texts: How to perfrom modular division while numerator is lesser than the denominator?

texts:
I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is

Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the two points.

Point doubling: $S = \frac{(3P_x)^2+a}{2P_y}$ where $P$ and $Q$ are the two points and $a$ is one of the parameters of the curve.

The divisions involved here are modular divisions. I use extended euclidean algorithm.

My question is what if the numerator is smaller than the denominator? In that case can i still use this algorithm? Or is there any other algorithm to perform such modular divisions? Or there is no possibility at all for the numerator to end up smaller than denominator in elliptic curves??


texts: Is the 64-bit blocksize a fatal issue when encrypting TBs of data with Blowfish CBC?

texts:
Crashplan uses 448-bit Blowfish to encrypt the data you send them. The mode used is CBC, keys are multiple use, and IVs are generated with SecureRandom from JCE. Keys are not derived from the password, but are generated randomly. MACs used are MD5 or SHA1.

The more I do research on Blowfish the more it sounds like the 64-bit block size is totally insufficient for the size of the volumes they will be backing up.

I've read that especially in certain modes (like CTR) it is totally insufficient for large streams of data, and can be distinguished from random data after only gigabytes? However, other stuff I've read seems to indicate this isn't an issue if properly implemented.

Would such an attack not apply to Crashplan's implementation?

With this sort of implementation does the 64-bit block size become an issue other than simply being distinguishable from random data after 'x' GB, or would there be greater issues if one were to encrypt say 10TB of data, such as plaintext leaks?

Keep in mind I'm using Crashplan's third option where I generated my own key which is supposedly never sent to Crashplan's servers and the client encrypts all data before sending to their servers. So I don't think transport is an issue? Correct me if I'm wrong.

Another question deals with the Blowfish weak key reflection attack, and is this something I should be worried about? Is there a relatively easy way to check if I'm using a weak key? Or does this just not apply to my situation?

I can make Crashplan backup to a folder on my PC and it seems to encrypt files the same way it would before sending to Crashplan's cloud. I could try to analyze data encrypted with my key if I actually knew what I was doing, but I don't. So, My final question is how would I begin to start analyzing this data if I wanted to try to crack my own stuff or find weaknesses in their implementation? What tools should I use? I'm interested in crypto and would like to learn more.

[This is a follow-up to a question I asked on Stack Overflow.]


texts: Rationale for use of right-shift (rather than rotate) in SHA-2?

texts:
The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a message block. For example, in SHA-256 (using 32-bit words)
$$\begin{align*}
\Sigma_0^{\{256\}}(x)&=\operatorname{ROTR}^{ 2}(x)\oplus\operatorname{ROTR}^{13}(x)\oplus\operatorname{ROTR}^{22}(x)\\
\Sigma_1^{\{256\}}(x)&=\operatorname{ROTR}^{ 6}(x)\oplus\operatorname{ROTR}^{11}(x)\oplus\operatorname{ROTR}^{25}(x)\\
\sigma_0^{\{256\}}(x)&=\operatorname{ROTR}^{ 7}(x)\oplus\operatorname{ROTR}^{18}(x)\oplus\operatorname{SHR}^{ 3}(x)\\
\sigma_1^{\{256\}}(x)&=\operatorname{ROTR}^{17}(x)\oplus\operatorname{ROTR}^{19}(x)\oplus\operatorname{SHR}^{10}(x)\end{align*}$$
with $\sigma$ functions used in
$$W_t=\sigma_1^{\{256\}}(W_{t-2})\boxplus W_{t-7}\boxplus \sigma_0^{\{256\}}(W_{t-15})\boxplus W_{t-16}\;\text{ for }16\le t\le63$$
Notations:

$\operatorname{ROTR}^k$ is right-rotation by $k$; it could be implemented in the C language as
uint32_t ROTR(int k, uint32_t x) { return x>>k | x<<(32-k); }
$\operatorname{SHR}^k$ is right-shift by $k$ with introduction of as many 0 on the left; in C
uint32_t SHR(int k, uint32_t x) { return x>>k; }
$\oplus$ is bitwise EXclusive-OR (C's operator ^).
$\boxplus$ is addition with truncation to word size (C's operator +).

There are similar $\Sigma_i^{\{512\}}$ and $\sigma_i^{\{512\}}$ functions for SHA-512, using 64-bit words and different constants.

Question: Is there a reason for the use of $\operatorname{SHR}$ rather than $\operatorname{ROTR}$ in the $\sigma$ functions of SHA-2?

Note: if we used $\operatorname{ROTR}$ rather than $\operatorname{SHR}$, it would still hold that $\sigma$ functions are bijections.


texts:
If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages?

i.e. could an attacker use the plaintext and signature to generate another plaintext which would also verify?

Or do I need to hash the plaintext to provide message integrity?


texts: I want to implement file storage in cloud using homomorphic encryption. I want to use paillier encryption. Can you suggest the drawback of RSA to store and retrieving the files. Then only i can use paillier instead of RSA.


texts: Is there a recommended cryptoperiod for HMAC hashing keys?

texts:
I have an application that receives certain pseudo-random input values and computes their keyed hash using HMAC-SHA256. The hashing key itself is 256-bits long, generated at random by a CSRNG.

Two questions:

Which category does the hashing key fall under in NIST's 2016 Recommendations? Is it a "Symmetric Data Encryption Key"?
If it doesn't fall under any of those categories, is there a recommended cryptoperiod for it, or can I use it ad eternum?

(I suspect that this is an irrelevant detail, but the pseudo-random input values the application is processing are themselves HMACs of other input values. However, they are computed by a third party. So, since I do not know or have access to the hashing key they use, I'm treating them as "pseudo-random.")


texts: How to find a generator g for a large prime p?

texts:
Trying to implement ElGamal. I have a 1024-bit prime p and now need to find a primitive root g for it.
How do you find such a g in an acceptable time? It takes so long, my sage server actually interrupts the calculation.


texts: Key and Message generated on Client, and validated by Server

texts:
(Sorry in advance for my blurry thinking on this: I'm a programmer, not a cryptography expert.)
I have a Client/Server web application. The Client needs to be able to alter the local state in ways that the program's code allows, but should not be able to "open the hood" to tamper directly with code or data itself, and thereby make "fraudulent" changes.
I was imagining that a solution would be for the Client program's code (with no Server interaction at the time of Event generation) to generate a Key for each audit-able Event. The Key would be directly and solely related to the Event itself, and the Client program's code would generate the Key, but it would be very hard to "spoof" the Key/Event pair by an attempted fraudster.
Then, when the Client went to "save" the Event to Server, the Server would use a Private Key to validate the Event. (And, obviously, if the Key didn't line up with the Event, the Event would be disregarded as invalid -- intentionally or otherwise.)
Thanks for any help. I have the vague sense that what I want is already being done commonly...


texts: Why is RSA encryption version 1.0 not specified in an RFC?

texts:
I saw that there are three RSA encryption versions, as follows:

RSA encryption version 1.5 (RFC 2313)
RSA cryptography specification version 2.0 (RFC 2347)
RSA cryptography specification version 2.1 (RFC 3447)

Why is there no RFC for RSA version 1.0?


texts:
I'm in a teacher-like position and would like my students to practice certain classes of RSA attacks. However I don't really know how to go about it and how to sensibly choose the parameters such that they have to practice the attack I had in mind when creating the challenge.

As two very concrete instances of this issue, I'd like to ask for advice on how to choose parameters such that my students have to (or are at least reasonably pushed towards) using

The chinese remainder theorem and / or
Wiener's attack on small-decryption exponent RSA.

So, how does one create RSA parameters to let them practice these two methods?


texts: Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?

texts:
Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every message, they want to append a MAC value to verify their identity.

The question is this:

Should I have a direction flag $D_a$ and send

$$ C:=Enc(D_a, M) || MAC_{K_S}$$

or generate a new key $K_a$ for each participant (for a total of 3 keys in my example) and send

$$ C:=Enc(M) || MAC_{K_a}$$

The second scheme looks more solid to me, assuming static direction flags. Intuitively I believe the two schemes are equivalent if the flags change after each message. Is this correct?

Notes:

When I say they exchange a key what I mean is they agree on some seed and use it to generate a pseudo-random stream using a PRF. For a long enough seed (32 bytes) and periodic re-seedings, I do not see anything wrong with this but any comments would be appreciated.
The encryption method is $C_i:=S_i \oplus M_i$ for some stream $S$.
For two participants generating the same stream, one uses every odd $S_i$ and the other every even $S_i$.


texts: Why does Learning With Errors require a bunch of samples?

texts:
Solving Learning with Errors(LWE) with average case complexity is as hard as solving the SVP with worst case complexity.

LWE requires $n$ dimensional lattice and $m$ samples of it, and Decisional-LWE is form of

$(\mathbf{A},\mathbf{sA+e}) \approx (\mathbf{A},\mathbf{r}) $

My question is why the random matrix is the form $\mathbf{A} \in \mathbb{Z}_q^{m\times n}$ ($m >> n$)?

Is $m=1$ easily solved?

I think in the case of Ring LWE, $m=1$ can work.


texts: RSA: Why must e be relative prime to phi(n)

texts:
I've got a question concerning fields used in RSA.

Let's use the following symbols for my example:

{p,q} = primes
{e,n} = public key
{d,n] = private key

I learnt that an inverse element exists if a is coprime to m.

Applied to RSA I would have guessed that e needs to be coprime to n in order to find it's inverse element, because n is used as mod. But according to the rules of RSA it has to be coprime to ϕ(n) (gcd(ϕ(n),e)=1). Why?


texts: What is a simple information authentication protocol for constrained devices?

texts:
Background: I have an application where devices will poll information from some source on the network.

These devices are very basic and have modest processing and memory capabilities. Hashing (and by extension, HMACs) is doable, but more might be too much.

The information is public, and the devices do not need to authenticate themselves to the source. However, the information must be authentic and fresh.

The protocol I have in mind is that (edited for clarity)

a device would generate an appropriately large nonce, and send it unencrypted to the source. The nonce is never seen before and can not be predicted.
the source would accept the nonce, concatenate it with the information,  generate the HMAC for the result, and then send the result back to the device. Note that the source does not authenticate devices and accepts any nonce sent to it.
the device would check that the HMAC is valid, and proceed to act on the information.

I believe this would provide the required security (Hopefully). However, I would very much rather use a well-known protocol if such protocol can meet both security and hardware constraints.

