paper on group signatures

texts:
I've come accross the following expression in a paper:

$$A_i=(C_2 * a_0)^{1/e_i} \bmod n$$

How to calculate $1/e_i$ in modular arithmetic?

Or does it have some different meaning that I do not know?

The paper is "A Practical and Provably Secure
Coalition-Resistant Group Signature Scheme" by Giuseppe Ateniese, Jan Camenisch, Marc Joye, and Gene Tsudik", on page no.9, step 4 of JOIN.


texts:
When a receiver is verifying signed message, it has all the public keys of possible senders.

Sender

$S(M)$ denotes signed message $m\in M$, private key $s$, and public key $p$ giving us:

$(m, \ s_i, \ p_1, \ p_2 \ , ... , \ p_n)$

Receiver
Verifies the message using:

$(m, \ p_1, \ p_2, \ ..., \ p_n )$

I am a little bit confused. How are these keys reconciled?

When validating the message, does the receiver try each public key one by one?

If the receiver has to conduct an exhaustive search, does it mean the receiver knows the exact public key used to validate the signed message?

Does knowing the public key mean knowing the owner of the private key?

How can a receiver know who signed the message?


texts: Nature of risk(s) from KeeChallenge XML file stored in cloud at Onedrive

texts:
As a noob user of KeePass2 on Windows desktop and Keypass2Android  on my phone, supplemented by YubiKey Neo configured for hmac-sha1 challenge response, I noticed that Keepass2Android appears to store an xml file on Onedrive (at least it looks that way to me).

So I'd appreciate any shared insight on:
1. the nature/extent of risks arising from storing the encrypted kdbx database file along with the xml file (from Keepass2Android??) on Onedrive, and
2. any practical means for a regular user like me to mitigate those risks?

Background/context is that Keepass2 on my laptop is configured to sync the kdbx file (that's stored on my laptop) with an instance stored on Onedrive; and when not at my desktop, I use Keepass2Android on my phone to 'open-up' the sync'd kdbx file on Onedrive to check passwords etc.  Thanks in advance.

P.S. As Onedrive doesn't appear to support Yubikey 2FA, I assume that c/b a relavent factor.


texts: If 1 can be a random number in Diffie-Hellman Algorithm

texts:
I've done some calculations and Diffie-Hellman Algorithm worked for all chosen random numbers except $1$. In the description of the algorithm, I can't find information that the random number has to be higher than $1 (r>1)$.

Could you explain to me if I made a mistake or where I can find information that $r$ cannot be $1$?


texts:
What is more important, in terms of security, the size of the MAC or the size of the key that it uses? I'm asking this because I have to answer the following homework question:

  What is more secure? A MAC with a 12-byte key and 6-byte MAC length,
  or a MAC with a 8-byte key and 12-byte MAC length?

For the first one, it's easier to find a pre-image of the result. But for the second one, it's easier to find the key.


texts: Cryptographic hash with ability to ignore specific bits based on a hidden pattern?

texts:
I'm looking to use password-style hashing to validate an environment, where some parts may be irrelevant. For example:

requirement = 0b1010
pattern = 0b1011
mask( a, b ) = a & b
hash( a ) = <any cryptographic hash>
condition = hash( mask( requirement, pattern ) )

# public
environment = 0b1110
hash( mask( environment, pattern ) ) == condition
-> true

So for the requirement 0b1010 and pattern 0b1011, both environments 0b1010 and 0b1110 would match (though typically there would be many more possibilities, since I expect only a small proportion of an environment to be relevant for a particular test)

The pseudo-code above would accomplish my goal, but it requires the pattern to be available in plain-text (since it must be applied to the given environment directly). The final check is performed publicly, and I would like to hide the pattern at this point, i.e.:

mask( a, b ) = ???
hash( a ) = ???
encryptedPattern = ???
condition = mask( hash( requirement ), encryptedPattern )

# public
environment = 0b1110
mask( hash( environment ), encryptedPattern ) == condition
-> true

The ultimate brute-force approach would be to generate salted hashes for every matching environment (doubling-up some possibilities to hide the information about how many bits the pattern masks out) and test them all in-turn, but clearly this isn't practical once more than a few bits are considered irrelevant.

