texts:
In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$
$$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$
with large prime $p\equiv3\pmod 4$ and the Legendre symbol $\displaystyle\left(\frac d p\right)=-1$.
The matching "twist" is
$$E'_d:\,y^2-x^2\,=\,1-d\,x^2\,y^2$$
Constant $d$ is chosen with minimal $|d|$ such that the curve's order $|E_d|$ is $4\cdot q$ with $q$ prime, the twist's order is $|E'_d|=4\cdot r$ with $r$ prime, and $q<p/4$.
The paper uses prime $p=4^{224}-2^{224}-1$ and gives $d=-39081$,
$q=2^{446}-\mathtt{8335dc163bb124b65129c96fde933d8d723a70aadc873d6d54a7bb0d_h}$,
$r=2^{446}+\mathtt{0335dc163bb124b65129c96fde933d8d723a70aadc873d6d54a7bb0d_h}$
It holds $|E_d|+|E'_d|=2\cdot p+2$. Update: initially my experiments¹ differed by two but Mike Hamburg kindly pointed my mistake: I did not count the two points at infinity for $E'_d$.
The question (now) boils down to: Why $|E_d|+|E'_d|=2\cdot p+2$ ? And how do we find $d$ given $p$ ?
If the later is by mere enumeration of $d\gets-j\cdot\displaystyle\left(\frac j p\right)$ for incremental $j>0$ and checking $q\gets|E_d|/4$ and $r\gets|E'_d|/4$ are prime, how are these computed²?

¹ With $p\gets4^i-2^i-1$ for $i\in\{4,5\}$, I get
$$\begin{array}{r|rrr}
i&p&d&q&r\\
\hline
4&239&19&59&61\\
5&991&-45&233&263
\end{array}$$
² This may be asking for Schoof–Elkies–Atkin adapted to Edwards curves. Pointer to an implementation also welcome.


texts: Abstracting primitives and modes of operation

texts:
I am developing a symmetric crypto library and have reached a roadblock. Looking at block ciphers, it is quite obvious that all block ciphers are trivially abstractable as a simple primitive consisting of:

a key schedule
a permutation function (which takes as an input a key, possibly a "tweak" and a data input)

This makes all block ciphers easy to use in any mode of operation, and makes it easy to "swap out" various algorithms in favor of others without needing to rewrite extensive amounts of code - only the above components differ between algorithms.

I am having trouble observing the same level of abstraction with hash functions. They are described by their compression function (straightforward) but also seem to have a built-in mode of operation which, while often shared between various hash functions, is not meant to be changed, for instance nobody uses the MD5 compression function with a Davies-Meyer construction, it is always used with Merkle-Damgård because that is what MD5, as a whole, is.

And these modes of operation are not quite the same, for instance Merkle-Damgård applies some simple padding at the end of the message to hash and then divides the message into blocks and processes it like that, whereas the UBI construction uses an extra "configuration input" in its compression function which requires the message to be handled quite differently.

So my question is: is there a way to nicely abstract hash functions in a specific framework as elegantly as with block ciphers, without needing to specifically write every hash function in a different way, so as to achieve optimal code reuse?

The best compromise I could come with is categorizing different hash functions in groups depending on what mode of operation they use (such as MD5, SHA1, SHA2, RIPEMD, etc.. would all go into the Merkle-Damgård category, whereas Skein would go in the UBI category, and so on), which would have code related to message padding and handling being reused when necessary, but also increases code complexity slightly.

This is also an issue for HMAC constructions. There is a fully abstract HMAC construction which works with any hash function regardless of its internals, however newer hash functions are starting to provide their own specific HMAC designs (for instance, Skein and its HMAC configuration block) which are more efficient than the "standard" method.


texts: Does AES encrypting /dev/zero and feeding output to AES again increase entropy of the ciphertext?

texts:
I just thought about what would change if would pipe the output of

openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt < /dev/zero | pv -pterb  > file

to AES again. What this does is take a passphrase out of urandom and encrypt the output of /dev/zero - so taking 1 passphrase and an endless number of zeros, which outputs random numbers. this way AES is used as a random number generator. This line can be used to fill up a file on a disk with random numbers. It's way faster than dd'ing /dev/urandom to a file. One can also substitute "file" with /dev/null, just to see how fast the system is encrypting and writing to null.

So I wonder what happens if I would feed the output of that line to AES again. **Would the output change in a way?

As I think it should not change anything — the randomness of the output should be exactly the same, shouldn't it? Is there a practical way to measure the entropy of the output?** I think no, as it should be good enough to not have any statistical anomalies, so there's no way of measuring an increased/decreased entropy - or am I missing/confusing something?


texts: How to prove an encryption scheme is not CCA secure

texts:
Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure

The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a pseudorandom function as follows $F : \{0,1\}^n \times \{0,1\}^n → {0,1}^n$ as follows:

$Gen(1^n)$: Return $k ← \{0,1\}^n$
$Enc_k(m)$: Pick $r ← \{0,1\}^n$ and compute $s = m\oplus F_k(r)$. Return $c = (r,s)$.
$Dec_k(c)$: Parse $c$ as $(r,s) \in \{0,1\}^n \times \{0,1\}^n$ and return $m = s\oplus F_k(r)$.

How would one prove that this is NOT IND-CCA secure?


texts: What are the chances that AES-256 encryption is cracked?

texts:
I'm currently building a web application and would like to encrypt all data on the back-end. I was thinking of using the AES-256 encryption but wasn't sure how safe it was. I did that math and felt safe.

I took this model to a professor at my college, who is a cyber security expert, and he seemed to have quite a different take. He told me there are only two encryption schemes that he knows of that cannot be broken, and AES is not one of them. He said sure, put it in, but just know that there are people out there who can crack it.

I Googled everything I could about the AES and it being cracked, and the only information I could find was this paper: Distinguisher and Related-Key Attack on the Full AES-256
(Extended Version). Sure it says the AES has been cracked but is still has a practical use, right? I believe it is $2^{231}$ instead of $2^{256}$.

So what gives? Is it practically secure to use or not? Does he just know something that most people don't? If my web application database credentials are somehow exposed, and a hacker gets the raw encrypted data, how can I ensure he won't be able to decrypt it within his lifetime?


texts: Does there exist a CSPRNG that does not require generating prime numbers, but also does not depend on any other cryptographic primitives?

texts:
The following excerpt is taken from the “Cryptographically secure pseudorandom number generator” article on Wikipedia:

  CSPRNG designs are divided into three classes:

  those based on cryptographic primitives such as ciphers and cryptographic hashes,
  those based upon mathematical problems thought to be hard, and
  special-purpose designs.

  The last often introduces additional entropy when available and, strictly speaking, are not "pure" pseudorandom number generators, as their output is not completely determined by their initial state.

I am interested in the question: does there exist a cryptographically secure pseudorandom bits generator that satisfies all of the three following requirements?

It belongs to class 2 according to the classification described above. Assuming that CSPRNG uses multiple iterations of some function $F$ to generate the output of the desired length, this requirement implies that the description of $F$ does not mention different versions of the function that are explicitly constructed for different word sizes. Examples of algorithms that satisfy this requirement: Blum Blum Shub, Blum–Micali algorithm;
It does not require generating prime numbers (or testing primality of any number);
If the algorithm uses any precomputed values, then there should be an open algorithm that demonstrates how these values are generated (with the detailed explanation of why it is required to use these values and why other values might impact the desired properties of the output).


texts:
Sorry but I've got a question about HElib again. I'm applying HElib to make a secure logical calculation and I apply bootstrapping as usual. Paras I selected was from "example". However, when I debug the program, there's a new problem:

terminate called after throwing an instance of 'helib::LogicError'
    what():  no key-switching matrices for k=2341, keyID=0

Is this caused by "Bootstrapping"? The methods I apply were initializing the context, make bootstrappable, and save it. After reading it, I didn't write func about boots.


texts: How can one-way hash functions in the signatures help by using same algorithm for encryption and signature verification?

texts:
I read some documents about digital signatures and one way hash functions, etc., but everything was too complicated and I don't have much experience in cryptography. Can anyone explain to me in a simpler way why this is possible?
By digital confirmations of receipt, whenever Bob has received a message, he sends it back as confirmation.

SA - Alice's digital Signature
EA - Alice's public key (for encryption)
DA - Alice's private key (for decryption)
SB - Bob's digital Signature
EB - Bob's public key (for encryption)
DB - Bob's private key (for decryption)
VA and VB are used functions for verification.

1. Alice signs, encrypts and sends EB (SA (m)).
2. Bob decrypts and verifies the signature VA (DB (EB (SA (m)))) = M.
3. Bob signs M with his private key, then encrypts it with Alice's public key and sends the whole thing back to Alice
EA (SB (m)).
4. Alice decrypts and verifies the signature. If the messages match, Bob received the message correctly.

If the same algorithm is used for encryption and signature verification (Vx = Ex and Sx = Dx), there is a possible attack.
QUESTION
Why can, through the use of one-way hash functions in the signatures, this attack be prevented even if the above requirement is met?


texts: Hashing entropy generator output with SHA256

texts: I'm using SHA256 to hash the output of an entropy generator to generate random numbers. Is it generally better to treat the output of the entropy generator as single messages and hash each of those separately (internal state is reset), or as a message of unknown length (internal state is preserved)?


texts:
When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys?

If you look at the ec_key.c file in the openSSL source this is what you see:

BN_rand_range(priv_key, order)

Here a cryptographically strong random number is generated which is smaller than the order.


texts:
I am thinking on a simple symmetric stream cipher. My first idea is the following:

The key is a set of array of random bytes ($\underline{k}_1$ ... $\underline{k}_n$), whose length is $l_1$, $l_2$, ..., $l_n$ (any pair of $l_j$, $l_k$ is relative prime).
We encrypt/decrypt the $i$-th byte of the stream by XOR-ring with these arrays, each after the other, periodically: $enc(s_i)=(\bigoplus_{a=1}^{n}k_{a, i \bmod {l_n}}) \oplus s_i$.

I think, this algorithm is so trivial, that probably not I am the first whom it came to mind.

How strong is it? If it is known, what is its name?

Extension: is it weaker, as a Vigenère cipher with length $\prod{l}$?


texts: Recover secret $x$ when $c\equiv m^x \pmod p$ with public $p$ (modified)

texts:
Given an encryption system where $c\equiv m^x \pmod p$, $p$ is a known prime,
1. Is it possible to recover $x$ with a known plaintext attack? Given $(p,\text{factorization of }\varphi(p),m,c)$
2. Is it possible to recover $x$ with a chosen plaintext attack? (Somehow with the chinese remainder theorem on the factorization of $\varphi(p)$ comes to mind)


texts: Are digital signatures secure for signing lots of small messages?

texts:
I need to sign the numbers from 1 to 1 billion (literally this, it's not an analogy) using a digital signature and then send these numbers in a particular order to someone. The message is not private and the receiver should be able to verify its authenticity without having to reply; it's a one-way public communication channel.

