texts: Hashing based on the discrete logarithm problem

texts:
At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup).

Additionally, $H(x)$ is homomorphic since $H(x+y)=H(x)+H(y)$, which could prove to be a useful property for a hash function in some applications.

What are some of the disadvantages or vulnerabilities that makes such a hashing scheme not popular in practice?


texts: What is the malicious potential of a key-substitution-attack?

texts:
What is the idea behind a key-substitution-attack?

We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$:

$v(m, s, y)= ok$

Now, by some mathematical magic (details are not relevent for the moment), an attacker shall be able to generate a new public key $\bar y$, so that

$v(m, s, \bar y)=ok$

However, I cannot identify the malicious potential of that attack: The recipient, getting $(m, s)$ will still use the original public key $y$, to verify $(m, s, y)$, so what is going to be compromised from the attacker just having such key $\bar y$ ?


texts:
It has been explained to me by IT that there is no such thing as totally secure email - but rather a spectrum.

If systems are secured via https and SSL what degree of encryption/security are we talking? I read somewhere that SSL is about encryption during transmission - but is thisthe same as having end to end encryption?

(If my questions aren't clear I will try and clarify as best I can.)


texts:
If I have a AESX-192 be a block cipher which is similar to DESX but has the DES being replaced by AES and the AES key size is 192 bits.

How should I compute the total effective key length of the AESX-192.


texts: Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

texts:
I just learned that using CBC encryption with an IV which is predictable is not secure.

From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can verify if the IV he guessed was right. How does this qualify as an attack?


texts: Is matrix elliptic curve discrete logarithm problem quantum-safe?

texts:
I can't be the first one to think of this and there must be a reason nobody design cryptosystem off this problem.
Let's define MECC as matrix of elliptic curve points, and MI as matrix of non-negative integers.
Given a MECC $G$, MI $v$, and MECC $P=v\cdot G$. How would a quantum computer calculate $v$ from $P$ and $G$?


texts: What is a fast good-uniformity hash function that if it's seed and it's hash values are unknown, can be strong as cryptographic hash functions?

texts:
The hash function is for an application that the input to the hash function is from a user's, hence the user can control the collisions, but the question is that if the collisions, the hash function's outputs, the hash function's seeds are unknown for the user, can there be a (fast and good uniformity) hash function that will prevent the user from making intentional collisions, even if the user knows the hash function name?

I thought CRC would fit here because of it's error-detecting ability (requiring good uniformity and diffusion), but it's somewhat slow on architectures that doesn't support CRC instructions, and above that I am not sure that it's secure enough if it's initial value is unknown.

Is there such hash function that fits the requirements (fast, uniformity and secured for such case)?


texts: Is there is a way to calculate the public key from the private key in pqNTRUSign algorithm?

texts: There is source code of this algorithm (https://github.com/NTRUOpenSourceProject/NTRUMLS). But this algorithm does not provide a function for generating a public key from a private key. Studying the function pq_gen_key in src/pqntrusign.c, I did not see how it can be done.


texts: What is the purpose of Pseudorandom Function Families (PRFs)?

texts: I'm currently in a course in Cryptography, and was wondering why pseudorandom function families exist at all. If there existed one pseudorandom function f(x), based on its definition, could that not be used in all cases where a pseudorandom function is needed? Why would pseudorandom functions ever need to be sampled from a family of functions?


texts: Is it an overkill to add external integrity check to the AES-GCM encoding?

texts:
There is a java library for android which implements integrity checking to predefined encrypting mode(which can be found here).

  Short class description from author page to avoid further questions about code.

  Algorithm & Mode: AES 128, CBC, and PKCS5 padding. We use a 128 bit key size for its widespread support and because it’s not clear that
  256 is stronger. We would have picked GCM for its built-in integrity
  checking, but that’s only available since Android Jelly Bean, which
  leaves out about 1/4 of active Android devices
  IV Handling: We securely generate a random IV before each encryption.
  Key generation: Random or pasword-based.
  Integrity: We’ve also added more-or-less transparent integrity checking in the form of a SHA 256 MAC with a constant-time equality
  check. This is in the form of a “combined key” where 128 bits of the
  key are used for encryption and 256 bits are used for integrity, then
  the keys are kept together.

As stated before, it's possible to use AES-GCM, which already have built-in integrity checking.

So, the question is: Are there any (dis)advantages of adding external integrity check to AES-GCM (in theory, or practically)?

To sum up already mentioned comments:

  Disadvantages:

  loosing the speed advantage of AES-GCM;
  performance/space use and extra complexity(i don't think that complexity is the case, as library is fairly simple);
  human factor:

  "Crypto is tricky: it’s hard to tell that the gibberish that’s being printed is not good crypto, and it’s hard to tell that the code example you picked up from {put any source name here you like} has serious flaws."

  Advantages:

  HMAC-SHA256 has stronger authentication than GCM(in-depth explanation here), among other things not leaking the key in case of nonce reuse

Thank you for your answers.


texts:
I have some issues understanding the original protocol proposed by Daniel J. Bernstein for Diffie-Hellman on Curve25519. On his web page he states to not validate remote public key, but at the same time enumerates a list of bad points for "some protocols". It does not state anything about zero check after scalar multiplication.

In another question I got linked to this article about validation, but I can not see a definitive conclusion explicitly telling to not validate inputs nor outputs.

Should Diffie-Hellman on Curve25519 be validated? By validation I mean to check that input public key is not a "bad point" and check for zero on scalar multiplication result.


texts: How is multiplication in field $GF(2^{8})$ done?

texts:
I am working on AES and I am stuck on multiplication in $GF(2^{8})$ field.

In terms of polynomial it is easy; I just have to multiply polynomials modulo $(x^{8} + x^{4} + x^{3} + x + 1)$. But I do not understand multiplication with $x$, following an example given in NIST specification:

  {57} • {13} = {fe}

solution:

  {57} • {02} = xtime({57}) = {ae}
  {57} • {04} = xtime({ae}) = {47}
  {57} • {08} = xtime({47}) = {8e}
  {57} • {10} = xtime({8e}) = {07},

thus

  {57} • {13} = {57} • ({01} $XOR$ {02} $XOR$ {10})
   = {57} $XOR$ {ae} $XOR$ {07}
  = {fe}

I am unable to understand a single step in this, please also explain the x_time() function too.

Also, how is $x^{i}$ calculated? I need this for the $rcon[i]$ matrix.

Edit: this question has been marked as a possible duplicate of Understanding multiplication in the AES specification. I have already read this but the explanation is not sufficient, I am unable to understand the concept hence I have posted this question, because I need a somewhat detailed answer.Thanks.


texts: Substitution ciphers amended with cipher block chaining: susceptible to frequency analysis?

texts:
I have been studying ways to amend a simple substitution cipher, and one of the toy suggestions was to use CBC in the following way:

identify each letter with a number from $0\ldots 25$
start with a random IV, i.e. just a random letter
add IV to the first letter in the plaintext, modulo 26, and then encrypt according to the old substitution rules

(then continue with CBC in this way, using modulo 26 arithmetic instead of XOR)
The resource then goes on to say that while this clearly can't be cracked by simple frequency analysis on letters, the ciphertext can be split into 26 sets, that is, the letters that follow each ciphertext letter, and then frequency counting can be done. Later on, the author reiterates that by partitioning the message into 26 groups that follow each ciphertext letter, frequency analysis can be done.
I've been trying to figure out what they meant by this. My main problem is trying to interpret the "26 groups that follow each ciphertext letter" part, and I didn't get anywhere with it. (Perhaps they meant grouping sets of 26 adjacent ciphertext letters together, and then modular arithmetic would ensure some repetition somehow? I don't really see how that would work, but I also don't see any other interpretations)
Would greatly appreciate any suggestions!


texts: Factors of the group order to secure against Pohlig-Hellman

texts:
I am looking into the security of Diffie-Hellman and the discrete log in general.

To make sure an attacker can not use Pohlig-Hellman to solve the discrete log quickly we need to make sure that the order of the group, $n$, has a large prime factor.

For Diffie-Hellman in $F_p$  this would mean that we should factorize $p-1$. Since we should take $p$ to be at least $1024$ bits, how are we supposed to factor $p-1$? is this not just as hard as the RSA problem?


texts:
Aumasson, Bernstein and Bosslet did an excellent job demonstrating fatal weaknesses in MurmurHash and CityHash, but what about SpookyHash?

My first uneducated guess is that it would be much harder to create collisions, but not impossible.

My second uneducated guess is that it would be impossible to create the massive kind of multi-collisions required for a HashDoS. That is, an attacker could possibly create two or three messages that hash to the same value regardless of the seed, but not hundreds or thousands. And since a moderate amount of collisions are expected anyway in any hash table and cared for, the attack would fail.

Am I correct about that? If not, would it help to mix the seed repeatedly
into the state, like here?


texts: Can we solve the Hidden Number Problem in $GF(2^n)$?

texts:
Is it possible to solve the Hidden Number Problem in extension fields? In particular in $GF(2^n)$?

Let's suppose an attacker knows some least/most significant bits of $r_i = a_i \times k$ in a given field $GF(2^n)$, for many uniformly distributed and known $a_i$ and a fixed and unknown $k$. Is it possible to recover $k$ ?

This is, as far as I know, an instance of the Hidden Number Problem originally introduced by Boneh and Venkatesan, used mainly to break digital signature schemes provided several signatures and partial knowledge of the respective nonces.

As far as I know HNP has always been applied in $GF(p)$, and furthermore the technique used to solve it, through Lattices and Closest Vector Problem, can't be easily adapted, IMHO, to $GF(2^n)$.

Rationale behind the question (not required for answering it):

I was comparing the authentications of GCM and Poly1305 in a specific, purely hypothetical, scenario where the attacker gets some knowledge of bits of the result of the authentication function, prior to the final addition of the encrypted nonce.

Let's assume we have single block messages.

Poly1305 authentication (without addition of encrypted nonce) is just:
$(c\times r)\mod {2^{130}-5}$ where $c$ is the message block and $r$ is the authentication key. I can see how to apply HNP to solve for $r$ in this case.

But GCM performs (I'm assuming to use an HW accelerator so that I can cheat in providing the final message with the aad and payload sizes):
$ (c\times h) \mod {x^{128}+x^7+x^2+x+1}$ where $h$ is the GHASH key. I don't see how to solve for $h$, having several partial information of the result for different and known $c$.


texts: Creating certificate: Where is my private key stored?

texts: I have some problems to understand the storage of my private key when a CA generates my key pair. Let's assume the CA creates my key pair, issues the certificate with my public key and signs it with the corresponding private key. So MY private key is first stored at the CA and after issuing of my certificate I will get my private key? Is that right?


texts: Function Secret sharing and sharing a truth table

texts:
I was reading a paper (Function Secret Sharing by Boyle, Gilboa and Ishai, PDF) on Function Secret Sharing and in that the author talked about a naive construction of a p party DPF wherein the truth table is additively shared.