I haven't been able to find anything on hashes constructed to have deliberate collisions, or accept ranges, and I don't believe it would be possible to retain positional information through a hash while maintaining irreversibility. At the same time, this feels like something which has probably already been studied, and I'm just missing the relevant terminology to find it.

Is there any existing work on this type of check, or methods which could be extended to support it? Alternatively, is it provably impossible?

For context, my eventual plan is to extend this by checking hash( mask( hash( environment ), encryptedPattern ) ) == hash( condition ), and use the unhashed condition (which would only be available by getting the "password" correct) as a key to decrypt other data.


texts: New model to convert two bits of data to each other

texts:
In during of my study between Geometry and Cryptography I found a new model to convert any two data to each other in other word let we have two data $A$ and $B$ such that each other consist of $n$ bits. There exit a invertible transformation $T_{(A,B)}$ such that $T_{(A,B)}(A)=B$.
I modeling this transformation in geometry (permutation is a particular of this model). now i follows that to some application for this modeling to use in Cryptography because convert plaintext to ciphertext needs to design an algorithm.

Do you have any information to help me?

Thanks,


texts: Data masking / Data obfuscation for string int float and date , preserving order and exact matches

texts:
I've to mask data into some different value but to keep their property such as order an exact match (substring is yet impossible)

What's the state of the art in data masking? I've some data on which I want to perform a search but I can't use the data as they are. the data type are standard data types, that is, string int float date/datetime/time boolean

For exact matches, I can use a key derivation algorithm, such as pbkf2. it's ok, a bit of overkill for things as integer and float I guess, no? anything better and maybe faster?

However, the real problem that I've is how to have a way to preserve the order. One thing that came to my mind is to add a random value to the original value that is then also added to the value of the search, example: (value:5) 5->10, 4->9 .. trivial but should change the data in a way you have to know some initial data to reconstruct the others. Yet, it's very trivial. is there anything better and more advanced?

For string, substrings matches are rather impossible (homomorphic encryption is still a thing of the future), but is there anything I can use or study as a technique?


texts: What are the differences between a UHF (as used in cryptography) and a cryptographic hash function?

texts:
After reading about UHFs from different sources (From Algorithm books to Crypto books), I am still thoroughly confused about them.
How is a UHF different from other cryptographically secure hashing functions? Is the only difference that it's a keyed hash function while other secure hash functions need not be keyed?
Also, Boneh defines a UHF as a keyed hash function which satisfies a very weak notion of collision resistance and he goes ahead he defines this notion by saying that the adversary must not be able to find a collision with no information about the key at all. Other than the mention of the key - this seems similar to the adversary having to find a collision where he can pick both m1 & m2 such that there is a collision. If the user can pick both messages to find a collision, then Christof Paar defines that as strong collision resistance rather than weak collision resistance. Paar's definition of weak CR is that user is given m1 & it's tag & he must find a m2 with a collision.
So I am confused here about a couple of things

Is UHF just a cryptographically secure hash function which is keyed?

What Collision Resistance property does a UHF need to possess - Weak or Strong CR & how do you define that type of CR?


texts:
Imagine that we're trying to create a function to generate a random string conforming to a user-supplied alphabet. That way, users can generate random strings with given characters. Something like:

string random_string(int length, string alphabet)

Now, the alphabet could be any combination of characters from length 2 to 256. So, to generate hex characters, you'd pass the string "0123456789abcdef"...

So the question at hand is which is the better unbiased method to generate the desired random data, assuming a stream based full-byte random source (/dev/urandom, etc)...

Base Conversion

First, we compute how many "bytes" we need from the stream:

int bits_per_block = floor(log(strlen(alphabet), 2) + 1);
int bytes = ceil(length * bits_per_block / 8);

Then, fetch randomness from the stream up to the required number of bytes, and store it in a "buffer".

Now, walk the buffer and do a numeric base conversion between 256 and the destination base. Then substitute the destination base for the characters from the alphabet. That's it.