Are there any algorithms that are safe enough for this? How many bits should the key have and how many bits will the signature have?


texts: How secure is SHA1? What are the chances of a real exploit?

texts:
I read that, in February 2017, a SHA1 collision was calculated for the first time. This, and earlier theoretical proof, means that SHA1 is officially cryptographicaly insecure. But, when using SHA1 in a protocol (SAML assertions in my case), both the protocol dictates a certain message format and the information in the message has to be meaningful to create a real collision exploit. Under these circumstances, how feasible is a real exploit?

Not being hindered by any real knowledge in the field I suspect this will 'never' happen. Or am I missing something?


texts: Purpose of the ZKPoPK in the original SPDZ protocol

texts:
What is the purpose of ZKPoPK in the SPDZ paper? And will the following can detect the active adversaries in 2 party spdz excluding ZKPoPK step?

Each party sends a commitment on his MAC key ∆_i before starting
the offline phase.
Parties  select random a_i and b_i and broadcast the encryption on a_i, b_i, ∆_i
These encryptions can be added up and multiplied using FHE to produce encryptions of (a · b, a · ∆, b. ∆, a · b · ∆)
Using the distributed decryption to allow the parties to receive an additive secret sharing of each of those values
Same procedure can be used to authenticate the inputs of each party
Circuit Evaluation
Reveal the output and the mac keys


texts: Leaving authentication data blank less secure for AES GCM?

texts:
The AES GCM example for Ruby / OpenSSL shown at: http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html has a GCM example of the following:

cipher = OpenSSL::Cipher::AES.new(128, :GCM)
cipher.encrypt
key = cipher.random_key
iv = cipher.random_iv
cipher.auth_data = ""

encrypted = cipher.update(data) + cipher.final
tag = cipher.auth_tag

decipher = OpenSSL::Cipher::AES.new(128, :GCM)
decipher.decrypt
decipher.key = key
decipher.iv = iv
decipher.auth_tag = tag
decipher.auth_data = ""

plain = decipher.update(encrypted) + decipher.final

puts data == plain #=> true

In the example, auth_data (authentication data) is set to nothing.

My question is: Does this make the encryption less secure by using blank auth data?

Any help is greatly appreciated. Thanks!


texts: To which game-based security definition is Perfect Secrecy equivalent?

texts:
We all know the classic definitions of perfect secrecy, being
$$\Pr[M=m|C=c]=\Pr[M=m]$$
and
$$H(M|C)=H(M)$$

But now what I've asked myself:
If we were to remove the polynomial restriction on the attacker, which game-based security definition would be equivalent to perfect secrecy and how would one show this?

Of course I've thought about this myself and it's obvious that known- and chosen-plaintext security is a given as we still can't learn anything new about the plaintext if a scheme is perfectly secret.
Even with chosen-ciphertext attacks I don't see how one could deduce more information on a perfectly secret scheme, given that the challenge ciphertexts would still be independently encrypted.
What I kinda can't grasp though is the reverse direction and of course the formal proof of equivalence.


texts: Using first, say, 50 letters from a public key as user identifier?

texts:
I am making a messaging system where users are identified by their public keys.  It doesn't matter which friendly username they have, so I'm not going to prompt them to choose one.  Each user will have a directory that will get their messages saved to, so it would be nice if the directory that belongs to them has a short name.  I.e. I can't create a very large directory name by using the entirety of their public keys (might be too long and hit file system limits).
I was considering to use, say, sha3_244(their_public_key) and consider that hash for their home directory names.
But then I thought, how about I take the 1st 50 bytes of their public key, base32 encode it, and use this instead of the sha3_244 checksum?  Should I be worried about collisions?


texts: How keeloq keyfob exchange key with receiver in the first place?

texts:
After reading a lot of articles and the microship maunal for keeloq IC, I think I understand how the encryption and decrytion works. If I understand correctly, however, the decryption require the exact same 64-bit key as the encryption does. My question is how the receiver get that key for decryption in the first place?
I see from microchip HCS300 maunal there are 3 learning mode, simple, normal and secure.

Most of the garage door opener I have seen with rolling code only require to press a single button on the keyfob, so it is not putting the keyfob on learning mode, so it is unlikely to be secure mode? And since most of these actually accept a generic keyfob you can buy from ebay, I don't think it is going to be a fixed crypt key as described in simple learning mode, or otherwise there is not much security.

So they are in normal learning mode? which the key is actually dervied by a manufactrer key and the serial number of the keyfob? But that is still an issue as the keyfob I bought online would not know which manufacturer gate opener I am going to use, and therefore with the keyfob key derived from the manufacturer key in the first place?

Bottomline: How does the receiver learn the keyfob encryption key in the first place?


texts: Can I simulate iterated AES-ECB with other block cipher modes?

texts:
I am trying to write some code using the Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/#algorithm-overview) which provides only some of the block cipher modes for AES, intentionally excluding AES-ECB (presumably because it is not normally a good choice for anything).

My need is to use AES-ECB-nopadding as part of a key strengthening step, i.e. iterate 6000+ times to introduce some constant extra time into the decryption, resulting in a strengthened key that I can use to decrypt the rest of the data.  My code is providing compatibility with an existing password system that does this (Keepass) so I don't have any choice as to what steps or algorithms to use.

Given lack of native support, can I simulate this with one of the other block ciphers, or will I have to load a third party library that includes the ECB block cipher?

I tried so far using CTR with a zero counter and never incrementing the counter.  This failed due to some technical limitations (it did not support those parameters).

I think it may work to use CBC with a zero IV and just doing a single block at a time.  Will that work (theoretically)?


texts:
I know that the message space is the set of all possible messages, but I'm not sure how to generally define it, rather than for a specific cipher. For example, I've seen $$\{\forall c \in A\}$$, where "$A$" is the set of characters being used.
But I think there should be a superscript at the end to denote the length. Would this be correct?


texts: what is the probability for an adversary to find the new key after adding new entropy in a group where computational diffie hellman is hard?

texts:
Let's say I have an Elliptic curve group $E(\mathbb{F}_q)$ with base Point $G$ and large prime order $n$. Computational Diffie-Hellman is assumed to be hard in that group.
$H: \{0,1\}^*\rightarrow \{0,1\}^\lambda$, where $\lambda$ is fixed, is a collision resistant hash function.

I have a symmetric encryption key $k\leftarrow H(X+Y)$, with $X,Y \in E(\mathbb{F}_q)$
Let's suppose after a certain time, the value $\alpha = X+Y$ is leaked, and I decide to update $k$ as follows: $k\leftarrow H(X+Y+Z)$ where $Z\in \mathbb{F}_q$ is a point sampled at random
Then (ElGamal Encryption) I sample at random $r\in \mathbb{Z}^*_n$ and compute $c_1 = r.G$ and $c_2 = X+Y+Z+r.pk_R$, where $pk_R$ is the public key of the receiver. Then, I send $c_1, c_2$ to the receiver over an authenticated line.

My question is the following: if a polynomial-time bounded adversary $\mathcal{A}$ obtains $\alpha, c_1, c_2$, what will be its probability to find/compute the new symmetric key $k\leftarrow H(X+Y+Z)$?


texts:
Are their any specific requirements for the IV when using Salsa20?
Is it for example allowed to re-use the same IV when encrypting with the same session key? Should the IV be random? etc

I tried to find some information in the related Salsa20 paper, but I could not really find any mentions of specific Salsa20 IV requirements.

Thanks for the information :)


texts: The output of experiments Real and Ideal in simulation-based security proof

texts:
For simulation-based security proof in searchable encryption, there are two experiments running for the Real and the Ideal world respectively.

I can understand that the Real world experiment taking the real ciphertext and auxiliary information as the input, while the Ideal world experiment only taking the auxiliary information as the input.

However, it is a little bit difficult to understand the meaning of the output of these two experiments.

Normally, both Real and Ideal world experiment will output a bit. What't the meaning of this bit?


texts: Security of password hash with known prefix and appendix

texts:
Assume I have a password that is exactly 32 characters long. I hash it the following way:

Prepend 1524 bytes (known to an attacker)
Append 3356 bytes (known to an attacker)
Do the checksum

It is clearly visible that only a tiny part of the plaintext is variable.

Assume the attacker stole the checksum from a DB. How difficult would it be for them to recover the password or create a collision? What checksum algorithms are more resistant against that?

Yes, I know that one cannot recover a password from a 16-bit CRC-16. Let's assume that the checksum is at least 128 bits long.

What would change if one of pads would disappear?


texts: Is the SHA1 hash of MD5 hash of a password secure?

texts:
Cryptography is not my area, so pardon me if the question is annoying.

Some time ago, I implemented an Internet site, which database had a users table. To keep the password in its user table field, I used

encrypted_password= sha1(md5(raw_password));

What are the pros and cons of the approach I used?


texts: Bilinear pairing arithmetic - cryptographic accumulators

texts:
For calculating accumulated values for set of elements chosen randomly from, say, $\{e_1 ,e_2,...e_n\}\subseteq X$ we use the formula $acc= g^{f(e,s)}$ where $f(e,s)= (e_1+s)(e_2+s).....(e_n+s)$.

Then, the witness for $e_k$ is calculated as $wit_{e_k} = g^{\prod(e_i+s)} $ where $i \ne k $  (i.e., accumulating all values except $e_k$).

This can be calculated by dividing $f(e,s)/(e_k+s)$ (assuming all $e_i$'s and $s$ are known to me) and raising $g$ to it.

My question is not about the application or purpose of cryptographic accumulators but about some mathematical clarifications:

While computing $f(e,s)$, do I have to do modular arithmetic on $P$ where $P$ is a prime number representing the order of group $\mathbb{G}$?
Also, one paper stated that it is impossible to create a witness for an element which is not accumulated into it. Will anybody please elaborate on it?
By dividing $f(e,s)$ by $(e_k+s)$ one can calculate a witness value.
Is there any way to distinguish between the witness (let me call it) values that where computed when $e_k$ is accumulated in $f(e,s)$ and when it is not accumulated $f(e,s)$?


texts: Best practice for JWE symmetric key encryption

texts:
After the user authenticates with Auth0, the backend issues a JWE with some info about the user. I do not want the user to be able to see the payload, which is why want to encrypt it.
Furthermore, only the backend will need to decrypt the JWE as no other party will be using the data of it.
To my questions:

Is symmetric key encryption the right fit?
Is it appropriate to generate one key, save it in a local file and read it to encrypt each JWE? Or would I need more keys for each user? What is the best practice?

Thank you!


texts: Do probabilistic one-way functions imply deterministic one-way functions?

texts:
Suppose $f$ is a probabilistic one-way function.  Then my question is, does there exist a construction of a deterministic one-way function $g$ based on $f$?
Or is it possible that probabilistic one-way functions exist but deterministic one-way functions do not?
EDIT: Probabilistic one-way functions are defined in definition 2.2.2 here.


texts:
Leaving aside the problem of how to compute the inverse of a PRF F, may we use it also as a PRP?

