texts: Why do crypto tools display key components in such an unusual format?

texts:
openssl x509 (v1.0.1f) displays public key moduli as arrays of hex-encoded bytes, 15 columns wide, starting with a leading 00::

    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
            Public-Key: (1024 bit)
            Modulus:
                00:b0:d0:f4:33:a8:b2:93:06:65:27:72:94:57:92:
                bd:c7:ca:d4:08:e7:06:b9:4e:5e:d4:4a:ff:cc:f3:
                4f:4a:fc:92:75:46:4f:ce:fc:18:4a:d1:30:f2:64:
                31:94:4d:13:0d:91:ef:a4:34:59:71:b4:a1:cd:4e:
                fe:8f:e4:57:71:55:6a:d5:47:db:12:db:aa:df:20:
                6a:36:d1:5d:8c:68:db:ef:63:87:56:df:79:71:50:
                69:8d:b8:67:32:e7:51:17:26:21:fd:20:c7:1d:d2:
                dc:78:d7:fe:98:42:d0:24:8c:6a:df:12:cd:da:a9:
                81:fb:60:8b:ba:c9:12:d3:a9
            Exponent: 65537 (0x10001)

GnuTLS's certtool -i shows the bytes in an array of 16 columns, which seems less surprising, but again starting with a leading 00::

Subject Public Key Algorithm: RSA
Certificate Security Level: Weak
    Modulus (bits 1024):
        00:b0:d0:f4:33:a8:b2:93:06:65:27:72:94:57:92:bd
        c7:ca:d4:08:e7:06:b9:4e:5e:d4:4a:ff:cc:f3:4f:4a
        fc:92:75:46:4f:ce:fc:18:4a:d1:30:f2:64:31:94:4d
        13:0d:91:ef:a4:34:59:71:b4:a1:cd:4e:fe:8f:e4:57
        71:55:6a:d5:47:db:12:db:aa:df:20:6a:36:d1:5d:8c
        68:db:ef:63:87:56:df:79:71:50:69:8d:b8:67:32:e7
        51:17:26:21:fd:20:c7:1d:d2:dc:78:d7:fe:98:42:d0
        24:8c:6a:df:12:cd:da:a9:81:fb:60:8b:ba:c9:12:d3
        a9
    Exponent (bits 24):
        01:00:01

When it comes to private keys, however, both openssl rsa and certtool -i -k show all the private key components in arrays of bytes 15 columns wide. They both show leading 00: for some components of the private keys but not others.

This display format seems unusual because the quantities in question are generally sized in powers of 2 (e.g. 1024 bits == 2^10), but the binary data is shown in rows of 15 columns. The leading zeros are surprising as well.

So… is there a good reason for this unusual display format?


texts: How to perform benchmark of block/stream ciphers?

texts:
I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption).

To get general idea, I guess it probably would be better to use existing tools than to implement everything myself, then I can implement certain ciphers myself to get better performance.

Are there any tools that I can use for this initial benchmarking? Which tool support wider range of ciphers (cryptsetup?)

I am going to be doing this from Linux. The only options that I can think of now are cryptsetup and TrueCrypt... but can I use disk encryption utilities to benchmark encryption and decryption of general data?


texts: Difference between Verification and Public Key for Signature Schemes

texts:
This is a semantics Question. Typically, in many asymmetric schemes, for this question specifically, digital signatures, we see that designers describe the key given to the verifier as Public Key.

However, in some contexts, specially identity based games, I would imagine the key used for verification should remain secret. Say anonymous credentials and some challenge response constructions.

My question is the following:

Should I always call the key used for verification "public key" even on those settings?
Is it ok to call it verification key on those settings instead?
I have seen some recent work, for example, on multivariate, lattice based and post quantum stuff in general, call it more and more verification key. They then assume is public, is it something that is coming to fore or there is a difference of meaning between the 2 terms?


texts: Test the randomness of a random permutations, that was generated without Fisher-Yates?

texts:
Overview of the problem
Before this gets immediately flagged as duplicate, I'm not interested in testing the Fisher-Yates shuffle for randomness, since this can simply be done by testing the underlying RNG. I'm interested in testing the quality of any function that generates random permutations.
How can one test the quality of a random shuffle function, of which I don't know the underlying implementation?
My specific problem
To be a bit more specific to my conundrum, I'm currently trying to implement a 64 bit version of a permutation algorithm from this blog post.
TLDR: You can use a hash function, that is invertible for a given power-of-two sized domain, to generate random permutations, by rounding up the range to the next power-of-two and excluding and indexes generated that are smaller than the range.
A hacky solution
I came up with a hacky solution, but I'm not sure if there are better ones and how to calculate the bias introduced by this solution:
One thing that comes to mind when evaluating random permutations is what happens if we shuffle an array that contains consecutive integers and just use the first index as a randomly generated number, which can now be tested for randomness using test suites like PractRand.
This approach has an obvious problem though, since we are interested in the correlation of a single permutation and not between different permutations, since e.g. in the algorithms from above the initial index is always properly random.
Now the next idea would be to use the first k indexes as random numbers, but this also has a problem since once a number is generated it can't occur again.
This can be elevated to an extent, by storing the consecutive integers multiple times each in the array. So every integer in [0,n] is stored m times in the array and k shuffled integers are used for testing.
With an increased m the bias in getting repeated integers would go down, and thus this is a theoretically useable solution.
This would require a huge amount of memory though, but fortunately the algorithm I'm interested in testing generates one random index at a time and thus this can be done quite efficiently, by using the mod n of the indexes generated.
Edit: To clarify what I'm talking about on a smaller scale: Say I had an array that contains m zeros and m ones (so n=1). I now shuffle the array and write the first k zeros and ones as bits to a testsuite like PractRand and then repeat this process. With a very large m (e.g. 2^50) and a smaller k (e.g. 2^8) the bias of repetitions should be so small that it's negligible.
I don't know though what values for k, n and m to choose and what the corresponding bias is.
Questions

Are there other methods of testing a function than shuffles an array for randomness, without knowing the underlying implementation of the function?
Is there anything wrong with my proposed method?
How do I calculate the bias my method introduces for given values of k, n and m?


texts: How random is the shared secret in the Diffie Hellman key agreement

texts:
How random is the value $ZZ$ in the DH protocol?

This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a random oracle, as the first byte will be lower or equal to the highest byte of $p$, if $p$ is encoded using the same $I2O$ (integer-to-octetstring) function.

Is there a mathematical function that shows how much "entropy" there is in the first (highest order) $x$ bytes taken out of $ZZ$?


texts: How good is using AES CTR mode with initial counter as 0?

texts: Is it advisable to use AES CTR mode with the counter initialized to 0? How good is it in security terms?


texts: Is the key deducible with AES CTR when we know about the plaintext, IV and the ciphertext?

texts:
Simply as stated, with AES running in CTR mode, can somebody work out the key (without brute-forcing) given we know about the plaintext, IV and also the ciphertext.

Assuming we also know about the cipher block size & key length.

In other words, we have the pseudo random AES CTR stream + IV, can we work out what the key is?


texts: Difference between MAC and Authenticated Encryption?

texts:
I am currently studying authenticated encryption and I was wondering if there was a difference between using a MAC and authenticated encryption.  It seemed like authenticated encryption schemes use MAC's in order to provide a level of integrity to the ciphertext.

However, I was unsure if there were specific modes of operation for different ciphers that inherently provided a level of authenticated encryption or if a MAC was always necessary to provide authenticated encryption?

Any examples would be of great help.


texts: Why can't Homomorphic encryption schemes support algorithms with conditions/branching?

texts:
If it isn't already apparent from the title of my question, i should make clear that I have only a very basic understanding of homomorphic encryption.

I would like to know why homomorphic encryption schemes cannot support algorithms with conditions/branching, and what the likely impact will be on the overall adoption of HE schemes. Given this limitation, are HE schemes likely to be useful in real life? Thanks.


texts: How to use maps in the Boneh Gentry Waters encryption scheme?

texts:
I am reading the source of pbc_bce library which implements the Boneh Gentry Waters broadcast encryption scheme. In this paper the authors use for their construction a bilinear group $G$ and a bi-linear map $e$ but in the source of pbc_bce I find the implementation of the bi-linear map. Which map is used for the pairing?

EDIT

I ve read the paper a lot of times, but I am not sure that I have understood it. Their first construction begins with "Let $G$ be a bi-linear group..". The proof that $D(E(K)) = K$ make use of the properties of a bi-linear map, e.g.: $e(a \cdot x,b) = e(a,b) \cdot e(x,b)$. That's why expected them to expand on the maps. Yet, they didn't.

The paper merely states on page 1 and 2: Our constructions use groups with an efficiently computable bilinear map. while section “2.2  Bilinear Maps” limits itself to (quote) briefly review the necessary facts about bilinear maps and bilinear map groups.

Am I missing something? How is this not related to some specific maps?


texts: Using High Level Probability Theory (eg Markov Chain Mixing) in Cryptography/Cryptanalysis

texts:
I'm currently doing a PhD in probability theory, specifically (discrete space) Markov chains and their mixing properties. As well as my current main project, I'm looking to have a side project, eg to work on if I want a (temporary) change from my main project. What I'm doing is fairly applied in the sense that we have certain graphs and we're looking at mixing on them; it's fully rigorous though.

While it's not hugely related to Markov mixing, I'm also very interested in cryptography/cryptanalysis. I expect cryptanalysis is more related to my kind of probability theory, but I could be wrong. I'd like to be able to apply similar principles of my main project (Markov chains, in particular mixing) to this.

I'm interested in using high level probability theory. By this, I don't mean only having to know about discrete distrubutions and conditional probabilities, but more -- for example, material in the Aldous/Fill book. By this I mean that it would be a probability project on (/applied to) cryptography/cryptanalysis.

In a related field, I'd also be interested in similar applications to coding theory, eg codes that error-correct with high probability. I know coding theory is based on basic probability, but again I'd be looking for more than just having to know some basic rules.

After some searching it doesn't appear that anything like this has been done. It might be a nice opportunity to do develop some new tools. After all, Tim Gowers got his field medal for combining combinatorics and functional analysis. Not suggesting I'm on Tim Gowers' level, of course! Bollobas successfully used probabilistic methods to show lots of stuff about graphs (again, no claim to be on his level!). This could include things such as developing algorithms via Markov chains and proving fast (polynomial) mixing. I'd be happy to learn new things -- maybe some machine learning techniques would be helpful? -- in order to do this. But I would like it to be probability at heart.

Now, it might be that there isn't literature on this topic because the tools I want to use just aren't applicable in this situation, or it might just be that people haven't done it it. People have different interests, and maybe this is a less common crossover. Let's hope for the latter!

So I'm wondering if anyone has experience of, or knows about, any such questions or areas of research? I've looked at various literature, but maybe someone of a more cryptographical/cryptanalytical background would know of some such problems.

I'd certainly appreciate any comments. This is a cross-post from Maths Overflow (see here).