What does it mean to share the truth table and how does it help?


texts: LWE status versus modern deployed crypto

texts:
LWE is the one of the most promising post quantum strategy.

How does parameters (key sizes, time for encryption etc) for LWE compare with modern deployed standards such as Factoring or discrete log based solutions for various problems such as:

Signature,
Key exchange,
Homomorphic encryption,
authentication,
various other practical problems?


texts: Is there a good reason not to mention that ECC is weaker than RSA on a quantum computer?

texts:
In most papers and other documents I see people are considering an ECC key of 256 bits equivalent to an RSA key of 3072 bits, which is true on a classical computer. But the amount of qubits required to crack RSA keys are estimated to be 2•bits while ECC is roughly 6•bits, which would make 256 bit ECC weaker than 1024 bit RSA.

|           RSA       |           ECC       |
| Key Length | qubits | Key Length | qubits |
|------------|--------|------------|--------|
| 1024       | 2048   | 163        | 1000   |
| 2048       | 4096   | 224        | 1300   |
| 3072       | 6144   | 256        | 1500   |
| 4096       | 8192   | 383        | 2300   |
| 15360      | 30720  | 512        | 3000   |

Source: https://security.stackexchange.com/a/96880

Is there a good reason to leave out that ECC is weaker than RSA on a quantum computer when writing a paper that involves comparing RSA to ECC? E.g. you want to promote the use of ECC over RSA.


texts: Let $ f : \{0,1\}^* \rightarrow \{0,1\}^n$ and $ g : \{0,1\}^* \rightarrow \{0,1\}^m$. $h$ is created by concatenate f and g: $ h : \{0,1\}^* \to \{0,1\}^{n+m}$ with $h(x) = f(x) || g(x)$. How do I prove that both $f$ and $g$ must be preimage resistant if $h$ is to be preimage resistant? Is the same true for 2nd-preimage resistance?


texts: Will knowing clear text value behind encrypted data help hacker find password?

texts:
I am building an Android App where I will be storing some encrypted data in a database. To ensure that the user has entered the right password, I have encrypted my own secret phrase and stored it in the database. Thus, I try to decrypt that using the entered user password to see whether it matches the clear text form.

Given that Android apps can be decompiled, to know my secret phrase, and assume encryption technique be figured out, will it be more useful for a potential hacker to know the clear text? I am using password based key generation (10,000 iterations) to do AES encryption.


texts:
Is there a way to find out the first few digits of the factors of the RSA numbers (RSA-1024 or RSA-2048)?

I do not want to get all the digits but only first 4-5 digits. My question is thus more precisely:

Is there a known, efficient, classical algorithm, that given a composite number, outputs the 4-5 most significant decimal digits of one of the prime factors of this number?


texts:
AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of this can be found on the GitHub pages of Miscreant  and on the IETF mailing list.

How does it compare to the other authenticated encryption (AE) algorithms? Does it have the technical potential to become a popular algorithm and overcome the other AE algorithms, that is, is it technically (security properties / performance) superior in (many?) aspects to other currently (somewhat) widely used AE schemes?


texts: What is the link between the parity check matrix, double-error-correcting codes and APN permutations?

texts:
I am currently reading a research paper (linked below) which mentions that a map $f:V:=GF(2^{m}) \rightarrow V$ which vanishes at 0 is APN if it satisfies the condition that it is a binary code $C_{f}$ with parity check matrix
$H_{f} =
\begin{bmatrix}
\dots & \omega^{j} & \dots \\
\dots & f(\omega^{j}) & \dots
\end{bmatrix}$
that is double-error-correcting (i.e. no fewer than 5 columns sum to 0).

From other sources that I found double-error-correcting also means that the minimum distance of the code should be 5.

However, I do not understand how all these definitions tie in together. Specifically, I do not understand how "no fewer than 5 columns sum to 0" ties in with the minimum distance of the code should be 5". Further, it would be great if anyone could clarify what "minimum distance 5" means.

An APN Permutation in Dimension 6


texts: How many known plaintexts are required to break a system with this property?

texts:
Suppose we have an $n$ bit block cipher $E$ with a key $k$ that has the following property
$$E(k; m_1⊕m_2) = E(k;m_1) ⊕E(k; m_2).$$
How
many minimum number of chosen plaintexts are required to decipher
(with probability 1) a given ciphertext (not from the list of ciphetexts
corresponding to the chosen plaintexts) without knowing $k$
and what would be those plaintexts be.
I figured replacing $m_2$ with a n-bit string of all 1's can give us $$E(m')=E(m)'$$ where $m'$ is one's complement of the bit string.
I cannot think of anything further than this. Not knowing the encryption algorithm seems to be a hurdle, although my teacher said it should not be.


texts:
I know it's possible with work backwards from the output bits of an LFSR to determine its feedback polynomial in a O(n) fashion.  I'm also curious if, given an LFSR state and polynomial, is it possible to quickly work out how far the LFSR state is from a given epoch state (eg: the all-ones state).  The only sure-fire method I know of is to run the LFSR forwards/backwards until the state is the epoch state and keep track with a counter.

Edit: thinking about this more, this would be equivalent to solving $S = M^NE$ quickly $N$, where $S$ is your current state, $E$ is the epoch state and $M$ is the companion matrix of the LFSR.  Anyone have a fast solution to the discrete logarithm problem in the ring of $KxK$ $GF(2)$ matrices?


texts: Why do we have fixed output length in the algorithm SHA1 . is there any explanation about that


texts: Can minimum encrypted message length be used to identify public key algorithm or derived some of its features?

texts:
Encrypting a very small message using public key cryptography always result in larger encrypted messages. Is it possible to deduce the algorithm used, key length, etc just by looking at the minimum encrypted message length?

More specifically, if I have black box system and when I input a small number of characters to encrypt I get the encrypted version back. Can I deduce anything about the algorithm in the black box using the encrypted message length?


texts: Homomorphic Encryption and Semantic Security using Lattices?

texts:
I've been reading Brakerski and Vaikuntanathan's "Efficient Fully Homomorphic Encryption from (Standard) LWE" and I'm still digesting pieces at a time.

Under section 1.1, "Re-Linearization: Somewhat Homomorphic Encryption without Ideals", they state they mask the plain text with noise. The noise is created with multiplications and additions of the plain text, and the result is cipher text:

  To encrypt a bit $m$ in $\{0, 1\}$ using secret key $\mathbf{s}$ in $\mathbb{Z}_q^n$, we choose a
  random vector $\mathbf{a}$ in $\mathbb{Z}_q^n$ and a "noise" e and output the cipher text

  $c = (\mathbf{a},b = \langle \mathbf{a},\mathbf{s} \rangle + 2e + m)$

  The key observation in decryption is that the two “masks” – namely,
  the secret mask $\langle \mathbf{a},\mathbf{s} \rangle$ and the "even mask" $2e$ – do not interfere with
  each other. That is, one can decrypt this cipher text by annihilating
  the two masks, one after the other: The decryption algorithm first
  re-computes the mask $\langle \mathbf{a},\mathbf{s} \rangle$ and subtracts it from $b$, resulting in $2e + m \pmod{q}$.
  Since $e \ll q$, then $2e + m \pmod{q} = 2e + m$.

How can this be semantically secure if the same mask $\langle \mathbf{a},\mathbf{s} \rangle$ is being used on messages? That is, two different encryptions of the same value (say "10") would produce the same cipher texts.

If I added two numbers (say "10" and "100"), wouldn't they need to be masked with the same $\langle \mathbf{a},\mathbf{s} \rangle$?
Or does this scheme require additional accounting somewhere to allow for different $\langle \mathbf{a},\mathbf{s} \rangle$ masks?


texts: Send an encrypted question and return answer without decryption

texts:
Oke bear with me for a minute.

Once upon a time someone mentioned a hypothetical way where you would send an encrypted question to Google and Google would return an answer without decrypting it.
As of lately i'v been searching for this hypothesis thinking there would be something about it on the internet, the problem is i can't find it.

So my question, is this theoretically possible, sending something encrypted and without the receiver knowing what it is return the correct information. Of course i get that when you encrypt every possible question and compare the 2 you could figure out the question and return the answer but i believe this was not how it was hypothetically done.

Has anyone of you ever heard of this? where does it come from?

I'm very sorry I could not provide a link to a paper or anything, I just cannot find anything about it.


texts: Additive masking for encryption inside $\mathbb{Z}$

texts:
If I have to obfuscate my value $m$ from someone, then what is wrong with just showing them $m+r$ as an "encryption" of $m$.
If someone would try to guess $m$ from it then it would require them to brute force till the upper bound of the value $m+r$ since $r$ and $m$ both can be anything in [0, $m+r$]. So, if I make this value $m+r$ to be really large so that this range [0, $m+r$] becomes computationally infeasible to brute through, doesn't this ensure the security of my secret value $m$?
I understand that this violates the property of succinctness which is required from all encryptions, but I don't see any potential attack here which can reveal the value $m$ and which performs better than just doing an exhaustive search.
Now my question is that if an adversary has $m_1 + r_1$ and $m_2+r_2$ such that he knows that $m_1 > m_2$ and $r_1 > r_2$, then can he infer something about he input values of $m_1$ and $m_2$?


texts: Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such?

texts:
Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute forced?):

$$d = e^{-1} \mod  (p-1)(q-1).$$

Is it impossible to design a public key system where it was harder to verify that the decryption of the key was successful?  The usual answer to protect an encrypted key from being brute forced is to use a larger key size, but I thought hard to recognize plain-text is a good property to have in an encryption system?


texts: Does ChaCha20 counter actually increment through iterations?

texts:
RFC defines:

state = constants | key | counter | nonce

Suggested on multiple places is to set counter to 0 or 1.

It is still unclear to me what the function of counter is. Why not just use larger 128bit nonce, instead of a 32bit counter + 96bit nonce?

Does the counter at position of 13th byte actually increment by one? Can I extract the number of iterations from the state of ChaCha20? From the specification, Id say that the state gets randomized after as much as one iteration.

This brings me to a 2nd question - if it is customary to set counter to 0 or 1, we can consider this is public. Does this mean then that nonce can also be made public (just like IV for block ciphers) without compromising the security? (of course provided that key stays confidential)

Thank you all for answers!


texts: How can frequency analysis be applied to modern ciphers?

texts:
I am building a computer program that deciphers Caesar, Vigenere and monoalphabetic substitution ciphers. All of those are susceptible to frequency analysis. However, it does not seem to be real-world applicable considering the complexity of the modern-day ciphers. Where else can frequency analysis be applied in the modern day to make my project real-world applicable?