The reciprocal of this statement is true, see for instance Katz and Lindell, Proposition 3.27, when the input length of F is sufficiently large. However, in practice to build a PRP from a PRF people use a Feistel network. This would address the problem of making the PRF invertible.

Leaving aside the invertibility I guess the same proof for PRP $\implies$ PRF is useful here. Am I right?


texts: Why ssh-gen makes difference between PEM and PKCS8?

texts:
Correct me if I am wrong, but PKCS8 is format to store private key info. It could be binary-enoded (DER) or Base64 encoded (PEM).

man ssh-config

-m key_format
             Specify a key format for the -i (import) or -e (export) conver‐
             sion options.  The supported key formats are: “RFC4716” (RFC
             4716/SSH2 public or private key), “PKCS8” (PEM PKCS8 public
             key) or “PEM” (PEM public key).  The default conversion format
             is “RFC4716”.

I am confused with "PKCS8 Public Key" (while RFC-5208 is "Private-Key Information Syntax Specification Version") but I also can't understand what is "PEM public key" here? PKCS8 could be PEM or DER. What does it mean?


texts: Why is the security level defined by $\log _{2} \inf \{ t_{i}/\varepsilon_{i} \mid i \in I \}$

texts:
In public-key cryptography, the security level indicates the strength of an adversary in breaking a scheme or solving a problem, which can be seen as the time cost of breaking a scheme or solving a problem. Generating a scheme with a security parameter $k$ does not mean that this scheme has $k$-bit security. The real security level depends on the mathematical primitive and the scheme construction.

  Suppose all potential attack algorithms to break a proposed scheme have been
  found with the following distinct time cost and advantage

  $$\{ (t_{i},\varepsilon_{i}) \mid i \in I \}$$

  Let

  $$2^{k^*} = \inf \{ t_{i}/\varepsilon_{i} \mid i \in I \}$$

  Then we sat this scheme is $k^*$-bit security.

My question is why the form is $t_{i}/\varepsilon_{i}$?

Of course the security level depends on the time cost $t$ and the advantage $\varepsilon$. I assume that

$$2^{k^*} = \inf \{ f(t_{i}, \varepsilon_{i}) \mid i \in I \}$$

Thus, there are some basic properties of $f$.

P1. For $t_{2} > t_{1}$ and $\varepsilon_{2} > \varepsilon_{1}$, $f(t_{2}, \varepsilon_{1}) > f(t_{1}, \varepsilon_{1}) > f(t_{1}, \varepsilon_{2})$. If we assume that $f$ is smooth, then we can let $df/dt > 0$ and $df/d\varepsilon < 0$.

P2. For every attack algorithm,  $f(t, \varepsilon) \leq 2^k$.

P1 and P2 hold true if we let $f(t,\varepsilon) = t / \varepsilon$.

However, there are may functions that satisfy these properties. And I think $f$ should also satisfy more properties.

For example, given an attack algorithm $A$, for the trivial modification of $A$, the value of $f$ should be the same.
Let $A_{n}$ be an algotithm that calls $A$ for $n$ times, $A_{n}(x) = 1$ if and only if there are more than $n/2$ times that $A(x) = 1$.
We know that
$$\frac{t_{A_{3}}}{\varepsilon_{A_{3}}} = \frac{3 t_{A}} {3\varepsilon_{A}/2} \neq \frac{t_{A}} {\varepsilon_{A}} $$

I try to explain the "trivial modification" more clear. If there is an oracle machine $M$ which is independent on the scheme, then I think $M^{A}$ should be a "trivial modification" of $A$. I believe that the power of $M^A$ should not be stronger than $A$. However, I do not know how to define the oracle machine $M$ in a formal way. So, I give above example of $M$ such that $M$ asks oracle $A$ for $n$ times and the output of $M^A$ only depends on these $n$ answers. We do not care about the specific attack algorithm $A$ is (and whether $A$ has the accesses of some oracles.)


texts:
I have been told that one advantage of using a hash function is that it spreads entropy over all input bits. But it also seems to be true that a bad hash algorithm can make things less random. But how do I know if the hash I am using doesn’t make things less random?

Currently, I’m hashing (SHA2) a few extracted bytes I collect from a CSRNG to create keys for AES encryption/decryption. Is that wrong? From what I’ve been reading, SHA2 seems to be secure. But I could also skip SHA2 and extract more random bytes from the CSRNG until I’ve got enough bytes for a key. Is that a better idea? Or is SHA2 not one of those hashes that might make things less random?


texts: Considerations on using a single long-term key for file encryption

texts:
I'm thinking about designing my own container file format that allows me to store a file in it along with, say, a thumbnail or other metadata. Some of these files are confidential and therefore must be encrypted. Basically, my goal is to achieve confidentiality, authenticity, and integrity for my file containers. But, with possibly millions of containers and only a single long-term secret (i.e. master key file), how can I do that properly?

I suppose what I'm looking for is AEAD (AD = the file header) for which I can, e.g., use AES-256-CBC + HMAC-SHA256 or AES-256-GCM.

The issue I'm held up with is the IV/nonce. Since there is only a single long-term secret in my design, I understand that I must ensure the uniqueness of the IV/nonce for each container with either one of the methods mentioned above.

Is it sufficient to use a simple sequence number for each container and place it in the (authenticated) file header?
Should I split the IV/nonce in a fixed and a sequential part (mentioned in RFC5116)?
Different approach?

I was also thinking about using an HKDF to derive key material for each container from the master secret and a GUID associated with each file container. I would then store the GUID in the plain file header. But then again I could simply use the GUID as IV/nonce. Is there a benefit in creating individual key material for each container?

Update

Individual keys for each container seem like the way to go. However, simply using a master secret to encrypt the container key does not solve the IV problem. Please take a look at the following proposal:

File header

$H: Plaintext\ file\ header$
$G: GUID\ associated\ with\ the\ payload\ (included\ in\ H)$

Payload

$P: Plaintext$
$C: Ciphertext$
$IV_p: Payload\ IV$
$K_p: Payload\ key$

$C = AES(IV_p, K_p, P)$

User keys and MACs

$S_i: A\ secret\ stored\ in\ a\ file$
$IV_i: IV\ for\ slot\ i$
$K_i: Key\ for\ slot\ i$
$K_{M_i}: HMAC\ secret\ for\ slot\ i$
$M_i: HMAC\ for\ slot\ i$
$K_{P_i}: Payload\ key\ material\ encrypted\ with\ K_i$

$(IV_i, K_i, K_{M_i}) = HKDF(G, S_i)$
$K_{P_i} = AES(IV_i, K_i, IV_p\ ||\ K_p)$
$M_i = HMAC(K_{M_i}, H\ ||\ C\ ||\ K_{P_i})$

Container file format

$H\ ||\ C\ ||\ (K_{P_i}, M_i)$

With this design, I

use a HKDF to derive as much key material from the keyfile as I need (solving the IV problem)
can later on add or remove as many user keys as I want
can detect tampering via the HMAC associated with each user key
do not need to store a hash of the container key (like LUKS does) because the HMAC guarantees the integrity of the decrypted key

Would you consider this a sound design?


texts: Efficient and stateless anti-forgery method

texts:
One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks.    The attacker doesn't need to sniff the wire in order to carry out a CSRF attack.  This attack relays on the fact that the HTTP request is predictable, and the defense is to add a secret value such that an attacker cannot forge this request.

In order for each request to be validated the server must keep track of each client's secret.  This requires the server to use significant resources to keep track of this state for a large number of clients.

Is there a cryptographic method that can prevent forging of requests that also very efficient?


texts: GPG + OTP--Would that be authenticated encryption?

texts:
Here is a GPG message, signed and encrypted (strictly for demonstration, with test keys):
-----BEGIN PGP MESSAGE-----

hQGMAyxbH69MHihtAQv/Z5FROYmcGwAWeomk+1b1ps4EQaLkUDU+iYKzhEojEDJa
pxbZB5yUsLlrEmJXMis3Jt4eSMvRpj6xUVR9cJHbWPAOTK1S6PMASquFIagNY0c7
dIoShPSlPDjSb1Vi/0drqZUoEkjeB3fnqRb3ECTwBbU24Ygq/MD5Jtf0pGLmcXxT
ZAM4Sbtta0pfCFKjfkV22jQiu/mfbxd05DrCkG64hhLvtmNI8R3iperlYIp41z53
8aaK5/FvASX8u1ngyzldiKc7TmVE8ypuGWs1bjD94H33YsJlyQFg/XTUr/aV2O1e
1YkKkjT3MdQ2iNDeuxpJFqeP8ZS3iEx99cTSWEzUXYg7EaAbVS7F23Rtb1DwL4cE
H0MuDa+aeWaRcGKO1DfW+QIJYoQxEm9X/jklGoEfc07Rsm0RhfO/sYW/JlKg9xX/
pDKWW4fC1bmELEmKz/U48CmqWBRKwLsGSuEEgycqox92uY8tov6RIG7cfTz5s0bI
7wsRV7TXboPv0xHhWFoQ0ukBFQuiJZC0UltJlHGCypb2I7xF0BW5KTHhv3ml4Jtd
asuR03aFjyHW+K81IV/OAd5H9fUH2ixz/DrbeyWQ4xXKoAdFJNqUX/4dVteYW9Uv
jaJcH3+0N8q/SJb/VHvKfAyE//5Qr6N9gjGga6MzNLfmA5659KY+P1hOvjPi0AaN
3uUYiG4QLSfToLA9qqDpHfp1M/Syg9LleX+JyPooBYiV8WZOhpGBxcE1yet1Qija
Qp23joj3vvhdPoK1XmBIRABWGbtPGTCSKBI3/YNtHcsARtHYSTMpSH4PtSu0Au17
vBKbOgkdz4bwy/wqfyJOFYQmoK5YLEnTlZL7eKBNZYqzMvoQpt63Q4mqvoVc8reS
odVXYFPs7Bz1zmevZf1BMx56ZRPBk0nRZRjGQtLKnOuARLzbkad0pCm213vau32D
jRyS9JlTX9XuMicVpExyjfUoXb28Z1MZpTCfnHKUXMXJl83NjSjcI4KYipSNhQ3R
QgUuaWb2K0PXu6D8Cv9F2QzvhpWQ9MDaCyVjCIUSwS1DgU4fwVlw4COVJNqFvuUd
STIedU/yqoUy8AlaFScoXR2vdh5IgyPIxgkRHrMBHCR5UbGuXXiIIow+8zWN5jDu
gPUZgFx27CZC4OMAE0uD5lBLNV6nQDcbKUvYRRW6H2QTwwCb5TKCGlP3HSyuCinO
JDZ9tAtPWkS98WjYshU4UVX+z1TIziuX9TMmviG4bLdYRECtQl04oez3N0gU210f
eSmOXA3d4lc=
=q3qY
-----END PGP MESSAGE-----

Here is its HMAC-SHA512 value:
/Uz8oVQr5ILR52r6ngYAHH6X/viEGwbRTQ55SocixqyaCsjdzGzPosqLDcgZwMH0k+F42D+9WcwR67JALmS2bQ==

Concatenate the entire block of the GPG message with the HMAC-SHA512 value.
Now pass a one-time pad over the whole thing. Send. Of course, the one-time pad will have been properly generated, secured, and shared.
Pieces of the one-time-pad key were just given away because the format of the underlying gpg message is, of course, known. In this case, there is no transposition.
Questions:

Is this authenticated encryption?
Is this quantum resistant?