Note the highly related question "Current mathematics theory used in cryptography/coding theory". In this, however, there is no mention of probabilistic tools being used there; it's mostly number theoretic or algebraic. Note that there is the tag "probabilistic encryption".


texts:
I have recently learned that Encrypt-then-MAC is recommended when using symmetric encryption.

I have two closely related questions related to that, which is why I am posting them as one:

Looking at the different kinds of available MACs (UMAC, HMAC, etc.), does it matter which one I use? Meaning: does the choice of MAC depend on the cipher, or the mode of the cipher, or anything else? Or is it more a matter of personal preference which kind of MAC I use?
Am I assuming correctly that I can transmit a MAC together with the related ciphertext? Meaning: is it safe to append the MAC to the ciphertext upon transmission, or is there another way I should prefer (separate transport over secure channel, or something like that)?


texts:
Suppose a message $m$ is divided into blocks of length $160$ bits: $m
> = M_1 || M_2 || ... || M_l$ And define $h(m) = M_1 \oplus M_2 \oplus ... \oplus M_l$

  Which of the three desirable properties of a good cryptographic hash
  function does h satisfy? Show that it does not satisfy the other two.

Three desirable properties of a cryptographic hash function
http://en.wikipedia.org/wiki/Cryptographic_hash_function#Properties

I feel like if there is only one, like the question states, it has to be the first one, preimage resistance.  However, given a hash $h = 000....0$
I can find a bunch of $m$'s that could give that particular hash.  Maybe since there are lots of solutions you can't pin point the specific $m$ that gave that value?

What do you think?


texts: Why would this algorithm be vulnerable to a preimage attack?

texts:
If I created this algorithm:

Break the message $M$ up into $n$ blocks $m_1,\ldots,m_n$ of 512 bits each.

Compute the hash by alternating AND and OR operations on the blocks. More specifically:

The first block and the second block are combined using AND
The result is combined with the third block using OR
The result is combined with the fourth block using AND
The result is combined with the fifth block using OR
• and so on…

In other words, $h(M) = (\ldots(((m_1 \wedge m_2) \vee  m_3) \wedge m_4) \vee m_5) \ldots )$

Why would this be vulnerable to a preimage attack?


texts:
I see on eprint that there are many papers suggesting ways to compute parameters for LWE. How can those be used to compute parameters for ring-LWE (assuming that known algorithms solving LWE are the best for solving ring-LWE)?

Specifically, consider the ring $R_q = \mathbb{Z}_q[X]/(X^n + 1)$. How can an R-LWE instance $(a, as+e)$ in that ring be transformed into an LWE instance $(A, As+e)$? I am missing in particular how to get $m > n$ linear equations from what appear to be only $n$ linear constraints in the original system.


texts: trying to understand multiplication + reduction in binary finite fields

texts:
The wikipedia.org article on Finite field arithmetic provides an example of multiplying $83$ and $206$ in $\mathbb{F}_{2^8}$ with $x^8+x^4+x^3+x+1$ as the reducing polynomial (in fact it is the reducing polynomial for AES). Quoting it:

Multiplying $83$ and $206$, whilst ignoring the carries, yields $16,254$ or (in binary) 11111101111110.

The reducing polynomial is then converted to binary (100011011), shifted forward to match the length of the number being reduced (eg. multiplied by a power of two) and then XOR'd (subtracted) against the number to be reduced. It seems like it's supposed to do this until the number being reduced is less than the reducing polynomial (in binary).

Here's the example wikipedia gives:

      11111101111110 (mod) 100011011
     ^100011011
       1110000011110
      ^100011011
        110110101110
       ^100011011
         10101110110
        ^100011011
          0100011010
          ^100011011
            00000001

My question is...  why is the last XOR done? 0100011010 is less than 100011011..


texts:
Consider a block cipher with a key of size 128 bits but a small block size, say 32 bits.  Is this kind of block cipher secure?

I would like to know to what extent I can use a small block cipher, like a 32 bit block cipher. What are the constraints so that the use is acceptable in a real life application.

For instance, if we use a one-time key, that is, to encrypt only one message. Besides, the message could be small.

Suppose that when we want so send one file, we perform a key agreement so that we use the key for one message. This scenario is not efficient, but the CPA find-then-guess game is not adequate in this case.


texts: Is it secure to encrypt with EC "for myself"?

texts:
I want to encrypt some small amount of data using ECDH for use by myself later, but I don't want to generate an ephemeral keypair like in ECIES, due to time and space constraints.

Would it be safe to use my existing EC keypair to encrypt data "for myself"?

In this case I don't need to store any key material with the ciphertext, which is nice.

But is it secure?
Alternatively I could just hash my private key and use that as the symmetric key. Would that be more or less secure?

The encryption goes as follows. Let $P$ be my public point on the curve secp256k1 and let $P=[d]G$ hold with $d$ being my private key. I encrypt a message $m$ as follows:

I perform an ECDH agreement with my own public key, i.e. compute $S=[d]P$
I hash the common point with SHA256 to get the key $K=H(S)$
I generate a 16 byte IV uniformly at random using a CSPRNG: $IV\xleftarrow{\$}\{0,1\}^{128}$
I encrypt the message using AES-256-CBC as $c=E_{K,IV}(m)$
I return $(IV,c)$, knowing that I can re-derive $K$ using only my key-pair


texts:
So I'm reading this question to learn more about length extension attack, and I want to make sure I understand the basics of padding.

It says in the post that given the hash and the length of the message, I can easily compute the padding.

Now, from what I understand, each block will always be 512 bits, or 64 bytes.

So does this mean if I have a message that says "LengthExtensionIsSuchAnInterestingConcept", which has a length of 41, it occupies 41 bytes. (Looked at some other posts, ASCII character is 1 byte per character. please correct me if I'm wrong.)

64 - 41 = 23 bytes, so the padding will be 23 bytes. And the entire MD5 in this case will only consists of one block.

Am I correct in my understanding above?


texts:
Main cipher objective : Generate a keyed CSPRN stream, that does not expose useful information about the state of the CSPRNG, and xor this with the plaintext. To prevent an attacked who could somehow recover state or key information from one ciphertext from using this on other ciphertexts, a "random section", here called an IV, is appended to the original key, before it is scheduled (hashed into the state of the CSPRNG).

The question concerns one final part of the algorithm not mentioned above : to transmit this "once generated" IV, it is encrypted with the original key (after scheduling the original key into the state of the CSPRNG), and appended to the output. How secure is this formulation ? Where original key is used 1 time to encrypt the random IV, and a novel key formed from original key + unencrypted IV is used 1 time to encrypt plaintext ?

As a list of instructions, the use of the IV proceeds like this :

Generate 37 random 32 bit integers
Pack these into bytes
Using the user key (which has been scheduled), encrypt these bytes, so the IV can be saved to file
Concatenate the original (unscheduled) user key with the unencrypted IV bytes
Reschedule this key, to give the final state of the stream generator before encryption

The encryption combination function is symmetric, just xor.


texts: Prove that this protocol based on square roots modulo $n$ is zero knowledge

texts:
Consider the following (zero knowledge) protocol based on the hardness of finding square roots modulo $n$. The Prover states that he knows a square root $x$ modulo $n$ of $y$, i.e., $y = x^2 \pmod n$.

The Prover randomly chooses $a \in \mathbb{Z_n^\times}$ and sends $r=a^2 \pmod n$ to the Verifier
The Verifier randomly chooses $b \in \{0,1\}$ and sends it to the Prover
The Prover sends to the Verifier the value $w=x^ba \pmod n$
V accepts if $w^2 = y^br$; otherwise the Verifier rejects

This protocol is repeated a sufficiently large number of times in order to convince the Verifier that the Prover really knows $x$.
This protocol is sound and complete (if the prover is dishonest, then he is detected with $1/2$ probability each time the protocol is ran.)

  How can we prove that this protocol is indeed Zero Knowledge?

Thanks in advance.


texts: RSA trap door permutation does not hold for all text Xs?

texts:
The RSA trapdoor permutation as I understand goes like this,

choose $N$ such that $N= p*q$ where $p$ and $q$ are large random primes.  Therefore $N$ is NOT prime

choose integers $e, d$ such that $e \cdot d =1 \bmod \phi(N)$

$F(pk, x) = y = x^e \in \mathbb{Z}_N$

$F^{-1}(sk, y) = y^d$

The proof that $y^d = x$ involves Euler's theorem whih states that $x^{\phi(N)} =  1$ only for $x \in \mathbb{Z}_N^*$. But this means that there are $x \not\in \mathbb{Z}_N$ for which the proof does not hold.
The user of RSA, however, decides $x$, what if user chooses an $X$ not in $\mathbb{Z}_N^*$?  Would RSA break down in such cases?


texts: Storing secrets on a peer-to-peer network by splitting up AONT data

texts:
I've come up with a way to transform a stream of bytes such that if any single bit is modified, it cannot be transformed back into its original state. Here's how it works:

  Encoding

  Get hash of entire file (call it hash A)
  XOR file using repeat concatenations of hash A
  Get hash of XOR'd file (call it hash B)
  XOR hash A using hash B (call it key)
  Put key at beginning of file

  Decoding

  Hash file excluding key (we get hash B)
  XOR key using hash B (we get hash A)
  XOR file excluding key with hash A
  File is good if its hash matches hash A

I've made a working implementation of this here, using sha1 as the hash function.

Edit: found out they're called All-or-nothing transforms.

My use case

I'm planning a peer-to-peer social networking system where users are authenticated using a conventional username/password combo. One method I can think of is to generate a private/public keypair, encode the private key with an AONT, split it up into pieces, and give an ID to each piece using some hash or PRNG output seeded by the username and password.

The pieces will then be distributed to random peers. Since each peer gets an incomplete part of the encoded file, it should not be readable. The peers would not know where the other pieces are, so the only way to reconstruct the file should be by getting all the pieces by generating the same IDs using the same username/password combo and requesting it from the network.

Somewhat like IPFS, where files are identified by its hash, each piece of the encoded file will only be accessible by its ID, which can only be acquired by seeding the PRNG with the correct username/password combo.

Questions

Is my encoding method right? Did I miss anything that would cause the encoded file to be (partially) decoded when the complete file isn't accessible?
Is there anything I could modify to improve it?
Is my use case approach to storing private info correct?

Thanks in advance!


texts: What would currently make the strongest https connection?

texts: when you look at the encryption websites use you will see that there is alot of diversity, some use 256 bit keys some do not, some use DHE-RSA some ECDHE some use sha 256 some sha1, but my question is, what would currently make the strongest https connection in terms of asymmetric  symmetric and hashing algorithms used.(I do understand that there might not really be an overall "strongest" one and that some schemes a better in different situations)


texts:
Diffie-Hellman groups are vulnerable to sieving precomputation attacks. These attacks allow a one-time computation against a given DH modulus that makes it practical to attack all subsequent key negotiation operations using the same group. It is speculated that, at least in 2015, it takes only $8M USD to build ASICs capable of performing this initial precomputation stage for any 1024-bit group in a single year.*
Section 5 of the above paper mentions that ECDH is merely less vulnerable to precomputation:

Transitioning to elliptic curve Diffie-Hellman (ECDH) key exchange with appropriate parameters avoids all known feasible cryptanalytic attacks. Current elliptic curve discrete log algorithms for strong curves do not gain as much of an advantage from precomputation.