Note that you'd need to convert the entire random buffer, and then cut off the most significant part of the result to size it properly (because the ceil call can cause it to over-generate). This is good, because it means that every generated character of the result will be unbiased.

This has the advantage that you're always fetching a known amount of randomness, up to a maximum of 1 extra byte.

It has a disadvantage that it requires twice the memory (one for the buffer, and one for the return), and that it's fairly complex (base conversion is not trivial).

Here's a sample implementation in PHP of the base conversion algorithm, and here it is in action.

Value Picking

This is the standard integer generation algorithm. Basically, we'd have an algorithm like:

character generateByte(string alphabet) {
    int len = strlen(alphabet);
    int max = 256 - (len % 256);
    do {
        int byte = get_random_byte();
    } while (byte > max);
    return alphabet[byte % len];
}

Note that the max ensures that the maximum generated int is divisible by the len parameter. So if we were generating into base 10, max would be 250, and byte % 10 would therefore be unbiased.

It has the advantage that it's a lot easier to implement. But it has a disadvantage that it could not terminate, or use a LOT of randomness to generate a string, especially for some odd bases...

So, is the Base Conversion an appropriate route to take? Or should we stick with the "value picking" approach?


texts: Decently safe amount of AES key derivation?

texts: I am encrypting my computer using Veracrypt. The default 500,000 derivations is quite slow, what would a "safe" balance be between security and speed? My password is more than 20 characters.


texts: Does High Frequency Randomisation of valid and dummy messages in a high volume channel add security?

texts:
This was originally posed as this question: "Does randomisation of valid and dummy messages in a high volume channel add security?"

But due to the reformulation based on answers provided, Tylo (https://crypto.stackexchange.com/users/4082/tylo) suggested it be posed as a new question.

Note that this question is possibly more communications management rather than true cryptography.

Scheme: valid messages in a high volume comms channel are identified by a pre-shared random number sequence interspersed with a large volume of random noise messages. These are ignored by the receiver but can be used to consume the resources of an attacker regardless of the attack mechanism/approach.

Any such arrangement using high volumes of noise must allow the receiver to ID valid messages. A truly random pre-shared number list would appear to be superior to any other sequencing.

Mechanism: Controller A has different RNG'd lists for each of his field agents B to Z. Controller A wants to send a msg to B. He looks up B's list and the next number on that list is 527. He sends 1000 msgs marked to B's attention. All are random noise but msg 527 which is encrypted with the key that A uses to contact B.

B captures all 1000 msgs and decrypts only msg 527. The attacker must attack all 1000 msgs, does not know who the msg is sent to, has 25 different keys to attack (25 agents) and only 1 real message encrypted with 1 real key per 1000 msgs.

For B to contact controller A he looks up his RN list and sees that 641 is the next number. The procedure is the same as A contacting B but made more complex by B using the key that only he uses to contact A. Now the number of keys is 50.

Since the number lists sequencing this traffic are truly random and
cannot be cracked and are never contained in ANY msg or disclosed in any way, then this seems to me to be a useful form of deception that just made the attacker's task 1000 times harder based on volume and 50 time harder based on key variation on top of any decryption difficulty for each key.

Questions: Is this interpretation basically correct?
Is the scheme practical or useful? When used as a mechanism for radio contact it would seem to provide one of the most powerful protections possible: not knowing who is a message receiver (as opposed to someone physically logging in from somewhere to open an email), not knowing if a message is a message, and not knowing any key.


texts: Adding the key in the first state of keyed sponge-based hash function

texts: What are the advantages to add the key in the inner or outer part of first state in keyed sponge hash functions?


texts:
What both parties have:

Server
Master Secret (MS)
Server supported versions (Svers)
Agreed upon version (ver)

Client
Master Secret (MS)
Client supported versions (Cvers)
Agreed upon version (Ver)

What I am planning on doing:

Client sends Cvers to Server.
Server checks what version to use (the highest version the 2 share will be selected)

then computes

Rand = Generate crypto random number
SessionID = SHA256(MS, ver, Rand) "<- though the hash will most likely be dependable on the selected version"
SessionKey = KDF(MS, SessionID)
EncryptionKey = KDF(SessionKey, Rand)
IV/nonce = Generate crypto random number

Server sends message to client: SessionID, Ver, Rand, IV/nonce
Client checks if the returned version he got from the server is actually a version he has (just to be sure). Then the client computes:

SessionKey = KDF(MS, SessionID)
EncryptionKey = KDF(SessionKey, Rand)

If we were to need an extra key (for HMAC) we would simply send over an other random number.