As far as I can tell, bit flipping is not going to have any advantages; having known plaintext does not seem to make any meaningful sense.  Factoring advantages against RSA surly will not help, nor will inverting SHA-1.  Is that right?


texts: How can we evaluate a polynomials in a group instead of a field? (verifiable secret sharing on elliptic curves)

texts:
I am trying to understand how we can have cryptographic schemes that builds on both secret sharing, which is build on top of a finite field, and bilinear maps, which are built on top of elliptic curve groups.

An example of this is section 4 in Public Verifiability from Pairings in Secret Sharing Schemes, where publicly verifiable secret sharing is obtained with bilinear maps as proofs of correctness.
The relevant part of the scheme for the question is:

Setup: $q$ is a prime and $h$ generates a group $G$ of order $q$. Each participant publishes the public key $h_i = h^{d_i}$, where $d_i$ is a random number in $F^*_q$.
Distribution: the dealer chooses a random polynomial of degree $t -1$ with coefficients, $\alpha_j$ in $F_q$: $P(x) = \sum^{t-1}_{j=0} \alpha_j x^j$ and publishes the encrypted shares: $Y_i = h_i^{P(i)}$.

and publishes commitments to the coefficients $C_j = g^{\alpha_j}$.
Verification: A step in the verification process involves calculating $X_i = \prod_{j=0}^{t-1} {C_j^{i}}^j = g^{ \sum^{t-1}_{j=0} \alpha_j i^j}$ and then evaluating whether the bilinear equation $e(X_i,h_i) = e(g,Y_i)$ holds.

The question then is:

How is this possible? The use of bilinear maps implies using elliptic curves groups, while calculating $X_i$ involves both addition, multiplication and exponentiation, i.e. it requires a field. But since we have transitioned to the group of curve points when we calculated $Y_i$ and $C_j$ we will have lost the multiplicative and exponentiation operations, right? What am I missing here?


texts:
I work with Historical Geographic Informations Systems on the academic level. I note this to give you an idea of my technical knowledge when it comes to computing, but that most of my knowledge of cryptography is a little outdated I'm more familiar with say the caesar cipher, the Enigma Machine, VENONA, etc from reading about them history and much less with modern encryption systems like PGP or AES.

I came across a text file of an encrypted public domain work which use AES-128 (XML encryption standard). From my initial research on google a brute force attack is unfeasible at that bit length. My question is if I already know what large portions of the encrypted text says when decrypted, because its a public domain work, is that something that can be use to decrypt the file?


texts: What information should I send along with an AES ciphertext and is there any standard to do that?

texts:
While using some crypto implementations I got to see that many times a comment is added to the ciphertext.

For example:

-----BEGIN PGP MESSAGE-----
Version: OpenPGP.js v1.5.0
Comment: http://openpgpjs.org

wcBMAyJd6d8o7Y2pAQf/WZM1LV/iq3R8QGK7fUiQoUVzR8nEow+RJcBh6ujH
MBGWKcm4Y//a76hOL4r/Htbt7lwnfGe2HLrznRQip1TaONW897zrD7amsOp3
xlbZZep/HQNHNgtOGHx4peqDjrPQk9Y7HvRxrPFQWM2jMFTFlvJsw3kBWiNn
FI0jn+8RZalxCXloAE2OSWTkzInf+RfAefrFRCSiQW536UZ0h89u560TgA10
u7N0b+iGzRAB+4AFBZjkWpO5/KpYRzlUng+BMw4TmrlHJlLxiW7s3R3V74/J
ZNu1IIZ0S16A0r3XuWGbccO59igNY8qzi3FyMiQgCbYCReccm6M59no7M0gK
0tJFAe9BC5GJuS0oTrnoH9Wf6/tftw5booEaNU67HDnU0qI9blUK2rFVFoR/
ZCNlDy2HxpQZFgrnGPBMsvV6wZSj/LgLF+wi
=jLQU
-----END PGP MESSAGE-----

Where:

-----BEGIN PGP MESSAGE-----

… identifies the beginning of the data.

Version: OpenPGP.js v1.5.0

… identifies which implementation of the protocol was used to encrypt the text.

Comment: http://openpgpjs.org

… provides a generic comment.

-----END PGP MESSAGE-----

identifies the end of the data.

The first thing I am wondering if it's some standard out there for this comments, and if so some links or informations about it.
Would've asked to Google but don't know what to search.

Then, I would like to use a comment like the one showed above to store my ciphered messages as plaintext.

Assuming I want to do that for a message ciphered using AES, which informations should I store?

Should I store the AES mode used for encryption ?
Should I store the AES implementation I used ?
Should I store the initialization vector ?
Should I try to be compliant to some standards while storing these informations ?


texts: Consider a block cipher that encrypts bit strings of length $n$, where the key-space of the block cipher is of size $2^{kn}$, $k \geq 1$.   My understanding of perfect secrecy is that a system is perfectly secret if (and only if?) the size of the key space is larger than the size of the message space.  But then, if the stated block cipher was used to encrypt messages, is it not true that such a block cipher could encrypt $k$ messages of length $n$ with perfect secrecy?  Would this be possible if, after each encrypted message, a nonce was used that changed the key in some way, so that every subsequent message had perfect secrecy?


texts: Is this the correct procedure for cycle walking using an FPE?

texts:
To encrypt a value from a set (say a range of years from 1001 to 2001)

Rank the set

{0 = 1001, 1 = 1002, 2 = 1003...999 = 2001}
Take the value you want to encrypt from the set (year = 1995) and determine the ranked value = 996
convert this to binary 996 = 1111100100
Encrypt binary value using FPE(1111100100) = En where n is the iteration
If En lands outside desired maximum of 999, take En and encrypt again FPE(En) = En+1
Stop when En+1 is inside range 0 - 999, else repeat step 5

Questions,

Is this the correct way to perform cycle walking using any FPE?
What is the smallest probability of landing outside the desired range? What is the largest?

Note:  In my case I'm using BPS as my FPE which has the restriction of at least two 'characters' as input so for binary number the smallest input values possible would be 00, 01, 10, or 11.  In decimal this is 0, 1, 2, 3.  Therefore the smallest range you can create from these values is 0 - 1.  So the probability of landing outside those two values would be 50%.  Is this correct?

Would 50% be the max probability of landing outside the smallest range - with the probability getting smaller as the range increases?


texts:
I understand that given solutions for solving a discrete logarithm problem are on the order of (2/2), ergo, 256bit private keys based on 25519 or secp256k1 have an effective bit strength of 128bits.

I was wondering if anyone could explain how one can know the largest size private key supported by a curve. Is it to do with the curves prime field? I'm just trying to learn a bit more about ECC.

As people slowly look at RSA 3072+ as archaic and not strong enough, I wonder how long before 128bit strength ECC goes the same way.

Do we have any non NIST (NSA backdoored :) ) curves which support 512 bit private keys (yielding 256bit security?).

Thanks,
John


texts: Prove the Security of Schnorr's Signature Scheme

texts:
I know that Schnorr's signature is important since it is one of the most compact signature schemes whose security has been proved in the random oracle model.

Now, I want to know if such proof is easy and someone could explain it to me, or maybe just point out the main steps of the proof.

For the sake of clarity, the Schnorr's signature scheme I know is the one presented by the Wikipedia page Schnorr signature:

Choosing the parameter: all users of the scheme agree on a group $G$ of prime order $q$, in which the DLP is hard (e.g. $G$ is a Schnorr Group, or an Elliptic Curve of prime ordere $q$), a generator $g \in G$, and on a hash function $H:\{ 0,1 \}^* \rightarrow \mathbb{Z}_q$
Key generation: the signer chooses a secret key $x \in \mathbb{Z}_q$ and makes $y=g^x$ public.
Signing: to sign a message $M$, the signer chooses a random $k \in \mathbb{Z}_q - \{ 0 \}$, computes $r=g^k$, lets $e=H(M||r)$, and lets $s=k-xe$. The signed message is $(M,(s,e))$.
Verifying: anyone can verify that $(s,e)$ is a signature on $M$ by computing $r_v = g^s y^e$ and $e_v = H(r_v||M)$; if $e_v = e$ the signature is verified.

Now, the proof of correctness is quite straightforward (i.e. if one follows the protocol, then the verification equation $e_v = e$ holds), but I don't see how to formally prove the security (i.e. if one doesn't follow the protocol, it is very unlikely that the verification equation will hold, hence it is hard to forge a signature on a message without knowing the secret key).

Any hint or suggested readings will be appreciated!


texts: I read a bit of A Method for Obtaining Digital Signatures and Public-Key Cryptosystems that introduced RSA in 1977, and, while learning the steps in RSA a few days ago, I noticed that they are similar to the Diffie-Hellman key exchange. Was RSA inspired by Diffie-Hellman, published the year before in 1976, as in does the cryptography rely on earlier work and re-use parts from Diffie-Hellman and modular exponentiation, and the secret being the inverse of the encrypted message?


texts: OFB output jth-block expression clarification

texts:
Stalling says:

OFB encryption can be expressed as
Cj = Pj⊕E(K, Oj-1)
where
Oj-1 = E(K, Oj-2)
Some thought should convince you that we can rewrite the encryption
expression as:
Cj = Pj⊕E(K, [Cj-1 ⊕Pj-1])

Is he implicitly saying that

[Cj-1 ⊕Pj-1] = Oj-1

? If yes, why?


texts: How can we build a ZKP simulator for “Were is waldo?”?

texts:
The following link illustrates two possible methods for solving the "Where is Waldo?" puzzle in zero knowledge.
http://www.anagram.com/jcrap/Volume_0_1/crv0n1-3.pdf

Let's consider the first method:

How can a Simulator be built for any of the method described above?

I believe that the question above can answered only once the protocol view has been defined. And here is where I am stuck.

One option is to define the view as a video recording of the interactions between Alice and Bob. This video should also include the full cavity search performed by Bob on Alice as this is part of the interaction.
If this is the view used for the protocol, how can a simulator build this view without having knowledge of Waldo's position?
After the cavity search has been performed, Alice (or whoever impersonates Alice) must have knowledge of Waldo position in order to complete the protocol successfully.

If the cavity search is omitted by the recording, then a simulator can build a view without having knowledge of Waldo's position as the cut-out image of Waldo can be replaced with any image of Waldo.