This leads me to my two questions:

What are the well-known and studied protocols that can meet these constraints?
In the unlikely case that no such protocol exists, what do you think of the protocol proposed in this post?

Any input on this matter would be appreciated.


texts: Algorithm design to verify an assertion on encrypted values

texts:
I'm trying to design some kind of protocol but I'm stuck, need some help please..

Given
$ (a,b,c)\in \mathbb{N}^+$ with $ a + b = c $

I need to send an asymmetric encrypted version of a,b and c though a third-party that must verify that $ a + b = c $ but this third-party can't have access to those numbers, only their encrypted values.

I would appreciate a lot some suggestions.


texts: Using SHA-256 with different initial hash value

texts: FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19.  What would be the risks of using a different value (for example: a random salt)?  Conceptually, this would be the same as prepending the message with a block which hashed (using the normal initial hash value) to the specified value.


texts: How to know the difference between two ciphertexts without key stream in stream ciphers

texts:
If I have two cipher texts lets say $C_1$ and $C_2$ of the same length encrypted through stream cipher technique using the same keystream. Let's say they are:

$$C_1: \texttt{96 C6 A1 08 E7 F2 33 3B 3F 5C AB}$$

$$C_2: \texttt{90 C6 A1 1E E6 F3 31 2B 37 4A B6}$$

$C_1$ is encrypted as ($P_1 \oplus \text{Keystream}$) and $C_2$ by ($P_2 \oplus \text{Keystream}$) where $P_1$ and $P_2$ are corresponding plaintexts.

I am asked to tell how can I differentiate between corresponding plain text $P_1$ and plain text $P_2$ from $C_1$ and $C_2$ as an attacker without knowing the keystream?

So, I think the answer would be since both ciphers are encrypted through the same key stream, they would have similarities where the same plain text and keystream value exists. In this way, I can differentiate the other parts of the plain text. Is there anything more to it?
Thanks.


texts: Implementing PKCS#7 Padding on a Stream of Unknown Length?

texts:
I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know implementing cryptographic methods by hand is generally a bad idea, padding 1-16 bytes of data isn't exactly the hardest thing in the world. Here is essentially what I'm doing:

while True:
    input_chunk = infile.read(1024)

    if len(input_chunk) == 0:
        # if we've reached the end of the file and it _is_ a
        # multiple of 16 in length, pad 16 bytes with the value '16'
        end_of_line = True
        input_chunk += struct.pack('{}B'.format(16), *(16 * [16]))
    elif len(input_chunk) % 16 > 0:
        # if we don't have an input_chunk which is divisible by 16,
        # pad it by the remainder with bytes with the value of the
        # remainder
        end_of_line = True
        input_chunk_remainder =  16 - (len(input_chunk) % 16)
        input_chunk += struct.pack('{}B'.format(input_chunk_remainder),
                *(input_chunk_remainder * [input_chunk_remainder]))

    outfile.write(encryption_cipher.encrypt(input_chunk))

    if end_of_line:
        break

The only problem I'm now having is trying to understand how I'll decrypt an input stream if I don't know its length in advance. The encryption I'll be implementing will actually be used to read a stream of bytes from a socket, decrypting each 'chunk' as it comes across.

How will I know when to trim the PKCS#7 padding? Can I assume that if the last n bytes in the stream are all the same value from 1-16 that I can trim the input after decrypting it? I would assume that this is dangerous and may trim data unnecessarily.

Is there a way to solve this problem?


texts: Does a high exponent compensate for a low degree of certainty?

texts:
If a RSA certificate is created with a low degree of certainty, does the value of the exponent compensate for this?

I'm asking because certain implementations of key generation software hide the certainty value from the administrator, and I'd like to find reassurance in any other parameter.

If the exponent doesn't compensate for this, does a longer key length compensate for certainty?


texts:
Is there any ZK protocol that can be used to prove dependence of two entities. More specifically, if there are x(dependent) and y(independent), is there protocol to prove that x is dependent or function of y, without revealing the function it self.

  Edit: As replies below suggested, I thought to provide concrete form of dependent function. So for example x= 2+y another example can be x=ky, where k is yet another independent variable. In short, x can be even more complicated function of y.


texts:
I am researching about lightweight hash functions and I've got two related questions:

What is the standard or requirement for a hash function in general to be considered lightweight ?
Why can it be said that the PHOTON hash function is lightweight?


texts: would this be classed as a cipher text attack?

texts:
Say i'm given a cipher text to decrypt, however i also have access to a server that performed the encryption; where i could enter
any plaintext and observe the result of encryption.
 would it be classed as a known plain text attack or cipher text? I'm abit confused


texts:
I'm studying this white-paper: http://jessekornblum.com/publications/di09.pdf

The author says that using AES-CCM with the external key (highlighted in green at page 9, figure 4) and with the nonce at offset 0x3662B8 (highlighted in red, figure 5) you can decrypt the data at offset 0x3662D4.

I don't understand how AES-CCM works in BitLocker. Can someone please explain it to me?

I have the following doubts:

The length of IV should be of 16 bytes, but I have a nonce of 12 bytes.
How is the MAC calculated?


texts: How to apply linear cryptanalysis to PRESENT?

texts:
Can someone help me implement linear cryptanalysis of the PRESENT block cipher?
How should I start with 64 bits of plaintext and 80 bits of key?


texts:
I am working is a project that would implement a cipher that would output ciphertext that would be easy to transmit through morse code, just like they did in the days of Enigma.
Use of AES or the likes would of course work, but the downside is that since AES can encrypt 256 different values for each character, the resulting ciphertext would have to be encoded to limited character set to satisfy above requirement, eg to hex using only characters 0-9 and A-F. This will result in ciphertext that is at least twice as long as the original plaintext, so it be harder to transmit.
This got me working on a Enigma style computerized rotor based cipher, with some steroids. This is how I envisioned it would work:

It would have a larger character set of 47 characters ([A-Z][0-9][.+-?!&@:=] (I chose this because 47 is a prime number)
It would have 47 rotors, each with different mapping. Each rotor would have an identifier from the above 47 available characters
for encryption/decryption, 10 rotors would be chosen from 47, but a rotor can be chosen multiple times
Each rotor would step 1-4 times between each encryption, this would be determined by the rotor ID and its initial position.
No deflector, for decryption the cipher would simply be run through the rotors in opposite order. A character CAN map to itself so a big flaw in original Enigma is solved.

So the keyspace would be formed from selecting 10 rotors in random from 47, and setting an initial start position of each into any of the 47 possible positions. So Keyspace would be 47^20 = 2.77E33 or roughly 111 bits. So I suppose brute force attack is infeasible. we would use the key so, that first 10 digits are the chosen rotors, and remaining 10 digits are the initial positions of the rotors (IV).
The actual encryption would work like this. First we generate a random 10 character initialization vector (IV), and encrypt that with the above message key. Then we use the resulting ciphertext (10 characters long) as the new IV for the next 10 characters to encrypt and so on until we reach the end of the message. To decipher, we do this in reverse. We know that first 10 digits are the IV for the next 10 digits and so on.
Example, Plaintext is "HELLO+WORLD+OF+ENIGMA", Message key is "01234567899876543210" (for simplicitys sake, I did not actually run this through the algorythm)

Generate random IV, eg "ABCDEFGHIJ"
Encrypt above with messagekey "01234567899876543210", this results in "KLMNOPQRST", add that to ciphertext
Encrypt first 10 characters of plaintext ("HELLO+WORL") with key "0123456789KLMNOPQRST", this results in "K?+L&KMWI7", add that to cipher text which is now KLMNOPQRSTK?+L&KMWI7
Encrypt next 10 characters of Plaintext ("D+OF+ENIGM") with key "0123456789K?+L&KMWI7", this results in "8/HFP:=JGR", add that to cipher text which is now KLMNOPQRSTK?+L&KMWI78/HFP:=JGR
Encrypt remaining 1 character ("A") with key "01234567898/HFP:=JGR" which results in A, so final ciphertext is KLMNOPQRSTK?+L&KMWI78/HFP:=JGRA

The result is something that would be easy to transmit in morse code, as well as easy to spell over voice radio etc. It only adds 10 characters to the length of the original message.
But how secure would that be ? I know brute force would not be an issue. But assuming the rotor mappings are known, how about more sophisticated forms of cryptoanalysis ? One obvious thing I can think of is that the attacker would know the length of plaintext (=length of ciphertext less 10), but is that really an issue.


texts: What does it mean for an adversary to run in PPT?

texts:
I've been reading this question where a detailed description of mine is given, I've understood that a polynomial-time adversary is an adversary for which the only feasible strategy are those that take polynomial time to run; anyway, I just can't understand why do we require the adversary to be probabilistic.

In Katz' book is explained that this is natural because the honest parties are required to be probabilistic (in order to generate random keys and so on), actually this isn't very natural for me (the fact that the honest parties are probabilistic shouldn't imply we must consider adversaries to be probabilistic too).

Also, they say that this is useful because the ability to toss coins may provide additional power, and therefore if the scheme is secure against PPT adversaries, then is secure against deterministic polynomial-times adversaries.

Please, someone can explain me why is this a valid argument? Thank you very much!.


texts: Is it a bad idea to use PGP encryption for structured/predictable data?

texts:
I'm working on an app and need to encrypt some structured data. The data will be turned into a string form (JSON) before getting encrypted.

The data format I'm using will always start with a { character and end with a } character. Does this make encryption less secure? Are there any methods for more securely encrypting a JSON string?


texts:
Chacha20 is essentially a hash function that maps 512-bit strings to other 512-bit strings which are in turn xored with the plaintext to create the ciphertext. Of the 512-bit input 128-bit are used for the "expand 32-byte k" constant, 256-bit are used for the key, 64 bit are used for the nonce and the final 64 bit are used for the counter.

I noticed that in the eBASH/eBASC benchmarks here and here that chacha20 depending on the architecture the speed for the encryption of a 512-bit message ranges (at least for the 64-bit architectures) from slightly faster to significantly slower when compared to BLAKE2b (if we use it in a mode similar to the one that we use in chacha20 - so 512-bit consisting of a constant, key, nonce, and counter and xor the result with the message) which is a "real" cryptographic/collision resistant hash function based on chacha20 that given a message of any (reasonable) size gives a 512-bit output. BLAKE2b has 12 rounds (each of which if I understand correctly is equal to two chacha rounds).