The only suggestion I have been given is an application to the Bitcoin encryption algorithm. I am not sure if this would be a viable option. Is it?


texts:
We've constructed a new private RSA key from two known private RSA keys $Priv_1$ and $Priv_2$ as follows:

$$p = next\underline{}prime\left(\frac{Priv_1(p) + Priv_2(p)}{2}\right)$$

and

$$q = next\underline{}prime\left(\frac{Priv_1(q) + Priv_2(q)}{2}\right)$$

where $Priv_{1}(p)$ is the first factor of $Priv_1$ and so on.

The keysize is 2048 bits. Suppose that we know the three public keys of $Pub_1$, $Pub_2$ and $Pub_3$, that $Pub_3$ corresponding public key for $p$ and $q$. Is it possible to find $p$ and $q$?


texts: What's the generally accepted way of padding more than 255 bytes?

texts:
There are plenty of popular padding schemes in use today. ANSI X.923 and PKCS#7 come to mind. However, all of them work on single bytes at a time. This is hardly surprising: padding for cryptographic purposes is usually just to 16 bytes and a single byte can hold the value 255.

I was wondering if there was any generally accepted method of padding when we need to add more than 255 bytes of padding. PKCS#7 obviously wouldn't work since you'd have to have multiple bytes for every byte normally. ANSI X.923 could be modified slightly to use more than one byte at the end to store the length of the padding, but this too comes with its own problems, namely that it doesn't work for every combination of inputs unless you do some dirty workarounds to manually take care of edge-cases, and even then I'm doubtful it'd work.

The solution I came up with was to simply run PKCS#7 multiple times. What I mean by that is if we want to pad 300 bytes, then pad up to 255 normally (by adding 255 bytes of value 255), then pad again up to 300 (by adding 45 bytes of value 45). When un-padding, you'd simply remove the top layer of 45 bytes, check to see if the next 255 values were all 255, and if they are, remove them all, and repeat.

I can't find a mention of anything similar to this, however, hence the question. Is there a standardized, accepted way?


texts:
Reading about the Decisional Diffie-Hellman on Wikipedia, I came across this section:

  Importantly, the DDH assumption does not hold in the multiplicative group $\mathbb{Z}^*_p$, where $p$ is prime. This is because given $g^a$ and $g^b$, one can efficiently compute the [Legendre symbol] of $g^{ab}$, giving a successful method to distinguish $g^{ab}$ from a random group element

I read through the related questions to this and I still don't understand how this assumption is false if $g$ is a generator of $\mathbb{Z}^*_p$  and not of $\mathbb{G}_q$? Can we even show the probability would be greater than 0.5?


texts: How can I generate large prime numbers for RSA?

texts:
What is the currently industry-standard algorithm used to generate large prime numbers to be used in RSA encryption?

I'm aware that I can find any number of articles on the Internet that explain how the RSA algorithm works to encrypt and decrypt messages, but I can't seem to find any article that explains the algorithm used to generate the p and q large and distinct prime numbers that are used in that algorithm.


texts: Dancing confusion with Daniel J. Bernstein's stream ciphers

texts:
I know of Salsa20 which won the ESTREAM competition. This is dated of 25 Dec 2007.

There is also the ChaCha20 stream cipher (cr.yp.to/chacha.html). This claims to increase the amount of diffusion per round. This is dated 28 Jan 2008.

Then there is another variant called XSalsa20 which has a 192 bit nonce instead of 64 bits. This is dated 4 Feb 2011. I'm not sure if it contains the diffusion per round improvements from ChaCha20 though.

Question is, which variant of these is the most secure to use? I do not care about speed. It would be really nice if cryptographers would just number their cipher versions/improvements as 1.0, 1.1, 1.2 so people know which is the latest algorithm easily.

On one hand, a 192 bit nonce with XSalsa20 sounds more secure than a 64 bit one. Maybe someone can explain the advantage of that? Would there be an advantage in using a 256 bit nonce which would keep it consistent with the key size? On the other hand, the better diffusion per round of ChaCha20 sounds like a good thing to have as well compared to the original Salsa20. Could a combination of the improvements in XSalsa20 and ChaCha20 be made?


texts: Hide message length in symmetric key cryptography

texts:
Is there any way to hide message length from adversary in symmetric key cryptography?

Suppose we want to hide message length from active and efficient adversaries.


texts: Random unique key per message, safe to use key as IV?

texts:
The overall setup is that I am using RSA public key encryption, and because the messages are big instead of encrypting the entire message via RSA I am encrypting a random AES-128 key with the PK and then encrypting the message with that in AES-CBC.

The AES key is randomly generated for each message. Questions:

Is it safe to use the key as the IV of the CBC? The rationale here is the key is unique and random for each message and I'm not seeing a problem. The key is used in 3 places thus: the encryption itself, then as an IV, then again concatenated with the encrypted message's hash and everything hashed again as a MAC.
Do I still need to do any random padding on the IM itself? The key and IV are already unique and random.


texts: Given p and q of DSA how do you show they are prime?

texts:
I am given

p = 4916335901
q = 88903

and am asked to show these are prime as well as q|(p-1) in DSA.

I am unsure on how to do this, what does q|(p-1) mean exactly?


texts: Need a test suite for my RSA implementation

texts:
I have an assignment to build a software which can encrypt/decrypt by RSA method. I already did it, but my teacher said that I need to find a test suite (include: modulus, public key, private key) to test if my software runs correctly.

He needs real data which has already been tested by someone else and that data needs to be mentioned in lectures, books, reports, benchmarks, etc...

I tried to find them but I cannot :(. I'm very appreciated if you can help me.
Thank you.


texts: zero knowledge proof of a number greater than zero

texts:
Is there a way to prove in zero knowledge that an element (h) of a group is less than (or greater than) another element from the group? In other words, can we prove that the difference of elements is less than (or greater than) 0? I have looked at some range proofs that prove a number lies in a certain range. But I just need the less than or greater than proof. Anything using bilinear pairings would be helpful.
PS : I am still a newbie with ZKP. So please bear my ignorance :-)


texts: Can a hard drive store clear text data that is physically impossible to retrieve?

texts:
I'm trying to study how HSM and TPM works when storing secret data in clear text. How can they achieve physical impossibility in retrieving secret data?

I get the point in software, if you just have input and no outputs then it should be impossible through software to retrieve something.

But, I want to know the hardware (physics) part as well. How can an IC achieve physical impossibility to retrieve data? Let's assume the data is stored in an hard drive permanently.


texts: What is the algorithm used to encrypt Linux passwords?

texts:
I noticed during an assignment that, if I create an user with a password (azerty for exemple), and then call the command to change the password but give him exactly the same password:

passwd user
>> azerty

the encrypted string stored in ./etc/shadow changes (despite the password not changing).

What algorithm is used here?


texts: Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

texts:
I am quite new to the RSA and I have a couple of questions that confuse me.

Q1: A Timing attack on RSA can be prevented _____________________________
A. By performing the “square and multiply” modular exponentiation algorithm using keys with equal number of 1’s and 0’s in binary form
B. By randomizing the ciphertext or the exponent
C. By using the Montgomery modular Exponentiation algorithm
D. By performing an additional constant time computation after the concluding the modular exponentiation

I am confused among 4 options:
Option A: from what was told in the lecture, "square and multiply" is a naive algorithm which means it is not effective.
Option B: I do not see how that can prevent the timing attack, does't seem relevant?
Option C: From my understanding, it is an algorithm for a quicker calculation of modular arithmetic. It speeds up the decryption process.
Option D: By performing an additional constant time, the pattern can still be observed and the attacker can subtract the additional constant time and perform timing attack again.
My understandings may be wrong, and I am out of ideas :(

Q2: For the textbook RSA encryption scheme,
$ c = m ^ e \bmod n $
is used for encryption where $m$ is the message to be encrypted, $(e,n)$ is the public key and $c$ is the ciphertext;
the decryption will be
$ m = c ^ d \bmod n $
where $d$ is the private key.
Assume that Alice sends to Bob a message $m$ that is encrypted as $c$ and that Carol wants to retrieve the message $m$. Carol can use the Chosen Ciphertext attack for RSA. Describe how such an attack will be used in order to retrieve $m$.

For this question, I guess it is asking me to describe a timing attack?
Thanks in advance!
Update:
Many thanks to Squeamish Ossifrage for your clarification and fgrieu for your hints
I kind of getting the answer of Q2, but I am not too sure. Correct me if I am wrong.

Suppose the original cipher $c_1 = m^e \bmod n $

Carol creates a second cipher by multiply $c_1$ with a random number $r$. So Carol has $c_2 = c_1 * (r ^ e \bmod n )$

Expand $c_2 = (m^e \bmod n) * (r ^ e \bmod n ) = (m^e * r^e) \bmod n$

The corresponding plaintext of $c_2$, $m_2$, can be written as $m_2 = c_2^d \bmod n$

Expand $m_2=c_2^d \bmod n = ((m^e*r^e) \bmod n)^d \bmod n = (m^{ed} \bmod n) * (r^{ed} \bmod n) = m * r $

Therefore, original message $m$ can be calculated as $m = m_2/r$


texts: This question at StackOverflow mentions that DSA cannot be used for encryption. But both RSA and DSA can be used to generate public and private keys, right? Then why can't I use the DSA public key to encrypt?


texts:
Actually i am studying cube attack so there is some confusion regarding that in my mind this is

1- it is used for MAC KEY RECOVERY

2- It is a test that user performs to check the frogery or MAC or encryption

3- It is used to break encryption

4- cube attack have paper test like xor etc so they are performed for validty and consistency check

5- trivium cypher is encryption methodology of crypto so when they performed on that they decrypt the information to some extent

6- cypher text is encrypted string having data can cube attack is used to decrypt that

so regarding that above mentioned point can any body tell me where i am right and wrong and add some knowledge and tell me they are used some things correct about trivium cypher and cube attacks


texts: Is there any weak message for an ECDSA signature?

texts:
Suppose ECDSA is used without hashing the message, but directly using a short message (say 10-bytes long) as the value z (using the definitions at http://en.wikipedia.org/wiki/Elliptic_Curve_DSA) because we need extremely fast signing with ECDSA in a specific embedded platform. We also pre-compute kG and k^-1 values.

Are there any weak z values such that the signature can be forged ?


texts:
I'm trying to implement Floyd's cycle finding algorithm on SHA256 function. I think I understood the method used to find cycles but what bothers me is how to properly feed the repeated hashing function.
Let's say I hash string "abc".
What I will get as a result is :
"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
As I understood this is a 256-bit (32-byte) output so it could be chunked as:
ba 78 16 bf 8f 01 cf ea 41 41 40 de 5d ae 22 23 b0 03 61 a3 96 17 7a 9c b4 10 ff 61 f2 00 15 ad where each chunk could be represented as individual character.

So my question is should I feed the next Hash function with the raw result with 32-byte or with the string:
"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
which I suppose has 64-byte.