Then finally the client would create a random message and encrypt this message in the propper way according to the selected version. It would send this random message and the ciphertext to the server, the server will either decrypt it or do the same as the client and compare the results. If the results match it will send an OK message back to the client and the communication can commence.

I have a few questions regarding this:

Obviously, is this secure?
Do i need the session key or can i derive the encryption key directly from the MS? (provided the Rand is different each time)
Is the generation of the SessionID ok this way or should a simple random number suffice?
Should the client create a random message and send this over in plain text or should both the server and the client have a message which is 'hard coded' and always use that (it will be the same every session).

I hope it is ok to ask these kind of questions here.

Disclaimer
Lets start of by saying, yes i know making an own protocol is bad mkay. I have discussed this (at length) with my supervisors but (they made a 'fair' point) there is no TLS implementation small enough that can fit on our devices (not much remaining code space). So here I am implementing (it hurts saying this) my own small TLS-ish protocol.

Also, the versions do not correspond to TLS, version 1 might be AES-CBC version 2 might be AES-GCM version 3 might met TDES-CBC (etc.)


texts: On the initializaton of the "xorwow" PRNG

texts:
In the original paper, Marsaglia defines the xorwow() function and gives some example values for the initial state of $x$, $y$, $z$, $v$, $w$ and $d$. But it is not clear to me, how these values have been chosen, or how they can be "randomized" from a seed. The paper doesn't go into detail here. Wikipedia has a slightly different xorwow() code  (should be equivalent, I think), but again doesn't say how to initialize the state - except that "the state array must be initialized to not be all zero in the first four words".
So, it is "safe" to initialize all 6 state variables with completely random data, e.g. taken from  the operating system's entropy source? Or do any of these variables need to be initialized in a specific form to get "good" random numbers? For example, did Marsaglia choose some "magic" values that perform best? Also, what about the counter $d$? Should $d$ even be randomized?


texts: What's the difference between block ciphers and symmetric-key encryption?

texts: Both block ciphers and symmetric-key encryption use a secret key to transform plaintext into ciphertext, and do so in a reversible manner. Are they the same? Or does symmetric-key encryption also includes things other than block ciphers?


texts: Is 80 bits of key size considered safe against brute force attacks?

texts:
I came across the KATAN family of ciphers for small domain input blocks. They cipher arbitrary block lengths: 32, 48 and 64, but their key size is 80 bits only.

Is 80 bits of key size considered safe against brute force attacks with current state of the art processors?


texts:
Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$.

Would it be possible to get to $M_1$ or $M_2$, given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$, if the underlying hash function $\operatorname{H}$ or MGF $\operatorname{G}$ used in this instance of $\operatorname{OAEP}$ is found to be broken (invertible)?

Thanks.


texts: Endomorphism ring of a Elliptic Curve and $j$ invariant

texts:
I am reading Schoof's 1995 paper, Counting points on elliptic curves over finite fields, page 236, Proposition 6.1(i). I am trying to understand page 238 (second paragraph) of the proof: if the conductor is $1$ then $j$ invariant is $0$, or $1728$.

In Silverman's book, The Arithmetic of Elliptic Curves, Section III.10 on page 103, a relation between the Automorphism Group and $j$-invariant is given.
Is there any relation between the endomorphism ring of an elliptic curve to the $j$-invariant? When $j=0,1728$, how does the endomorphism ring look?

If the endomorphism ring is equivalent to the maximal order of the field, why is the $j$ invariant equal to $0$ or $1728$?