However, I believe that the cavity search should be part of the recording as it is part of the interaction between Alice and Bob.


texts:
In pursuit of understanding a randomly found topic I was interested in learning the connection between integer programming and cryptography and found Lenstra Jr.'s Integer Programming and Cryptography. It is bit technical for my taste. Is there an easier reference to use for a novice to learn about what cryptography and linear/integer programming has to do with one another. And what are the ongoing works in this field ?
Appreciate your time in answering this question.


texts: Known Plaintext Attack on Block Cipher in ECB and CBC Modes of Operations

texts:
These 2 similar questions  are from Paar's Understanding Cryptography. I could not see the answer so if someone can help I will appreciate:

Question1:  We consider known plaintext attacks on block ciphers by means of an exhaustive key search where the key is $k$ bits long.The block length counts $n$ bits with $n>k$ .

(i)  How many plaintexts and ciphertexts are needed to succesfully break a block cipher running in ECB mode? How many steps are done in the worst case?

(ii) Assume that the initialization vector IV for running the considered block cipher in CBC mode is known. How many plaintexts and ciphertexts are now needed to break the cipher  by performing an exhaustive key search? How many steps need now maximally be done? Briefly describe the attack.

(iii) How many plaintexts and ciphertexts are necessary if you do not know the IV?

(iv) Is breaking a block cipher in CBC mode by means of an exhaustive search considerably more difficult than breaking an ECB mode block cipher?

Question 2: Keeping an IV secret in OFB mode does not make an exhaustive key search more complex. Describe how we can perform a brute force attack with unknown IV?What are the requirements regarding plaintext and ciphertext?


texts: Is there any reason not to use Single-Key EM with AES and a constant key?

texts:
I've read recently the paper "Minimalism in Cryptography: The
Even-Mansour Scheme Revisited" by Dunkelman, Keller and Shamir where it is claimed that the following construction (Single-Key EM) is secure:

$$C=K\oplus E(P\oplus K)$$

with $E$ being a publicly known fixed permutation.

Is there any reason not to use the above scheme (as block cipher) with AES-128 and key $0^{128}$ as $E$?

As for the reasons why somebody may want to use it:

It can provide smaller implementations, enabling the hard-coding of the round constants
It may be faster for the same reason
It is more key-agile, allowing for much faster key switches (e.g. in a hashing / KFB scenario)


texts: TPM/FIDO Direct Anonymous Attestation practicality

texts:
DAA (Direct Anonymous Attestation) is not the only scheme to achieve anonymous attestation. In general, these schemes allow an entity to stay anonymous throughout the attestation process. The concern here is not the attestation but key revocation. TPM/FIDO DAA scheme requires to keep a rogue list of compromised private keys to make revocation possible. But the assumption of compromised device will have its private key leaked publicly is naïve. In fact in many scenarios,  a hacker may not reveal a compromised key. Such key can be used for attack such as denial of service attack etc... Since device identity is anonymous to service provider, there is no way for service provider to differentiate an attacker from genuine user.

What making it worse is having the private key stored/protected using hardware security controller or HSM (Hardware Security Module). A hacker may have the knowledge to hack and extract the private key from a HSM using zero-day vulnerability. Since private key is designed not to output private key in plain. Therefore, even if a user acknowledge his device is compromised, but there is no way for him to inform the authority since it is not possible to extract the private key as a normal user.

Therefore, DAA sound like a wonderful technology but is not commercially viable? Considering the fact that the DAA scheme is already introduced in FIDO specification. I'm curious to find out why is this scheme accepted in FIDO with the aforementioned weakness. Maybe I missed something and someone can answer it


texts: Name for identical operations for encryption and decryption

texts:
Is there a name for the property of a cryptographic algorithm that the operations for encryption and decryption are identical, i.e.

$E_k(x) = D_k(x)$ and accordingly $E_k(E_k(x)) = x$?

An example for this would be most stream ciphers; are there any other, possibly block ciphers, with that property?

It seems like a good thing to avoid in a cipher design (otherwise, any encryption oracle would automatically become a decryption oracle); is there a name for the absence of that property as a security feature?


texts: Is there an algorithm or protocol that allows to securely generate random shuffles when two parties are not colluding without a sever side seed?

texts:
I am building an app that pits one party against another party in a gambling transaction – both parties have competing interests and have an incentive not to cheat the other party.

I am looking for a cryptographic solution for this.  It includes card games but not Poker (so this includes baccarat, blackjack, and other games including some dice games).  Mental Poker is a solution similar to what I am after, but mental poker, as I understand it, either cannot be applied to games like this or should not… although I don't see why not (other than the increased computational issues)?

But the idea where you can encrypt a deck of cards (or the combinations of two dice) and pass that to shuffle is still along the line of what I am after since this method does not require a central sever to provide a seed to a local application and can still provide a pseudo random outcome.


texts:
This may be a difficult question

So, $C_1$ = AES-GCM($k_1$, nonce, message) where nonce = HMAC(key,message). $C_2$ = AES-CBC($k_2$, iv, $C_1$).
Now, a security breach occurs.  The adversary obtains $k_1$ and $C_2$ because they are the most vulnerable parts of my encryption scheme.  I change the keys in this instance and re-encrypt the database.
Now, $C_3$ = AES-GCM($k_3$, nonce, message). $C_4$ = AES-CBC($k_4$, nonce, $C_3$).
Then there is another data breach.  The adversary now has $k_3$ and $C_4$.

1.) If the adversary has $k_1$, $k_3$, $C_2$ and $C_4$ can he decrypt the messages?

TL,DR explanation

In my encryption scheme, I have two sets of 256 bit secret keys [$c_1$,$c_2$] used to encrypt data.  The first key is used by my customers to encrypt data using AES-GCM.  The second key is used to encrypt the data once again using AES-CBC with PKCS#7 padding before being saved on the server.  Please assume I never repeat the same 96-bit nonce when using AES-GCM.  My message length is short and the number of messages encrypted will remain well below 1 billion.

How would a worst-case scenario play out assuming the adversary already has the customer key?  If an adversary obtains the data on the database I will change the keys and re-encrypt the data using the new keys.  If an adversary then obtains all of the data once again can he break my encryption assuming he has the customers key?


texts: Is there any vulnerability if I hmac(key,key)?

texts:
It is a general question, but I'm using SHA-2.

My reason is to take a short pin or string and to generate a longer hash of that pin to locally generate a local key for personal use to be used to generate other passwords based on a domain and user name.

Eg.

Site password = Hmac( Hmac(pin,pin), Domain + username)

Or

Site password = Hmac( Hmac(pin,pin), hmac(Domain + username))

Additional info: Random passwords, unique for each account is ideal. But then I need to trust a password manager and install it on every device I own or use - this seems worse as I already trust Chromium/Google to store my passwords - why introduce another party? - and it seems popular password managers are patching design and implementation flaws a few times a year (and my code is no different).

My aim is to make any released passwords or hashes so long and pattern-free that my hashed passwords would remain un-cracked. And if cracked, then only one account would be compromised.

This is the idea I'm working on, it is not my idea, just my implementation.

In doing so I wondered if hmac(key,key) leaked info about the key or perhaps was trivial to crack. So after finding nothing on first page of a google search I decided to ask the SE community.


texts: Why would you use a weaker hash function than cipher strength?

texts:
Some cryptographic libraries (like “Bouncy Castle”) support many modes where the maximum number of bits which can be produced by the hash are significantly fewer than the cipher strength.  For example:

MD5 (128 bit max) is paired with 256 Bit AES
SHA1 (160 bit) max is paired with 256 Bit AES

What benefit is derived from using 256 bit AES over 128 Bit AES in cases like this?


texts: Is bcrypt better than GnuPG's iterated+salted hashing method?

texts:
GnuPG has slow hash built-in in form of iterated+salted S2K.

Does it have disadvantages in comparison with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?


texts: Is it secure to use the same master secret key in two independent IBE schemes?

texts:
Given two IBE schemes:

Boneh-Franklin IBE scheme (https://doi.org/10.1007/3-540-44647-8_13)

Secure under the CBDH problem (in the ROM)
The master secret key is a random element in $\mathbb{Z}_p$

Park-Lee IBE scheme (https://doi.org/10.1007/s10623-015-0035-0)

Secure under the DBDH problem (in the ROM)
The master secret key is a random element in $\mathbb{Z}_p$

Lets say, we have a message $m$ and encrypt it with both Boneh-Franklin IBE and Park-Lee IBE schemes, with the same $id$ (public keys of $id$ are calculated according to both key generation algorithms, using the same $msk=\alpha$ in $\mathbb{Z}_p$). The two IBE schemes use the same curve. Adversary is able to query two kinds of secret key oracles.
I believe the constructed scheme is secure, but it seems impossible to make a security reduction to the underlying IBE schemes. Since the challengers of two schemes would use different master secret keys, the simulator of our scheme can not answer secret key queries properly.
Are there any security implications for this scheme? How to prove its security?


texts: ipsec, esp: Which key is used to generate the HMAC

texts:
Short Question:
Are the keys for the ICV calculation and the encryption the same in IPSEC/ESP?
Or do there exist two keys in the SA?

Long Question:
Before a new IPSEC-ESP connection is established, IKEv2 is used to start a new session.
This involves also a DH key agreement.
This key is than stored in the IKE-SA.

Once the session is established, ESP uses the key in the IKE-SA's for the message encryption/decryption.
After the payload was encrypted, the ICV is calculated by a HMAC calculation.
But this HMAC requires also a key.
I have already searched for a few hours without being successful.

Is it the same key that is used for encryption, is it calculated out of the encryption key or are there two keys stored in the SA?

I wasn't able to find the answer in rfc4303 (ESP), rfc2104 (HMAC) or rfc7296 (IKEv2).

And there are not many books about IPsec out there.


texts: What is the importance of adding round key in AES

texts:
I know this may not be the place to ask this but I have found it difficult to find an answer to this question. I know the steps of the AES encryption algorithm but I am finding it difficult to understand the concept stage by stage.

How would by not adding the round key at each stage increase the vulnerability in AES encryption?


texts: Socialist Millionaires variant, where only one party learns $x=y$?

texts:
In the Socialist Millionaires protocol, Alice selcts some $x$ and Bob selects some $y$, and both parties learn whether or not $x=y$ without learning the other party's selected value. However, on a successful match, both parties do learn the other person's value -- it's the same as their own value. Does there exist a variant protocol (or way of cheating the existing protocol) wherein only one party learns $x=y$ and the other party learns nothing?

My particular case goes something like this:

Bob has a small list of people he has invited to his birthday party.
Bob is happy to let people query his entire list, item by item, via a Socialist Millionaires exchange to see if a particular person is included in the list. However, he does not want to give out the entire list wholesale.
Alice has a secret crush on Charlie and wants to learn if Charlie is invited to the party. She could learn the answer by engaging Bob in a Socialist Millionaires exchange for every item in Bob's list.
However, she does not want Bob to learn that she is interested in Charlie's invitation. If Charlie is on Bob's list, Bob will see that he and Alice participated in a matching exchange for his entry for Charlie.

Can Alice learn the equality of "Charlie" against every item on Bob's list, without Bob learning whether any particular item on the list was a match?