Emphasis mine. This implies that these attacks can be used against ECDH, albeit with less benefit, despite the fact that ECDH is not run over a multiplicative group of integers modulo a prime, which precomputation exploits. I have three questions about these attacks and how they apply to ECDH:

How can ECDH be attacked if it uses multiplicative groups of points on a curve?

How much of an advantage does an attacker gain from said precomputation?

Does the choice or class of curve have any impact on the feasibility of this attack?

* On a side-note, I'm skeptical that this cost estimate is accurate, since the authors of the paper assume that consumer SDRAM (in terms of price and access behavior) will be used instead of high-speed VIAs or other custom constructions.


texts: Question on Miller's algorithm (change the input m)

texts:
From the book titled " An Introduction to Mathematical Cryptography" (Chapter 5,page 322), we know that the miller's algorithm returns a function $f_P$ whose divisor satisfies
$$div(f_P) =m[P]-[mP]-(m-1)[O],$$
where $O$ is the point at infinity. When the order of $P$ is $m$, we will get
$$div(f_P) =m[P]-m[O]$$.

I am thinking what if we change the input $m$ to $m^\prime=km$. Then we will get a function $f_P^\prime$ whose divisor satisfies
$$div(f_P^\prime) =km[P]-[kmP]-(km-1)[O]=km[P]-km[O].$$
My question is what's the relation between the functions $f_P$ and $f_P^\prime$. Or given a point $S$, what's the relation between $f_P(S)$ and $f_P^\prime (S)$.


texts: Securing content and login with "same" password

texts:
I'm writing a client application that wants to store some secret information with a storage service. The client has to authenticate the user with the service and the service should not be able to decode the information that it stores for the user. Authentication against the service has to be based on username - password combination (I also can't use local storage to store encryption keys on the client).

I want to minimize the information the user has to memorize (willing to sacrifice some security but not too much for this). Ideally just username plus 1 password. Is there a well understood cryptographic scheme that allows me to do that?

If not how well would the following work (from a security perspective):

Client app asks user for username (U) and password (P) .
Using cryptographic hash H(), the client registers the user with the user name U and password H(P).
Client then encrypts the secret that is to be stored using some password based encryption (e.g. PBKDF2) using P.
Client then authenticates with the service using U and H(P) and uploads the secret information encrypted with P.

The thinking being that the server will only ever see H(P) and thus not be able to decrypt the secret (which requires knowledge of P) and also H(P) being a reasonable password for the service.


texts: Is creating an authentication-key (mac) from the encryption password a vulnerability?

texts: I can think of at least one problem with it - that testing for a correct key (when brute forcing) is simpler with a mac key (at least for short messages) and therefore can help brute force decryption.


texts:
Suppose $H$ is a hash function; why is $$H(k\mathbin\|H(k\mathbin\|m))$$ not secure?

See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $$H(k_1\mathbin\|H(k_2\mathbin\|m)).$$ Why don't we use $$H(k\mathbin\|H(k\mathbin\|m)),$$ which has only one key?


texts: Differential privacy of "randomized responses"

texts:
We define randomized responses as follows:

  In a question that can be responded with a "Yes" or "No", a respondent is asked to flip a fair coin, in secret, and answer the truth if it comes up tails. Otherwise he/she flips another coin in secret, and answers "Yes" if comes up tails, "No" otherwise.

According to the introduction this paper [1], the $\epsilon$-differential privacy of surveys relying on randomized responses is:
$$
\ln(0.75/(1-0.75)) = \ln(3)
$$
I am wondering how was this calculated. Note that the proofs contained in paper are related to the RAPPOR protocol.

[1]Úlfar Erlingsson, Vasyl Pihur, Aleksandra Korolova,"RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response"  https://research.google.com/pubs/archive/42852.pdf


texts:
I am studying classical ciphers and have the following doubts:

Is the row and columnar transposition cipher the same?

It is similar since the process of encryption and decryption is the same for both(my opinion).

How did the author get the ciphertext using row transposition cipher? (link: http://williamstallings.com/Extras/Security-Notes/lectures/classical.html)

Key(R): sorcery => 6 3 4 1 2 5 7
Plaintext: laser beams can be modulated to carry more intelligence than radio waves
Ciphertext: erasb lecam snabd umole atoed ctamo ryrre elntl iicee ntgha dnria oesav w


texts:
In the paper regarding Curve25519 DJB defines the base point to be $P_{base} = (9,y)$. The main reason for choosing it this way is, that $P_{base}$ has a big prime order which gives security advantages. But there are a lot of other points with the same properties. $x=9$ was choosen, because it is the smallest point with such a big order.
My question: Does a small x-value although give an advantage regarding the speed of the scalar point multiplication?


texts: Does a method exist where a secret is generated so that is is unknown until 3 or more people (predetermined) reach consensus that it should be revealed?


texts: How to create a PEM file for storing an RSA key?

texts:
I have an RSA private key $\{d,n\}$ and a public key $\{e,n\}$, where $n$ is the modulus, and I also have the prime factors $p$ and $q$ of $n$.

I want to create a PEM file containing this information, so that I can decrypt a file encrypted with the public key using OpenSSL.
How can I do this?


texts: Zodiac unsolved 340 cipher decryption in 2020

texts:
This is a rather general question, but I'd really appreciate your (experts, in my view) opinion on this subject.
I was wondering if, using current tech like machine learning, quantum computers and ultrafast GPUs, are we anywhere closer to deciphering the (in)famous 340-sign Zodiac letter which he sent to the press in November 1969?
I can't understand why it isn't as simple as sifting thorugh random substitution-decrypted combinations of plaintext and employing properly trained NLP neural net to select only these outputs that have the highest rating in terms of grammatical and semantic correctness also taking into account the timeframe (late 60s, early 70s frequently used words) as well as context (Zodiac was a serial killer).
I'm not thinking of trivial word salad pseudo-solutions but possible plaintext which would be deemed to convey coherent message via correct language-specific sentence building rules/structures.


texts:
A Computationally Binding commitment scheme is defined as a tuple of protocols $(\mathsf{Keygen}, \mathsf{Com}, \mathsf{Open})$, that along with correctness guarantees that for all PPT algorithms the probability that, given a correctly generated commitment key $k$, it outputs a commitment and two different openings is negligible.
Now, if the receiver sends a message $R$ between the committing phase and the opening phase, called $m$ the message revealed, then it's almost never the case that $m$ and $R$ are independent (with negligible probability the adversary could open to a function of $R$). Can we at least say that $m$ and $R$ are "almost independent" (in this question I proposed a way to have relaxed independence)?
In case the answer is negative, what are computationally binding commitments used for?


texts:
What is the advantage of AEAD ciphers? Why is the TLS working group pushing for them? I thought modern cipher suites require SHA256 for authentication. What advantage is there to including Poly1305?

Slight additional question: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 has GCM and SHA256. What is GCM used for, and what is SHA256 used for? It seems all one needs is GCM.


texts: What mathematics do I need to study in order to understand fully homomorphic encryption?

texts:
I am currently working on a project that requires me to use the HElib library that implements the BGV homomorphic encryption scheme described in this paper. I need to be able to tune the parameters correctly so I am trying to understand the underlying concepts. However, I find the mathematical notation in the paper quite complicated. Perhaps someone can suggest a set of mathematical concepts that I should study before reading the paper.

Edit: I've just finished my third year in a computer science undergrad program. So my background includes basic courses on discrete math, linear algebra, probability and statistics, theory of computation..etc. I have self-studied some basics of cryptography such as AES, DES, RSA..etc.


texts:
Is the uncompressibility of encrypted data a necessary property for a good cryptographic algorithm?

To make a crude experiment, I encrypted an 8K file with all 'A' and then compressed both the encrypted and the unencrypted file.

The compressed unencrypted file went down to less than 200 bytes while the conpressed encrypted file became larger than the encrypted file.

I think that while this result says nothing about the goodness of the encryption, the opposite result (i.e. if the encrypted file would shrink after compression) would have revelead a weakness of the encrypting algorithm.

Am I correct or am I missing something about the relation between encryption and compression?


texts: How large should a Diffie-Hellman p be if the messages are encrypted?

texts:
How large should the prime $p$ and generator $g$ values be in a Diffie-Hellman handshake if the messages are encrypted.

If the key that encrypted the Diffie-Hellman messages becomes compromised, then does that compromise the key generated using Diffie-Hellman?


texts: how to prove sequence y uphold golomb's third axiom

texts:
given $\{ x_k \}$ is a m-seq of order $n$, we define $\{ y_k \}$ to be a $m$ digits number:
$$
y_i=x_ix_{i+1}...x_{i+m-1}
$$
for every integer $n \ge m \ge 1$

how can I show that $\{ y_k \}$ upholds golomb's third axiom which says that the auto-correlation:
$$
c_{yy}(\tau)=\left\{\begin{matrix}
2^n-1 & ,\tau=0\\
Const & ,\tau \ne 0
\end{matrix}\right.
$$
I'm having troubles understanding how to show that it is the same const for every $\tau$


texts: How to deduce enigma settings given a partial plaintext?

texts: Assuming some large block of text is encrypted with an enigma machine and I only know a small subset of letters before and after encryption, how do I go about figuring out the enigma settings from this point?


texts: Is there a way to double the size of ciphertexts of a public-key scheme which is IND-CCA2

texts:
Let $\Pi = \left( \mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec} \right)$ a public-key scheme which is secure in the sense of IND-CCA2.
Assume the ciphertexts space is $\mathcal{C} \subset \{0,1\}^{n}$.
Can we construct a $\Pi' = \left( \mathrm{Gen}', \mathrm{Enc}', \mathrm{Dec}' \right)$ which is also secure in the sense of IND-CCA2 such that $$\mathcal{C}' \subset \{0,1\}^{2n}$$
and for every plaintext $x$,
$$|C'(x)|/|C(x)| > poly(n)$$
and
$$0^{n} \Vert \mathrm{Enc}_{pk}(x) \in C'(x)$$
where $C(x) = \{ y \mid y = \mathrm{Enc}_{pk}(x) \}$.

In general, it seems easy to make the ciphertexts longer keeping the level of security. But if I just modify the form of ciphertexts simply (e.g. $r \Vert \mathrm{Enc}_{pk}(x)$ for $r \leftarrow \{ 0,1 \}^{n}$). It can not be secure in the sense of IND-CCA2 any more.


texts: Favor hash size or field size when systems are disparate?

texts:
I'm working on an implementation of Krawczyk's Hashed MQV (HMQV). I'm using Crypto++, which is a C++ library.

C++ has some features where classes that represent the crypto objects can be combined even if they don't have matching security levels. As an extreme example, imagine a P-160 curve is coupled with SHA-512. Or imagine B-571 coupled with MD5.