Additionally, if I were only to check first 4-bytes for the collision, what should be fed to the hashing function in this case?


texts: Security of a self-decrypting block-cipher?

texts:
If I have a block-cipher like for example AES,
a plaintext $x$, we use different function to encrypt and decrypt
: $\text{encrypt}(x) = y$ , $\text{decrypt}(y)=x$.
Now, if we build a function with a permutation $P(x)$ with $P(P(x))=x:$
$F(x)=\text{decrypt}(P(\text{encrypt}(x))$ , we have $F(F(x))=x$, a function that encrypts and decrypts.

Does this reduce the security or allow new attack on the cipher?
I know stream cipher already encrypts and decrypts using the same function but what about a block-cipher ?


texts: Basic Encryption and Decryption related question

texts: I recently started studying cryptography and got interested in the subject. But I got this doubt when I was studying the encryption scheme. Even though we encrypt our message and change it into ciphertext, this ciphertext is still available to the attacker. So, what if the attacker modifies this ciphertext and sends it to the receiver? Then the receiver cannot decrypt the message right..?


texts:
Simple question: we have AES 128 encryption and a key. How can we calculate the key check value (KCV)?

One example: key is 48C3B4286FF421A4A328E68AD9E542A4 and KCV should be 77DC84.

I am trying it out in C#, but there are just to many 'unknowns' for a newbie in cryptography...

Edit: there was a question why I need it - let's say that I have a bunch of key-KCV combinations, written down by multiple users in our organization, but some of the keys are invalid (employee wrote 8 instead of B, 1 instead of 7, etc...). So I needed a program, which changes some bytes in the key and then calculates the KCV. If the key has one wrong byte, then it is calculated in 2ms, for two wrong bytes 5seconds, for three wrong bytes an hour and half, and so on...


texts: How can one prove correctness of shared secrets in secret sharing schemes?

texts:
Assume we are in a centralized secret sharing setting, where one party generates the shares, and distributes them to other parties. How can the distributor who creates the shares prove to the parties that they received the correct share?

Imagine the parties later share their shares or some other information between themselves to check whether the shares indeed combine to the correct value. But if this fails, it means one or more of the shares were wrong. Can one identify which shares were indeed wrong? And if yes, how does one know whether the distributor gave a wrong share to a party, or if this party deviated from the protocol and sampled a random share himself/herself?

For simplicity we can assume that shares are additive, and they are generated as $s_1,\ldots,s_{n-1} \gets \mathbb{Z}_p$, and $s_n = s - \sum^{n-1}_{i=1} s_i$, for a secret value $s$ that we want to share. And we are in n-out-of-n setting.

Also we can imagine that the distributor is the one that samples $s$ and then sends $g^s$ to other parties, so they can just combine their shares in the exponent to check whether it is equal to $g^s$. Which again opens a door for distributor to cheat, what if it sends wrong value, such as $g^{s’}$?


texts: What is more efficient, pairing based cryptography or non pairing based cryptography?

texts: As far as I know non pairing pairing based cryptography is less time consuming than pairing based because, pairing based uses complex operations. Are there any advantages of pairing based cryptography over elliptic curves without using pairing based cryptography?


texts:
I need to know, please:

(1) Is there anyway to pick uniformly at random permutation polynomial in a field of prime order?

(2) Are there many permutation polynomials in a field?

(3)  In a finite field of q elements how many bijective polynomials exist whose degree are smaller than d ?

***Indeed has the permutation polynomial used in this way in cryptography to generate uniformly random value? If yes, where?


texts: Question is simple yet confusing, why there is the need for image encryption. How text encryption is different from image encryption if using same technique like AES, DES, Chaotic algorithm. If the only difference is at implementation it's more of engineering task than science. Can same encryption technique applied to both text and image, then why image encryption a separate part.


texts: Solving discrete log in partially known group

texts:
Suppose I have a group $G$ of unknown order $n$ where $n=p^k\cdot s$, $\gcd(p,s)=1$, $p$ is a known prime, $k,s$ are unknown positive integers and $k,s\ge1$. (Known - $p$ and $p\mid n$, Unknown - $n,k,s$).
Assume that it is easy to solve the discrete log problem in the subgroup of order $p$.

Questions

I know that if I have an upper bound on $n$, I can use Baby step-giant step to solve the discrete log in $G$. Does Pohlig-Hellman also work if you know the upper bound?
Can I solve the discrete log problem in $G$ using the Pohlig-Hellman algorithm or any other algorithm that has square root complexity in the above group setting?
Can one find $k$ using any of the discrete log solving algorithms?

My probable answers

Assuming that Pohlig-Hellman only works if you precisely know the group order, then no I can't solve the discrete log problem in $G$ as I don't know $n$(or $k$ for that matter).
Not sure what the answer is if I use baby step-giant step but I think you can not find $k$ using Pohlig-Hellman.

Need help in filling the gaps and verifying my answers.


texts: How much extra information is in an RSA public key?

texts:
I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is that what I retrieve and the actual key size is off by 12 bytes, or 96 bits for that matter – for a 1024 bit key, I get 140 bytes (=1120 bits).

I know there is at least always an exponent and the modulus in the public key. My question is:

Is it always a fixed difference (12 bytes), or can the difference vary and if yes - how do I know how big the difference is?


texts: Do I need to use a MAC with asymmetric encryption?

texts:
The internet has drilled into me that when I delivery any symmetrically encrypted data, I should also deliver a MAC to authenticate it before any decryption occurs. Do I also need to do this if I use asymmetric encryption? If so, what is the proper mechnaism?

The normal pattern that I have used so far is to use the same symmetric key as used for the encryption also for the MAC. Something like this:

// Alice
ciphertext = aes_encrypt(plaintext, aes_key, iv)
mac = hmac_sha(ciphertext + iv, aes_key)

// Bob
verify_hmac_sha(ciphertext + iv, aes_key, alice_mac)
plaintext = aes_decrypt(ciphertext, aes_key, iv)

Now, if I replace the encryption with an asymmetric algorithm, I immediately run into the trouble that there is no symmetric key pre-shared between the two parties. Using the asymmetric key pair's public key for the HMAC key seems nonsensical, as it is obviously public and anyone could fake the MAC.

However, assuming that Bob also knows the public key of Alice, Alice could simply sign the data being sent using an appropriate asymmetric signature algorithm. To me, this seems equivalent to using a MAC.

Is my understanding correct? Furthermore, do the vulnerabilities that require MACs with symmetric cryptography even affect asymmetric cryptography?


texts: Encryption of big files in Java with AES/GCM

texts:
I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes.

I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and encryption.

I would like to use the handy Cipher Input/Output Stream cause I can chain it with GZip I/O Streams to compress the data a little before encryption.

However I was reading that the implementation of Java appends the authentication tag at the end of the stream. That means that for a long file, if I were using CipherInputStream to decrypt it, it wont be able to tell whether the contents have been tampered or not until it reaches the end of the stream, right?

If that were the case, wouldn't it be problematic to actually use that operation mode for what I'm trying to accomplish becuase since the file can't be decrypted in memory it will have to be decrypted somewhere in the filesystem until the failure is detected, leaving some time for an attacker to see the plain text?

Is this a potential thread and a real concern that I should be worrying about or there's something about the algorithm / cipher streams that I'm missing and prevents that from ocurring?


texts: Is there a universal construction for Davies-Meyer hash functions?

texts:
My understanding is that there exists no strong pseudorandom permutation for which the Davies-Meyer construction is known to yield a provably collision-resistant hash function.  Were I mean provably in the sense of invoking no assumptions like the ideal cipher model.
But my question is, does there exist a universal construction for the Davies-Meyer construction?  That is, does there exist a strong pseudorandom permutation F such that if there exists at least one strong pseudorandom permutation whose Davies-Meyer construction is collision-resistant, then the Davies-Meyer construction based on F is collision-resistant?


texts: Differential cryptanalysis in "The Block Cipher Companion"

texts:
I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher:

In Fig. 6.10 (page 126) there are some evaluations to the probabilities of success to correctly restore the bits 4-8 of k5 depending on a given count of choose messages. I try to compare my implementation with the given results. My problem currently is, that my implementation does not really compare good to the given results. For example: In the book they say, with 32 choosen messages, they restore the bits of k5 with a probability of 64% in 100 cases. I get roughly 28% with my implementation. So may be there is some problem with my implementation or the setup of the tests are a bit different. Is here anybody who implemented the differential cryptanalysis for the cipher in the book "The Block Cipher Companion"? Or does somebody has some test vectors?


texts: Can TweetNaCl box sender's private key be set to "1" without privacy loss?

texts:
The use case is: I need to encrypt data such that only my own private key can be used to decrypt it, from a machine that only knows my public key.

I'd prefer not to have to create and keep track of a sender key pair in addition to my own key pair. I understand that by setting the sender private key to "1" I will not be able to properly authenticate the sender of the message as being myself, but I am happy to accept that.

Related question 1: If a proper sender key pair was used (using a random private key rather than a "1" private key), can the encrypted message be decrypted using only the sender's private key and knowledge of my public key? Edit: Clarification: The receiver (me) would be told the public key of the sender key pair. The crux of the question was about whether if the encrypted message, the sender private key and my public key were all known, could the message be decrypted without my private key?

Related question 2: Is it OK to use the same key pair for both the sender and recipient when using the Box? This would mean a third party can authenticate the message as being encrypted by me, using only the public key.


texts: ZKP: Asymmetric encryption with confidential message and known hash

texts:
I'm searching for a ZKP package that supports asymmetric encryption so I can implement the following scenario:

Carol encrypts message $m$ with Alice's public key and sends the ciphertext to Alice. Bob and Alice both know $\operatorname{hash}(m)$, but because $m$ is encrypted by Alice's public key Bob doesn't know $m$--only Alice knows $m$.

Here is the part that needs ZKP: Alice wants to prove to Bob that this ciphertext is actually the encryption of a message whose hash is $\operatorname{hash}(m)$.

In other words, I want to be able to prove that I have a value whose hash is equal to y = hash(a), and whose encrypted form is z = enc(a), but I don't want to reveal a.

I searched in ZKP packages thoroughly, but none of them can implement encryption, so I take it that ZKP isn't the solution.

Do any of the available packages support what I am trying to do?


texts: Why not use `` or `==` in constant time comparison?

texts:
I am comparing secret data stored in arrays a and b to see which holds a greater value.  My current (pseudo)code looks like this:

unsigned char smaller = 0, bigger = 0;
for (i = 0; i < size; ++i) {
   smaller |= (!bigger)  & (a[i] < b[i]);
   bigger  |= (!smaller) & (a[i] > b[i]);
}
return bigger;

But when I look at (for example) sodium_compare, I see they are not using the < or > operators. Instead they subtract values and do some bit-operations, amongst which shifting a byte by 8 (as a sidenote: doesn't that result in undefined behaviour in C?).

Is there a reason for avoiding the < and > operator?