My question is, how can BLAKE2b be faster in some architectures than chacha20 even though it does more work? I think that BLAKE2b uses 64-bit words rather than the 32-bit words that chacha20 uses, is this one of the causes?

Also, would there be any reason not to prefer BLAKE2b (in what is essentially a CTR mode) for such an architecture?


texts:
Pretty simple question - but I can't seem to find much information about it.

What exactly is a tweakable block cipher?
How do they differ from traditional block ciphers?
What is the 'tweak'?  Is it just a sequence of bytes? Does it have any special qualities?
Are tweakable block ciphers more suited to any particular situation?
How does Twofish (a traditional block cipher) compare to Threefish (a tweakable block cipher)?


texts: How to brute force sqlcipher encrypted file with MD5 hash of a 7 bit key?

texts: I have a database file that is encrypted using sqlcipher and MD5 hash. Sqlcipher to my understanding provides 256 bit AES encryption. The key is 7 bits long. How do I brute force it?


texts: Is $H(k \operatorname\| H(k \operatorname\| m))$ with double length $k$ like NMAC?

texts:
I know that NMAC is mathematically proved with two different keys with length $L$.

But, if I choose to implement a MAC this way: $$H(k \operatorname\| H(k \operatorname\| msg))$$ with a key $k$ of length $2L$, am I vulnerable to some attacks?


texts: Designing a secure protocol to avoid MITM?

texts:
Imagine that you are designing an online game, the framework consists of a player A, a game host H and a trusted central server S.

  The player A has a symmetric key KAS and id A that is known to the trusted central server (these would be set up using a registration key printed on the CD box).

  The host and server have well known public keys.

  The player will connect to the host H and set up a symmetric session key with which to play the game. You want to ensure that only people who have bought the game can play online. Therefore the host H will have to check with the server S that the player A really does have a key.

  Design a protocol that will let A connect to the host H and let H check with the server S to see if A is a legitimate player (i.e., really does have a shared key with S).

  There is only one server but there may be a number of hosts and players. In particular, your protocol should make it impossible for an attacker to wrongly authenticate with a host by intercepting and replaying messages or by acting as a man-in-the-middle.

What I have tried:
\begin{align}
A \rightarrow H&: E_{K_{AS}}[A, n_1], A\\
H \rightarrow S&: E_{S_{pub}}[E_{K_{AS}}[A, n_1], K_{AH}, n_2]\\
S \rightarrow H&: E_{H_{pub}}[\{A, n_2, K_{AH}\}, E_{K_{AS}}[K_{AH}, n_1]]\\
H \rightarrow A&: E_{K_{AS}}[K_{AH}, n_1]\\
A \leftrightarrow H&: E_{K_{AH}}[game play]
\end{align}

Am I somewhat on the right path here, or did I miss anything important?


texts:
I don't understand how we could bruteforce a symmetric cipher.
Let's take AES with a key size of $128$ as an example. It means that there are $2^{128}$ possible keys, and as many ways to decrypt a ciphertext $c$. Given that there are so many different keys, it is theorically possible to decrypt $c$ into multiple plausible messages (e.g. message that read like english). So while we are bruteforcing $c$, if at some point we obtain a plausible message we can't tell for sure that we found the good key because there are plenty of other plausible messages that we haven't found yet.
It's not like with hash functions or asymmetric ciphers, where we have a way to make sure that we found the good antecedent/private key.
So I don't understand what they mean in this article: https://en.wikipedia.org/wiki/Key_size
For example:

For instance, Triple DES was designed to have a $168$ bit key, but an attack of complexity $2^{112}$ is now known (i.e. Triple DES now only has $112$ bits of security, and of the $168$ bits in the key the attack has rendered $56$ 'ineffective' towards security).

Even if Triple DES only had 50 bits of security, we would still be able to decrypt multiple plausible messages that are not the original message, let alone the case where the original message is gibberish and not necessarily natural language. I feel like the notion of "security level" is not the same for hash functions/asymmetric ciphers and symmetric ciphers. For both, it refers to the subset of the antecedent/key space that we know the good antecedent/key is in, but for the latter, we can never be sure that we have found the good secret key, and thus that we bruteforced successfully.
Could you explain it to me please? Thank you for your help.


texts: Does chaining random number generators lead to loss of randomness?

texts: Assume you chain random number generators, i.e use the result of one PRNG as the seed for the next. What kind of errors can that introduce in the randomness of the numbers generated?


texts: A question about RSA key generation algorithm

texts:
I'm fairly new to this stuff so be forgiving. I'm trying to learn how RSA works,
My resources for the manner of sake:

this video
this wikipedia page

This is what I got so far:
since
$m^{phi(n)} \equiv 1 \bmod n$
as long as $m$ coprimes to $n$.
So eventually:
$m^{k * phi(n)+1} \equiv m  \bmod n$
Now we construct $e$ and $d$:
$k*phi(n) +1 = e * d$
$e$ is selected so that it coprimes with $phi(n)$
I have 2 questions:

Since $m$  can be anything (this is the encrypted content right?), how do you verify that $m$ and $n$ coprimes, as needed for the Euler's theorom to work?

Why do $e$ needs to comprime to $phi(n)$ ?

Thanks!


texts:
We all know the OTP is unbreakable and we all love the OTP (judging by the amount of question on this site).

The strength of the OTP is not that it is unable to find a word without the key but you can find any word. Now obviously if we could create a cipher which output would be only letters and several keys would output several grammatically correct sentences (or what ever output you would expect to be a valid output). But is such a thing possible?

I find it odd the OTP is the only one with this characteristic. If we would take AES with a 128 bit key and encrypt hello world" with AES-CBC and key "Acknowledgement" (nvm the IV)

9e 6c d3 86 33 aa fa 09 59 b1 75 86 85 e1 5a ea

why wouldn't there be keys in the 128 bit space which could decrypt this to valid plain texts other than hello world.

With my above example if there are multiple valid decryptions for the given ciphertext then it won't be every single possibility which would make it weaker than the OTP since an attacker could sort the valid plain text on relevance. But when the valid plain texts are many (just not all possibilities) the chances of an attacker finding the right one are negligible.

lets disregard OTP for a second.

Is it possible to create a cipher with the following requirements:
For each N keys and X valid plaintexts there is a X/N chance of the decryption of the ciphertext resulting in a valid plaintext. Where 1 key can be used to encrypt multiple plaintexts where the key is smaller than the overall lenght of all plaintexts without posing a weakness. (similar to a block cipher) and X/N is sufficiently large for it to be impossible to determine what the correct plain text is.

Example:

Key K = "secret"
Plaintext p = "hello"
Plaintext p2 = "noway"
Ciphertext c = "aqfum"
RandomKey N = "wrong"

Encrypt(p, k) = c;
Decrypt(c, N) = "array"
Decrypt(c, N2) = "pozdi"
Decrypt(c, N3) = "bonus"

Encrypt(p2, k) = C2 = "almost"

Scheme(C2, C) != K

Has anything ever been tried or am I wrong in assuming that this is possible with reuse of the key?

NOTE
With cipher I mean an algorithm in the sense of something similar to a block cipher.


texts:
First up: it's a step in some challenge found on the Internet, where we get an application and a file. The application must be feed with that file and a password (the password is the flag for the challenge).

So, after reversing the application, I found that the algorithm used is RC4 with a small change in the "S" array, which was not initialized to the identity but initialized to $S[i]= 0xFF -i$ .

The information I get from the challenge is that the file once decrypted has the INTEL HEX FORMAT which has a quiet regular format (like the : at each line).

At this point, I get some information about the keystream (i.e a partial keystream).
My question is there some relation between the element of the keystream, and is it possible to reconstruct the total keystream from my partial keystream?

All what I found on the RC4 was for attacking WEP, based on the fact that it use the same (IV+key) to encrypt multiple packets, and I don't think it's possible to use this in my case.


texts: Is this a secure keyed hashing construction?

texts:
I need a PRF for use with PBKDF2, however, the only thing I have is the AES block cipher primitive. I'm attempting to derive a keyed hash function from the block cipher. The design is based on the Merkle–Damgård construction. The inputs are $i$ and $k$, for the input data and key, both are a list a bytes. The byte 0xff is appended to $i$, and then subsequent 0x00 bytes are appended until $length(i) \mod 16 = 0$. $i$ is then split into $length(i)/16$ blocks in the array $b$. And then the algorithm continues as follows.
$$s_{-1} = k$$
$$s_x = E_{s_{x-1}}(b_x)$$
$$h = s_0 \oplus s_1 \oplus s_2 ...  \oplus s_{length(b)-1}$$
$h$ is then returned as the resulting hash. Is this secure enough to use with PBKDF2?


texts: Why use argon2i or argon2d if argon2id exists?

texts:
So I am currently working on a GitHub project of mine and I want to implement Argon2. The problem is that I dont really know a lot about it. Internet research is not really helpful, because Argon2 is only 2 years old so all that really exists are scientific papers and that GitHub page.

But before I carry on developing with argon2 I need some important question answered. I will start with the first one :

If Argon2id is the hybrid version of Argon2i and d then why do people even use one of the other two, would it not be more secure to use something that is resistant to side channel attacks and gpu cracking?


texts: transforming RC2 keys to have effective minimum length in implementations with fixed effective lengths

texts:
mcrypt's implementation of RC2 has a fixed effective length of 1024 bits, however, it is possible to simulate keys with effective lengths between 1-1024 by doing something like this:

http://php.net/manual/en/function.mcrypt-generic-init.php#111496

My question is...  is there a similar technique that can be used with OpenSSL? OpenSSL's implementation of RC2 has a fixed effective key length of 128 bits but is it possible to simulate keys with effective lengths between 1-128 bits with OpenSSL?

The php.net technique doesn't work out of the box for OpenSSL because the PHP technique essentially creates a 1024 bit key out of a key between 1-2024 bits long. And you can't truncate the result, either, since, quoting RFC2268, "the purpose of th key-expansion algorithm [in RC2] is to modify the key buffer so that each bit of the expanded key depends in a complicated way on every bit of the supplied input key".

Any ideas?

Also, does anyone know of any sort of more authoritative reference for the technique described at php.net?


texts: Why was AES limited by NIST to a 128-bit block size, although Rijndael could support more?

texts: Rijndael could support block sizes up to 256 bits; this seems to be useful in AEAD.  Wht did NIST restrict AES to a 128-bit block size?


texts: How to thwart a cleartext message's size?

texts:
Here is a question I don't find addressed in my cryptography books:

let's say Alice want to send Bob a message of length N.
what is the proper way for Alice to hide N?