In the case where the field size and hash size are disjoint, which should I prefer when implementing the protocol? Should everything be based on the field (and field elements) sizes effectively using truncated hashes? Or should it be vice-versa? Vice-versa would include the field size being larger than the hash, with the values being 0-filled at the MSB as required.

I should also qualify the question with: there is no standardization of the protocol, and there is no reference implementation. The protocol is often only described in a paper. This issue shows up more often than it should. Its one of the differences between theoretical and practical crypto.


texts: I have been reading about attacks and many of them work on specific rounds of TripleDES but not on full TripleDES. Is there any attack except brute force that works on full TripleDES? (theoretical)


texts: Difference entity authentication and implicit key authentication

texts:
From the Handbook of Applied Cryptography, in discussions of key sharing algorithms, I see definitions:

Implicit key authentication is when one party is assured that no other aside from a specifically identified second party has the possibility to determine the secret key (§12.2.1).
Entity authentication is when one is corroborated of the identity of another party, and of the fact that this party is alive (active) during the protocol (§10.1).

Somewhat further (§12.6) it is stated that MTI/A0 provides mutual key authentication without key confirmation or entity authentication.

This made me wonder what the difference could be between entity authentication and implicit key authentication aside from the alivelinees property. I see the "specifically identified second party" and "corroborated of the identity of another party" as the same thing. Is this correct or do I interpret things wrong?


texts: Hash length extension attack - SHA256 to 512 - impossible, correct?

texts:
Just want to be sure about something before I sign off on a method we're about to put into place.

We have a secret, to which a user-defined key is appended. The user can see the SHA256 hash of the secret.

The secret and the user-key is then hashed with SHA512 to obtain results.

Given the ending hash is SHA512, and the user only knows the SHA256, a hash length extension attack would be impossible, correct? As there is no way to convert a 256 to 512, or to backtrack the 256?

From every angle I can see it, it shouldn't be possible. But want to confirm with those more well versed than I. Thanks.


texts:
I'm trying to analyze a login protocol based on symmetric key cryptography. I'm just starting out, so this may very likely be a very bad idea, but nonetheless I'd like to hear your thoughts on it.

The protocol assumes the existence (and agreement on) the following:

A symmetric-key algorithm $E$ / $D$.
A key derivation function $KDF$.
A "strong" hash function $H$.

Additionally, the server $S$ has a secret key $k_{S}$.

When a user $U$ wants to register on a server $S$, the following happens:

$S$ generates a random bit string $b_{S}$.
$S$ encrypts $b_{S}$, yielding $v_{S} = E_{k_{S}} (b_{S})$.
$S$ computes $h_{S} = H(b_{S})$.
$S$ sends the pair $\langle v_{S}, h_{S} \rangle$ to the user (this is the server's "verification pair").
$U$ chooses a password $p$ and uses $KDF$ to get $k_{U} = KDF(p)$, its secret key.
$U$ generates a random bit string $b_{U}$.
$U$ encrypts $\langle b_{U}, v_{S}, h_{S} \rangle$ yielding $v_{U} = E_{k_{U}} (\langle b_{U}, v_{S}, h_{S} \rangle)$.
$U$ computes $h_{U} = H(b_{U})$.
$U$ sends the pair $\langle v_{U}, h_{U} \rangle$ to the server.
$S$ stores $v_{U}$ and $h_{U}$, associating them to $U$'s username (or whatever means of identification is used).

Now, in order for a user to authenticate to a server, the protocol proceeds as follows:

$U$ "requests" a login from $S$.
$S$ responds with $v_{U}$.
$U$ decrypts $v_{U}$ getting $\langle b_{U}, v_{S}. h_{S} \rangle = D_{k_{U}} (v_{U})$.
$U$ verifies the server's identity:

$U$ sends $v_{S}$ to the server.
$S$ decrypts $v_{S}$ getting $b_{S} = D_{k_{S}}(v_{S})$.
$S$ generates a random bit string $b'_{S}$.
$S$ encrypts $b'_{S}$, yielding $v'_{S} = E_{k_{S}} (b'_{S})$.
$S$ computes $h'_{S} = H(b'_{S})$.
$S$ sends $\langle b_{S}, v'_{S}, h'_{S} \rangle$ back.
$U$ verifies $H(b_{S}) = h_{S}$.

If the above procedure was successful, $U$ continues, otherwise, $U$ aborts.
$U$ generates a random bit string $b'_{U}$.
$U$ encrypts $\langle b'_{U}, v'_{S}, h'_{S} \rangle$ yielding $v'_{U} = E_{k_{U}} (\langle b'_{U}, v'_{S}, h'_{S} \rangle)$.
$U$ computes $h'_{U} = H(b'_{U})$.
$U$ sends the triplet $\langle b_{U}, v'_{U}, h'_{U} \rangle$ to the server.
$S$ verifies $H(b_{U}) = h_{U}$.
If the above procedure was successful, $S$ continues (logging $U$ in), otherwise, $S$ aborts.
$S$ replaces $v_{U}$ with $v'_{U}$ and $h_{U}$ with $h'_{U}$ for the user.

I know this looks involved, but it's actually pretty simple. The proof $U$ gives to $S$ is knowing how to decrypt a ciphertext into a plaintext with a given (known to $S$) hash. In order to avoid having to persist state on the user's side, more information is encrypted inside $v_{U}$ so that the user may verify the server is who he says it is (by the very same means as he, the user,  authenticates to him, the server).

One of the properties I find interesting of this protocol in particular is the fact that no keys need be exchanged at all (something like Shamir's 3-way protocol), and that the server stores no password-equivalent information, furthermore, it resembles (somewhat) Lamport's chained hash login (S/KEY).

So my questions are:

Does this work?
Are there any evident attacks on it?
Is this any better / worse (probably worse) than any other authentication protocol?
what can be said about the security provided by this protocol?

Furthermore, I'd like to keep it strictly symmetric-cipher + hash based.

Sorry for the lengthy description, I'd welcome an edit by someone more knowledgeable.


texts: I want to be able to detect tampering in a log file that is under the control of an untrusted party. I am not interested in secrecy, only the integrity of the contents in the file - so I want to detect if entries have been removed/changed. The solution that I seem to have found from a short google search is to use hash chains linking the current log entry to all other previous entries. The untrusted party publishes the hashes with some acceptable frequency such that any tampering after the time of publishing can be detected. Is there any technique that will accomplish something similar without the need for publishing the hashes frequently?


texts: How is the TLS 1.2 sequence number generated?

texts:
In the other ciphers supported by TLS 1.2, namely stream cipher and CBC block cipher mode, the sequence number is implicitly in the MAC (RFC5246, 6.2.3.1):

MAC = HMAC(MAC_write_key, seq_num +
                      TLSCompressed.type +
                      TLSCompressed.version +
                      TLSCompressed.length +
                      TLSCompressed.fragment);

How many bytes is seq_num? How is the sequence number generated? There seems to be no explicit information about this in the RFC document.


texts:
I wrote the following protocol.
I wrote the code.
I do not know how to write the rest of the code.
please guide me.

usertype SessionKey;

usertype TimeStamp;

hashfunction H1;

macro sessionkey = H();

protocol SCiSH(A,HG)
{

role A
{
    fresh VA,RA,NID,VHG,RHG: Nonce;
    fresh T1,T2 :TimeStamp;
    var IDA,IDHG,SK;

    send_1(A,HG, {A,NID,VA,RA,T1}H1(RA) );
    recv_2(HG,A, {VHG,RHG,T2,HG}H1(RHG) );

    claim_A1(A,Secret,NID);
    claim_A2(A,Secret,VA);
    claim_A3(A,Secret,RA);
    claim_A4(A,Secret,VHG);
    claim_A5(A,Secret,RHG);

    claim(A,Secret,sessionkey);
    claim(A,Alive);
    claim(A,Weakagree);
    claim(A,Commit,A,R,S);
    claim(A,Niagree);

}

role HG
    {
    fresh VA,RA,NID,VHG,RHG: Nonce;
    fresh T1,T2 :TimeStamp;
    var IDA,IDHG,SK;

    recv_1(A,HG, {A,NID,VA,RA,T1}H1(RA) );
    send_2(HG,A, {VHG,RHG,T2,HG}H1(RHG) );

    claim_HG1(HG,Secret,NID);
    claim_HG2(HG,Secret,VA);
    claim_HG3(HG,Secret,RA);
    claim_HG4(HG,Secret,VHG);
    claim_HG5(HG,Secret,RHG);

    claim(HG,Secret,sessionkey);
    claim(HG,Alive);
    claim(HG,Weakagree);
    claim(HG,Commit,A,R,S);
    claim(HG,Niagree);

}

}


texts: Calculating the point on the curve during ECDSA signature verification

texts: I'm confused as to how he got (62, 44) as an answer within this article: https://www.coindesk.com/math-behind-bitcoin


texts: Why use a date-dependent substring of a pre-shared key instead of just the key?

texts:
I've recently come across a situation where one system passes an encrypted payload to another system. The payload is encrypted using a pre-shared key. However, instead of just using the key itself, a calculation is made using the current day and month to produce an integer value. This value is then used to retrieve a substring of the key. So if the output of the calculation is 10, the key used to encrypt the payload is a substring of the original key beginning at the index of 10. Both systems have this logic.

I understand this prevents someone who possesses the key but not the aforementioned logic from decrypting payloads, but is this necessary or an industry standard solution to this problem? I've never encountered it before and I'm not sure what terms to use for further research.

Any insight is appreciated!

EDIT: I suppose the original "key" isn't really a key...it's a password the keys are derived from.


texts: Can a QR code be scanned if split using visual cryptography?

texts:
I'm trying to get a python script to work such a way that it takes a QR code (a jpeg or a png) splits the jpeg into two images as shown here
https://github.com/LessonStudio/VisualCryptography

I'm not sure if the code can be scanned. I know we can get the image back, but what about the information stored ?

Any help would be appreciated.


texts: Double DES meet in the middle attack: number of candidate keys

texts:
I'm new to cryptography and found this statement in a book, which says that when having a message block of $64$ bits and using a key of $56$ bits, we will get $\frac{2^{112}}{2^{64}}=2^{48}$ candidate keys if we encrypt a given plaintext and decrypt the corresponding ciphertext (in double DES).