Similarly, constant-time comparison for equality is usually implemented by taking the byte-wise xor (^) and take the or (|) of all values. Is there a reason for prefering ^ over == in that situation?


texts: trying to understand the elliptic curve format for XML Signatures

texts:
https://www.w3.org/TR/xmldsig-core/#sec-ECKeyValue gives the following example of an ECDSA key:

<ECKeyValue xmlns="http://www.w3.org/2009/xmldsig11#">
  <NamedCurve URI="urn:oid:1.2.840.10045.3.1.7" />
  <PublicKey>
    vWccUP6Jp3pcaMCGIcAh3YOev4gaa2ukOANC7Ufg
    Cf8KDO7AtTOsGJK7/TA8IC3vZoCy9I5oPjRhyTBulBnj7Y
  </PublicKey>
</ECKeyValue>

Here's what it says regarding the encoding of the PublicKey:

  The PublicKey element contains a Base64 encoding of a binary
  representation of the x and y coordinates of the point. Its value is
  computed as follows:

  Convert the elliptic curve point (x,y) to an octet string by first converting the field elements x and y to octet strings as specified in
  Section 6.2 of [ECC-ALGS] (note), and then prepend the concatenated
  result of the conversion with 0x04. Support for
  Elliptic-Curve-Point-to-Octet-String conversion without point
  compression is required.
  Base64 encode the octet string resulting from the conversion in Step 1.

From that I'd expect that the first character of the base64 decoded text would be 04 but it isn't. It's BD. Here's the full decoded value:

bd671c50fe89a77a5c68c08621c021dd839ebf881a6b6ba4380342ed47e009ff0a0ceec0b533ac1892bbfd303c202def6680b2f48e683e3461c9306e9419e3ed

So what gives? Am I misunderstanding something or is the example they provide a bad one? If the latter then where might I find a good example?


texts: Would this image steganography technique be effective at avoiding detection?

texts:
I've observed that when you view only the LSB of an image it is typically random looking, but often has areas that correlate with the over all structure of the image. It's common for there to be large sections of the image that are solid 1s or 0s. There are often blocky patterns. Complete randomness of the LSB would therefor be a potential indicator that steganography is present.
I am considering a simple block based technique. Consider a grayscale image. Divide the image into 2x2 pixel blocks, LSB only. There are 16 possible permutations, which are grouped into sets of twos. Blocks that match the first set (four white pixels, or four black pixels) are ignored. Blocks that match the other seven sets will encode our ciphertext. One of two possible patterns is chosen based on the bit of the ciphertext we are storing. Optionally, we may look at neighboring blocks (up, down, left, right) and if they are of the four solid pixel variety then we also ignore this block. For color images you could do this separately for each color channel.
This would essentially only store bits of ciphertext in parts of the image that appear random. Every block that stores a bit of ciphertext is only ever replaced with a block that is a flipped version of itself, so the number of 1s and 0s always remains the same.
Can someone more mathematically inclined and familiar with steganography weigh in on how effective this approach might be?


texts: Why does the SRP-6 calculation of B include a multiplier k = 3?

texts:
In SRP-6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$?

(In SRP-6a, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP-6.)


texts: Statistics on the frequency of usage of RSA key public exponents

texts:
Are there any publicly available stats regarding how often are specific public exponents used for RSA keys?

Presumably, 65537 is the most commonly used of them, but I'd like to get some notion of which other values one should care about when testing for compatibility.


texts: Why the salt is used as a key in the extract phase of HKDF?

texts: What is the reason that in the HKDF standard (RFC5869), in the "extract" phase, the 'salt" parameter is instantiated as HMAC key, and the secret keying material 'IKM' is instantiated as HMAC input data (so that the extract phase equation is PRK=HMAC(salt, IKM))? Especially, the RFC says that the salt, which plays the role of the key for the HMAC function, doesnt have to be secret at all. So it seems there is no security degradation if the key of the HMAC is known? and if the salt does not affect the security, why should it used anyway and not just do hash(IKM) instead of full HMAC?


texts:
I have some questions regarding aforementioned subject:

Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
Is ECIES-KEM sufficient ?


texts: For $e(g, d) = c $, can we compute $d$, given others

texts:
Given $$e(g, d)  = c $$
where,

$e$ is bilinear pairing function chosen by the user/attacker,
the values of $g$ and $c$ are known
$g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$

can we somehow compute the value of $d$

In a high level, I am asking if there exists a function $f$ that, in one way is the inverse of a $e$ can be used to compute $d$?


texts: Determining collision resistance of a function?

texts:
I am having trouble trying to understand if the function is collision resistant.  As I understand it, preimage resistance means that it is hard for an adversary to find two messages that produce the same digest, and second preimage resistance means it is hard for an adversary to find a message that produces the same digest for a given digest.  And collision resistance just implies both things.  So for the following problem, I don't understand how I would determine if the function exhibits any of the resistances?

The function f(x1,x2,...,xn) = x1 ⊕ x2 ⊕ ... ⊕ xn takes an input of n blocks, each m bits long, and produces an output of length m bits. Is this function: preimage resistant, second preimage resistant, or collision resistant?


texts: Is there a time-space tradeoff attack for breaking symmetrical cryptos?

texts:
Is there any known techniques for using time-space tradeoff for speeding up symmetrical crypto breaking? Kind of like rainbow tables speed up breaking hashes by using huge precomputed tables.

Is something similar possible for symmetrical cryptos like AES? If not, why? Is there a difference between block and stream ciphers in this regard? Couldn't you get at least a head start on brute forcing by searching through gigantic tables where a lot of plaintext "heads" have been pre-computed?


texts:
I'm doing differential analysis of a toy block cipher in which I've to extract the differential characteristic of the first n-1 rounds.

However, I can't do that very well as I can't see the network itself. Basically, I wonder if there is a software which generates a SPN network automatically given round permutations&S boxes and presents it visually. This would make the analysis much simpler.


texts:
Say for instance we are encrypting over a subgroup of ($Z_{67}^*, \bmod 67$).
To perform a round of El Gamal's encryption scheme we should:

Choose a subgroup of ($Z_{67}^*, \bmod 67$), of prime order.

Choose the parameters of ElGamal's scheme (generator, Bob's secret key, etc.).

Choose three random messages, and Alice's parameters, and describe what Alice transmits to Bob in each round

My question is not necessarily how to encrypt, but how to set up for encryption.
Given that in El Gamal's set-up is traditionally:

$(p, \alpha, \beta)$  is Bob’s public key.

$(a)$ is his private key

What would $p, \alpha, \beta$ be in this case? For example, is result of $(1) = p$? Result of $(2) = \alpha$?


texts:
I am planning to implement a MAC function for the SHA3. I read that its latest variant is KMAC. I am confused by the comments in the http://keccak.noekeon.org/
website.
Its says...

  Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be performed by simply prepending the message with the key.

Also

  KMAC is a keyed hash function or pseudo-random function (PRF) that can be used, e.g., to compute a message authentication code (MAC) or to derive a session key from a master key. It is more efficient than HMAC by removing the need for HMAC's nested construction.

So if I want to implement a MAC function Can i just do  the first method ?? just pad the message with key and do the hash ?  Or do I need to follow the KMAC steps?

KMAC128(K, X, L, S):
Validity Conditions: len(K) < 22040 and 0 ≤ L < 22040 and len(S) < 22040

newX = bytepad(encode_string(K), 168) || X || right_encode(L).
return cSHAKE128(newX, L, “KMAC”, S).
Could anyone help ? which method we should use


texts: Hash system to generate same (specified) hash from multiple datasets?

texts: I have a hashed value $X$ and need to ensure that any of the data sets $D_1...D_n$ can be concatenated with a correctional value $C_1...C_n$ and passed into a hashing algorithm to result in the value of $X$. What I need is a way to figure out what $C_i$ should be in order to ensure that $Hash(D_i, C_i ) = X$. If I use a simple hash like addition or XOR then it'll be pretty easy, but is there any way to figure out $C_i$ for better hashing algorithms?


texts: Relaxed trust criterion for mental poker server?

texts:
I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a third-party server whose trustworthiness can be easily verified (or whose cheating can be easily proven).

For example, let's say a game server is set up that sends messages to players, and every message it sends is signed with its public key and has details about the request that generated it, a timestamp, and so on. So if the server ever, for example, forged a timestamp, someone could publish a signed message from the server, subsequently signed by another timestamp service, proving this. Likewise, if the server ever cheated on someone's behalf, an insider could easily publish a set of signed messages proving that he received information from the server to which he was not entitled.

The hard part, I imagine, would be out-of-band communication. That is, guy at a server on the phone with a player. But that too could be easily exposed by a whistleblower by publishing the information he got out-of-band in a way that makes it statistically unlikely that he could have guessed it (for example, his info signed by another timestamp server earlier than his legal reveal).

Is there such a protocol known/in use? Am I missing something obvious about why this would be impractical and/or not significantly faster than the untrusted server protocols?


texts:
How secure would this be? To be clear, I mean replacing the block cipher encryption step in the Wikipedia diagram explaining CBC with plain old XOR?

EDIT:

Replace block cipher encryption part of diagram with XOR ($\oplus$)

CBC diagram

Or:
($C_0 = IV$)

$$C_i \equiv \left(\bigoplus_{C_{i-1}}^{P_i}\right) \oplus {K}$$


texts:
CECPQ1 (combined elliptic Curve and Post-Quantum Cryptography Key Exchange) is a new key exhange developed by google, which combine X25519 with NewHope (elliptic Curve KE + Post-quantum KE).

Google has implemented CECPQ1 in boringSSL But there isn't a documentation or clarified explanation, how it works.

Looking at the code, I think, there are two key exchanges - X25519 and NewHope. Results of those exchanges are concatenated (here)
Then this concatenation is fed into KDF and used as session key.

So even if NewHope is broken whole scheme is secure, because X25519 is secure. Attacker must break both NewHope and x25519 to break a scheme.

Can Someone confirm that? or give me more details about CECPQ1?


texts: AES Password Based Key Derivation Iterations

texts:
I have been writing my own implementation of the Advanced Encryption Standard with cipher block chaining in python3 for the last several months, mimicking the OpenSSL command line interface. I can successfully encrypt a message or binary with the OpenSSL implementation of AES and then decrypt it with my python3 program (and vice versa).
I am currently working on PBKDF1 SHA-512 Key Iterations.
OpenSSL generates the key and IV for the password “Sparky” using PBKDF1 SHA-512 like so:
OpenSSL command to use to follow along is this:
printf "hi" | openssl enc -aes-128-cbc -md sha512 -p -S 436172616D656C00 -k “Sparky”

which means that
salt=436172616D656C00
key=D0F4428B02B161F125FF3FA1FDD98AFE
IV=6F26A9F743FAD01BBC68417A398359A6

In python3, the same Key and IV can be obtained like this:
import hashlib

salt = "436172616D656C00"
passwd = "Sparky”.encode(“utf-8")
salted = passwd + bytes.fromhex(salt)
Key = hashlib.sha512(salted).hexdigest()[0:32]
IV = hashlib.sha512(salted).hexdigest()[32:64]

The key and IV can be found in substrings of the SHA-512 hash.