I am thinking Alice should do something prior to encrypting her message.
Let's say N is the length of Alice's cleartext message, along
with its cryptographic signature.

I guess Alice can prepend her N bytes with some M random bytes, and
append P random bytes at the end.
But, how to choose M and P?
Should they even be chosen according to N?

Thanks!


texts:
I am working on a library (using standard primitives: AES256 CTR; HMAC with SHA256; PBKDF2 with SHA256, 128 bit salt, and 10000 rounds) to encrypt and decrypt data, given a password.

The encrypted data includes a header with version information and an HMAC (the header is included in the HMAC).

I am worried about exactly how I should check/use HMAC and version:

In a future release (with a new version number), the HMAC algorithm or parammeters may have changed.  So I need to check version first and abort if the version is newer than the current code.  But that means that if someone maliciously alters the version then they can "trick" the code into aborting (and likely issuing a warning to the user saying that they should update their software).

Alternatively, in the future, if the version is within acceptable range, then I need to use that to select the HMAC.  That will then validate the version.  But it seems like it could lead to an attack that allows an older, broken HMAC to be abused in some way.

Is there some standard way around these issues?  Or are they not considered important?  Or do I simply need to wait until I have more specifics (for the second case).  Is there anything else I should know?  Should I extend the API now to include a flag that controls backwards compatibility?  Since the API is meant to be very simple that needs a default - what should it be?

I realise that I am not the best person in the world to be doing this work, but no similar library appears to exist for Python 3 and so far I have been lucky enough to find useful support from others (eg on HN; also note that I am not writing any algorithmic code - everything is delegated to pycrypto).  Thanks.


texts: How can I provide a non interactive proof using the Fiat Shamir method for the valid reencryption of a simple mixnet?


texts: Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

texts:
I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses implementations that do not check that the PKCS#1 1.5 padding of a decrypted signature is correctly layed out. Most vulnerable implementations accept cases where the embedded hash is not right-justified. With a reduced padding, the hash can be moved forward (more to the left) then the remaining bytes can be treated as "garbage", which in turn make enough room for organizing so that this number is a perfect cube. In case of public exponent 3, it means that the cuberoot of the latter number is a valid signature as seen by the wrong implementation. Actually what happens is that you're basically good with the rounded cube root of a number of your choice of the form (line29, https://github.com/akalin/cryptopals-python3/blob/master/challenge42.py), and cubing it only messes up the garbage digits/places anyway.

Now, I'm wondering about the case where an implementation does check that the hash is right-justified, but doesn't check the previous bytes at all. Assuming that we're still talking about exponent 3, someone could imagine that there might be a way to find a perfect cube that ends with that particular hash, thereby utilizing the more significant digits that are not checked by the code. On the other hand, the ending digits are already restricted just by the value being a cube number.
Let hashlen be the length of the hash in bits, and rsalen the much bigger length of the signature. Giving up on forging a signature for a particular hash, my intuition would tell me that if you take the last hashlen bits of the possible cube numbers for the signature (for which there are possibilities on the order of 2^1/3*rsalen*) then this set would have a non-negligible intersection/overlap with the possible hash values of size hashlen. Is it possible to sign some message feasibly by somehow utilizing the structure of the particular hash in context of these (hash, perfect cube) pairs?
Conversely, is there a quick and profound argument that shows that the outlined "signature checking" (looking at only the hash at the end) does not weaken the implementation?


texts:
I'm working on software that should eventually result in a crypto file system similar to encfs. So far, i have a user password that goes through PBKDF2 using

PKCS5_PBKDF2_HMAC

with SHA-512 and a couple of thousand rounds to generate the Key Encryption Key. The Data Encryption Key and IV are random on a per-file basis with

RAND_bytes

DEK encrypted with KEK and the IV are written to the file header. So far so good.

For file encryption, I use a configurable block size of 512, 1024, ... 4096 bytes to split write requests into chunks and encrypt each chunk with AES. The mode however depends on various parameters and is not the same all the time. Right now I'm using CBC mode to maintain backwards compatibility, but esp. for random writes, CBC is somewhat ''clumsy'' to handle, so I want to switch to a different mode like GCM. Before I start coding, I have two questions:

Because GCM also offers AEAD, I want to keep the 512, 1024, .. blocks and use a per-block AAD and store the tag in the file. This allows me to fail early during decryption. What should I use for the AAD?
My per-block IVs (nonces for GCM) are generated using ESSIV: IV_n = AES(sha-512(DEK), block number) with Key = DEK and IV = per--file IV for AES, truncated to whatever IV size is used. Is that OK?

Hope I'm not completely off track ...


texts: Should we sign-then-encrypt, or encrypt-then-sign?

texts:
We regularly want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers can't trick Alice into thinking that some message came from Bob when really the message is some (accidental or malicious) modification of a real message Bob sent or a message that was forged out of whole cloth by an attacker.
Is it better to (a) generate the digital signature from the (hashed) plaintext, and then encrypt a file containing both the plaintext message and the digital signature?
Or is it better to (b) encrypt the message first, and then generate a digital signature from the (hashed) encrypted file?
Or (c) combine encryption and public-key digital signatures in some other way?
A closely related earlier question ( Should we MAC-then-encrypt or encrypt-then-MAC? )
seems to focus on symmetric-key MAC authentication.
As Robert I. Jr. asked earlier,
Do the same issues with (symmetric-key) MAC-then-encrypt apply to (public-key) sign-then-encrypt?


texts: Manipulate encrypted file: AES / ECB / PKCS5Padding

texts:
As part of a competition I want to manipulate (or decrypt) a file. I know, that the file contains gzip compressed text and is encrypted with AES / ECB / PKCS5.
I also have the plain text and the cipher text of that file. I don't know the secret key. What would be a strategy to manipulate this file, so that afterwards it could still be decrypted and decompressed with the same secret key and the plain text would be different from the original one. Is that possible at all?


texts: Why sorting is needed for Meet-in-the-middle attack

texts: The weakness of double DES, E (k1, E(k2, M)) is that Meet-in-the-middle attack is possible. When performing Meet-in-the-middle attack, we first need to build the table with the first column all the possible keys and the second column all the encryption with these keys, then second step is sorting the second column, why do we need to sort the second column? What do we base on when performing the sorting?


texts: Calculating the number of rounds required for block cipher with known differential

texts:
Suppose we have a 128-bit block cipher for which the best two-round differential holds with probability $p = 2^7$. Suppose as well that this differential is iterative and that the best differential attack will be formed when using this differential.

How many rounds would the block cipher need in order to be resistant to differential cryptanalysis?


texts: Why, or when, to use an Initialization Vector?

texts:
i'm trying to figure out when an Intialization Vector (IV) should be used.

There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are encrypted with the same Key+IV, then it's trivial to recover the plaintext.

To test this, i've encrypted two pieces of equal length plaintext using the same IV and Key. i am using AES, which has a 128-bit block size (16 bytes), so i will make my sample plaintexts less than 16 bytes.

Ciphertext1: ba 81 1b c3 d1 6b ee bd 0a 87 23 33 04 90 5d 8a
Ciphertext2: b0 80 01 ed e8 2c 6c 60 17 b7 5d 60 37 9a e8 3d

Now the theory is that C1 ⊻ C2 = P1 ⊻ P2:

So i calculate Ciphertext1 xor Ciphertext2:

Ciphertext1: ba 81 1b c3 d1 6b ee bd 0a 87 23 33 04 90 5d 8a
Ciphertext2: b0 80 01 ed e8 2c 6c 60 17 b7 5d 60 37 9a e8 3d
XOR:         0A 01 1A 2E 39 47 82 DD 1D 30 7E 53 33 0A B5 B7

Now, for comparison, the XOR of the two (15 byte) plaintexts together is:

Plaintext  XOR: 03 0C 1E 1F 1B 49 4E 57 28 07 15 01 53 17 18
Ciphertext XOR: AE 2C 0B F7 19 39 FA D6 0B 16 F4 59 1D EA D5 67

Which are not the same.

What causes an encryption algorithm to be weak if a specific key is used?

Pseudo sample code, using WinCrypt API:

hProvider = CryptAcquireContext(null, null, PROV_RSA_AES, CRYPT_VERIFYCONTEXT);
hKey = CryptImportKey(hProvider, keyData, sizeof(keyData), null, 0);

encryptedLength = CryptEncrypt(hKey, null, true, 0, plaintextData, plainLength);

CryptDestroyKey(hKey);
CryptReleaseContext(hProvider, 0);

In other words, in the words of MSDN:

  If keys are generated for symmetric block ciphers, the key, by default, is set up in cipher block chaining (CBC) mode with an initialization vector of zero.

i am using an IV of all zeros, in CBC mode. Edit: But since there is only one block being encrypted, there is no "chaining" to be had; so the result is the came as Electronic Cookbook (ECB).


texts:
To give some foreground information: I acknowledge that I am a cryptography newb and not by any means an expert (and probably never will be).

In a recent CS class we had several assignments writing and implementing RSA and Diffie-Hellman. It was fun but it was exclusively two party encryption. I want to implement multi-party encryption. For example, a chatroom or IRC scenario where all parties involved send cyphertext to each other simultaneously. Looking around, I've seen that there are several libraries that accomplish this in other questions. But not just algorithms in general.

I can imagine something like this implemented in RSA and sending out public keys to everyone and simultaneously encrypting and decrypting messages multiple for every other member. For example, 3 people are in a chat room. Person A sends out "Hello guys" two unique cyphertext message that Person B and Person C receive and individually decrypt with their own private keys. This would work, but this seems inefficient and somewhat haphazard.

Is there a generally accepted algorithm that allows multiple parties to use public key encryption at once?

(Once again, this won't go to any production level system. This is just for my own academic curiosity.)


texts: More technical details on the ongoing (alleged) Chinese cyberattacks

texts:
Recently, there has been quite a lot of news about the Chinese compromising various US weapons systems and stealing military designs through "cyberwarfare". I am reading the news sources about these attacks, but popular news sites often refer to the technical details as "solving complicated mathematical problems" or just "attacks."