I know that given $E: y^2=x^3+Ax+B$, if $A=0$ then $j=0$ and if $B=0$ then $j=1728$. The endomorphism ring will be isomorphic to an imaginary quadratic field if $E$ is ordinary and to a quaternion algebra if $E$ is supersingular.

Please help me to understand the relation between the endomorphism ring and $j$ invariant.


texts: Format Preserving Encryption - Generating coupon codes

texts: If I use cycle FPE with AES to generate 20 digit coupon codes, what is the probability that an attacker could generate a valid coupon?


texts:
I would like to start by saying I know nothing about Cryptography and was reading up on how to choose a random seed and this link is something that I found. What I basically understood that the seed has to be sufficiently random that guessing the seed would be hard.

So the question is would the hash of a Tweet, at any given time, be a good candidate for a random seed? This is mainly because the content of a Tweet can be practically anything as it's being generated by a huge percentage of the world population.

That said, I understand it is possible to game it by mass tweeting a specific string continuously from multiple accounts flooding the tweet stream with predictable seeds. So if this can be mitigated by blacklisting the bad usernames, is using tweets for seeds a viable option?


texts:
I came across this question with this answer about a cryptographic timelock-puzzle that needs approximately 30 years to be solved. There is also an explanation with source code for that puzzle available here and here. All of this looks very similar to RSA. My first question is: In which ways does this differ (or not differ) from RSA?

I also heard of conditions that have to be true for the chosen prime numbers in RSA to guarantee security. In the (old) source code the program just looks for the next prime number it can find. Are there any conditions for prime numbers in RSA? If so, could I implement these myself or should I use already existing code?


texts:
I found an algorithm to find the frobenius coeffs here.
Here, the non_residue of BLS12-381 is -1,
And non_residue of BLS12-377 is written -5.
How can I find this value?
And what is the non_residue value of BN462?


texts: The exact difference between a permutation and a substitution

texts:
I've noticed confusing definitions about permutation and substitution, preventing me from understanding the difference.

A permutation changes the order of distinct elements of a set, but this can be written as a function changing one element by another, exactly as a substitution.

So, how exactly can we distinguish between these two notions?

This question is interesting since we have these two notions in block ciphers, in which S-boxes perform substitution. The problem is that this table is used to replace one element by another, exactly like a permutation.


texts:
I have clear text, usually less than 10 bytes, which contains a few infrequently changing bytes.

Reading: http://lollyrock.com/articles/nodejs-encryption/ I tried aes-256-ctr:

The cipher text is as short as the clear text, which is good.
The cipher text contains patterns, at the positions of the infrequently changing bytes, which is bad.

I tried aes-256-cbc:

The cipher text length is rounded up to the nearest 16 bytes, which is bad.
The cipher text appears random, which is good.

Is there a form of AES encryption where the cipher text matches the length of the clear text and does not show patterns?


texts: Is the IEEE 1363.1 standard of NTRU post-quantum secure?

texts:
I have a question regarding the IEEE 1363.1 standard for NTRU with padding, which offers CCA security. Does the IEEE standardized implementation offer post-quantum security as well?

Also, what are the major differences between the IEEE 1363.1 NTRU standard vs. the NTRUEncrypt NIST PQ submission here: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Round-1-Submissions

Or, is the NTRUEncrypt submission to the NIST PQ competition exactly the same as in the IEEE 1363.1 standard? Is there a difference in the parameter sets to enable PQ security vs. the parameters in IEEE 1363.1?

Is it correct to claim that the IEEE 1363.1 is PQ secure as well?

Thank you!


texts: A feasible approach for AEAD on an ethernet link?

texts:
The setup is shortly this: There are two custom switches (think of an FPGA for example), both are handling 10-100 Gb/s orders of traffic from their outside facing interfaces. This is normal traffic. Then, they have a link between each other. I want to apply AEAD to secure this link, so that an eavesdropper will not be able to analyse the traffic. The restriction is this: The traffic is streaming fast and obviously there is not much time to encrypt or authenticate.

I own both switches, so pre-configuring certificates, symmetric-keys etc. are all allowed. After bootstrapping, I can asynchronously exchange keys in-band, but no out-of-band exchange is allowed.