To put it another way, I think that this could be done with fully-homomorphic encryption, e.g.:

Bob encrypts each item in his list with Alice's public key
Alice sends her request for "Charlie" also encrypted with her public key
Bob performs a homomorphic equality comparison of each encrypted list item against Alice's encrypted query (that is, Bob performs a $map$ of the encrypted list into a list of encrypted booleans, based on the homomorphic equality comparison of each item)
Bob sends back a list of homomorphically encrypted booleans describing the matching-state of each comparison
Alice decrypts Bob's reply with her private key

This case satisfies my requirement (I think?) that Bob learns nothing, because he can decrpyt neither Alice's query nor the results of his own homomorphic equality comparisons.

Is there a way to get a similar guarantee using a zero-knowledge proof exchange?


texts: Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data?

texts:
I am designing a simple and secure stream communication protocol. My idea was to build each message sent to the wire as:

(message size || clear text || UHASH(message size || clear text)) $\oplus$ unique stream cipher output

where UHASH is the main function from UMAC (see question Using UMAC with stream cypher), || is concatenation and $\oplus$ is exclusive or.

The problem is that I found it was very easy to DoS attack my system; all it takes is to flip a high order bit of the 4 byte message size, and the receiver will wait for a multiple gigabyte message before having the chance to verify the MAC.

My solution is, if the message is bigger than some reasonably small size, I will add a MAC just after the size, validating it, so no very long message will be expected without validation. It seems to work, but given the overhead of calculated a 8 bytes keyed MAC from a 4 byte value, I wondered if there is any simple way of guaranteeing the integrity of such a small value using only a stream cypher and a few bytes more than the value I want to protect.

Do you know of any? For instance, let $\times$ be multiplication mod $2^{32}$, sending such a header:

(message size $\oplus$ cipher output 1) || (message size $\times$ cipher output 2)

would solve my problem? I understand that the probability of forgery can not be smaller than $1 / 2^{n} $ for the n extra verifications bits I send, but how to guarantee this chance is close to the minimum?


texts: Recommended length for a nonce in hashed-based authentication

texts:
Considering the following variation of the SKID3 protocol
(1) $A \rightarrow B: r_A$
(2) $B \rightarrow A: r_B || \operatorname{MAC}(r_B||r_A||A)$
(3) $A \rightarrow B: \operatorname{MAC}(r_B||r_A||B)$
my professor recommended to choose a length for the random numbers to be (any) different from the digest length (MAC). Can you explain why?


texts: Can a fuzzy hash be used as a less accurate merkle root?

texts:
If I had many, say a million random numbers (technically public keys.. ~600 bytes each) and I wanted to hash them all together using a fuzzy hash, how accurately could I test that a given hash was a part of the fuzzy hash?

I could use merkle trees, but the problem is in my system, two person should be able to hash together a similar but not exactly identical number of public keys as another person has and the other person should be able to test whether it contains a given public key. And I'd really prefer not to send all the public keys to everyone.


texts: is it correct that for a nbit LFSR (galois algorithm in particular) the maximum number of unique 32byte keys can only be 255?

texts:
In fact I have more than just the one question as I try to better understand the whole topic.
for a CTF challenge I am currently reading up on LSFR. The code the challenge provides as an example is a 5bit lsfr and it generates from its bit sequences a 32byte long key (8bit to one byte and this 32 times).
So the first and last byte of the key are the same for this particular 5bit case as after 2^5-1 iterations the whole sequence repeats.
Also if I understand the whole logic behind LSFR right I can produce 2^5-1 unique keys only for the 5bit version. (starting with one particular seed e.g. s=1). Also I can have 2^5 different initial seeds. According to my tests this will not produce additional 31 unique 32 byte keys but only the same keys but in a shifted sequence. ok, so here the questions I have.

a) are the above statements as written correct or did I miss something ?

b) if above is correct then I can get up to 255 unique keys if using as minimum a 8bit_lsfr (2^8-1). right ?

c) I will always get a max of 255 unique keys even if I increase the bits of the lsfr as I can only have 255 unique bytes and the byte sequence will repeat. is that correct ?

d) So it doesnt make sense to increase the bits beyond 8 bits or is there another benefit for this particular case that I dont see ?

Thanks for any help in better understanding this in advance.
Best
Zaphoxx

edit: Clarifying what I mean with unique 32 byte key:
when I generate multiple 32byte keys from an lsfr, then I save the generated keys in list and each key is only once in that list. I thought that when running a nbit lsfr the maximum number of 'unique' keys would be 255 but that might not be true and I'll need to recheck that.
maybe someone can clarify that question.


texts:
I've looked at a few previous posts on this site but I'm still struggling with the concept of keyspace. Specifically I'm following a coursera course but I think it's probably too advanced for me as I'm failing to understand some numbers.

In the course it talks about a substitution cypher in an alphabet of 26 letters. There is then a question

  What is the size of key space in the substitution cipher
  assuming 26 letters?

The answer is 26! (I get this bit) but the instructor then says this is roughly equivalent to 2^88 which I don't get as the numbers don't seem close to me at all.

Furthermore it talks about the enigma machine and how a 4 rotor machine which would have the following

  keys = 26^4 = 2^18

  This is equating to 26^4 combinations (4 rotors with 26 keys - again I get this (though should it not be 26!^4?) but then I don't get how this gives a key space of 2^18 . I think it's the equality signs throwing me off as I'm thinking it's 'equal to' as opposed to it 'equates to or resolves to'.

I just don't get these numbers if I'm honest.

Can someone break it down in it's simplest terms for me? As I say, based on this evidence I think the course might be beyond me mathematically, but I really want to understand at least this part now I've gone through it!


texts: Software Security Impossible in Non-Trusted Hardware?

texts:
Fundamentally it is impossible to protect software if you can't trust the execution platform (e.g. using a TPM), so what is the point of software security then?

With vendors claim that their white-box crypto / obfuscation technique are the best, is there a methodology or a way to assess the strength of software security?


texts: Safety of AES ECB when used with openssl_seal function

texts:
I'm trying to use PHP to encrypt files with a public key. I'm using the function openssl_seal that "encrypts data by using RC4 with a randomly generated secret key."

RC4 is considered unsafe so the alternative is to use AES ECB, but it too is generally considered unsafe (AES CBC is sadly not an option).

My question is:
Is AES ECB still unsafe, even when used with a randomly generated key, which is different for each file?


texts: Does adding more characters to the Enigma rotors improve crypto strength?

texts:
This seems like an obvious question but I haven't been able to find it, so here goes:

Enigma is based on an alphabet of A-Z (26 characters); obviously this directly affects message content (e.g. numbers would be specified using their names one, four, two, etc) and it also has a direct bearing on the number of possible permutations (crypto strength).

Would increasing the alphabet of the rotors (e.g. to A-Z, 0-9, and a selection of special characters) increase crypto strength? I know it would increase the number of possible permutations but I'm not sure if that would introduce some kind of weakness.

Update (additional context)

I'm building a "for fun" software implementation of Enigma, in C# - currently as a UWP application that will run on any Windows 10 device (including phones).  It will include implementations of a few of the real-world historical Enigmas (I, M3, M4) as well as the ability to take "extended" Enigmas where you can create your own rotor sets with any number of rotors, including new wiring's and character sets (i.e. beyond A-Z).

Based on feedback provided adding additional characters could be dangerous.
I was thinking that for an 'extended' implementation you might want to include 0-9 and some special characters commonly used these days (such as : /).  I guess one motivation for this was convenience.  Of course given the flexibility of modern computing I guess I'd be better off allowing the user to input "convenience-plain-text" such as "HTTP : //WWW" transform it to "standard enigma A-Z plain-text" "HTTPCOLONBACKSLASHBACKSLASHWWW" then encipher it, and possibly perform the reverse at the other end.  Maybe that's the basis of further questions another time.

Update - 28-July-2017

Based on this Q&A I can now actually measure the increase in key-size for enigma like systems; whilst expanding the supported character set does increase the key size, adding additional rotors increases it by significantly more (notwithstanding the other issues that affect the overall crypto-strength of enigma).


texts: Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?

texts:
When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are:

Curves: P-256, P-384, or P-521

Hashes: SHA-1, SHA-256, SHA-384, or SHA-512

If I was not constrained by these choices, I'd choose Ed25519. Would ECDSA with P-256 and SHA-256 provide an equivalent level of security (assuming I trust the NIST curves)?

How should I reason about the WebCrypto choices available to me?


texts: How to decrypt a '.enc' file that has been encrypted with RSA using a public key?

texts:
While solving a CTF challenge online, I came across a situation where I needed to decrypt a '.enc' file that has been encrypted using someone's public key. The corresponding public key '.pem' file was provided to me. I solved almost all other CTF challenges except this one and it has been bugging me since. I solved the first part: I have been able to decode a hint that says: "The file file.enc could be decrypted with a private key. Using raw algorithm, every 64 bits chunk of data was encrypted at a time. You can do the same thing to decrypt using RSA."

Here's what I have tried:

Read many posts like this one online and tried to decrypt the '.enc' file: http://www.czeskis.com/random/openssl-encrypt-file.html

I tried the following command for decryption: openssl rsautl -decrypt -in public_key.pem -out key.bin. I got the this error:

 no keyfile specified
 unable to load Private Key

Yes, but that's because private key is not provided to me. If I try to use the public_key.pem as infile, I get this error:

unable to load Private Key
139914348455592:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY

Tried the tool 'openssl' in Linux in several ways to try to decrypt the file.

Here is the 3 files zipped in tarball, if anyone wants to analyse them: http://www.filedropper.com/chaltar

Could someone please advise me on how to decrypt the '.enc' file before I give up on this challenge? I have worked long and broken the first part of the challenge, now I feel I'm so close.

Facts:

I know the tool 'openssl' will be used to solve this challenge.
Encryption: RSA
Files: Only three files, public_key.pem, file.enc,
and a random file that I decrypted that provided the hint I wrote
above.


texts: Smart's attack for secp256k1 does not work


texts: Proofs that NM-CPA implies IND-Cpa and $\text{IND-CCA} \leftrightarrow \text{NM-CCA}$

texts:
I am looking for a proof for the following two claims from "Serious Cryptography" by Aumasson.

  NM-CPA implies IND-CPA. [...] IND-CCA and NM-CCA are equivalent notions that imply the presence of the other.

where IND-CPA/IND-CCA and NM-CPA/CCA are defined as indistinguishability and non-malleability under chosen plaintext/chiphertext respectively.

Where can I find those proofs?


texts: Expected Linear Complexity of a sequence

texts:
Let (s) be a sequence of length n. What are the expected linear complexities of (s) and $(s)^{\infty}$ (meaning that the periodic version of s)?

I have no idea of the answer to this question? What does it mean when it say: "expected linear complexity"? Does anyone have any ideas on this issue?