What cryptologic techniques are the Chinese [alleged to be] using to steal these weapons designs and compromise the US military system?  Can anyone provide more technical details or a reference to a more detailed, in-depth description?


texts: Given an input x, can a distinguisher D output 1/2?

texts:
Consider a PPT distinguisher $D$. Now if I give it an input (a bit string) $x$, it outputs 1 if $x$ ends with $1$ and $0$ otherwise. We know such a distinguisher exists and is often given as an example many times.
Now consider another distinguisher strategy, where on input $x$, it checks if $x$ is $0^n$ or $1^n$. If yes, it outputs $0$. Otherwise it tosses a coin. If the result is heads, it outputs $1$, else it outputs $0$.
My question is - Is such a distinguisher valid according to the assumptions we make in cryptography?
I think it should be valid as our distinguisher being PPT, has access to a random number generator (hence the coin tosses). Can someone please confirm.


texts: What is the intuition behind the strength of unstructured symmetric cryptography?

texts:
Consider a single round of a cryptographic permutation, what is so special about it that lacking some bits of information that either get mixed into it as a subkey or omitted at the end (sponge construction) makes you unable to revert it efficiently once it gets looped in sufficient number?

The best analogy I could come up with is a chaotic dynamical system, where any tiny change eventually gets amplified out of control (where the evolution of the two systems - changed and unchanged - no longer encodes any information about the change). And even though it is in a continuous domain where gradients can be analytically computed, after a certain point they either explode to infinity or vanish to 0.

There, there is the jargon of stretching and folding - the fractal dimension, how points get stretched out into the fractal dimension and then get folded back (this achieves a mixing of sort and eventually any two points no matter how close get further and further apart until eventually they completely dissociate as they each get sent into different parts of the attractor).

This seems similar to confusion and diffusion.

Is what's being done in cryptographic permutations the same phenomenon but in a discrete domain?


texts:
As discussed here, a classic and secure construction of PRF from PRG is:

$F_k(x_1x_2\cdots x_n) = G_{x_n}(\cdots(G_{x_2}(G_{x_1}(k)))\cdots)$

where $G$ is a secure pseudorandom generator. I was wondering whether the following construction is discussed anywhere (secure or insecure):

$F_k(x) = G(k+x)$

The $k+x$ could take a mod to have a fixed-length seed. Can anyone provide some proof hints or a link for discussion?


texts: What are the relations between cryptanalysis of block ciphers such as AES and Kendall's tau coefficient?

texts:
Studying AES on Wikipedia, I noticed a statement regarding some ongoing studies on the use of Kendall's Tau coefficient in cryptanalysis:

  According to the Snowden documents, the NSA is doing research on whether a cryptographic attack based on tau statistic may help to break AES

This paper on Kendall's tau refers to the Pearson correlation coefficient, and in the related Wikipedia article we can read:

  Pearson correlation coefficient is a measure of the linear correlation between two variables X and Y

It's somehow straightforward to think at the variables in this statement like the variables in linear cryptanalysis... is this correct?
Is the application of Kendall's tau a sort of power-up of Linear Cryptanalysis? How?


texts: tripartite diffie hellman with Weil pairing

texts:
I try to understand how the tripartite Diffie-Hellman key exchange works.
I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/845e96c20e5a5ff3b03f4caf72c3cb817a7fa542/pdf

However on page 388 he states the following equality which I don't see why it is true:
$F_W(a,P_b,Q_c) = F_W(a,Q_b, P_c)$

where $F_W(x,y,z)= e_m(y,z)^x$.
For me the first value of the equality is the inverse of the second one?


texts: RSA encryption and signature padding flaw

texts:
This is Oxford's computer security exam question:

Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding
decryption key $kd$), and Alice has published a public RSA verification key $kv$
(retaining in secret the corresponding signing key $ks$). Alice wants to send an integrity protected
and confidential message $m$ to Bob by transmitting the pair:

$E_{ke}(m)$, $SIGN_{ks}(E_{ke}(m))$

Bob will perform the obvious decryption and verification, rejecting messages which are
incorrectly signed or have incorrect padding.
However, Alice and Bob use defective padding schemes. The encryption process RSA encrypts
the byte string ‘padding 00 message’, where "padding" contains random nonzero
bytes, 00 indicates a single zero byte, and message is the intended message (which is
assumed to fit within the RSA modulus). The signature process RSA-signs the byte string
‘01 01 message’ (and again the message is assumed to fit within the modulus in this
format).
Greedy is an active attacker who intercepts Alice’s communication to Bob. He knows
that the message contains a sum of money which is to be transferred by Bob (a bank)
to Greedy himself. Show how Greedy can tamper with Alice’s message to give himself a
non-negligible chance of getting very rich.

I have read RSA Encryption and Signature - Weak Padding but the attack found in that question can not control the content of $m$. Can anyone show me how to answer this question?


texts: Construct new SIS solutions from given ones

texts:
Assume we have a lattice SIS problem
$A x = 0$, with $\Vert x \Vert < \beta$ and we are given $k$ solutions $x_1, \dots, x_k$ by, say an oracle.
Is it then hard or easy to construct from there a further solution $x_{k+1}$ ?


texts: Difference between implicit signature and explicit signature

texts:
In most of time, what I see is explicit signatures such as ElGamal, it's rare to see the implicit signatures. So I wonder

why it's rare to be seen?
what aspect is it mainly used?
what's the difference between implicit signature and explicit
signature?

P.S. I want a detailed answer, better give some examples of implicit signatures


texts: Number generation for Fujisaki-Okamoto commitment scheme parameters

texts:
I need to implement the Fujisaki-Okamoto commitment scheme for a project such that I can demonstrate performance of various zero-knowledge proofs in relation to one another, for example Boudot's "proof that a committed number belongs to an interval" (see §3.1 if you are interested in what this entails, though it is not directly relevant) among others. In the Fujisaki-Okamoto commitment scheme, a message $x$ is committed as $C=g^{x}h^{r}\mod{n}$. ($r$ is a random value in $ℤ^{*}_{n}$).

This requires me to generate numbers $n$, $g$, and $h$ where $n$ is a large composite number whose factorization is unknown to Alice and Bob. I have implemented it as $n=pq$, where $p$ and $q$ are both large primes such that the discrete logarithm problem is unfeasible, so I know its factorization behind-the-scenes. However $p$ and $q$ are dynamically generated each time I create an instance, so they are not static although I save their values (the chance that they are composite does not exceed $2^{-100}$). As for $g$ and $h$, "$g$ is an element of large order in $ℤ^{*}_{n}$, and $h$ is an element of large order of the group generated by $g$" (such that the discrete logarithm of [$h$ in base $g$] and of [$g$ in base $h$] are unknown by Alice).

Unfortunately, this is very difficult for me to Google as I really don't know how to start here. I can't find much about Fujisaki-Okamoto scheme at all, actually, but my problem is not in using it but in how to generate these numbers to get it working in the first place.

Basically my question comes down to two things:

What are the theoretical requirements behind $h$ and $g$ in this scheme?
What algorithms can be used to generate $g$ and $h$?


texts:
I've read the CBC-R description from Rizzo & Duong but am having trouble understanding the sequence of steps that would be taken when the IV is unknown and is not included with the ciphertext.

Suppose I want to send a two-block ciphertext such that block 1 decrypts to garbage and block 2 decrypts to my desired plaintext. Would the following work? If so, why not?

Pick a desired plaintext, call this P
Create a random block, call this R1
Send the random block to a padding oracle decryption routine, call the result D1
XOR D1 with P, and make this block 1
Use R1 as block 2

Since the IV is unknown the first block becomes garbage, but the during decryption the next block should decrypt R1, yielding D1, then XOR it with my block 1 to get back to my desired plaintext. Am I looking at this correctly?

Side question: I assume plaintext (step 1) should include any padding sequence that the server expects, e.g. PKCS#7. Or should this be somehow applied during step 5?


texts: Is it impossible to model a homomorphic hash function as a random oracle?

texts:
Recall that, by definition, on input a query $q$, a random oracle $H$ can output a fresh random string as its response $H(q)$ (if this query has not been seen before).

My understanding. A homomorphic hash $HH$ allows someone to compute $HH(a + b)$ from two hash values $HH(a)$ and $HH(b)$. Since $HH(a + b)$ is dependent on $HH(a)$ and $HH(b)$, its value is not randomly distributed as the one generated by a random oracle. So, it is safe to conclude that $HH$ is not a random oracle.

Is my understanding correct? Or is there any special random oracle model can be used to model a homomorphic hash function? Many thanks.


texts: Usage of different size chunks during AES encryption/decryption

texts:
I want to encrypt user's files on our server. For this purpose I decided to use the PHP Mcrypt library. I chose to use the Rijandel-128 algorithm and CBC mode for encryption. Since files are quite large, I decided to encrypt/decrypt files by chunks.

Everything works well when I use one chunk size for encryption and decryption processes. But when I encrypt a file with 8 KB chunk size and try to decrypt it with 4 KB chunk size, file is corrupted.

My question is – is it possible to encrypt and decrypt a file with different chunk sizes? If yes, what are the pitfalls of this process? Right now, I don't understand if there are any bugs in my code or there are some encryption restrictions I'm not aware of.


texts: Is perfectly secret key exchange provably impossible?

texts:
We know that perfect secrecy in encryption is possible (one-time pad). Now, the concept of key exchange like Diffie-Hellman is that we can establish a shared key without an interceptor knowing, and with no previous communication.

Obviously, for Diffie-Hellman as such, an interceptor can actually find the shared key; it would just take them ridiculously long. But I'm wondering, is it possible to make it impossible for the interceptor to find out the shared key?

I know that no such key exchange currently exists, but is it proven that it's impossible for such a scheme to exist? Or is there a chance it could be invented?


texts: How to explain indistinguishability obfuscation (iO) to my grandmother?

texts: At the risk of oversimplification, how do I explain indistinguishability obfuscation (iO) to my grandmother?


texts: Is it possible to encrypt data points but still be able to select the ones "near" a given value?

texts:
We have an application where we would like to store "encrypted" data points (as in, not being able to know the original - plaintext - data just by looking at the stored - encrypted - version of it) but still be able to ask the running system for all data points up to a certain distance from a given point. We don't want to decrypt the whole dataset and compute distances on plaintext data, of course. On the other hand, we don't even need a way to actually decrypt data and get back at the original data points.