So, assuming that using one key, each of the $2^{64}$ plaintexts will be mapped to again $2^{64}$ ciphertexts and let's also assume that the function of encryption is such, that there are no repetitive ciphertexts, that being said, the mapping is bijective. Now, if we make a new set of ciphertexts for each key, there will be a total of $2^{56}$ (out of $2^{64}!$ possible permutations) different sets, corresponding to different mappings. My question is, where do we get the $2^{64}$ mentioned in the very first sentence? I get it that there are $2^{64}$ possible ciphertexts, but don't we get a set of $2^{56}$ ciphertexts from encryption, and also that much from decryption? So wouldn't the number of candidate keys be the number of elements of the intersection of these 2 sets?


texts: Is there any algorithm capable of encrypt securely (symmetric) N numeric digits in a numeric message of M digits (N < M)? I am especially interested in a specific case in which N = 10 and M = N + 3. I tried the most famous algorithms, like DES and AES, but they did not get success. Does anyone know a way to encrypt messages with limitations like this?


texts: Does re-iterate AES-128 with different keys gives any benefict?

texts:
I'm not cryptography expert but I have this doubt…

Suppose I have 2 different keys:

secretkey1
secretkey2

And a plain text:

myReallySecretPlainText

If I use AES-128 on my plain text with my first key I get this:

U2FsdGVkX19fHxumDqEB9Kuyvhj+aoHpctLCdo2VEvt1danATMo+sBaz3nsCaS/Z

now, if I use on this cipher text my second key I got this:

U2FsdGVkX1/AqJ3w8nTRAHvm1ZbDTdwmq7LTVBDR/z4O9ngaXGuAIqcqTzPj+flPRIV6++twqBnIEHgUVVe7oO1D75VO14ezRX5tqcjBTPUUtr7YDqCks5ZW7fX8crqg

Looks pretty safe, but I have a doubt: does this have the same security of a AES-256? Or does it have the security equivalent to a single 128 bit key?


texts: How does a user register his verifier at host in SRP (Secure Remote Password) protocol?

texts:
I read RFC 2945 and 5054 describing SRP, but there was no mention of registration.

How should user registration happen in SRP? Is there a standard or paper describing it?


texts: Ideas for non duplicate cryptographically secure numbers

texts: My Boss asked me this today. I am not a math major. He needs to generate 50 billion non-sequential non-duplicate (no collisions) cryptographically secure random numbers. I work in GO. Any ideas?


texts: Active S-boxes for AES with 8x8 MDS matrix

texts:
One way to enhance the security of AES is by increasing the number of active S-boxes. Larger MDS matrices are used to increase the number of active S-boxes. Using a $4\times4$ MDS matrix results in 25 active S-boxes after 4 rounds.
How many S-boxes would be active after 4 rounds using an $8\times8$ MDS matrix?


texts:
Good day everyone! Please bear with me as this is my first post on the crypto exchange.  An interesting question was raised in a meeting recently about the double-encryption problem (i.e. same algorithm used on same message block twice yields weaker results).  However, the team was concerned that database encryption (such as Oracle or SQL Server's TDE) along-side SAN encryption might cause weaknesses.

For example, Wikipedia states (en.wikipedia.org/wiki/Multiple_encryption):  "Picking any two ciphers, if the key used is the same for both, the second cipher could possibly undo the first cipher, partly or entirely. This is true of ciphers where the decryption process is exactly the same as the encryption process—the second cipher would completely undo the first."

However, my understanding is that TDE protects against a SAN admin decrypting the disks and walking out with a copy of the database.  Not having TDE would be frowned upon by infosec unless it demonstrably causes weaknesses.

So when does double-encryption issues apply, or does it not at all here?  I am more hoping to understand the rationale behind when this does/does not apply.


texts: Practical differences between circuits and turing machines for cryptography

texts:
In formal cryptography, we model algorithms (mostly our adversaries) as (Probabilistic) Turing Machines or as boolean circuits. In our lecture on formal cryptography, we learned that circuits are more powerful than turing machines, in the sense that every polynomial-time (probabilistic) turing machine can be represented by a polynomial-size circuit, but not every circuit can be represented as a polynomial-time turing machine.

As circuits are more powerful, it would intuitively make sense to use them instead of turing machines when modeling algorithms, as proving our system secure against a PPT turing machine does technically not imply security against polynomial-size circuits. However, since people are still using turing machines, I assume that this distinction is mostly irrelevant in practice.

Are there any practical differences between circuits and turing machines for cryptographic research (i.e. are there systems that are secure against PPT turing machines, but not polynomial-size circuits?) or does it exclusively come down to personal preference / convenience which one you use for your proofs?

Remark: I considered posting this to the computer science stack exchange, but decided against it as it is directly related to cryptography. If you disagree, feel free to migrate.


texts: Calculating the inverse for a Rijndael s-box


texts: Will Fernet’s key function at any timeframe?

texts:
I’m very new to cryptography and I need to use a symmetric cryptography approach.
My simple question is, will the key always at any time be able to decrypt the encrypted text?
The encrypted text may be years old, and key will be saved years before as well.
Is there any time factor applied that may make the decryption fail?


texts: Perfectly secret scheme for two distinct messages

texts:
Following the same definition in this question for perfect secrecy for two messages $m,m' \in \mathcal{M}$. I don't understand how the accepted answer produces a secure system?
I mean The adversary would always be able to xor the two ciphertexts to obtain the xor of the original message s thus changing the distribution of $\mathcal{M}$ and violating the definition.

I tried to come up with another scheme where $\mathcal{M}=\{0,1\}^l,\mathcal{K}=\{0,1\}^{l2^l}$, where each key $k$ would the concatenation of smaller keys $k_0,...,k_{2^l-1}$ of size $l$ and to encrypt a message $m \in \mathcal{M}$ we xor it with $k_{m}$. This way different message will be encrypted using different small keys thus maintaining perfect secrecy.

However, this will not allow decryption by xoring back with $k_{c}$ because it might be that $k_{c}\neq k_{m}$. After thinking for a while I start to suspect if one-time pad can be extended to satisfy the above definition or am I doing something wrong?

Thanks

I know a comment on the original question would be more relevent, but couldn't do that due to reputation restrictions.


texts: Multiple Hash Functions that work in either nesting

texts:
Are there any hashing functions that, if two are used in conjunction (with the same salts) will return the same response regardless of ordering?

I.e. are there hash-functions $H_1$, $H_2$ such that for all suitable salts $s_1$, $s_2$ and all passwords $x$ we have

$$  H_1(s_1, H_2(s_2, x)) = H_2(s_2, H_1(s_1, x)) $$


texts:
Can someone explain this to me?
For example how M chanes to 0c?

Changing plaintext to state:


texts: What are the families of codes frequently used in McEliece cryptosystem or its variants? I know that binary Goppa codes were used in the original system but many codes with efficient decoding algorithm can be used. Are there any other requirements on the code or generator matrix for that matter? I don't care about parameters used, just the names of families like Goppa, Hamming , Reed Solomon etc. is enough.


texts: Multiplication by 2 in the Rijndael Galois field

texts:
I was studying the mix column transformation in AES and working through an example.

$[\mathtt{02}]\cdot[\mathtt{87}]$ - this multiplication works fine in the polynomial form modulo $x^8+x^4+x^3+x+1$. The polynomial answer to this is $x^4+x^2+1$ which is $\mathtt{0001 0101}$. But if you try to work this in bits, the answer you get is $\mathtt{0001 0100}$. (Multiplying by $2$ is the same as a left shift by $1$ followed by XOR with $\mathtt{00011011}$ if the MSB was $1$ before the shift).

Why is there a difference? Obviously, there shouldn't be a difference... Where am i going wrong?


texts: AES 128-bit encryption - not getting expected results


texts:
Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and nonce reuse only compromise the particular (key, nonce) pair, rather than compromising integrity for every message encrypted with the given key.

It seems surprising that I can improve upon a well-known and widely-used algorithm as GCM, so I would like to know if there are flaws in this approach.


texts: Relations between Number theory/Algebra and Lattice based cryptography

texts:
I am an intern (I started yesterday) in a research lab on lattice based cryptography and I have a more mathematical background, in particular algebra.

I would like to know what type of algebraic problems intervene in lattice based cryptography?

I am supposed to do a phd and I would like to work more on algebraic aspects of cryptography, but I have no idea where to look at.


texts: Is there such a concept as „encrypted operations“ on cyphertext?

texts:
Homomorphic encryption allows computation of (arithmetic or boolean) operations on ciphertext with the result being another ciphertext.

In that case...

client A encrypts p_in
A sends encrypted data c_in to the computer C
C performs a set of known (from perspective of C) operations f_p(c_in) = c_out
A is able to decrypt c_out to p_out
due to the homomorphic property f_p(c_in) = c_out => f_p(p_in) = p_out

Is there a concept that would allow computation of "encrypted" operations on ciphertext?

client A encrypts p_in to c_in and f_p to f_c
A sends encrypted data c_in and encrypted operations f_c to the computer C
C performs a set of (semantically) unknown (from perspective of C) operations f_c(c_in)
now from here there are two options:

f_c(c_in) = c_out: the result is a ciphertext as well
f_c(c_in) = p_out: the result is a plaintext

While 1. is a strict "enhancement" to homomorphic encryption, 2. has different implications and limitations.

the encrypted operations ENC_f(f_p, s) = f_c should not be (too) dependent on p_in or c_in

instead ENC_f(f_p, s) = f_c and ENC_p(p_in, s) = c_in should (somehow) have a shared secret s
the whole concept becomes less useful the more conditions for p_in / c_in are in f_c

the plaintext result of f_c(c_in)is known to C so f_c should not reveal too much about its input, e.g.

if f_c would be a SUM or AVG function it could be abused by C to find out more about other c* =/= c_in
on the other hand if f_c is something like f_c(c_in) = p_in < 1300 since the only output is either true or false and neither (semantics of the) operation nor (semantics of the) input is known to C there seems to be no issue with C obtaining more information that they should

Is there any concept known with any type of operations (logic gates...) that would allow for such an application (either 1. or 2.)? Or is it maybe proven that such a concept can or cannot exist?


texts: Is it safe to use cipher block sizing instead of padding?

texts:
I'm using this kind of technique instead of padding of cipher buffer (here goes pseudo-code):

struct {
   int size;         //size of cipher buffer
   byte[32] vector; //random IV (block size is 256 bits)
   byte[] buffer;    //encrypted buffer
}

Cipher data encrypted using block cipher with CBC chaining using IV specified as vector

I'm storing this structure "as-is" and in order to decrypt it decrypting buffer block by block then just cutting buffer to size.

Question is: is it safe/secure? Any hints/criticizm?


texts: Why are ed25519 keys not recommended for encryption?

texts:
Was wondering why there is no straightforward way of using ed25519 keys for encryption.
Then I found this: https://github.com/indutny/elliptic/issues/108
There it is stated that it's unlike RSA not recommendable for this purpose - one should rather derive a Symmetric key from diffie-hellman style shared secret.
It is rather used for signing. But if signing works like this:
hash = doHash(message)
signature = doAsymetricEncrypt(hash, privateKey)

hash == doAsymetricDecrypt(signature, publicKey) //true

So I would assume it should also work in this direction.
encryptedToken = doAsymetricEncrypt(token, publicKey)

token = doAsymetricDecrypt(encryptedToken, privateKey)

My current understanding of the relevant matter boils down to:

asymetric cryptography works in both directions: encrypt with private key -> decrypt with public key & encrypt with public key -> decrypt with private key
ed25519 private key is just a random 256bit number
the public key may be unambigously derived by projecting the private key number over the curve25519
ed25519 actually means the version as DSA in combination with sha-512

So I would assume that when I have the 32bytes for the private key and know that it is exactly such key. I should be able to just use it in any context regardless of using it as signature or encryption algorithm.


texts: Decrypting a substitution cipher, but with symbols instead of letters

texts:
I'm trying to decipher a message encrypted by a substitution cipher (probably a monosubstitution). But the problem is, that we have symbols instead of letters (letters were substituted for random symbols). What would be the best way to decrypt such a message?