So I’m not having trouble obtaining the Key and the IV without iterations, but I can’t figure out how to generate the next iteration of the Key (-iter 1)
According to several sources on the internet the iteration function hashes the resultant hash n times. I think something else or something additional is going though because I have tried to hash Hash#0 and the resultant hash does not contain the expected strings for the Key and IV.
So the result of the same OpenSSL command above but with -iter 1 added yields:
printf "hi" | openssl enc -aes-128-cbc -md sha512 -p -S 436172616D656C00 -k "Sparky" -iter 1

results in:
salt=436172616D656C00
key=6354F3AE1EEF92EAE4406759A5882B46
IV=8ACE6C6AE7E1EBDEE45342D0C9087422

Hash0 (the SHA-512 hash without iterations) in this example is
d0f4428b02b161f125ff3fa1fdd98afe6f26a9f743fad01bbc68417a398359a675fe9c7bbf87315f7e4d2b8ef40e578a86eec2acdd95511329af2a9d69f59e76

If I were to take this hash which I know to be good for the 0-th iteration, and hash it again, I would get:
35841649790d6ce2d0ac2b3fe338aba5121858494006aa098f84e06f21587b77adf14f1c5c0a1530db628acfd5d6123d46e449b9619a41a5a6e32ab9230a31e4

And according to the OpenSSL command with -iter 1 set, the hash should start with
6354F3AE1EEF92EAE4406759A5882B468ACE6C6AE7E1EBDEE45342D0C9087422

If you would like to see my code, I can upload it to github or my virtual private server and share it.


texts: Can a MITM attack be applied to this construction?

texts:
On reading the accepted answer to this question, I was wondering whether a Meet In The Middle attack could be applied to the suggested construction (below), and if not, then what is the effective key strength of combining two 256 bit ciphers in such a way? If I understand correctly, the Tahoe-Lafs 100 Year Cryptography project uses a similar construction.

  $C=P\oplus K^1\oplus K^2$, where $C$ is the ciphertext, $P$ is
  the plaintext and $K^1$ is the key stream of one cipher and
  $K^2$ is the key stream of the other cipher (courtesy of
  Maarten
  Bodewes).


texts:
I would like to know what $O(v(n))$ really means in detailed and simple words please.
I found it everywhere in the literature I am reviewing but I cannot find what the intuition of it (especially if it means the Big O Notation, then what it has to do with the Probability here; also what is $v$, it is never defined except in another paper as a constant -but maybe not related directly to v in this formula-).

Many Thanks.
References 1 , 2


texts: Verifying valid public key and finding private key?

texts:
A naive user of RSA has announced the public key $n = 2903239, e = 5$.
Eve has worked out that $n = 1237×2347$. Verify that the public key is valid
and explain why the private key is $d = 2319725$. [Calculators are not
required.]

This question comes from a mock exam that I am trying to solve for tomorrow.

I attach my working out:

$n = p\;q = (1237)(2347) = 2903239$

$\varphi(n) = (1237-1)(2347-1) = 1236(2346) = 2899656$

$d\;e \bmod \varphi(n) = 1$

$e = 5$

$5\;d \bmod 2899656 = 1$

Applying the Euclidean algorithm:

$5\;x + 2899656\;y = 1$

$2899656 = 5(579931)+1$

The public key part: $(e,n) = (5, 2903239)$
The private key part: $(d,n) = (2319725,1)$

I do not understand how the private key is calculated, nor how to do this with a calculator. Any help would be welcome.

EDIT:
$$\varphi (n) = (1237-1)(2347-1)= 2899656 \neq 2903239$$

de mod (phi(n)) = 1

5d mod 2903239 = 1

5x + 2903239y = 1

2903239 = 5(580647)+4

5 = 4(1) + 1

1 = 5 - 4(1)

1 = 5 - (2903239 - 5(580647)

1 = 5 - 2903239 + 5(580647)

1 = 5(580648) - 1(2903239)

I am still unsure of how to obtain the private key value from this.

2903239 - 5860648 = 2322591

This value is not the same as the desired value of d, d = 2319725.


texts:
I'm designing a system where the client asked for documents to be encrypted with "asymmetric cryptography".

I've explained them that the best practice is to encrypt the data with a symmetric algorithm using a randomly generating key and then, using an asymmetric algorithm, to encode that key. The entire scheme is "asymmetric" but it uses multiple algorithms. I offered the usual performance/convenience arguments.

However they are insisting that we should only use asymmetric algorithms because they "have read that is better".

I'm preparing a note for them to better explain the topic and I would greatly benefit of official documents. I browsed the NIST, FIPS, RFC documents and so on but they are too wide to be used as a reference for a customer that is not well versed on this topic.

Does anyone have some pointers to authoritative sources that explain the best practices and that I could use to back up my arguments?


texts: Is simple XOR with secret key using DHE secure?

texts:
Client and server have given generator 3 and modulus which is 256 bit prime same all the time for all clients and server (simply hardcoded).

They both generate a private exponent and send result to each other and generate secure key. This all is done over insecure channel. That's all simple Diffie-Hellman exchange.

After this step every sent packet is encrypted over simple XOR block cipher by secure key's bytes, in this case 256bit long block.

Is this way of encryption any secure and if yes, how much, if no, what are ways to reverse it, as it is so simple and doesn't use much resources?


texts:
So I'm not sure if this is possible but assume I have

$$c \equiv m^e \pmod n$$

I have $c$, $m$ and $n$ but no $e$, which in my case I a value that can be up to 15 digits. Is there a way to do this?


texts: In TLS 1.3 handshake, what's "PSK binders" used for?

texts: PSK handhanke works like session ticket resumption in TLS 1.2, but I found a set of PSK binder for each identity(ticket) in TLS 1.3, why PSK binder are needed in TLS 1.3 ? To protect some attacks?


texts: Why isn't data encrypted with mutiple ciphers?

texts:
Why isn't data encrypted with multiple uncompromised (so far) ciphers? Feel free to answer for a single private key for both and separate private keys.

For example, encrypting data with TwoFish and then AES?

Is it a matter of doubling resource consumption vs a small security improvement? Can two ciphers together be weaker than either cipher separately (in practice or theory)?

If the latter, why not apply one cipher to the data and one to a one time pad and transmit both? ( Can a message and one time pad each encrypted with separate ciphers be weaker than the stronger of either cipher? )

If I understand 2DES doesn't give you nearly the bump in security you'd think it would vs 3DES. But IIRC 2DES is still stronger than DES.


texts:
I am trying to solve congruences of the form
$$J_A \cdot a^e\equiv 1 \pmod n$$

where $n=pq$ for $p,q$ prime and $\gcd(e,\varphi(n))=\gcd(J_A,n)=1$

Solve for $a\in \mathbb{Z}$, in terms of $n,J_A$ and $e$.

I am using example from GQ signature scheme from the book Page 451.

Nota Bene: This is not a homework question. I am looking for a way to implement it.


texts:
I'm running into very contradictory opinions when try to understand if weak elliptic curves exist. I'm not interested in the case when a curve's weakness is attributed to properties of an EC's prime, because those cases have been already explored, e.g. here: http://wstein.org/edu/2010/414/projects/novotney.pdf

I want to understand if there is a known proven weakness attributed to parameters a or b of a short Weierstrass equation.

Dan Brown introduced a hypothesis of "spectral weakness" here:

https://www.ietf.org/mail-archive/web/tls/current/msg10393.html
https://www.ietf.org/mail-archive/web/cfrg/current/msg03952.html

DJB went even further and dubbed curves with unclear parameter's generation method "manipulative" at http://safecurves.cr.yp.to/rigid.html

Both major and popular ECC standards such as NIST and Brainpool have a "verifiable random" requirement for the curve's parameters.

At the same time I've learned just yesterday that there is a strong opinion that "spectral weakness" (attributed to the parameters) doesn't exist (see comments to this blog: http://ogryb.blogspot.com/2014/11/why-i-dont-trust-nist-p-256.html)

If no weak curves have been discovered yet, how big the threat of "spectral weakness" is?


texts:
Can someone explain what attribute based encryption is?

I was searching for a book or something that can help me in this regard but so far I have found none. Google also returns practically nothing aside from the papers.


texts: How can cryptographic signatures be somehow linked to a physical signature?

texts:
A few days ago, I was asked to sign an online document over DocuSign as well as on SignEasy, any the signature were accepted just by a physical signature sent over email or on the app. They did not even ask me to generate a private key whose public key I should upload to their website. So, I felt that the process quite fake and superficial; it just satisfies the naive users. But these apps are quite famous all around.

So, I feel that I think that I am missing out something somewhere. Can you please explain how the physical signatures in these apps are linked to the cryptographic digital signatures?


texts: Divide data into parts and restore from them

texts:
I'm not much familiar with cryptography, so please guide me in the right direction on the following question:

Let's say I have some data (array of bytes) $D$. I want to convert it into $N$ pieces (arrays of bytes) in such a way that

if someone knows at least $m$ of those pieces ($m \le N$) then it should possible to restore the original data, i.e. $D = f(p_1,...p_m)$. It's important that any $m$ pieces should suffice to restore $D$, not necessarily $m$ consecutive pieces
if someone knows $k \lt m$ pieces then there's no way (computationally difficult) to restore $D$ or any part of $D$

Example: if $N=3$ and $m=2$, it should be possible to restore $D$ from $(p_1, p_2)$ or $(p_2,p_3)$ or $(p_1,p_3)$ but not from $p_1$ or $p_2$ or $p_3$ alone.


texts: how do i implement zero knowledge proof?

texts:
I am new to this concept of zero knewledge proofs, from what I understand it is not a mathematical general equation like RSA or ECC cryptography has, but its a methodology that varies from problem to problem.

What I want to do is to let a prover prove that his public key belongs and exists in a known public bulletin board that contains a list of public ECC keys without revealing the public key so it should be encrypted (the public key should be encrypted for privacy reasons).


texts: Crypto libary with Commutative Encryption

texts: I want to implement Mental Poker in JavaScript as a toy program and lead in to a larger serious project so I did my research and found Massey-Omura cryptosystem and the Shamir three-pass protocol however I couldn't find any implementations of them, and the information on how to do SRA is scant. Would anyone be able to shed some light on how to implement Commutative Encryption with SRA(RSA) or know of a Massey-Omura/Shamir library?


texts: Possible to convert PGP ed25519 signature into signify-compatible format?

texts: Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?


texts: Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

texts:
If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic authenticated encryption?

By convergent encryption I mean content-hash keyed encryption, where the hash is encrypted with the user's key (e.g. like this). By deterministic authenticated encryption I mean the definition in the SIV paper by Rogaway and Shrimpton.