Practical monodimensional example:

let A=2, B=5, C=8 (numbers are our "plaintext", letters are just identifiers)
we store encrypted versions of the data, so if you stole our persistent storage you know we have three points A, B, C but you can't know they actually have values 2, 5, 8
we want to ask the system for "all data points up to a distance of 3 starting from an origin point = 6" and the answer should be [B, C]
we won't ever need to be able to go back from A,B,C to 2,5,8
ideally this should be possible to extend to n dimensions, or at least two or three dimensions

About the purpose: improve security of our system in case of any successful attack. We don't need to actually know that data (as long as we can compute which data points are inside a maximum distance from a given, known point) but it's also not a problem if we do know them. What we're trying to improve on is what data an attacker would have access to if he ever succeed in compromising our systems (either getting copies of data at rest on persistent storage - a simple disk encryption would take care of that - or by getting access to an actually running system).

Speed is not a problem, we're not in an hurry. We want to minimize as much as possible the cleartext we have on the running system.
Ideally: receive data, encrypt and store it, forget about cleartext and do not need to see it again to compute its distance from a center point.

Is there any technique that allows that? Is it even theoretically  possible?


texts:
I currently study and develop the KMIP.

I test the sample(Part of sample message encode(Beispiel Nachricht Enkodierung)) with opensource, KMIP4J. I think Symmetric Key(Object Type) in sample is Managed Object. and I also think Managed Object shall be contain the Key Block Structure as KMIP document(2.2.2 Symmetric Key). but sample has not Key Block, Instead of containing Template Attribute(Cryptographic Algorithm, Cryptographic Length and Cryptographic Usage Mask).
however, KMIP document(4.1 Create) explain using create operation.

What is Difference between Managed Object and Object Type in KMIP?

thanks.. I wish to help, anyone who's reply will be very helpful!.


texts: Cipher recommendation for known-plaintext attack

texts:
I need to encrypt a 4-digit number. The cipher-text can be up to 11 digits long and there are no limits for the key size.

Considering that the attacker has access to both the cipher-text and the plain-text but I want the key to remain secret, what algorithm would you recommend?


texts: Homomorphic Obfuscation vs Fully Homomorphic Encryption?

texts:
Let's say that we want an untrusted person do to a calculation on a 32 bit floating point number and send us back the result, without learning what the specific number was that we care about.

For the sake of argument, let's assume that a partially homomorphic algorithm was not sufficient and that we needed to be able to evaluate any polynomial of any depth.

One way to do this would be to use fully homomorphic encryption which I've heard takes on the order of 2GB to encrypt a single bit, and takes about 10 minutes to AND two encrypted bits together due to bootstrapping / etc.

Another method would be something outlined here: Low Tech Homomorphic Encryption

The idea is to make a file listing all possible 32 bit floating point values starting (in hexadecimal) at 0x00000000 and ending at 0xFFFFFFFF.

We could have the untrusted party perform the operation on every value in the file, get it back, and then, since we know which value we actually cared about, we'd be able to know what the result is, without the untrusted party gaining any information about our value - other than it being 32 bits and presumably that it was representable by a floating point number, since the circuit asked to operate on the data looked like floating point operations.

Going that route, the list of floating point values is 16GB (2^32 different values, each being 4 bytes big).

Doing any floating point operation on this list of values - or doing a floating point operation between two lists of values, which would represent two "encrypted" floats - is going to be pretty quick since you can either go SIMD/Multithreaded, or send it over to a GPU to plow through.

The operations are very simple and massively parallelizable.

Given this, how does this technique of homomorphic obfuscation compare to modern state of the art homomorphic encryption?

It seems to have as much security as the real thing, and seems like it's smaller and faster.  Is that true?


texts:
For any PPT prover ($p$) and verifier ($v$), imagine I have a low entropy witness, say smaller than $2^8$.  Now, let us say I have a dlog statement in the form of  $y = g^w$. Theory says I could use a sigma protocol such that $p$ can prove to $v$ that it knows $w$. I could also make use of the fiat shamir transform to make it non-interactive.

This is not the case when the entropy of the witness is low as in this example. In both cases I could simply enumerate the $256$ possible witness  and use the response and commitment to check to which one it might correspond i.e:

For a commitment:

$t = g^v$

A challenge $c$ and a response:

$r = t + c \times x$

It is obvious to see that if I have $r, \space c$ and $t$ I can recover $x$. The same happens if we were to use Pedersen commitments instead.

I assume this is a common problem for all dlog based ZKPoK, but I am not sure, nor I do not know what should I use instead.

The one liner in this case is: How can I prove Knowledge when the witness entropy is that low?


texts:
Quantum key distribution (QKD) promises unconditional security in data communication and is currently being deployed in commercial applications. Nonetheless, before QKD can be widely adopted, it faces a number of important challenges such as secret key rate, distance, size, cost, and practical security. nature.com article

  What are challenges in quantum key distribution ?


texts: Best practices: AES-GCM parameter (initialization-vector, ...) transport

texts:
Apparently there is no mandatory method to transport AES-GCM parameters. I only read that the initialization vector often will be prefixed to the ciphertext. So, regarding the other parameters too, I could send a string like this

my_string = ':'.join([
  'a_unique_iv',              # initialization vector
  '128',                      # the tag size in bits
  'id-1234',                  # associated_data
  'the_cipher'                # cyphertext (converted to string)
])

to a REST API endpoint that stores the data. Or another example (that I would prefer because I already use json objects): Add all parameters as json fields:

my_json = {
  'field_a': 'value b',
  'field_c': 'value_d',
  ...
  'aes_gcm_parameters_and_data': {
    'nonce':           'a_unique_iv' ,
    'tagBits':         128,
    'associated_data': 'id-1234',
    'cyphertext':      'the_cipher'    // converted to string
])

Regarding best practices: Are both approaches fine? Is there a better way? Thx.


texts: Hill Cipher: Determining the number of bad keys

texts:
Find the number of matrices whose determinant is a multiple of 13 where the first column is not a multiple of 13 but the second column is a multiple of the first modulo 13.
Here's what I have done:
The number of combinations when the first column is not multiple of 13 is $(26^2-2^2) = 2^2×(13^2-1)$
The number of combinations when the second column is multiple of 13 is $2^2$
Thus, the total combinations: $2^4 × (13^2 - 1)$
The solution given is: $2^4 × (13^2 - 1) x 13$


texts: How to start a classical cryptanalysis on a Substitution + Shift cipher?

texts:
i was thinked about problem of Cyrpto.

At first glance, it looks like a simple classic password problem, but there are a lot of difficulties to think about the way the two encryption schemes are mixed.

The process is as follows.
First, create a substitution table for 26 alphabets.

Second, we select two key values for the shift cipher.

For example, the substitution table looks like this, and the key value of shift cipher is (3,7).

Original..  : A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Substitution: N E O B F M D Q V P U A W R I K Y J C S Z L G T X H

Plain Text : "APPLE"

first, The letter corresponding to 'A' is N.

cipher : APPLE --> NPPLE

second, Shift key 3 shifts the shift table to the right, and then maps the table.

Original..  : A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
shift table : T X H N E O B F M D Q V P U A W R I K Y J C S Z L G

cipher : APPLE --> NPPLE --> NWPLE

third, Shift key 7 shifts the shift table to the right, and then maps the table.

Original..  : A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
shift table : Y J C S Z L G T X H N E O B F M D Q V P U A W R I K

cipher : APPLE --> NPPLE --> NWPLE --> NWMLE

forth, Shift key 3 shifts the shift table to the right, and then maps the table.

Original..  : A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
shift table : R I K Y J C S Z L G T X H N E O B F M D Q V P U A W

cipher : APPLE --> NPPLE --> NWPLE --> NWMLE --> NWMXE

forth, Shift key 7 shifts the shift table to the right, and then maps the table.

Original..  : A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
shift table : D Q V P U A W R I K Y J C S Z L G T X H N E O B F M

cipher : APPLE --> NPPLE --> NWPLE --> NWMLE --> NWMXE --> NWMXU

The resulting encrypted string is : 'APPLE' result cipher is 'NWMXU'.

I tried to use the matrix, and I tried to perform the frequency analysis after the offset calculation for 26 ^ 2 cases (676) because I thought that the shift range exceeded the rotation range of 26 is meaningless in the shift operation anyway.

However, it has never been solved easily. I would appreciate it if you could give me some advice.


texts: How is an AES Encrypted Message Decrypted with Random Padding?

texts:
One thing I was surprised to learn about AES is that random padding can be added to the message to make it a multiple of block size. What I can not wrap my head around is how this random padding can reliably be removed from the message upon decryption, given that if it is generated by a truly random process, the recipient has no information about it.

What are the properties of random padding (and I realize there are different ways to do it but I'm looking for an illustrative example) that allow it to be reliably removed from the message?
Is it true that in order to decrypt the message you must have information about the padding scheme in addition to the secret?


texts:
Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} \bmod p$, where $r_1, r_2$ are uniformly random values and $p$ is a prime number. Both send their values ($a$, $b$) and the corresponding signatures ($s_1$, $s_2$) to an untrusted server.

At some time, they want to ask the server to calculate $a+b$ and sends the result along with the combined signature, $(r_1 * r_2 * g^{a+b})^{d_2}$ to Bob. So Alice needs to transform her signature to be compatible with Bob's signature, and this allows the server to combine two signatures correctly. Alice can pass the $r_1$ onto Bob to verify the combined signature.

How can this transformation be done?

It should be secure against the server for many iterations, so Alice or/and Bob should be able to interact with different clients and do the same operation and transformation again.

Only Bob needs to be able to verify the signature, this does not need to depend solely on public values. The signature could be a MAC.


texts: In Paillier homomorphism, how do you deal with bit length?

texts:
I'm trying to figure out homomorphic encryption and would like to multiply two paillier encrypted numbers.
Like so:
[a].[b]=[a+b]

To try this I got this Paillier.java and tried the following:

BigInteger Paillier p = new Paillier (2048);
BigIntegera=p.encrypt(BigInteger.valueOf(12345));
BigInteger b=p.encrypt(BigInteger.valueOf(54321));
BigInteger c=a.multiply(b);
BigInteger res=p.decrypt(c)

Except this gives me the error

Exception in thread "main" java.lang.Exception: Paillier.decrypt(BigInteger c): ciphertext c is not in Z*_{n^2}
    at pet4.Paillier.decrypt(Paillier.java:180)
    at pet4.Main.main(Main.java:13)

Now looking at the bitcount of c I can see that it's above 4000 (it varies a bit). So how do we deal with the fact that multiplying paillier encryped numbers results in larger bitcounts?


texts: What is a simple approach in Curve25519 key exchange in basic steps?


texts: What security do digital signatures provide (like used when signing PDFs)?

texts:
I want to ask you one question about digital signatures as they are (for example) used when digitally signing PDFs.