Thanks


texts:
Given:

$eG=P$, $kG=(r,y)$

ECDSA signature transmits (r,s) and does this calculation:

$u = \frac{z}{s}$, $v = \frac{r}{s}$

$uG+vP=(r,y)$ means the signature is valid

Why do we transmit $s$ and not $s^{-1}$?

Currently, $s=\frac{z+re}{k}$, why not $s=\frac{k}{z+re}$? The equations would all go through:

$u=zs$, $v=rs$

$uG+vP=zsG+rsP=zsG+rseG=(zs+rse)G=s(z+re)G=\frac{k(z+re)}{z+re}G=kG=(r,y)$

Given that finding the inverse is very expensive computationally, what are we gaining by transmitting $s$ instead of $s^{-1}$?


texts: Using IV buffer after altered inside a Rijndael CBC Encryption/Decryption process as IV for next message?

texts:
When sending a block to be decrypted or encrypted, with RijndaelCBC, we input the data to decrypt/encrypt and an IV for syncing and to prevent identical outputs for identical inputs.

This question is regarding to any loopback mode use of AES chipher block using an IV, but my experience is with CBC.

Inside the RijndaelCBC "machine", (model), the input IV is processed and changed through a number of XORS with an end result (logically) different from the input IV.

Because of the symmetric nature of RijndaelCBC the encryption process and decryption process will both change the input IV to a different valued buffer then the original but an identical result for both processes.

My questions are:

Does this "Output IV" holds information that can have private key or plain data value inferred from?
Is using the IV in such a way, which can keep both sides of a Rijndael secured communication link sync data (IV) up to date without the need of sending the IV over communication (Although it is not secret), is a known and used approach?

Example for the second question:

Variables: PrivateKey, StartIV
Box A and Box B are connected on a Rijndael secured link.
User Ainputs and receives data from Box A, while User B inputs and receives data from Box B.

User A → Plain Data → Box A →
Enc(Plain Data,PrivateKey,StartIV) →
OutputIV, EncedData → SecuredLink

User A sends plain data to box A, it is then encrypted using a starting IV and private key, saving the output IV from the encryption operation, while sending the encrypted data to Box B through the secured link.

SecuredLink → EncedData → Box B →
Dec(EncedData, PrivateKey, StartIV) →
OutputIV, Plain Data → B User

Encrypted data received from the secured link in Box B which then decrypts the encrypted data, using the private key and start IV, to plain data; saves the output IV and sends the plain data to the user.

User B → Plain Data → Box B →
Enc(Plain Data, PrivateKey, OutputIV) →
NextOutputIV, EncedData → SecuredLink

User B sends plain data to box B, it is then encrypted using the OutputIV, (Generated output from decrypting the message arrived from Box A), and private key, saving the output IV from the encryption operation as the next output IV, while sending the encrypted data to Box A through the secured link.

SecuredLink → EncedData → Box A →
Dec(EncedData, PrivateKey, OutputIV) →
NextOutputIV, Plain Data → User A

Encrypted data received from the secured link in Box A which then decrypts the encrypted data, using the private key and the OutputIV, (Generated output from encrypting the message that was sent to Box B), to plain data; saves the output IV as the next output IV, and sends the plain data to the user.

Now i might be very naive but i don't understand why not to use this approach and save the syncing operation over communication.


texts: Is it acceptable to write the nonce to the encrypted file during AES-256 GCM?

texts:
I've used AES-128 in CTR mode in the past and using the same key but different IVs for each file, I wrote the IV to the first 16 bytes. Is it safe to do so with the nonces used in AES-256 GCM? I'm using the word nonce here because that's what is declared in the Sodium library.

Are the uses for IVs and nonces exactly the same?

Also, is there any use in providing additional authenticated data? Should I keep it NULL?


texts: How is the time intereval calculated for symmetric key re-negoatition in UK Security Standard – Use of Cryptography?

texts:
According to point 10.6.4 (Encryption in Transit) in Security Standard –Use of Cryptography, one of the criteria for key renegotiation is timeout ,

Encrypted sessions MUST re-negotiate new symmetric keys after one of
the following criteria is met:

The “counter” in CTR or GCM mode has exhausted all possible unique values for the initialisation vector. The standard deployment using
AES permits 64GB of information to be passed and no more;
8 hours have passed, which is a best-practice requirement to prevent initialisation vector re-use where the exact amount of data
transmitted cannot be trackedand/or different modes are used.

Question 1. How is the value of 8 hours obtained ?what are the inputs to the calculation?


texts: Does a man-in-the-middle attack apply in this scenario?

texts:
Disclaimer: I am aware that the question's title does not adequately describe what I am asking, but it is the best I could come up with. Any improvement is welcome.
I am a university student studying for an upcoming cryptography exam, and I came across this unsolved exercise. I have various questions that stem from it.  Unfortunately, my professor is unavailable, and I cannot contact her. So I would appreciate some clarification as to whether my approach is correct and whether there are many right answers.
Consider the following system for the communication of a group of nodes. This group has a standard number of M members that each have a unique id. A central entity CE also exists for the facilitation of node communication.
When a member Mi is accepted into the group, they produce a key pair KiPUB and KiPriv, and share their public key and id with the CE.
When a member of the group wishes to communicate with another member, it sends the id of the intended receiving node to the CE and gets back the receiver's public key. The message is then encrypted with said public key and sent.
a.  If you have access to the communication path of Mi with CE or any other node, but cannot meddle with the contents, can you decrypt messages sent by Mi?
My initial answer to that is no. The attack that makes sense to me is the man-in-the-middle attack, and it needs to be able to change the messages sent. However, it is unclear whether the man-in-the-middle has to be an entity "formally" incorporated into the system, into the communication process. If so, then it does not apply, and some other attack would be appropriate for this scenario.
b.  You can now alter the contents of Mi's communication with other nodes and CE. Can you do that without being detected? Can you now decrypt the messages sent?
My answer to that can be easily derived from the one in question a. my problem is if man-in-the-middle does not have an effect here, my whole reasoning falls apart.
c.  How would you change the system so that every node stores every other node's public key to protect from such attacks? What memory demands would that system have compared to the existing one?
It seems unlikely that all that is required as an answer is "have each member send all other members its public key via a secure channel," and at the same time, I'm not sure how much further beyond that I am supposed to go.
As for storage, compared to the $M$ number of keys CE would have to store, $M$ being the number of members, each member now has to store all member public keys, so it changes to $M^2$.
To clarify, this is not an exercise that will be graded, just one that I'm trying to solve to understand the material better and clarify my thinking on the matter. If you downvote my question, please provide a comment with the reason. I am looking for some pointers and explanations, as the theoretical approach doesn't seem to be enough for me to figure this out.


texts: How to extract the keyword from a mono-alphabetic substitution cipher

texts:
I am a beginner to cryptography and I have the following question.

I know that to extract plaintext from a mono-alphabetic substitution cipher I can perform shifting the characters by $n$ times until I have the plaintext, or I can also use the frequency letter analysis.

However, by doing this I'm getting only the plaintext and not the keyword that been used. The answer might include creating a table with the alphabet linked to the corresponding letters used in ciphertext by following the frequency letter analysis but I'm not sure how this works.

Can someone explain to me how I will be able to get the keyword?


texts: Generating HMAC-SHA256 - is this procedure secure enough?

texts:
I have 256-bit value (call it "{Secret Value}") and I would like to compute HMAC-SHA256 digest of this value to check its integrity, and second requirement is to  minimize need of another artifacts for this process.

I have an idea that do not need any other artifact but {Secret Value}:

Compute PBKDF2 key from {Secret Value}, and as a salt use first 64 bits of my {Secret Value}
Key computed in step 1 use as key for HMAC-SHA256 and as value use {Secret Value}

Another option in step 1 is compute another PBKDF2 key for salt value from {Secret Value}.

I need to create this integrity digest to check if {Security Value} comming from user is the same as value I have in database.

Is this approach secure enough?


texts: Best choice out of these six TLS cipher suites

texts:
I have a small embedded platform that supports 6 TLS ciphers. Is there a good/better/best one to chose?

I was looking around on the web for some kind of rating system or list of ciphers that have known weaknesses, but I couldn't find much.

Back to my project, I used the Wireshark tool to capture the "client hello" when authenticating with the server, and my (slim) options are as follows:

TLS_RSA_WITH_RC4_128_SHA (0x0005)
TLS_RSA_WITH_RC4_128_MD5 (0x0004)
TLS_RSA_WITH_AES_128_CBC_SHA (0x002F)
TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032)
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000A)
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013)

I have heard triple DES, RC4, and MD5 are insecure, so should I be avoiding ciphers with those algorithms? Does this leave me with cipher suites TLS_RSA_WITH_AES_128_CBC_SHA and TLS_DHE_DSS_WITH_AES_128_CBC_SHA?


texts: Reversing decryption function involving XORs and bit rotations?

texts:
I am trying to reverse this equation to find the encrypted number given to it. Here is the equation:

$$y = x \oplus n \oplus (x \ggg 3) \oplus (x \lll 7) $$

$\oplus$ is the bitwise exclusive or function
$a \lll b$ is $a$ bit rotated left by $b$ bits
$a \ggg b$ is $a$ bit rotated right by $b$ bits

$y$ is a known 32 bit integer
$n$ is a known 32 bit integer but unique for every $x$ and $y$
$x$ is the encrypted message and what I want to solve for, and it is an unknown 32 bit integer


texts:
In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about DES algorithm the authors say that:

  "If double encryption is equivalent to single encryption, then the
  (single encryption) cryptosystem is much less secure than one might
  guess initially"

The authors don't explain what this means and why. Are you able to tell me ?


texts: Knapsack Public to Private (Superincreasing knapsack)

texts:
I need to convert a hard knapsack to a superincreasing knapsack.

I have these superincreasing values (3,6,11,22,43,87).
I also have w = 7 and n = 173.
I converted the superincreasing values to hard one (21,42,77,154,128,90)
by computing $a_i = x_i * w \bmod{n}$.

(3 * 7) mod 173 = 21
(6 * 7) mod 173 = 42
(11 * 7) mod 173 = 77
(22 * 7) mod 173 = 154
(43 * 7) mod 173 = 128
(87 * 7) mod 173 = 90

Question

I want to ask how can I get the superincreasing values if I have hard one.

example

Can I convert (21,42,77,154,128,90) to (3,6,11,22,43,87) with $w = 7$ and $n = 173$?
Or how can I find the x_i if w = 7 and n = 173?

(x1 * w) mod n = 21
(x2 * w) mod n = 42
(x3 * w) mod n = 77
(x4 * w) mod n = 154
(x5 * w) mod n = 128
(x6 * w) mod n = 90


texts:
I'm writing a wrapper for a chat program to allow for end-to-end encryption. I'm using Python and PyCrypto to accomplish this. I'd like to use a well known library to do this, but to my knowledge, none exist that do what I'm looking for.