I.e. we have a convergent encryption algorithm: $C(k, m) = E(k,H(m))\ ||\ E(H(m),m)$.

We turn it into $D(k, k', m) = E(k, \operatorname{HMAC-H}(k', m))\ ||\  E(\operatorname{HMAC-H}(k', m), m)$.

Is $D$ a deterministic authenticated encryption algorithm, if you verify the HMAC?

Note: the encryption no longer converges for different $k'$, but that is fine. Only the properties of DAE are required here.


texts: What are the properties derived from the fact that a hash function is indifferentiable from a random oracle?


texts:
An HMAC depends on the Message, Key and the Hash function used such as SHA-256, SHA-512, etc.

Consider if the computation of the MAC used a different set of Initial hash values or initial array of round constants.  Instead of the "first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19", the first 8 primes 8675309 onward or similarly random non-trivial set of bits are used.

It appears that those values are not special, other than they should have little correlation.  The usual specified values are well tested, unlike the discussed different sets.

A similar post addresses some impact, yet I'd like to go one step further.

Suppose these different Initial hash values (IV) and initial array of round constants are kept secret, otherwise the MAC is computed as usual.

  What would be the negative authentication impact of exposing the secret cryptographic key of the HMAC in this case?
  Is the key still needed?


texts:
I am studying about additive differential probability.

And I show a paper that is V.Velichkov et al., The Additive Differential Probability of ARX.

I have a question in chapter 5.2.

V.Velichkov et al. said that "In general, following the mapping in Table 2, an initial state $S[0]=j \in \{0,2,4,6\}$ will match final states $S[n-1]=j$ and $S[n-1]=j+1$.

I want to know why this is correct.


texts:
Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an existing channel (e.g. Skype/ Cellular)?

I was wondering if the FPE could be made to take such a form that the compression algorithms used in VoIP would not be able to compress and would be forced to send all the analog signal (the encrypted voice message).

As I understand the voice compression algorithms work by cutting off sounds over a certain frequency, so if the encrypted "sound" would be 100% in the "don't truncate" part of the sound spectrum the voice codec would have no way of compressing and default to send the entire thing.


texts: How does one associate the actual identity of a person or organization with a decentralized ID?

texts: In SSI (Self-Sovereign Identity), anyone can generate their own DID (Decentralized ID). No authority or authorization is needed to create one. Since a public key pair is associated with DID, the person can prove the ownership by using the private key. DID document, which includes DID, is stored in a blockchain that prevents illegal manipulation. In some materials on the web, they call this decentralized PKI. This is a little confusing because I always associated PKI with certificates issued by CAs. In SSI, how do people verify that the given DID is Alice's DID? Furthermore, how do people verify that the given DID is the Issuer's DID (for example, a university that issues verifiable credentials of a diploma)? Do we need some other mechanism (perhaps centralized PKI to prove this DID is Alice's DID to the issuer before requesting her diploma)? What is the main reason we no longer need certificates when using public keys?


texts: How is original plain text length reconstructed after decryption under RSA?

texts:
So far I know the ciphered output length of RSA equals the modulus N.

If I have only a small block of data significantly smaller than N, is the rest of the input to RSA just zero padded?

How can deciphering be unique then?

For instance if I get back as a plaintext

P="XXXXXXXXXXXX000000000000000000000000000000000000000000000000000000....",
how can I know, how many zeros had been in the original plain text:
It could be

"XXXXXXXXXXXX" or also "XXXXXXXXXXXX000000" as well as "XXXXXXXXXXXX0"

All those plaintexts would give the same ciphered text after padding.


texts: How many bits shift is a TEA encryption?

texts:
void encrypt (unsigned long* v, unsigned long* k) {

unsigned long v0=v[0], v1=v[1], sum=0, i;           /* set up */
unsigned long delta=0x9e3779b9;                     /* a key schedule constant */
unsigned long k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
for (i=0; i < 32; i++) {                       /* basic cycle start */
    sum += delta;
    v0 += ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
    v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
}                                              /* end cycle */
v[0]=v0; v[1]=v1;

}

I saw this code on the wiki of TEA encryption and was wondering is this considered a 4-bit or 5-bit algorithm since there was a shift of 4 bits to the left but a shift of 5 bit to the right.

I am confused on the algorithm of this encryption and would appreciate it if somebody can clarify it for me.

Thank you


texts: Theoretical security of bit rotation for encyption

texts:
This is a theoretical question.

I have a idea, encryption by bit rotation in byte.
Do not know if something like this already exists.

General concept is:

First n bytes is rotated to left or right by value between 1 and 7.
Next n bytes are rotated to left or right by different value between 1 and 7.
While keeping n between 1 and 10 bytes.
and so on till the end of the of encrypted file.

The value of n and a list of shift values for each block make up the key.

My intent is to use this for a symmetric encryption between computers over the internet.

How breakable/hackable should something like this be?


texts: Calculation of AES encryption per second

texts: How fast in terms of the number  AES encryption/sec, would an Internet encryptor need to be if the plain text rate is 10gb/sec?


texts: Using Hadamard Form of a Matrix in the Block Cipher

texts:
Definition: A matrix A of size $2^n$ is a  Hadamard matrix, if has the following form
$$
A=
\left(
\begin{array}{cc}
U & V \\
V & U
\end{array}
\right)_{2^n\times 2^n}\, ,
$$
where $U$ and $V$ are also Hadamard matrices.

Example:  A Hadamard matrix A of size $2^2$ is as follows
$$
A= \left( \begin {array}{cccc} a_{{0}}&a_{{1}}&a_{{2}}&a_{{3}}
\\ a_{{1}}&a_{{0}}&a_{{3}}&a_{{2}}
\\ a_{{2}}&a_{{3}}&a_{{0}}&a_{{1}}
\\ a_{{3}}&a_{{2}}&a_{{1}}&a_{{0}}\end {array}
 \right)\, ,
$$
Where $a_i$, $0\leq i \leq 3$ are from any arbitrary field.

Consider B is a $2^n\times 2^n$ matrix such that the $(i,j)$the entry of B, denoted B$[i,j]$, is defined by B$[i,j]=a_{i \oplus j}$ where $i,j \in \{0,1,\cdots , 2^{n}-1\}$ and $i \oplus j$ means Xor between two numbers $i$ and $j$(for example $2 \oplus 3=1$ since $10 \oplus 11=01$).

Example: A matrix B of size $2^3$ is
$$
B=
 \left( \begin {array}{cccccccc} a_{{0}}&a_{{1}}&a_{{2}}&a_{{3}}&a_{{4
}}&a_{{5}}&a_{{6}}&a_{{7}}\\ a_{{1}}&a_{{0}}&a_{{3}}
&a_{{2}}&a_{{5}}&a_{{4}}&a_{{7}}&a_{{6}}\\ a_{{2}}&a
_{{3}}&a_{{0}}&a_{{1}}&a_{{6}}&a_{{7}}&a_{{4}}&a_{{5}}
\\ a_{{3}}&a_{{2}}&a_{{1}}&a_{{0}}&a_{{7}}&a_{{6}}&a
_{{5}}&a_{{4}}\\ a_{{4}}&a_{{5}}&a_{{6}}&a_{{7}}&a_{
{0}}&a_{{1}}&a_{{2}}&a_{{3}}\\ a_{{5}}&a_{{4}}&a_{{7
}}&a_{{6}}&a_{{1}}&a_{{0}}&a_{{3}}&a_{{2}}\\a_{{6}}
&a_{{7}}&a_{{4}}&a_{{5}}&a_{{2}}&a_{{3}}&a_{{0}}&a_{{1}}
\\ a_{{7}}&a_{{6}}&a_{{5}}&a_{{4}}&a_{{3}}&a_{{2}}&a
_{{1}}&a_{{0}}\end {array} \right)=a_{i \oplus j}\qquad
0\leq i,j \leq 7 \, .
$$

My question: Why the matrix B=$(a_{i \oplus j})$, $0\leq i,j \leq 2^{n}-1$, is an $2^n\times 2^n$ Hadamard matrix?

My Try: I can proof it by induction on $n$, but I would like to see its proof with other method.

Background: When entries of a Hadamard matrix come from the finite field $GF(2^q)$ and be an MDS matrix, then the Hadamard matrix can be used in the diffusion layer of block cipher such as Khazad block cipher


texts:
I was reading some articles about attacks on RSA system and I wonder about some generalization of the following theorem.

  Theorem (Coppersmith).

  Let $N=pq$ be an $n$-bit RSA modulus, where
  $p<q<2p$. Then given the $\frac{n}{4}$ least significant bits of $p$
  (that is $\approx$ half of LSB of $p$) or the $\frac{n}{4}$ most
  significant bits of $p$ (that is $\approx$ half of MSB of $p$), one
  can efficiently factor $N$.

I wonder what is going on, if we know for example $\frac{n}{8}$ MSB of $p$ and $\frac{n}{8}$ LSB of $p$.

Second idea, what is going on, if we know for example $\frac{n}{8}$ MSB of $p$ and $\frac{n}{8}$ LSB of $q$.

Is it enough for factoring $N$ in effective way? Or maybe with some other numbers instead of pair $(\frac{n}{8}, \frac{n}{8})$ (of course assuming, that both numbers are greater than $0$ and less than $\frac{n}{4}$)? Was there some research in this field?


texts: Proof that any key exchange protocol is vulnerable to MitM attacks in the absence of shared information or trust

texts:
Today I realised that every key exchange protocol I know, without a priori any shared information or trust relations (i.e. any ability to sign anything), is utterly broken by an active man in the middle attack.

I asked a professor of mine today whether there a proof of this in a formal setting and he said "yes, it's something information theoretic but I can't quite remember what..."

I looked in (what I believe to be) the relevant chapters of a couple of textbooks I have to hand, and done some google-ing and turned up nothing. I was wondering if someone could point me in the direction of either a paper or a text book containing such a proof. Thanks!


texts: Is there are a metric based on collisions to compare bad hash functions?

texts:
Bad hash functions are not so perfect as in the "general collision probability"  hypothesis... And a general concept of "collision resistence"  not need the constraint  of independence between the hash function and the sample set.

Let $H$ be a hash function with digest of $k$ bits, and $S$ a input sample set with size $s=|S|$.$H$ is collision resistant if it is "hard to find" two inputs that hash to the same output,
$\exists x\ne y\in S|H(x)=H(y)$

But "hard to find" is not a good definition: to compare the performance of two hash functions $H_1$ and $H_2$ we need a precise metric... Wikipedia  use $Pr[H]$, the probability concept to define this metric... But, in real-life tests or benchmarking, we have only the number of collisions $c$, and a big standard deviation to compare $c$ values when change $S$ or $H$.

Puting the question in other words:    there are a "standard way" to obtain the real-life $Pr[H]$ of bad hash functions?

Context. Let me be a programmer that buy low quality proprietary software that implement exotic hash functions: the hash function $H$ for me is a black box, and I need to test it.