I am not looking for an unbreakable system, I just want to protect the traffic as much as possible.

What would be the best approach in this case? So far my approach is: I can install certificates to both sides (for authentication), I do not know if or how I should renew them as time goes by. For encryption, I will XOR the plaintext with symmetric keys on both sides (I guess this is the fastest way). However, I consume keys much faster than I can produce. Somehow I should stretch keys or find a way to produce key streams very fast. After this point I get lost.


texts: Is there any way to check signed documents in a group of people without knowing who signed which?

texts:
Let's say there are 3 people A, B, C. Everybody knows their public keys. They sign documents/messages and normally we can know who signed which by checking with their public keys.

Is there any way to check these signatures without knowing who signed which? I just want to know these messages is signed with one of these people.

This method may involve making them sign known messages or making some preparation before the signing process. I am just trying to be sure, if the message is sent one of these people with electronic signature without knowing the identity of the sender.


texts: How can user privacy be preserved in certificateless cryptography?

texts:
In certificateless cryptography, how can a user preserve his privacy from Key Generation Center? If the KGC becomes malicious, how can the user's privacy be preserved?
I read "Privacy-Preserving Decentralized Key-Policy Attribute-Based Encryption, IEEE transaction on distributed system."

  In a privacy-preserving decentralized KP-ABE scheme, the authorities do not know the user’s GID nor can cause failures using the information of the GID.

And in Section 2.3:

  The global identifier could be the user's ID Card Number or Social Security Number.

I am thinking as follows :

While practically, At the time of doing registration at Decentralised authority or KGC ,user will provide his unique ID (like user's ID Card Number or Social Security Number which is Global Identifiers)
Now, Decentralised authority or KGC have user’s Global Identifier .

My questions are:

How the above statement is different from stated one? According to Section 2.3: "In a privacy-preserving decentralized KP-ABE scheme, the authorities do not know the user’s GID nor can cause failures using the information of the GID."
Please explain me Blind key generation algorithm

In this paper BlindKeyGen Algorithm is stated.

I don't understand exactly how user's privacy will be preserved?


texts: Can someone explain the timing attack on RSA with Montgomery multiplication?

texts:
I have read several articles on the temporal attack against  Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle.

I understood that there is a  additional reduction when performing Montgomery multiplication when the multiplication is greater than the modulus.

What I don't understand is how to choose the message sets. Or how to go from one key bit to another. And how many messages should be taken for each bit.

Edit : i'm still wondering on how we get the two sets of messages. The first set should not include a reduction in contrary to the second set. How can we know if there is a reduction or not ?


texts: Establish a secure connection between a Bluetooth Low Energy device and an Android App using ECDH

texts:
Im very new to security and trying to learn how to establish a secure connection between a android application and a Bluetooth Low Energy device with limited hardware performance.

The procedure:

App:

Generate private/public keys with ECDH Key Pair Generator and elliptic curve spec "sect163k1" using java.security.* (https://gist.github.com/ymnk/fec39e033394ee2ec47c)
Send public key to BLE Device
Generate secret master key from apps private key and the public key from the BLE Device using ECDH (https://docs.oracle.com/javase/7/docs/api/javax/crypto/KeyAgreement.html#generateSecret())
Store secret master key in database. (never shared)
Encrypt data with secret key using AES/CBC with integrity (using https://github.com/tozny/java-aes-crypto)
Send data to BLE Device to be decrypted with the device secret master key

BLE Device:

Generate private/public keys with ECDH Key Pair Generator and elliptic curve spec "sect163k1" (or another curve)
Send public key to App
Generate secret master key from apps public key and BLE Device private key using ECDH
Store secret master key in device (never shared)
Encrypt data with something like EAS/CBC with integrity
Send data over to app to be decrypted with apps secret master key

Would this keep the communication between both parts safe? Second time the connection is established the same shared secret could be used to encrypt the data, in order to improve performance. Its a 1:1 relationship between the device and the logged in account in the app so I could also use the shared secret to verify the right user is connecting to the BLE device.