Here's the design of the handshake protocol.

Alice and Bob have previously generated long-term RSA-2048 keys $A$ and $B$ for signing. Alice initiates an encrypted connection with Bob by creating a new session RSA-2048 key $S$. Alice signs $[S_{public}, \text{"Alice"}]$ with $A_{private}$ using PSS padding to get $Sig_A$.

$$[A_{public}, S_{public}, \text{"Alice"}, Sig_A]$$

Revision: Alice includes her identity in the signature.

Side note: The generation of a new RSA-2048 key is for forward security. I realize generating a new RSA-2048 key is inefficient, but I have no good way of using ECC or Diffie-Hellman.

Bob then verifies $Sig_A$, rejecting the connection if it fails. Bob then matches $A_{public}$ against a list of known trusted keys. Bob then generates a random 512-bit shared secret $Sec$ and encrypts it with $S_{public}$ using OAEP padding to get $EncSec$. Bob signs $[EncSec, A_{public}, S_{public}, \text{"Alice"}, \text{"Bob"}]$ with $B_{private}$ using PSS padding to get $Sig_B$, and then sends the following:

Revision: $A_{public}$, $S_{public}$, and both party's identities are included in SigB.

$$[B_{public}, EncSec, \text{"Bob"}, Sig_B]$$

Alice verifies $Sig_B$, rejecting the connection if it fails. Alice matches $B_{public}$ against her own list of trusted keys. Alice decrypts $EncSec$ with $S_{private}$ to get $Sec$.

Revision: Alice signs $[EncSec, B_{public}, \text{"Alice"}, \text{"Bob"}]$ as $Sig_C$ and sends this to Bob. Bob then verifies $Sig_C$ and rejects the connection if it fails.

At this point, the users would each get a notification showing the fingerprint of the person they are talking to, and whether or not they have been matched against a known list of trusted keys. Fingerprints are generated as $SHA256(RSAPublicKey)$ truncated to 16 hex characters, with a colon added every 4 characters. This fingerprint can be verified with some hard-to-spoof method, such as a phone call.

Alice and Bob have now verified each other's identities and shared a secret value. They both derive encryption and MAC keys like this.

$$EncKey = HMAC_{SHA256}("0", Sec)$$
$$MACKey = HMAC_{SHA256}("1", Sec)$$

Note that the "0" and "1" are strings of length 1 each, not the literal numeric values 0 and 1.

Encrypting and sending a message happens like this. (Assuming $M$ is the message, and $Rand(x)$ is a cryptographic random number generator that returns $x$ random bits)

$$IV = Rand(128)$$
$$C = AES_{CFB}(M, EncKey, IV)$$
$$MAC = HMAC_{SHA256}(IV || C, MACKey)$$

$IV || C || MAC$ is then transmitted. On the receiving end, $MAC$ is checked, and the message is rejected if it fails. Otherwise, the message is decrypted and displayed.

Are there any problems with this? (Other than the obvious "don't roll your own crypto", as I'm fairly backed into a corner here)


texts: Question regarding reconstruction vector in LSSS

texts:
Suppose we have a policy $A \wedge ( D \vee (B \wedge C))$ with attributes ${\{A,B,C,D}\}$. The set of subsets of attributes which satisfy this policy is ${\{{\{A,D}\},{\{A,B,C}\},{\{A,B,D}\},{\{A,C,D}\}}\}$ of which ${\{{\{A,D}\},{\{A,B,C}\}}\}$ is the set of minimal subsets.

We convert the above boolean formula into a LSSS matrix $L = {\{{\{1,1,0}\},{\{0,-1,1}\},{\{0,0,-1}\},{\{0,-1,0}\}}\}$ according to this(Pg. No 30).

I have a question regarding the yellow marked line taken from this(Page No. 7).

$\textbf{Is the resulting 0 a vector in $w \cdot M_i$ ? Is the first entry of the vector $w$ -1? }$
$\textbf{How do one go on to calculate this $w$?}$. It will be helpful if anyone can explain using the above LSSS matrix above and the unauthorized subset ${\{A,B}\}$.


texts: Securely start a client server connection without ssl/tls

texts:
NOTE: Pardon my ignorance of encryption, I learned about these concepts today
Going to rephrase this question, but I think I already have fine answers provided.  I need to have a block of data containing a message (user imputed) that is included in what I want to encrypt.  I also need to have some means of authenticating the user, such as a password.  The password will most likely be hashed for extra security.  I am considering using a RSA public and private key pair of which the attacker can know, but wont be able to use, as he/she will need to authenticate themselves with a password of which they cannot know.  Both the message (which I do not want the attacker to know) and the hashed password will be included inside the RSA encrypted data block (aka: RSA('message block', sha256('password')) ).  Right now, my main question is if this is secure or not.


texts:
I just read about the AES MixColumn step, which can be calculated as:
$$b(x)=c(x)a(x) \pmod{X^4 +1}$$
$a(x)$ is the column to encode and $c(x)=3x^3+x^2+x+2$
My question is: how did they calculate $c(x)$?


texts: The Boneh-DeMillo-Lipton fault attack (RSA CRT)

texts:
I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature.

Suppose that we sign a message $m$ with RSA-CRT :

$d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$

$s_p = h(m)^{d_p} \bmod p$ and $s_q \not= h(m)^{d_q} \bmod q$ where $h$ is a hash function

By CRT we get $s$ the signature modulo $n=pq$

I don't understand the following assertion :

As $s^e \equiv h(m) \pmod p$ but $s^e \not \equiv h(m) \pmod q$ we can factorize $n$ by $p=GCD(s^e - h(m), n)$.

Can somebody explain to me why $p$ is the greatest common divisor between $s^e - h(m)$ and $n$?


texts: What does "the input difference of each Sbox should be zero" mean?

texts:
While going through the article, The MALICIOUS Framework: Embedding Backdoors into Tweakable Block Ciphers. I came across this statement

in order to have a deterministic differential characteristic all Sboxes must be differentially inactive (i.e., the input difference of each Sbox should be zero)

What does the input difference of SBox mean?


texts: How do Käsper and Schwabe's Bitsliced AES Mixcolumns work?

texts:
The only way I see it possible to do the matrix-multiplication in the MixColumns operation of AES is by shifting the bits in the multiplied number, and then reduce with the polynomial if needed.

This can be done in constant time for a bitsliced implementation as shown below in C-like pseudo-code (the example is for multiplication by $3$ in $GF(2^8)$):

vector bit[8] = "bits from a bitsliced byte";
vector new_bit[8];

//First multiply with 2 in GF(2^8) with polynomial x^8+x^4+x^3+x+1:
new_bit[0] = {0} ^ bit[7];
new_bit[1] = bit[0] ^ bit[7];
new_bit[2] = bit[1];
new_bit[3] = bit[2] ^ bit[7];
new_bit[4] = bit[3] ^ bit[7];
new_bit[5] = bit[4];
new_bit[6] = bit[5];
new_bit[7] = bit[6];

//XOR M2 with original bits to get the result for multiplying with 3
for (int bit = 0; bit < 8; bit++){
 new_bit[i] = new_bit[i] ^ bit[i];
}

However, this does not seem to be the way that Käsper and Schwabe do it in their bit-sliced AES MixColumns operation. Instead they are doing rotates. I have read their paper and looked at the layout of their bit-sliced state, but I'm unable to understand, how they arrive at those equations. If someone understands it, could they perhaps help a poor soul out there to understand it too? Just sending me in the direction for a paper that explains it more in depth would mean the world to me as well!

I'm currently trying to implement a bit-sliced mix columns implementation for a cipher other than AES (I'm trying to bit-slice the primates cipher: http://primates.ae/wp-content/uploads/primatesv1.02.pdf), and have currently made the "simple" MixColumns that I described. I'm curious in whether it can be done better, after having seen that they do it differently in their AES implementation. There's not the same symmetry in this MixColumns matrice, so I doubt a bit that it is possible.

EDIT: Here is a link to their AES implementation paper: https://www.iacr.org/workshops/ches/ches2009/presentations/01_Session_1/CHES2009_ekasper.pdf


texts: Are there practical upper limits of RSA key lengths?

texts:
Suppose one wanted to use RSA encryption for the sole purpose of sending key bits for use in symmetric crypto systems, a dedicated key exchange system so to speak.
And say you didn't think that the presently used RSA key lengths were going to be secure in ten or fifteen years.

What would be some of the technical difficulties (hardware and or software) of of using an RSA key length of say a million bits?

Assume that you are designing this from scratch and you have a clean slate as to your hardware-software design options. Also assume that you don't care if it takes 24 hours or so to encrypt or decrypt the information.


texts:
I am currently doing a research paper on the Blowfish encryption algorithm and one of the components that I need to include is time and space complexity.

I have tried reading academic articles and journals, but they have the complexity in the matter of kilobytes.

Would anyone have an idea on what is the time and space complexity of the Blowfish encryption algorithm in Big-O notation?


texts: Verifying the ownership of curve25519 public keys

texts:
Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. Each user keeps a database of public keys of the other users but it needs first to verify that the other users actually own the claimed public key.

Can I use libsodium to verify the ownership of the keys? Let's say the flow of verifying the ownership of the key (or let's call it authentication) works as follows:

The claimant sends the verifier its public key.
The verifier generates a long random binary challenge (let's say 128 or 256 bits) and encrypts it with the sealed box method crypto_box_seal() as illustrated in https://libsodium.gitbook.io/doc/public-key_cryptography/sealed_boxes and keeps the plaintext challenge in some private database.
The claimant receives the encrypted challenge and decrypts it with crypto_box_seal_open() and sends the verifier back the plaintext answer
The verifier checks the received answer and compares it with the expected answer stored in its database. If they do match then the public key really belongs to the claimant and it gets stored in the verifier's database.

Is is this flow correct? Can it be shorter since curve25519 keys are usually implemented only for encryption and not signing purposes? So users can just upload the signature of their own public keys in step no. 2 and thus we can skip the additional request from the verifier to the claimant in step no. 3?


texts: Is the use of a 4-round Blake2b permutation in OPP justified?

texts:
The  MEM-AEAD construction uses a 4-round Blake2b permutation in masked Even-Mansour mode as a (tweakable) block cipher.

4 rounds of the Blake2b permutation are already broken to my knowledge.  Why are the designers justified in their choice?


texts:
Currently my padding is adding a string of random characters

$ l(N)/3 - (l(M) + 1) $

Long and just adding it to the messages, is this sufficient?

$l(x)$ = length of a variable


texts:
Aremed with only basic crypto knowledge, I'm trying to understand the security benefits of LUKS over plain-mode dm-crypt. Hopefully this is a good place to ask.

Given the LUKS header contains information describing how the payload is encrypted, would it not be more secure to use plain dm-crypt instead?

I'm thinking that a plain device will just look like random data and won't have a label attached that tells all that it's encrypted data and what the cipher and other details are. Plain mode allows plausible deniability where as LUKS doesn't.