So, if the seller of the function says it is resistant, I need to check it by experiments and some statistical analysis of the experimental results.

Back to the question... If this standard exists, I am supposing that is a kind of probability definition, so,  will be someting like (is it? need only to check the number $c$ of collisions) $$Pr[H](S)=\frac{c}{|S|}=\frac{c}{s}$$

Bad hash functions (example) have characteristic values of $Pr$ that not depends only on $|S|$...  We can use  $c$ to compare the efficiency of the bad hash  with other hashes. I am imagining that  I can  use $c$ or an averaged $\overline{c}$ based on many $c_i$ tests as a metric of collision rates.

NOTES

Let $c_1$ the number of collisions in $H_1(S)$ and  $c_2$ the number of collisions in $H_2(S)$, them we can compare the two hash functions.

To avoid bias we can do an average about many sample sets $S_1$, $S_2$, etc. So there are averaged $\overline{c}_1$ and  $\overline{c}_2$ as good estimators.

Theoretically we can also estimate the minimum $\overline{c}$ of a hash function with digests of $k$ bits by   $${Pr}_{min}[H](S) ~=~  1 - \frac{2^k!}{(2^k)^s (2^k - s)!} ~\approx~ 1 - exp({-s^2/2^{k + 1}})$$

Conclusion, a good score to compare hash functions is
$$q ~=~ Pr[H](S) - Pr_{min}[H](S) ~\approx~ \frac{\overline{c}}{s} -1+exp({-s^2/2^{k + 1}})$$

When $q=0$ we have "perfect hash function", that have an expected behaviour about collisions... Imagining that hashes like SHA1 are always perfect because is impossible to compute $\overline{c}$, but  truncated SHA1 or "bad hashes" can be tested about big $S$ samples. PS: negative $q$ is possible when  $H$ and $S$ are not independent.

My interest is the behaviour of these truncated or bad hashes, and to compare them.


texts:
I am trying to prove that RSA is a permutation. All I can find is places where it is stated that it is a permutation because the function is bijective. I know that it is, but would like to see a detailed proof.

For clarity, we have $N = p \cdot q$, where $p$ and $q$ are prime and $e$ such that $1 = \gcd(e, (p-1)\cdot(q-1))$. We want to show that $f(x) = x^e \pmod N$ is a permutation. I am thinking we must use Fermat's little theorem somewhere but I cannot complete a detailed proof myself.


texts: What papers describe the rationale behind cryptography algorithms

texts:
I am trying to introduce myself to cryptographic hashing and encryption. I am looking for original papers of sorts, to describe the inspiration behind why they choose certain numbers, if they are relevant, and why they choose certain algorithm features. But every paper I have found so far is like this which just describes the algorithm like encyclopedic metadata. Where can I find the meat on the bones, the why they chose certain features?
I assume starting at earlier algorithms (like SHA1) is probably better because they may specify the reasoning in more detail. But as they get to more recent (and secure) algorithms, they just cite the old algorithms for the meaning behind the decisions.
I am looking for things like SHA256 or other secure algorithms, but perhaps simpler nonsecure ones are better to start. For example, why does the SHA1 algorithm use 5 prime numbers? Why not 4, or 8, or non-primes?
Before processing any blocks, the H's are initialized as follows: in
   hex,
      H0 = 67452301
      H1 = EFCDAB89
      H2 = 98BADCFE
      H3 = 10325476
      H4 = C3D2E1F0.

That's all that is said.


texts: Hybrid encryption with RSA and AES versus spliting into multiple RSA messages?

texts:
I've done research about this subject, but I can't find the answer I'm looking for.
The problem is that the string I want to send doesn't fit into the RSA key that the client have, and during encryption getting ValueError: Plaintext is too long.
The proposed solution is to do hybrid encryption by generating a secret key, sending the secret key encrypted with the clients public key, and then send the rest of the data encrypted using AES and the secret key.
I understand the performance is much better in this manner, but for me this feels like opening an extra door to the data. Even though no one would ever find my service interesting enough to try to decrypt the RSA or AES data. But now I have to trust and support two(!) algorithms for the client applications.
Everyone only seems to be speaking good about the hybrid solution, and I understand that it would be the best solution for anything with a lot of traffic going on. Since it's probably about serving users as fast as possible and its not good to waste resources on encrypting/decrypting data.
But theoretically the data is open to two attacks, either by brute-forcing the RSA and get the secret key to decrypt the AES, or directly by brute-forcing the AES. But then again, using 2048-bit RSA and 256-bit AES wouldn't be possible to brute-force any of them any time soon.
So the 256-bit AES must be harder than the 2048-bit RSA, else the data is now less secure somehow, but since AES is 'thousands of times' faster than RSA this doesn't feels true.
Guessing a 32-byte AES password seems easier than guessing the much longer private key.
How secure are they (AES-256 vs RSA-2048) relatively to each other?

The idea I have is that I split my message into chunks, and encrypts each one of them using RSA, then concatenate them into one packet, and the client can then read each encrypted chunk and decrypt them and then concatenate them back to the original message.
Other than it's slower than a hybrid method, Is there anything wrong with this approach?
How much slower it would be to use RSA in this way relatively to AES? For a 512B string and a 2kB string? Or if the speed is constant, the answer expressed in MB/s

PS: Now you don't need to bother and fight about the protocol, which I happened to explain earlier. I just thought the background would help you to answer the question easier, but instead more comments and downvotes on the wrongs in the protocol than the real questions.


texts: Security of AES counter mode vs. CBC mode

texts:
For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is, for AES-CTR mode the first counter must be random or it can be a nonce?
Thanks


texts:
I am looking for a references for post-quantum threshold secret sharing schemes.

I am especially interested in knowing whether any one based on one-way compressor functions or cryptographic hashes exist.

The trivial secret sharing systems with $t=1$ and $t=n$ give information-theoretic security.

Here are some other alternatives that I don't know the security of:

Shamir's secret sharing - I don't know [Update: gives information-theoretic security]
Blakley's scheme - I don't know
The Chinese Remainder Theorem - It seems like it is a problem a quantum computer would easily solve.


texts: Given a deterministic oracle that calculates square roots modulo n, factor n

texts:
When $n = pq$ where $p$ and $q$ are primes, we can generate random numbers until we get $a$ and $b$ such that $a^2 \equiv b^2 \pmod n$. This implies $n$ has some common factor with $a^2-b^2$, and then we can use the Euclidean algorithm to find the gcd, which will be a factor of $n$.

However, I'm trying to figure out how to solve the problem when $n$ is an arbitrary number ($n$ being a product of two primes is not guaranteed). How could I generalize the above case to find a general solution?


texts: Does this break the pre-image resistance of the hash function?

texts:
Supposing a secure hash function $f(\cdot): \{0,1\}^* \rightarrow \{0,1\}^n$ satisfies pre-image resistance.
That is, given a hash value $y$ it should be difficult to find any message $x$ such that $y = f(x)$ within $O(2^{n})$ efforts.
The question is:
Given $y \in \{0,1\}^n$, if we find $x_1,x_2$ such that $f(x_1) + Rf(x_2) = y$, can we say that we break the  pre-image resistance?, where $R$ is a positive integer.


texts: How much extra security does key wrapping provide?

texts:
Wikipedia says:

  Key Wrap. Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material. The Key Wrap algorithms are intended for applications such as protecting keys while in untrusted storage or transmitting keys over untrusted communications networks.

Now key wrapping needs another key for wrapping. Isn't it like a chicken-egg problem. We now need to protect another key.

If someone needs to transfer key over network, wouldn't he/she use SSL/TLS rather than wrapping key?

For storing keys, wouldn't someone use the password protected keystore?


texts:
Why is it that a one time pad is vulnerable is the key is shorter than the message?
I know that if a key is reused across multiple plaintexts, you can XOR two existing ciphertexts to get the pad, but I'm not entirely sure how this works in practice.

Any help/ explanation is appreciated. Thanks.


texts: Is there any standard present to measure strength of a generated key using true random number generator?

texts:
I was wondering how to measure the security strength of a generated secret key for the below protocol:
"A 128 bit random number is generated by TRNG and the random number will be used as a private key for Diffie-Hellman key exchange protocol. Two entities generate the shared secret key and that will be used as a session key for symmetric encryption."
My questions are:

Is there any standard way to measure how secure the generated key is?
What are the properties that the generated key should have to be resistant to attacks? Is there any paper/Standard document available that has the list of such properties?

Thanks.


texts: Is Blowfish strong enough for VPN encryption?

texts:
I'm looking at an OpenVPN connection between two sites configured to use 128 bit Blowfish in CBC mode, and trying to figure out how to assess the strength, but I just don't know enough of the maths.

I could ask this over on Sec.SE, but there I think the focus might be on whether it should use 3DES instead of Blowfish – here I guess I'm hoping for guidance as to relative strength of the algorithm, and whether a break is realistic when used this way.


texts: Why Fiat-Shamir based signatures incur a security loss?

texts: I read here that assuming we have a Fiat-Shamir (FS) signature $\Sigma$ that is secure based on the hardness of a particular hard problem $\Pi$. Then, the security proof of $\Sigma$ in the classical ROM indicates that the reduction algorithm can break the underlying problem $\Pi$ with advantage $Q^{-1} \cdot \epsilon^2$, where $Q$ is the number of hash evaluations an adversary can perform and $\epsilon$ is the advantage of an adversary in breaking the security of $\Sigma$. Hence, if we let adversary about $2^{40}$ hash evaluations, and target for 128-bits of security for $\Sigma$ (i.e., $\epsilon = 2^{128}$), then one would need to set the parameters of $\Pi$ to achieve $296$-bits of security. And apparently the loss is even bigger in QROM setting. But where does this security loss come from? More precisely, why one can break $\Pi$ with an advantage of $Q^{-1} \cdot \epsilon^2$?


texts:
It is generally bad form to reuse the same key for encryption and authentication in an "encrypt then MAC" scheme. For example, in the naive encrypt then MAC scheme, we use a randomized CBC block cipher and MAC the cipher text but an attacker can pass in all 0 messages to violate the CPA security condition.

However, what if we used dependent but not the same keys?

For example, if the key used for MAC is of the form $k' = k \oplus V$ for some fixed value $V$. Is this still bad form, i.e. would there be an encrypt then MAC scheme which is insecure?


texts: DES : Is Double Encryption using same key twice equivalent to single DES using different key but of same size

texts:
If we encrypt a plain text using Double DES but with same key K1,
Can we get the same result as if we would encrypt the plain text using single DES but with different key, say K2.
What I'm asking is can we achieve this for same size of K1 and K2 :
DES(K1,DES(K1,m)) = DES(K2,m)

What would be effective key bits for the first ?
I know this is the case for Mono-Alphabetic shift cipher but I'm confused for DES.
By Key Size I mean like 64 Bit key for which their are 2^55 computations.