We know that if our document has a digital signature, we can detect if the original document has been altered or not. And if we want to prove owner identity, we use digital signatures.

On the other hand, it's very simple to remove a certificate from the document, and change it (because the document itself will not be altered, due to the certificate not being in the byte range of which the hash is encrypted as a digital signature).

So, what security do digital signatures provide (to - for example - PDFs)? Or am I missing something?


texts:
I desire an algorithm in which Alice sends a block of data $X$ to Bob, with proof that the data was both sent and received.  Ideally this would take the form of a public-key signature of the block $X$ by both Alice and Bob, so that each is in possession of (X + sign(X,A) + sign(X,B)).

Further let us assume that Alice and Bob both may have motivation to lie about having sent/received the communication.  Bob may choose to lie depending on the contents of $X$ once he sees it, and Alice may lie to attempt to discredit Bob.  Therefore the signatures or other proof of communication must be revealed simultaneously to both Alice and Bob.  At no point may either be in possession of the proof while the other is not.

I'd put a bounty on this if I had any reputation, but hopefully people will just consider it an interesting challenge.  Some notes that may help:  This is closely related to the Two-Generals problem (for which there is no two-party solution), however due to cryptography orders may not be forged, so I hold hope that there may be a two-party solution.  If not, a multi-party solution (using witnesses) is acceptable.  An example of an algorithm which simultaneously reveals information is Diffie-Hellman, but the shared secret there cannot be chosen by either party, so cannot itself contain any information.


texts: PKCS#1: Purpose of `Padding1` in EMSA-PSS encoding method

texts:
The central part of the RSASSA-PSS signature scheme of PKCS#1 is the EMSA-PSS encoding operation, described in section 9.1 of the standard.
This encoding method makes use of a padding (titled Padding1) which is simply eight zero-bytes (0x00). The concatenation of this padding, the hash of the message and the randomly chosen salt is then hashed once more, forming one part of the final signature - see eg the ASCII diagram on page 39.
Which brings me to my question - what is the purpose of this padding specifically?
The one effect I could think of is that it ensures that - given an empty salt and an empty message - the input to the hash function will not be empty. However this seems dubious as all hash functions I am aware of will work just fine with empty inputs, and the hash - be it of an empty byte string or a byte string containing 8 * 0x00 - will be deterministic in either case.
The purpose of the second padding - Padding2 - is clear to me, as it ensures that the signature has the desired (user-defined) length, while simultaneously being structured such that the salt can be retrieved without requiring prior knowledge of its length.


texts: IND-CCA Security of a encryption scheme which is combination of two schemes

texts: I have two public key encryption scheme $\Pi_0$ and $\Pi_1$ and one of them is IND-CCA secure, another one is IND-CPA secure. Let $\Pi$ be a public key encryption scheme, which is a combination of $\Pi_0$ and $\Pi_1$. As IND-CCA security implies IND-CPA security, so $\Pi$ is IND-CPA secure.  Is $\Pi$ is IND-CCA secure? How to prove or disprove it?


texts:
Let's say you have an encryption algorithm that uses PKCS5 padding. You input 'secret message', which is 14 characters long, but for some reason or another the algorithm needs it to be 16 characters long. So you add on two bytes that are equal to 2 at the end.
Then when you decrypt it, you just look at the last byte and take that many off for the end result. But how would you be able to tell if there was no padding in the first place? I'm just a noob so be nice please. Thanks in advance!


texts: Non-malleable file encryption using AES XTS 256?

texts:
I'm looking to do file encryption of a bunch of individual files, some small, some quite large.  The files will be write-once/read-many, so I could use CBC, however, since the read-access needs to have seekability, XTS seems a better fit.  One issue, as I understand it, is that XTS (or CBC for that matter) is malleable... i.e. if the encrypted cipher text is modified, an attacker could potentially do some targeted things to files.  So I was thinking surely this problem is already solved but it wasn't clear to me what the standard was, if any.  Performance is a concern, so one thought I had was simply running a CRC on each XTS sector and including the CRC result in the plaintext for encryption of that XTS sector (e.g. just expand each sector by the 4 octets).  Thus, if anything in the sector was modified by an attacker, the decrypt would fail (i.e. the CRC wouldn't likely match).  Is there a smarter way, or a standard that's "fast"?

EDIT: it occurs to me that if the files are rewritable (which currently they are not) a CRC on each cluster in XTS mode is still open to an attack where an attacker can guess at the plaintext and write a cluster to a known location in the file and see if it matches the cluster that's already there.  Only way to prevent that is to have a random IV per block as well, that changes per write, I think.


texts: Confused about how chosen ciphertext attacks work?

texts: When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is some random string of same length as m. The goal of the adversary is now to guess which one the challenger sends back. However, the adversary already has the pk, so why can't he himself not just encrypt his message and check if it fits with the one he got back?


texts: Comparing the security when using fixed IV for CBC and CTR

texts: Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the system wouldn't be secure in CTR and with fixed IV same plaintext would be converted to same ciphertext which causes another security issue. Even though I know these, I cannot decide which would be more secure when I use fixed IV's. Any help is appreciated.


texts: Soft question: Examples where lack of mathematical rigour cause security breaches?

texts:
Cryptographic tools can often become adopted even when their security proofs lack mathematical rigour - or altogether missing.

Are there famous cases of security breaches in the industry, where the underlying cryptography was  (up until then) considered secure?


texts: Encrypting and obscuring data between site/user without SSL

texts:
Im trying to figure out what the best way to encrypt data sent between a webpage and the user(both ways) is, when hosted in an environment that doesn't support SSL. The purpose of encryption would be obscuring content for delivery through filters that aid in internet censorship. What ways would that be possible to acomplish for normal visitors without any effort on their part?

Any steering you guys could provide is greatly appreciated, Thanks!


texts: Can an U2F public/private key-pair for signatures be used for encryption?

texts:
I understand that this might be more a process question:

Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device to generate an encryption key?

I would like to understand if U2F could be used to improve the following scenario:

I use a password manager with a password vault file with 100 stored passwords.
I use a master secret to unlock the password vault, which leads the password manager to decrypt all 100 passwords.
I use a single password from the vault to log into a web-site and close the vault again.
An attacker that has access to my computer would have access to the master password, the password vault file and all 100 passwords.

How can we improve on this scenario:

I would like to encrypt each password stored in the vault with a specific encryption key.
I would like to use a second factor device to make sure that only one password is decrypted at a time when I perform a physical action.
U2F seems an ideal application for this, since it automates the process of storing individual credentials for individual 'sites', except that it performs signatures but not encryption.

Constraints:

The public/private key pair is generated inside the U2F device and the private key can not leave the device.
The device does not support any other operations but the signature operations based on the U2F specification, namely ECDSA.
The password vault should be treated as an insecure and static, i.e. the user has unlocked the vault and an attacker could see all data in it. The password manager has no means to perform any secret operation, any computation is visible to an attacker.
Communication between password manager and U2F device can be observed entirely by the attacker.

Pointers:

A comment in an answer to a similar question on security.stackexchange.com seems to indicate that there is no plausible way to use an ECDSA device to derive an encryption scheme

To answer @fgrieu's question:

The U2F device is meant to assist to decrypt a single encrypted password
An authentication scheme is not sufficient, since an attacker has access to all encrypted data and could bypass the authentication step if no encryption is involved.
Only a signature function exists on the U2F device
The U2F protocol is executed by the password manager as the server, so no external data storage exists. All U2F handle information and the ECDSA public-key are to be stored in the password vault.
The U2F device generates public/private key-pairs of which the public-key is returned as part of the initial registration. The private key remains securely stored on the U2F device.


texts: Collision resistance of hash function built on modular exponentiation

texts:
Consider the following hash function family for hashing integers:

$Gen(1^k)$: generate 2 $k$-bit primes p,q. Let $n = pq$. Choose random $y \rightarrow QR_n$ and output $n,y$.

$H_{(n,y)}(x) = y^x \bmod n$

My question is this hash function collision resistant if the RSA assumption holds?


texts: Feistel cipher key generation and round function algorithms

texts:
I'm getting confused of what is the actual structure of the key generation and the round function algorithms that Feistel cipher uses. I have been reading many resources about block cipher. All resources starts talking about Feistel cipher, but non of them explains how the key generation and the round function work. They all suddenly jump to explain The DES method. I know perfectly how DES works,and also know that  DES is a form of Feistel cipher with specific features which are:

64-bits Key
64-bits Plain text
16 Rounds

So, are the key generation and the round function of Feistel cipher same as DES cipher? if yes, are there another key generation and round function algorithms else the one of DES?. Sorry for the many questions, but I really confused. Thanks in advance.


texts:
Suppose that we have a secure PRG $$G:\{0,1\}^{n} \rightarrow \{0,1\}^{l(n)}$$

I want to construct a secure PRG $G'$ that when we select its seed $s \in \lbrace 0,1 \rbrace^n$ that $parity(s)=0$, it becomes insecure.

I construct this: $$G'(s||\operatorname{parity}(s)) = G(s)||\operatorname{parity}(s)$$

(where $\operatorname{parity}(s)$ is defined as XOR of all bits of $s$)

Intuitively, I think this is correct. Am I wrong? I couldn't prove it.


texts: Is it possible to multiplex TLS connections by SNI metadata without knowing any keys?

texts:
Imagine the following communication diagram:

C1-----\ /--B1
C2------P---B2
...----/ \--...

We have multiple C(lients), call them C1, C2, etc. They connect to a single P(roxy), using the SNI extension of the TLS protocol. The proxy uses the SNI metadata to decide, to which backend (B1, B2, etc) the connections should be forwarded to.

The proxy has no information about the used keys, thus it has no way to intercept/eavesdrop the transfered data. More clearly: the backends are using heavily client/server certs which are used for authentication/authorization. This information can't be lost by an (unneeded) decrypt/re-encrypt by the P.

On this reason, the P(roxy) has to

do the TLS handshake, until the SNI information arrives,
choose the required B(ackend),
replicate the TLS handshake to it,
and then do the common bi-directional forwarding as proxies work in general.