The LUKS header not only contains the master key (albeit it stretched and encrypted) but it also contains up to eight attack vectors that can be used to get the master key. Yet, underlying all this, the same dm-crypt engine is used to encrypt both the plain and luks payloads.

Therefore, attacking a plain or luks payload could be done directly (however impractical that may be), but LUKS throws in some additional ways to crack the data whereas plain-mode gives nothing away.

I guess it may boil down to the fact that a user of plain mode will need to have the actual key and may not store it securely or use a pass-phrase that is only hashed simplistically, whereas a user of LUKS mode will never have the actual key but will use a pass-phrase that is put through a salted iterative key derivation function.

So, is LUKS less secure than plain dm-crypt ?


texts: Zero-knowledge proof for the product of additive Paillier ciphers

texts:
Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key.

Alice computes $E(\sum x_i)$ from the product of the cipher values she received.
Alice sends $E(\sum x_i)$ to Bob for decryption, but she needs to prove that she used all the cipher values she received to form the product $E(\sum x_i)$ for Bob to return the plain text $\sum x_i$.

What should each entity: $i$ send along with their share $E(x_i)$ for Bob to be able to do such verification, and how could he do it?

Note: $x_i$ values are not merely $0$ or $1$. They can take any integer value.


texts: References on lattice-based cryptography

texts: I need earlier references (books, articles, etc) on lattice-based cryptography, and any advice will be helpful to me. I am reading Stinson & Paterson's Cryptography: theory and practice. Thanks in advance.


texts: Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

texts:
My question refers to EdDSA as specified in RFC 8032.

I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ed25519ph the hash of the message is signed.

Step 2 of the Sign process is:

$SHA-512(dom2(F, C) || prefix || PH(M))$

where in the case of ed25519 the $PH$ function is the identity function and in the case of ed25519ph its for example an implementation of SHA512. However, the part I am curious about it that this isn't the only difference between the two.

According to the RFC $dom2(F,C)$ actually is also different:

  dom2(x, y):
  The blank octet string when signing or verifying
                    Ed25519.  Otherwise, the octet string: "SigEd25519 no
                    Ed25519 collisions" || octet(x) || octet(OLEN(y)) ||
                    y, where x is in range 0-255 and y is an octet string
                    of at most 255 octets.  "SigEd25519 no Ed25519
                    collisions" is in ASCII (32 octets).

What's the reason for that?
If this wasn't the case one could construct ed25519ph by simply hashing the message and passing it as input to an implementation of ed25519. The way its specified this construction wouldn't be compatible to an implementation of ed25519ph (because of the dom2 prefix).


texts: Perfect Forward Secrecy Stream Cipher based on Block Cipher

texts:
I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not comprimse data encrypted earlier without knowing the seeding parameters (Key, IV). A stream cipher would be preferrable to a block cipher, because this way one could guarantee that there are no incomplete blocks of data waiting for encryption.

Exemplary non-solutions:

Generating a pseudo-random one-time-pad-like key stream and saving this encrypted asymetrically might solve the problem, but does not seem to be very efficient; more practically one might pre-generate key blocks using a stream cipher, and only encrypting the IVs. I'd expect that there might be a known solution using symmetric ciphers (e.g. AES) too, but I can't seem to find one.
Common cipher modes do not seem to be suitable, since all of them use a constant key for the AES encryption, which allows to revert all encryption already done.
I reckon that this cannot work well with a constant key -- only discarding the IV from memory would not prevent reconstructing it; replacing a counter mode counter with a non-revertable hash chain would be susceptible to partial-known-plaintext-attacks (e.g. predictable video headers) and using an PRNG instead of a counter would only relocate this problem to finding a suitable PRNG that is not susceptible to a leaked internal state (e.g. by still having its seed in RAM).
Some similar ideas have been documented by https://bitslog.com/2013/02/22/block-ciphers-modes-with-forward-secrecy-for-cryptocatotr/ for the OTR protocol.

Is there a trivial reason why the common block cipher modes appear to only vary the plain text input of the block cipher, but never the key?

Is there maybe a well-known block cipher mode providing such a stream cipher that I failed to identify as such?


texts: How to bruteforce password from HMAC-SHA256 hash (if you have the key)?

texts: Short of creating one's own script / program, is there an existing, readily available way of iterating through a list of potential passwords to find which one corresponds to a hash (HMAC-SHA256), assuming you have the key it was generated with? This is in asp.net. For the sake of this question / instance, no salt has been used.


texts: Is a random string good for an AES-256 instance

texts: I have a randomly generated string of about 256 characters long. This string is hashed to for a key and initialization vector for a program running on the .NET framework 4.8. Is this method secure from a professional point of view?


texts: How to verify a root of high degree polynomials?

texts: If I want to verify a root of a  polynomial that has degree $n$, I must to compute the $x^n, x^{n-1}...x, 1$.It seems to be inefficient. Is there any method to do this without computing many power?


texts: Is it reasonable to assume that $\text{Keccak-}f[25n]$ block permutation is defined for any value of $n$?

texts:
Wikipedia contains the following claim for $\text{Keccak-}f[25w]$:

  It is defined for any power-of-two word size, $w = 2^ℓ$ bits.

Although all official descriptions of Keccak do not explicitly mention well-definedness of $\text{Keccak-}f[25n]$ for any $n$ above $64$.

So I have two related questions:

Can we assume that $\text{Keccak-}f[25n]$ is a well-defined function for arbitrarily large $n$?
What stops $\text{Keccak-}f[25n]$ from being a well-defined function even if the lane size $n$ is not a power-of-two number? In this case, we can simply calculate the required number of rounds as $$12 + 2\lceil \log_2 n \rceil,$$ where $\lceil x \rceil$ denotes a mathematical ceiling function. (Of course, round constants and rotation offsets will also be recalculated for the corresponding value of $n$.)


texts: I'm doing some research into the RSA cryptosystem but I just need some clarity on how it worked when it was published in the 70s. Now I know that it works with public keys but did it also work with private keys back then or did it use a shared public key first and then private keys were introduced later?


texts: What advantage is there for using a nonce and a timestamp?

texts: I know both nonces and timestamps are used to prevent replay attacks, and nonces may offer increased security in the situation a message could be replayed with the timestamp in the allowable window. However, if a nonce can provide all the protection a timestamp does, why would they ever be used together?


texts:
Alice and Bob have agreed to use the Three Pass Protocol.

p=1009

Alice chooses the encryption exponent

e_A = 101

Bob chooses the encryption exponent

e_B = 209

Now Alice and Bob send three encrypted messages: y1, y2, and y3 in this order.

Which of the following are possible solutions?

a. y1 = 471, y2 = 27, y3 = 14 is possible

b. y1 = 27, y2 = 471, y3 = 14 is possible

c. y1 = 471, y2 = 14, y3 = 27 is possible

d. y1 = 27, y2 = 14, y3 = 471 is possible


texts: Key wrapping - encrypting many times with AES-GCM

texts:
When encrypting many short plaintexts with a single key, lets say about 2^64 total plaintexts at under 64 bytes each: (edit note - was 2^70 in the original question)

Is there a way to use AES-GCM, as specified by NIST Special Publication 800-38D, safely in this scenario?
Is is safe to use when there are no IV collisions, e.g when the IV is a counter?
Is it possible to use a larger IV while still adhering to the NIST specs, possibly large enough to collisions even with random IVs?

Does this change if the plaintexts are high-entropy, for example when wrapping keys?


texts: Why are MACs not included when defining Protocols?

texts:
I see often in literature related to cryptographic protocols that MACs (Message Authentication Codes) are not included in protocol definitions.

For example:

A -> S: {TA, B}KAS
S -> A: {TS, KAB, B}KAS
S -> B: {T'S, KAB, A}KBS

Shouldn't it be defined as follows ? (Encrypt-then-MAC + using second key for MACs)

A -> S: {TA, B}KAS, [{TA, B}KAS]KAS'
S -> A: {TS, KAB, B}KAS, [{TS, KAB, B}KAS]KAS'
S -> B: {T'S, KAB, A}KBS, [{T'S, KAB, A}KBS]KBS'

Isn't integrity a concern, or do protocol analysts generally assume that cipher-text cannot be modified at this level of protocol abstraction? Do you exclude ciphertext-only attacks?


texts:
At Blackhat 2013 this week, there was a talk saying RSA is (essentially) doomed in the near future.

networkworld.com ~ “Black Hat: Elliptic curve cryptography coming as smarter algorithms threaten RSA”

What "two devastating attacks in the past 6 months" is Mr Ritter referring to, and how real is the threat to RSA?


texts: How to check the strength of an encryption algorithm?

texts: I asking for advice on how to check strength of an encryption algorithm.


texts: How many bits of an exponent are leaked when doing a powmod?

texts:
How many bits of the exponent $x$ are leaked when you calculate and reveal $g^x \pmod p$ for some generator $g$ of $\mathbb Z^∗_p$?

The low bit of $x$ is obviously leaked: the low bit equals $1-\frac{\left(\frac{g^x}{p}\right)+1}{2}$, with parentheses representing the Legendre symbol.


texts: Understanding multiplication of Shamir secret sharing during threshold (EC)DSA signing

texts:
I have been looking at the threshold (EC)DSA schemes for honest majority by Gennaro et al. https://www.sciencedirect.com/science/article/pii/S0890540100928815. In the scheme, there are steps where we wish to open the product of Shamir secret sharings. So for example [a],[k] are degree-t sharings of a,k respectively, each party i holds shares [a]_i, [k]_i, and we wish to reveal the value a*k to all parties. The paper explains that while parties can compute [a]*[k] locally, this does not yield a random degree 2t-sharing of a*k (in particular, the polynomial underlying the sharing can not be irreducible) and so revealing [a]_i*[k]_i could leak information about a and k. To get around this, parties additionally hold shares of a degree-2t sharing of 0, denoted here as [z], which they add to their shares of [a]_i*[k]_i to re-randomize it. All parties therefore reveal their shares of [a]_i*[k]_i + [z]_i, from which ak (and the polynomial it lies on) can be interpolated.
I understand that taken by itself [a]*[k] + [z] is a random degree-2t polynomial with constant term ak and so doesn't leak any information about a or k. However, here the attacker also knows shares of [a],[k], and [z] and what I'm struggling to understand is how to argue that [a]*[k] + [z] is a random sharing and doesn't leak anything conditioned on this knowledge. For example, working in a field of size q, if the attacker controls t replicas it can reduce the possibilities for the polynomials sharing [a],[k] to sets of q possibilities each, and [z] to a set of q^t possibilities (since they know t shares of [z] plus point at 0). So this gives q^(t+2) possibilities for the polynomial underling[a]*[k] + [z], which is less than the q^2t possibilities there would be for the polynomial underlying a random sharing of ak.
I know this is quite a standard trick that I've seen in other papers so I must be missing something, but I haven't been able to find a detailed proof of why this works. If anyone could help me understand the intuition behind this that would be much appreciated.


texts: As I understand it, ChaCha20 is slower than AES-CTR in hardware.  Are there any hardware-optimized stream ciphers?