Note that: for sequences which satisfy Golomb's Randomness Postulates, we calculate the "Linear Complexity Profile" of the sequence and  for such sequences it is proved that the Linear Complexity at each step is approximately equal to  n/2. Actually the LC values are in the +(-)5/18  neigbourhood of n/2 line.  But in the above question there is no specification on the randomness of the sequence.


texts: In GnuPG, what's the difference between --s2k-cipher-algo and --cipher-algo?

texts:
I want to change some encryption options while using GnuPG to encrypt a file symmetrically.

1) However, for choosing the cipher algorithm, GnuPG has two commands and I don't know which one to use.

Between these two, which one should I use?

  --s2k-cipher-algo AES256

  --cipher-algo AES256

2) Also for choosing the digest algorithm, there are two options,

Between these two, which one should I use?

  --s2k-digest-algo SHA512

  --digest-algo SHA512

3) Is there anything wrong with this encryption?

  gpg -symmetric --cipher-algo AES256 --digest-algo SHA512 --s2k-mode 3
  --s2k-count 65011712 PlainText

Edit: This is not a duplicate question, I can't find any post here on Stackexchange or any where in the net that specify the difference between --s2k-cipher-algo and --cipher-algo.


texts: A topic for my master thesis on post quantum cryptography

texts:
I am a master´s student.
I am interested to work on post quantum cryptography. None of my professors are offering any topic this year related to post quantum cryptography.
However I have the freedom to choose my own topic.
So can you help me to find or suggest some problem which I can use for my master´s thesis.
Now About my background and specific interests. I am an electronics engineer with a strong knowledge in hardware implementations (FPGA) and C.
Also I have a good background in mathematics. I have learned cryptography myself and have read PQ crypto algorithm LWE and ring-LWE. I don´t know whether these type of questions are entertained here but I really need some help and hence knocking on every door.
Thank you for your help in advance.


texts: Explanation of vector in Visual Cryptography

texts:
I'm starting to study about visual cryptography, but I am stuck with the following problem.

On paper "Visual Cryptography" by Moni Naor and Adi Shamir, on page 6. How to read/what is the meaning of

$$J^0_i = 0^{i-1}10^{k-i}$$

and

$$J^0_k = 1^{k-1}0$$

where $1 \le i \le k$?

Can someone explain how to read it? Because I think I misunderstood.. And also I'm happy if anyone gives me a reference to learn it.


texts: What real life OpenPGP public key has the biggest amount of signatures on it?

texts:
Have you ever seen key with dozens or 100+ signatures? Link to it will be very much appreciated.

I have read that old Zimmermann's key had a lot of signatures on it, but I was not able to find it. In fact when I search MIT key server I am not able to search for 'Zimmermann' name at all for some reason.


texts:
I'm trying to verify the claim of paper Improved Algebraic Fault Analysis: A Case Study on Piccolo and with Applications to other
Lightweight Block Ciphers about the numbers of equations in algebraic normal form that in one round of the Piccolo cipher. According to method in Section 4.2 is there 928 equations, but I can't understand ... I get verify only the 544 variables numbers but not the numbers of equations

I'm trying:
For each S-box is there 4 equations, then in 16 S-box by round is there 64 equations. For mix columns, using Table 3 I have 12 equations ...


texts: In the book "Foundations of cryptography-Oded Goldreich-Page 33", if we use the deterministic polynomial-time algorithm instead of the probabilistic polynomial-time algorithm for case 2 (Hard to invert), what would be the situation?


texts: Classification of attacks against lattices

texts: I'm interested about the cryptanalysis side of lattice-based cryptography, and was wondering whether there is a survey paper or something that gives some classification of attacks against lattices, current state-of-the-art in each category, and how they relate to one another. For example, I see on one side there is lattice basis reduction such as LLL and its variants, then there seems to be sieving attacks, enumeration attacks, and some other approaches. How do these approaches relate to one another?


texts: How Far Ahead of Academia Are Government Agencies?

texts:
This is a soft question regarding comparisons between government security services (eg, NSA or GCHQ) and open-source research (e.g., academia). Hopefully it's on-topic for this site!

In essence, my question is the following.

  How far ahead (if at all) of of open source (specifically academic) research are governmental agencies?

There are some various thoughts I've had on this matter.

NSA is the largest employer of mathematicians worldwide, and their primary focus is on security. So not only do they have an incredibly large number of people, but they're also very focused. On the other hand, cryptography departments at universities (that I'm aware of) don't seem to be particularly large.
We now get onto the actual people who do the work. For example, to start at the base level at GCHQ you need a 2:1 in a three-year maths degree. (I'm from the UK, and don't really know any comparison with American GPA.) In comparison with university faculties, these will all have doctorates as a minimum, and university researcher places (at least in UK universities I'm aware of) are very competitive.
At a first glance, this suggests that the standard of researchers in general is much higher in academia. Of course, one has to be careful: not everyone wants to do a PhD for starters; moreover, a lot of people may not want the job-insecurity of post-docs, and prefer to move into a more secure (likely higher-paying) job outside of academia. Furthermore, continuing from the first point, these people then spend all their time working on this stuff, with large amounts of resources (including many other people around).
As an example, when DES was replaced with AES, instead of developing AES themselves, the NIST set a challenge to other researchers. The NIST then chose the best of these (supposedly, anyway; many people have apparently legitimate claims that the most secure wasn't chosen, but instead the one the the NIST 'liked' the best).
I have heard that RSA was discovered some 8 (or maybe 3?) years before it was public, but that this was at a time when there was comparatively little open source research into such topics.
Finally, a lot of what secret agencies do is, well, secret!

Basically, there seem to be arguments for many points, and I was wondering if anyone has more insight than I do!

Very related (but not the same) is this question: How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?; that question is more about some specific things (eg symmetric ciphers).

To be clear, I know this question isn't definitively answerable without high-up knowledge of governmental affairs, but I feel some approximations should be possible.

Of course, none of this addresses private companies (eg, Google). These employ a lot of people, likely(?) with higher entry requirements than NSA/GCHQ (see above on why that doesn't give a clear cut implication) and also have lots of money; moreover, there's likely(?) less bureaucracy.

If any of my above claims are wrong, please do point them out! I'm not very knowledgeable in the world of cryptography. I'm a maths PhD (discrete probability), but have interest in this stuff.


texts: Cipher Feedback Mode - sizes of the blocks and shift registers

texts:
I have a question regarding the resulting sizes of the blocks and shift registers in Cipher Feedback Mode.

In the web there are different pictures to illustrate the CFB-mode.

Now on the first picture there are no shift registers at all. I dont understand which special case the first picture describes. Is really the entire ciphertext (after the XOR with the plaintext) is taken as the argument in for the next block or just s bits?

What if I use the CFB-128 Mode with the following assumptions:

IV size is 128bits
Key is 128bits
CFB-Mode is CFB128
Plaintext is 256bits.

Is the resulting ciphertext of this operation always the size of the Key (128 bits in this case)? If yes is the ENTIRE ciphertext taken as the argument for the next Encryption block? I am confused about the sizes and the pictures describing it.

EDIT: Another question which I have is: What is the resulting ciphertext at the end?
Is it just the last ciphertext block or is it a concatenation of all blocks (c0+c1+c2...+cn)?


texts:
Are there online resources with an ASCII character frequency table for HTML?

There's tons of them for english, but I can't seem to find one for page source. I know that this is something that's likely to vary from site to site, but surely there's rule-of-thumb good-enough-usually tables where < is ranked higher than z?


texts:
Well i have downloaded some cryptographic algorithm. Do there are those I didn't understand so this is my question: What is polymorphic RC4 or Polymorphic xor encryption?

I heard this in malware encryption.


texts:
Under which condition is $f : x \mapsto x^e \mod n$ invertible?

I mean, for each distinct $x \in \{0, 1, 2, \ldots, n-1\}$ the result is distinct?

Is that $e$ must be coprime with the totient of $n$ ($\varphi(n)$)?

I read several articles on RSA, but this point is still not clear to me.


texts:
Say I have a $26\times 26$ matrix $M$, each column$C_i$ of which contains the numbers from 1 to 26 in a random order. To encrypt a word, I take the first letter (e.g., b), convert it to its index $i$ (here, 2) and take the $i$th element of column $C_i$ for the first letter. Let's say that b becomes d. Then I take the fourth column $C_4$ (because $d$ is the fourth letter), convert the second letter to its index $j$ and encode it with the $j$th element of $C_4$, and so one.

Example with four letters $a,b,c,d$: take

$$ M=\begin{bmatrix} 2 & 2 & 4 & 3 \\ 3 & 3 & 1 & 4 \\ 1 & 4 & 3 & 2 \\ 4 & 1 & 2 & 1\end{bmatrix} $$

to encrypt $bacd$: the first letter, $b$, has index $2$, so it will be coded by ${C_{1}}(2)=3$, so $c$. For the second letter, we use $C_3$; $a$ has index 1 so it becomes $C_3(1)=4$, that is, $d$ and the next letter will be coded with $C_4$. $c$ has index $3$ so becomes $C_4(3)=2$, so $b$ and the next letter will be coded with $C_2$. $d$ has index $4$ so becomes $C_2(4)=1$, so $a$. Finally, $bacd$ becomes $cdba$.

My question is, is this method known (certainly!) and does it have a name? One advantage is that is avoids simple statistical analysis on the frequency of letters.


texts: suggestions for cryptography projects for an ece 3rd year student

texts:
I am an electronics and communication engg student currently doing my 3rd year second semester. i am interested in info coding and the security aspects of it. As an ECE student i want to know what is the scope of cryptography in my field.

and i also want to know about the projects that i can take up in the field of cryptography.

please anyone help me in this regard. i am good at maths


texts: Side-channel vulnerability of AEGIS naive AES implementation

texts:
AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is at a first sight vulnerable to side-channel attacks.

However, unlike AES which uses the same expanded key on all its rounds for the entire message, AEGIS uses its own internal state as the round keys, so all table lookups are in fact preudorandom.

Are side-channel attacks still possible for preudorandom table lookups as AEGIS does?


texts: Fully or partially Decrypting Data with Multiple keys

texts: Is there any good paper or research carried out till now that a data is encrypted by a single key or onwer(user) and their are 2 or more decryption keys. One key can decrypt the entire data. Other keys decrypt partial data or a portion of data. A person having no key cannot decrypt the data but those having keys can fully or partially decrypt data based on the keys.


texts: Choice of multiplication polynomial in Rijndael s-box affine mapping

texts:
The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows:

We have chosen an affine mapping that has a very simple description per se, but a
complicated algebraic expression if combined with the ‘inverse’ mapping. It can be seen as
modular polynomial multiplication followed by an addition:
$b(x) = (x^7 + x^6 + x^2 + x) + a(x)(x^7 + x^6 + x^5 + x^4 + 1)$ $mod$ $x^8 + 1$

The modulus has been chosen as the simplest modulus possible. The multiplication polynomial has been chosen from the set of polynomials coprime to the modulus as the one with the simplest description. The constant has been chosen in such a way that that the S-box has no fixed points (S-box( a ) =  a ) and no ’opposite fixed points' (S-box( a ) =  ā ).