The question is: is it possible with TLS, if the P does not know any of the keys?


texts: Does an information-theoretically secure hash function exist?

texts: Does an information theoretically secure hash function exist? (By exist I mean is discovered/invented and implemented, not whether it could exist.)


texts: Implementing symmetric encryption algorithms with whole words

texts:
Scenario

I have some unique requirements to encrypt text:

symmetric encryption;
the encrypted text will be a valid text (that means that humans could read it and not just “gibberish”);
I can not replace the key from time to time (that means no temporary \ one time key algorithms);
each word must be always encrypted to the same word (and only to one word).

These needs are important to support the following use cases:

a third party will get the encrypted text and will be able to index it for searches (effective indexing needs basic morphology, this is why need number 2 is important);
when someone sends this third party an encrypted word(s) it will be able to find the texts that associated with these words (this is why needs number 3 and 4 are important).

But I also have some flexibility in the system:

I can always add more words to a dictionary (if need in the encryption / decryption process);
both sender and receiver has access to this dictionary (always synced).

Example scheme

So basically I can use some sort of a dictionary and map words and replace each word in the encrypted word (like Caesar cipher but for words).

Every time I encounter a word I can add it to the dictionary as both original word and encrypted word.

For example:

Word: “I” Encrypted word: “Cat”
Word: “Love” Encrypted word: “Dog”
Word: “You” Encrypted word: “Home”

Now the text “I Love You” will be encrypted to “Cat Dog Home”. This fits all the needs that I have. But as you probably know, this is a very week encryption.

To make it stronger I was thinking about randomly inserting words that I know that are fake (no mapping to a real words), this (maybe?) prevents statistical analysis of the language (common words and etc).

For example:
 - Encrypted word: “Boy” is fake.
 - Encrypted word: “Test’s” is fake.

Now the text “I Love You” will be encrypted to “Cat Test’s Boy Dog Test’s Home Boy”. This fits all the needs that I have. But I believe this is still weak, so I’m looking for something better.

Symmetric ciphers

I’ve read about symmetric encryption algorithms like Blowfish, Twofish and AES-256 and from my (limited) understanding they are all algorithms that replace one byte with another and they consider to be strong encryption methods.

Is it possible to implement a symmetric cipher, but instead of operating on bytes it will operate on words?

NOTE

After further research I've come to the understanding that this question is more misleading than helpful.

The question asks about encryption but directs to obfuscation - and so may some of the answers.

I believe that noobs (like me) will be more distracted and misled than gaining anything from this.


texts: How to encode and decode 14-character codes with 20 specifically allowed characters as integers within the smallest range possible?

texts:
I am attempting to do phase space analysis on Coke Reward Codes that are 14 characters long and composed of only the following 20 characters:

Letters: B F H J K L M N P R T V W X

Numbers: 4 5 6 7 9 0

What I am trying to do is implement a function that takes a string input of a code (ex: "FWR59NR0RR5NHV") and converts it to one unique integer for that code. The reason I need to convert these codes to integers is because I generate an attractor graph by calculating the gradients of a time-series sequence of the codes. So, for example, a small sequence (ordered from newest code to outdated code) may be 7508, 16, 9000, 5200 for the codes "440W6KN40XMBL7," "0PPLV7NW6V9VTJ," "6NB6PL9KXWRV5K," and "5RNB0WJKVRJB0M" respectively. Then, I take the gradients from this sequence and plot them as x, y, and z values as a way to predict a future code (this procedure known as delayed coordinates comes from the experiment located here: http://lcamtuf.coredump.cx/oldtcp/tcpseq.html).
The equations for calculating x, y, and z are the following:

 x[t] = seq[t]   - seq[t-1]
 y[t] = seq[t-1] - seq[t-2]
 z[t] = seq[t-2] - seq[t-3]

Using the numbers of seq above (7508, 16, 9000, 5200), x=7492, y=-8984, and z=3800.

My current method of converting codes to integers is concatenating ASCII values of each character in the code into a huge hexadecimal, i.e.

"FWR59NR0RR5NHV" ->
0x46575235394e52305252354e4856
because 0x46 is 'F', 0x57 is 'W', etc.

I have two problems with this method though:

The attractor graph is composed of in-between gradient integer values that if added or subtracted to/from a code produces a code with invalid characters because ASCII includes all characters instead of only the 20 I want. If all possible codes are somehow mapped to the set {x, x+1, x+2, x+3, ... x+20^14} where x is some arbitrary starting value, then this problem can be solved.
The integer values of the codes are huge (bigger than 64-bits) and encompass too many possible values that shouldn't even exist because only 20 letters are allowed instead of 256 possible values per position that are stored in the hexadecimal encoding.

In summary, what I am looking for is a function that maps all possible valid codes (with only the 20 characters shown above at each of the 14 positions) to an integer set {x, x+1, x+2, x+3, ... x+20^14} such that every valid code can be encoded into a unique integer within that set and every number within that set can be decoded back into its code.

If it is or isn't possible to perform such encoding and decoding, please let me know. Any help is appreciated.

Thank you,
Vikas


texts: Safe generation of $k$ points on a curve such that the mutual discrete logs are hard?

texts:
I have a multiplicative group $G$ of prime order $p$ implemented using a twisted Edwards curve (similar to Ed25519).

I want to compute a set of $k$ distinct points $P_1,...,P_k$ that generate $G$, such that the mutual discrete logarithms of these points are hard to compute. I.e., for any distinct $P_i,P_j\in \{P_1,...,P_k\}$ it should be hard to find $s$ such that $P_i=s\cdot P_j$.

To obtain such a point $P_i$, I do the following steps:

I select $y$,
I use $y$ to compute $x$,
I verify if $(x,y)$ is on the curve,
I verify if the order of $(x,y)$ is $p$.

If $(x,y)$ is not valid, I retry with a different $y$. I repeat this process until I have found my $k$ points.

My question:

Can I generate the points by simply increasing $y$ (e.g., $y=3,4,5,...$) or will this affect the security if the $y$ coordinates of all my points are in a very small range?


texts: ZKP: Proving knowledge of a variable length hash preimage

texts:
I am currently trying to implement a proof of knowledge of the preimage to a public hash image using different zkp system implementations.

There are a lot of examples that do exactly this (see this question for some further reference). But: All of these have a fixed input size to the hash function (often two times 256-bits to do merkle tree proofs). Now while this is very convenient for examples, I would like to allow the preimage to be variable in length.

I have some questions on this:

Is a variable length input possible in zkSNARKs, where the verifier and prover keys have to be calculated beforehand? Can I create a prover key that permits arbitrary input lengths? To my understanding this is not possible and the prover would have to reveal the preimage length before the trusted setup.
In Bulletproofs I have to split up the preimage into 32 byte chunks, represent them as scalars and commit to each. Is there a way to avoid a linear amount of commitments to the size of the preimage?


texts: DES anti-fixed points for semi-weak keys

texts:
I am looking for some "real examples" of anti-fixed points for DES semi-weak keys. As I know, there are $2^{32}$ anti-fixed points for 4 of the 12 semi-weak keys each. One or two examples of these points may help.

Anti-fixed points: For 4 of the (known) DES semi-weak keys, there exist $2^{32}$ plaintexts such that $E_k(x)=\overline{x}$

More info about DES weak keys, semi-weak keys, fixed points and anti-fixed points in the Handbook of Applied Cryptography, fact 7.90 (alternate link)


texts: Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

texts:
OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support.  Its only drawbacks seem to be that it requires frequent rekeying ( every $~2^{13}$ blocks if one wants to match GCM auth robustness when very large amounts of data are transmitted) and is patented (a dealbreaker for many applications).

Are there any other modes that can match OCB for speed?


texts: Are there comprehensive alternatives to RSA?

texts:
If we wished to, is there a comprehensive alternative to RSA?

I say comprehensive as I wonder if there is one which does both encryption and digital signature like RSA?

If not, simply what alternatives are there?


texts:
Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$.

I know that if we can predict next IV with 100% probability there is attack that completely breaks encryption. Then if we randomly choose IV as prediction, we have $\frac{1}{2^{15}}$ probability of correctly guessing next vector.

Is there a better CCA or CPA for this weak IV? How many queries on average and at most would it take?


texts:
When encrypting a message with a symmetric key, it seems like the best practice is to first encrypt the message, then run the cipher text and key through HMAC, appending the result to the cipher text. The receiver can strip off the hash, HMAC the cipher text and key, and verify that the hashes match. This tells the receiver that the person who made the HMAC had the secret key, and that the message was not tampered with.

But why can't the sender instead hash the cipher text, then encrypt the hash with the secret key? The receiver would decrypt the hash with the same key, hash the cipher text, and verify that the hashes match. Wouldn't this give the receiver the same assurance, and isn't this how it's done in public key cryptography, when the sender wants to sign the cipher text?


texts:
I want to encrypt a short plain text (i.e., 30bit), and the requirement is that length of cipher text is the same as the short plain text.

It seems that stream encryption methods like CFB-8 satisfies my requirement. My question is that

What is the cracking time of CFB-8 in brute-force-attack? Does the cracking time only depend on the key length?
Does the length of plain text influence the cracking time? if so, what's the relationship?
Are there any better methods for my requirement?


texts: Different inner and outer hash functions for NIST-recommended HMAC?

texts:
The NIST recommended HMAC uses

$$\operatorname{HMAC}_k(\mathrm{text}) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \mathbin\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \mathbin\| \mathrm{text}) )$$

Is it feasible to analyze the security and efficiency with different hash function implementations for $H_\mathrm{in}$ and $H_\mathrm{out}$ for a single instance?

I would like to know whether it makes sense to use different hash functions for the same HMAC.


texts: ECDSA Signature R|S to ASN1 DER Encoding question

texts:
I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert this into ASN.1 DER in Java. I get following format:

0x30|b1|0x02|b2|r|0x02|b3|s
b1 = Length of remaining data
b2 = Length of r
b3 = Length of s

For example, suppose:

r|s = b2b31575f8536b284410d01217f688be3a9faf4ba0ba3a9093f983e40d630ec722a7a25b01403cff0d00b3b853d230f8e96ff832b15d4ccc75203cb65896a2d5

Breakdown ASN.1 DER signature format 0x30|b1|0x02|b2|r|0x02|b3|s:

3045022100B2B31575F8536B284410D01217F688BE3A9FAF4BA0BA3A9093F983E40D630EC7022022A7A25B01403CFF0D00B3B853D230F8E96FF832B15D4CCC75203CB65896A2D5

My question is - will I be getting this format always or will there be a chance that r and s could be converted and to make length of curve?