The multiplication polynomial being $x^7 + x^6 + x^5 + x^4 + 1$, which is irreducible and therefore coprime to the modulus $x^8 + 1$. The inverse mapping multiplication is $x^7 + x^5 + x^2$.
However, $x^7 + x + 1$ is also irreducible, and has an even more simple representation. It is the most simple irreducible polynomial of degree 7. It also has a longer affine period (8 vs 4) which is supposedly better. There are many valid choices for the added constant that result in no fixed or opposite fixed points. The inverse mapping multiplication is $x^6 + x^5 + x^3 + x^2 + 1$, which is coprime to the modulus.
Is there some obvious reason the more simple polynomial was not used? The implication in the Rijndael specification is it does not have the simplest description, which does not seem to be the case. My assumption is lack of complexity of the algebraic expression in the resulting s-box or its inverse, but I do not have the means to determine if that is the case.
update
Thinking that the reason may have been the statistical performance of the s-box with the given affine polynomial, I compared it against $x^7 + x + 1$, the results are below:
                             AES        x^7 + x + 1
SAC Relative Error           12.5%      9.4%            lower is better
SAC Satisfaction %           67.2%      67.2%           higher is better
Distance to SAC              432        432             lower is better
Negative DSAC                176        152             lower is better

2nd order SAC Rel Err        12.5%      12.5%           lower is better
2nd order SAC Sat %          56.7%      61.2%           higher is better
Dist to 2nd order SAC        1664       1424            lower is better
Negative 2nd order DSAC      844        684             lower is better

AVAL Relative Error          3.52%      3.12%           lower is better
Guaranteed Avalanche         339.2      339.2           my own metric

Bit Independence Rel Err     13.412%    12.856%         lower is better
Bit Independence Sat %       56.2%      63.8%           my own metric

It is quite clear that $x^7 + x + 1$ has better results in many s-box performance metrics when compared to the chosen polynomial.
During testing I also found that the Rijndael s-box has a self inverse mapping at 0x73 and 0x8F, where an input to the s-box and the inverse s-box produce the same result. This implies that the additive constant may not have been chosen carefully enough. The optimal constant appears to be 0x15.


texts: Algorithm to generate ECDSA keys with random number generator

texts:
I have a certified random number generator (TRNG, it does not matter what it is for the question).

I would like to use it as a source to generate secp384r1 ECDSA keys. What is the algorithm I should use? Is it possible?

I know that it is generally not a good idea to implement one's own cryptographic algorithms, so is there any library that can be used for this? (something like Bouncy Castle?)


texts: Uniform distribution/randomness of characters in the SHA-256 hash?

texts:
I'm using the SHA-256 algorithm to generate a number in one of my programming projects. A SHA-256 hash is calculated from three strings: one the user can edit, one the user can view but not edit and one the user cannot view or see until it is changed to a new string.

From the hash, the first two characters are looked at to determine the number. Each of the 256 combinations of two letters/numbers that can appear in a sha256 hash are arbitrarily assigned a value with the following pattern.
aa=1, ab=2, ac=3...fd=84, fe=85, ff=86...97=254, 98=255, 99=256: In the project a number from 1-100 is needed so all of the combinations of two characters are looked at from left to right until a number in that range is found.

After testing this by generating thousands of hashes from seemingly random inputs (with php I made the input md5(uniqid(rand()))) multiple times, the average number from 1-100 was around 51.

Any idea what is causing the number to be weighted more towards combinations from "dc" to "0d" (51-100) compared to "aa" to "da" (1-49)? Is this a flawed way to determine a random number even if the input is random? What if the player has control over one of the strings added to the input like described in the first paragraph?

Note: I don't study cryptography so explanations without intense cryptography jargon would be the most useful!


texts: Constructing Low-Density Parity-Check Codes of length $n$ and minimum distance = $\delta n$ over $GF(q)$?

texts:
I am looking for a way to construct an LDPC (Low-Density Parity-Check) Code $C$ of length $n$ and minimum distance $d_C$ that scales linearly to $n$, meaning $d_C = \delta n$ for $\delta \in (0,1)$.

I have been looking through the state-of-the-art papers about the construction of LDPC Codes, and seeing their minimum distance. Some codes are quasi-cylic (QC-LDPC) and cylic (C-LDPC), and are supposed to have "good" minimum distance, but they only scale to $\sqrt n$ at most.

Some papers efficiently construct such codes, but with the case over $GF(q)$ where $q = 2^m$, like Tanner Codes and Distance amplification for example.

Some other papers state, or even try to prove theoretically that such codes with $d_C = \delta n$ can be found, but dont' provide any partical way for the construction (for example), and don't reference any other papers for such constructions.

So I ask this question after a lot of research : is there any efficient algorithm to construct LDPC codes $C$ of length $n$ and minimum distance that scales linearly to the length $d_C = \delta n$ (over any $GF(q)$)


texts: Convert homomorphically encrypted decimal number to homomorphically encrypted binary number

texts:
I am trying to convert a homomorphically encrypted integer to a homomorphically encrypted binary number (in vector form like {Ciphertext(1),Ciphertext(1),Ciphertext(0),Ciphertext(1)}), which I cannot really get the remainder (and any other "intermediate results") without decryption.
Is there really a way to do this?


texts: Can I deduce the info such as the bitsize of an LFSR from multiple ciphertext messages?

texts:
If I encrypt the same message multiple times (>10000 times) with the same LFSR can I then somehow retrieve some information on the LFSR? I'm looking for information like bit size, polynomial used. The ciphertext is different for each encrypted message.

The assumption is that cipher is 48bytes in size. The message is most likely encrypted with a 32 byte long key (stream) generated by the LFSR. Each byte of the message XOR-ed along the the way.

How could one approach this challenge?

edit:
The LFSR used is a Galois primitive. That's additional known intel.


texts: Can I obtain the hashing algorithm if I know both the input and the output?

texts:
Suppose I have a string "Hello World".
And I pass it through an unknown function which gives output as "6Xbhkfo520/78".

So, using several input and output pairs, can I determine the algorithm of the hashing function?


texts: How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?

texts:
If I have an encoding function  $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows:

Choosing a random number $k < n -1 $ where $n$ is the order of the curve E .

Calculating $C = [k] G $ where $G$ is the generator point of the curve E

Calculating $R = [k]Q $ where $Q$ is the recipient's public key

Now the message is encrypted by adding $P$ to $R$ to get
        $C_e$ $( = R + P)$ which is sent along with $C$ to the recepient.

DECRYPTION:

Now for the recepient to decrypt my message they compute $R = [privatekey] C $ (where $C = [k]G $) and simply subtract $R$ from $C_e$ to get the encoded point $P$ back which is then decoded by an inverse function $f^{-1}(x)$ to recover $m$.
Now , two problems arise : If the attacker knows the plaintext (suppose if I follow a particular format of data while sending messages ) he could encode his guessed plaintext and subtract it from $C_e$ to recover $ R $ back ! . If I used that same $ R  $ to encrypt further "blocks" of my message then the security of the later parts of my message has been breached!

I realize that doing  something like a scalar multiplication over and over again for every block of data, would be a huge drawback in efficiency and speed.

Is there any way to compute a different $ R $ for every block of data, without using much resources and that too quickly ?

Does reusing the same $R$ for another message break security ?

NOTE: This question is for educational purposes only. It's for the sake of expanding my knowledge on Crypto.


texts: What is the complexity for attacking 3DES in linear or differential cryptanalysis?

texts:
I know that 3DES is NOT vulnerable to DC , LC .
But is it because the attacks  requires too many  input\output pairs ?
Or because it's impossible ? (i.e requires more than 2^64 pair )


texts: Is "Bit Independence" of SHA-2 hashes secure?

texts:
I know bit independence is good in SHA2 function output, but is it truly 100% secure?  For example:

Y = SHA512(secretKeyNonce256bit)
A = first 32ytes / 256bits of Y, used as message encryption key
B = next 16bytes/128bits used as authentication HMAC key for message
C = next 16bytes/128bits used as access code. NON-SECRET, and known to message carrier. If user provides this code, he is given the encrypted message by the carrier.

Does having knowledge of C yield some insight into A,B?  Would it be better to instead use C2=first 16 bits of SHA256(C) ?

One weakness, which extra SHA does not prevent, is if secretKey were derived from a crummy password [not the case here], C would be valuable to whoever attempted brute-like password guessing, because if a tried password produces C, it is likely that the password is correct & can produce correct A, B.  Some people may mention 128bit HMAC is on a weaker side, but I think 128 / 64bit collision resistance is sufficient for my application.


texts:
When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL.

Which Certification Authority issued the first SSL certificate and whom was it issued to?


texts: What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

texts:
When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same cryptographic goals), I am wondering why NIST chose to change the naming from „Message Digest“ to „Secure Hashing Algorithm“. A look around didn’t return useful information related to this.

Was there a specific reason to change the existing naming convention? Does it in some way indicate that there was change in cryptographic goals (and if, which ones) or was it simply the result of a standardization decision, potentially based on terminological changes within NIST definitions?

In case there’s an official statement explaining this change in naming convention, I’ld also appreciate a pointer to it for reference purposes.


texts: Legendre conditions on the factors of the fundamental negative discriminant to minimize the 2-Sylow subgroup of the class group

texts:
If we know the prime factorisation of the fundamental negative discriminant $\Delta_K$, say $\Delta_K=p_1\cdot p_2 \cdots p_n$, then we are guaranteed that at least $2^{n-1}\mid h_K$, the class number of $C(\mathcal{O}_K)$.

Now, I would like to know the legendre conditions on the factors of $\Delta_K$ such that the size of the 2-Sylow subgroup of the class group is $2^{n-1}$. In other words, I want to guarantee that $2^{n-1}$ is the highest power of 2 that divides the $h_K$.

For example, when $\Delta_K=-pq$ and $\Delta_K\equiv1\pmod{4}$ then the condition $\left(\frac{p}{q}\right)=\left(\frac{q}{p}\right)=-1$ guarantees that the size of the 2-Sylow subgroup of the class group is exactly $2^{2-1}=2$. The example is from this paper which in turns refers to a French paper by Kaplan.

I asked this question first on the math site which yielded 0 response; so tried to ask here now.


texts:
I have been thinking about digitally signed documents (Word files and PDF files) and can not get over the fact about - how can I securely know when the file was signed?

Scenario:
If the date of the signature is saved in the file that I am signing. The voucher for the date is me. However, if someone steals my private key, and I revoke my Certificate, the thief can easily create a PDF file with a false date and sign that with my revoked key. The document will appear as being signed at the time, when my Certificate hasn't been revoked yet.

The only way I can think of to implement the signature date safely is by sending my signature to a "trusted" time server, which timestamps my signature and signs it. So in fact - I need a digitally signed document which vouches about the time of my signature.

Does Adobe just take Computer time, or does it get time from the Adobe server, or does it receive an Adobe-signed vouch for time?

Is there another - simpler way?